@orthacms/copilot-server 0.4.2 → 0.5.0

package/dist/index.d.ts

@@ -21,4 +21,5 @@ export { SkillRepository } from './lib/skills/infrastructure/persistence/skill.r
 export type { SkillRecord } from './lib/skills/infrastructure/persistence/skill.repository';
 export * from './lib/chat/infrastructure/schema';
 export * from './lib/skills/infrastructure/schema';
+export { proposalEventActor } from './lib/chat/application/proposal-event-actor';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,YAAY,EACR,oBAAoB,EACpB,6BAA6B,EAChC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EACH,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,YAAY,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAMhF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kDAAkD,CAAC;AAG3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAKrF,OAAO,EACH,SAAS,EACT,oBAAoB,EACpB,uBAAuB,EAC1B,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mDAAmD,CAAC;AAC7F,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,YAAY,EACR,gBAAgB,EAChB,WAAW,EACX,cAAc,EACjB,MAAM,+DAA+D,CAAC;AACvE,OAAO,EACH,iBAAiB,EACjB,qBAAqB,EACxB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EACR,cAAc,EACd,iBAAiB,EACpB,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACH,mBAAmB,EACnB,oBAAoB,EACvB,MAAM,gDAAgD,CAAC;AACxD,YAAY,EAAE,YAAY,EAAE,MAAM,gDAAgD,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAC3F,YAAY,EAAE,WAAW,EAAE,MAAM,0DAA0D,CAAC;AAG5F,cAAc,kCAAkC,CAAC;AACjD,cAAc,oCAAoC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,YAAY,EACR,oBAAoB,EACpB,6BAA6B,EAChC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EACH,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,YAAY,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAMhF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kDAAkD,CAAC;AAG3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAKrF,OAAO,EACH,SAAS,EACT,oBAAoB,EACpB,uBAAuB,EAC1B,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mDAAmD,CAAC;AAC7F,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,YAAY,EACR,gBAAgB,EAChB,WAAW,EACX,cAAc,EACjB,MAAM,+DAA+D,CAAC;AACvE,OAAO,EACH,iBAAiB,EACjB,qBAAqB,EACxB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EACR,cAAc,EACd,iBAAiB,EACpB,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACH,mBAAmB,EACnB,oBAAoB,EACvB,MAAM,gDAAgD,CAAC;AACxD,YAAY,EAAE,YAAY,EAAE,MAAM,gDAAgD,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAC3F,YAAY,EAAE,WAAW,EAAE,MAAM,0DAA0D,CAAC;AAG5F,cAAc,kCAAkC,CAAC;AACjD,cAAc,oCAAoC,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SkillRepository = exports.SkillResolutionError = exports.SkillCatalogService = exports.SYSTEM_PROMPT_VERSION = exports.buildSystemPrompt = exports.ConversationRepository = exports.CapabilityProfileService = exports.UnknownModelChoiceError = exports.CopilotDisabledError = exports.RunEngine = exports.copilotAppliersRegistrar = exports.ProposalApplierRegistry = exports.buildModelRegistry = exports.InjectCopilotConfig = exports.COPILOT_SKILL_REGISTRY = exports.COPILOT_RUN_LIMITS = exports.COPILOT_CONFIG = exports.CopilotModule = exports.CopilotPlugin = void 0;
+exports.proposalEventActor = exports.SkillRepository = exports.SkillResolutionError = exports.SkillCatalogService = exports.SYSTEM_PROMPT_VERSION = exports.buildSystemPrompt = exports.ConversationRepository = exports.CapabilityProfileService = exports.UnknownModelChoiceError = exports.CopilotDisabledError = exports.RunEngine = exports.copilotAppliersRegistrar = exports.ProposalApplierRegistry = exports.buildModelRegistry = exports.InjectCopilotConfig = exports.COPILOT_SKILL_REGISTRY = exports.COPILOT_RUN_LIMITS = exports.COPILOT_CONFIG = exports.CopilotModule = exports.CopilotPlugin = void 0;
 const tslib_1 = require("tslib");
 var copilot_plugin_1 = require("./lib/utils/copilot-plugin");
 Object.defineProperty(exports, "CopilotPlugin", { enumerable: true, get: function () { return copilot_plugin_1.CopilotPlugin; } });
@@ -46,3 +46,5 @@ Object.defineProperty(exports, "SkillRepository", { enumerable: true, get: funct
 // The Drizzle tables this plugin owns and migrates.
 tslib_1.__exportStar(require("./lib/chat/infrastructure/schema"), exports);
 tslib_1.__exportStar(require("./lib/skills/infrastructure/schema"), exports);
+var proposal_event_actor_1 = require("./lib/chat/application/proposal-event-actor");
+Object.defineProperty(exports, "proposalEventActor", { enumerable: true, get: function () { return proposal_event_actor_1.proposalEventActor; } });

package/dist/lib/chat/application/decide-proposal.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decide-proposal.service.d.ts","sourceRoot":"","sources":["../../../../src/lib/chat/application/decide-proposal.service.ts"],"names":[],"mappings":"AAEA,OAAO,EACH,kBAAkB,EAClB,KAAK,YAAY,EACpB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,4CAA4C;AAC5C,MAAM,WAAW,SAAS;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACvB;AAED,6CAA6C;AAC7C,MAAM,MAAM,YAAY;AACpB,kCAAkC;AAChC,iBAAiB;AACnB,+EAA+E;GAC7E,YAAY;AACd,8DAA8D;GAC5D,cAAc,CAAC;AAErB,+BAA+B;AAC/B,MAAM,MAAM,YAAY,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAA;CAAE,GACpC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBACa,qBAAqB;IAI1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAJ7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;gBAG5C,SAAS,EAAE,kBAAkB,EAC7B,QAAQ,EAAE,uBAAuB;IAGtD;;;;;;;;OAQG;IACG,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC;IAkBzE;;;;;;;OAOG;YACW,iBAAiB;CAmDlC"}
+{"version":3,"file":"decide-proposal.service.d.ts","sourceRoot":"","sources":["../../../../src/lib/chat/application/decide-proposal.service.ts"],"names":[],"mappings":"AAEA,OAAO,EACH,kBAAkB,EAClB,KAAK,YAAY,EACpB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,4CAA4C;AAC5C,MAAM,WAAW,SAAS;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACvB;AAED,6CAA6C;AAC7C,MAAM,MAAM,YAAY;AACpB,kCAAkC;AAChC,iBAAiB;AACnB,+EAA+E;GAC7E,YAAY;AACd,8DAA8D;GAC5D,cAAc,CAAC;AAErB,+BAA+B;AAC/B,MAAM,MAAM,YAAY,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAA;CAAE,GACpC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBACa,qBAAqB;IAI1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAJ7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;gBAG5C,SAAS,EAAE,kBAAkB,EAC7B,QAAQ,EAAE,uBAAuB;IAGtD;;;;;;;;OAQG;IACG,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC;IAkBzE;;;;;;;OAOG;YACW,iBAAiB;CAwDlC"}

package/dist/lib/chat/application/decide-proposal.service.js

@@ -81,7 +81,12 @@ let DecideProposalService = DecideProposalService_1 = class DecideProposalServic
                 userId: by.userId,
                 actorEmail: by.email,
                 workspaceId: by.workspaceId,
-                runId: proposal.runId
+                runId: proposal.runId,
+                // Provenance, alongside the run: the applier stamps the
+                // pair onto the domain event, so an audit row can say which
+                // change an agent turn actually made rather than only that
+                // one happened.
+                proposalId: proposal.id
             });
             // A second write rather than folding the result into the status
             // transition: that transition only matches a `pending` row, and

package/dist/lib/chat/application/dto/create-run.dto.d.ts

@@ -8,8 +8,15 @@ export declare const MAX_MESSAGE_LENGTH = 8000;
  * the model is ever called.
  */
 export declare const MAX_RUN_ATTACHMENTS = 8;
-/** The surfaces a run can be started from (design §2). */
-export declare const RUN_SURFACES: readonly ["chat", "palette", "entry", "records"];
+/**
+ * The surfaces a run can be started from (design §2).
+ *
+ * `create` is the new-entry form. It is a separate surface rather than
+ * `records` because the client cannot describe it any other way: the URL has a
+ * content type but no entry id, so the form used to arrive here claiming the
+ * person was looking at a list.
+ */
+export declare const RUN_SURFACES: readonly ["chat", "palette", "entry", "records", "create"];
 /**
  * Where the user was when they asked. Every field is optional — the chat panel
  * knows only the workspace, the entry editor knows the type and the entry.

package/dist/lib/chat/application/dto/create-run.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-run.dto.d.ts","sourceRoot":"","sources":["../../../../../src/lib/chat/application/dto/create-run.dto.ts"],"names":[],"mappings":"AAqBA,+EAA+E;AAC/E,eAAO,MAAM,kBAAkB,OAAQ,CAAC;AAExC;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,0DAA0D;AAC1D,eAAO,MAAM,YAAY,kDAAmD,CAAC;AAE7E;;;;;;;;;;GAUG;AACH,qBAAa,aAAa;IACtB,sCAAsC;IAItC,OAAO,CAAC,EAAE,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;IAExC,wCAAwC;IAKxC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,iCAAiC;IAKjC,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,0CAA0C;IAK1C,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gBAAgB;IACzB,oEAAoE;IAGpE,OAAO,EAAG,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,WAAW;IACpB,wEAAwE;IAUxE,IAAI,EAAG,MAAM,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,qBAAa,YAAY;IACrB,2BAA2B;IAK3B,OAAO,EAAG,MAAM,CAAC;IAEjB,qDAAqD;IAIrD,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;;OAKG;IAKH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;OAOG;IAKH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;OAUG;IAKH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,yBAAyB;IAMzB,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB;;;;;;;;;;OAUG;IAOH,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAEjC;;;;;;;;;OASG;IAOH,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CAC1B"}
+{"version":3,"file":"create-run.dto.d.ts","sourceRoot":"","sources":["../../../../../src/lib/chat/application/dto/create-run.dto.ts"],"names":[],"mappings":"AAqBA,+EAA+E;AAC/E,eAAO,MAAM,kBAAkB,OAAQ,CAAC;AAExC;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,4DAMf,CAAC;AAEX;;;;;;;;;;GAUG;AACH,qBAAa,aAAa;IACtB,sCAAsC;IAItC,OAAO,CAAC,EAAE,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;IAExC,wCAAwC;IAKxC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,iCAAiC;IAKjC,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,0CAA0C;IAK1C,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gBAAgB;IACzB,oEAAoE;IAGpE,OAAO,EAAG,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,WAAW;IACpB,wEAAwE;IAUxE,IAAI,EAAG,MAAM,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,qBAAa,YAAY;IACrB,2BAA2B;IAK3B,OAAO,EAAG,MAAM,CAAC;IAEjB,qDAAqD;IAIrD,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;;OAKG;IAKH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;OAOG;IAKH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;OAUG;IAKH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,yBAAyB;IAMzB,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB;;;;;;;;;;OAUG;IAOH,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAEjC;;;;;;;;;OASG;IAOH,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CAC1B"}

package/dist/lib/chat/application/dto/create-run.dto.js

@@ -16,8 +16,21 @@ exports.MAX_MESSAGE_LENGTH = 8_000;
  * the model is ever called.
  */
 exports.MAX_RUN_ATTACHMENTS = 8;
-/** The surfaces a run can be started from (design §2). */
-exports.RUN_SURFACES = ['chat', 'palette', 'entry', 'records'];
+/**
+ * The surfaces a run can be started from (design §2).
+ *
+ * `create` is the new-entry form. It is a separate surface rather than
+ * `records` because the client cannot describe it any other way: the URL has a
+ * content type but no entry id, so the form used to arrive here claiming the
+ * person was looking at a list.
+ */
+exports.RUN_SURFACES = [
+    'chat',
+    'palette',
+    'entry',
+    'records',
+    'create'
+];
 /**
  * Where the user was when they asked. Every field is optional — the chat panel
  * knows only the workspace, the entry editor knows the type and the entry.

package/dist/lib/chat/application/proposal-event-actor.d.ts

@@ -0,0 +1,26 @@
+import type { EventActor } from '@orthacms/database';
+import type { ProposalActor } from '@orthacms/copilot-domain';
+/**
+ * The {@link EventActor} an applier stamps on the domain events its write
+ * raises.
+ *
+ * The **actor is the human** who accepted — there is no copilot identity and
+ * there must not be one, since the write runs on their authority and their
+ * permissions. `via` is what stops the resulting audit row being
+ * indistinguishable from one they typed: under
+ * [ADR-0009](../../../../../../docs/adr/0009-copilot-applies-directly.md) a
+ * proposal applies as it is drafted, so without it "Ada updated three articles"
+ * could equally mean Ada edited three articles or that Ada accepted one agent
+ * turn that rewrote them.
+ *
+ * Shared rather than restated in each applier because there are nine of them
+ * across four packages, and an applier that quietly omitted `via` would produce
+ * exactly the row this exists to prevent — with nothing failing anywhere.
+ *
+ * **It lives here, not in `copilot-domain`, because that package imports
+ * nothing** — not even `@orthacms/database` — and `EventActor` would be an
+ * import. Every package that binds an applier already depends on this one for
+ * `copilotAppliersRegistrar`, so there is nothing new in the graph.
+ */
+export declare function proposalEventActor(actor: ProposalActor): EventActor;
+//# sourceMappingURL=proposal-event-actor.d.ts.map

package/dist/lib/chat/application/proposal-event-actor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proposal-event-actor.d.ts","sourceRoot":"","sources":["../../../../src/lib/chat/application/proposal-event-actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,aAAa,GAAG,UAAU,CAUnE"}

package/dist/lib/chat/application/proposal-event-actor.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.proposalEventActor = proposalEventActor;
+/**
+ * The {@link EventActor} an applier stamps on the domain events its write
+ * raises.
+ *
+ * The **actor is the human** who accepted — there is no copilot identity and
+ * there must not be one, since the write runs on their authority and their
+ * permissions. `via` is what stops the resulting audit row being
+ * indistinguishable from one they typed: under
+ * [ADR-0009](../../../../../../docs/adr/0009-copilot-applies-directly.md) a
+ * proposal applies as it is drafted, so without it "Ada updated three articles"
+ * could equally mean Ada edited three articles or that Ada accepted one agent
+ * turn that rewrote them.
+ *
+ * Shared rather than restated in each applier because there are nine of them
+ * across four packages, and an applier that quietly omitted `via` would produce
+ * exactly the row this exists to prevent — with nothing failing anywhere.
+ *
+ * **It lives here, not in `copilot-domain`, because that package imports
+ * nothing** — not even `@orthacms/database` — and `EventActor` would be an
+ * import. Every package that binds an applier already depends on this one for
+ * `copilotAppliersRegistrar`, so there is nothing new in the graph.
+ */
+function proposalEventActor(actor) {
+    return {
+        id: actor.userId,
+        email: actor.actorEmail,
+        via: {
+            kind: 'copilot',
+            runId: actor.runId,
+            proposalId: actor.proposalId ?? null
+        }
+    };
+}

package/dist/lib/chat/application/run-engine.service.d.ts

@@ -69,7 +69,16 @@ export interface StartRunInput {
 export declare class UnknownModelChoiceError extends Error {
     constructor(message: string);
 }
-/** Thrown when a run cannot start at all — the controller maps it to a 4xx. */
+/**
+ * Thrown when a run cannot start at all — the controller turns it into an
+ * error frame.
+ *
+ * **Rarely reachable over HTTP**: the copilot's kill switch now unregisters
+ * every controller (`copilot.module.ts`), so a disabled deployment 404s the run
+ * route rather than opening a stream to say no. Kept because the engine is
+ * drainable without a socket, and a caller that gets one anyway deserves a
+ * named reason rather than a 500.
+ */
 export declare class CopilotDisabledError extends Error {
     constructor();
 }

package/dist/lib/chat/application/run-engine.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-engine.service.d.ts","sourceRoot":"","sources":["../../../../src/lib/chat/application/run-engine.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAcH,KAAK,kBAAkB,EACvB,KAAK,eAAe,EAGpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAKlB,KAAK,SAAS,EAKjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACH,YAAY,EAGf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uDAAuD,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AACvF,OAAO,EACH,wBAAwB,EAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAErF,OAAO,EAGH,KAAK,cAAc,EACtB,MAAM,iBAAiB,CAAC;AAEzB,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC1B,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,yBAAyB;IACzB,OAAO,EAAE,cAAc,CAAC;IACxB,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,2CAA2C;IAC3C,MAAM,EAAE,WAAW,CAAC;CACvB;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI9B;AAED,+EAA+E;AAC/E,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAED;;;;;;;;;GASG;AACH,qBACa,SAAS;IAOU,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAOvB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAtBhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,yCAAyC;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;gBAGU,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,aAAa,EACxB,MAAM,EAAE,mBAAmB,EAClD,QAAQ,EAAE,wBAAwB,EAClC,KAAK,EAAE,YAAY,EACnB,aAAa,EAAE,sBAAsB,EACrC,SAAS,EAAE,kBAAkB,EAC7B,SAAS,EAAE,qBAAqB,EAChC,WAAW,EAAE,oBAAoB,EACjC,MAAM,EAAE,mBAAmB,EAO3B,WAAW,GAAE,kBAAkB,GAAG,IAAW,EAG9D,MAAM,GAAE,SAAS,GAAG,IAAW;IAQnC,qDAAqD;IAC9C,GAAG,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,CAAC,eAAe,CAAC;IAyKjE;;;OAGG;YACY,IAAI;IA4InB,2EAA2E;YAC5D,UAAU;IA6DzB;;;;;;;OAOG;IACH;;;;;;;;;;;;;OAaG;YACW,MAAM;YA2GN,WAAW;IAwJzB;;;;;;;;;;;;;;;;;OAiBG;YACW,cAAc;IAqI5B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,aAAa;IA6E3B;;;;;;;;OAQG;YACW,WAAW;IAiCzB,gEAAgE;YAClD,KAAK;IA6BnB;;;;;;;;;;;;;;;OAeG;YACW,kBAAkB;IAmChC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,WAAW;CAwC5B;AAED;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,KAAK;gBAC1B,OAAO,EAAE,MAAM;CAI9B;AA0BD,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,KAAwB,CAAC"}
+{"version":3,"file":"run-engine.service.d.ts","sourceRoot":"","sources":["../../../../src/lib/chat/application/run-engine.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAcH,KAAK,kBAAkB,EACvB,KAAK,eAAe,EAGpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAKlB,KAAK,SAAS,EAKjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACH,YAAY,EAGf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uDAAuD,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AACvF,OAAO,EACH,wBAAwB,EAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAErF,OAAO,EAGH,KAAK,cAAc,EACtB,MAAM,iBAAiB,CAAC;AAEzB,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC1B,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,yBAAyB;IACzB,OAAO,EAAE,cAAc,CAAC;IACxB,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,2CAA2C;IAC3C,MAAM,EAAE,WAAW,CAAC;CACvB;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI9B;AAED;;;;;;;;;GASG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAiBD;;;;;;;;;GASG;AACH,qBACa,SAAS;IAOU,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAOvB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAtBhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,yCAAyC;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;gBAGU,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,aAAa,EACxB,MAAM,EAAE,mBAAmB,EAClD,QAAQ,EAAE,wBAAwB,EAClC,KAAK,EAAE,YAAY,EACnB,aAAa,EAAE,sBAAsB,EACrC,SAAS,EAAE,kBAAkB,EAC7B,SAAS,EAAE,qBAAqB,EAChC,WAAW,EAAE,oBAAoB,EACjC,MAAM,EAAE,mBAAmB,EAO3B,WAAW,GAAE,kBAAkB,GAAG,IAAW,EAG9D,MAAM,GAAE,SAAS,GAAG,IAAW;IAQnC,qDAAqD;IAC9C,GAAG,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,CAAC,eAAe,CAAC;IAyLjE;;;OAGG;YACY,IAAI;IAgJnB,2EAA2E;YAC5D,UAAU;IAiEzB;;;;;;;OAOG;IACH;;;;;;;;;;;;;OAaG;YACW,MAAM;YA2GN,WAAW;IAwJzB;;;;;;;;;;;;;;;;;OAiBG;YACW,cAAc;IAqI5B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,aAAa;IA6E3B;;;;;;;;OAQG;YACW,WAAW;IAiCzB,gEAAgE;YAClD,KAAK;IA6BnB;;;;;;;;;;;;;;;OAeG;YACW,kBAAkB;IAmChC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,WAAW;CAwC5B;AAED;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,KAAK;gBAC1B,OAAO,EAAE,MAAM;CAI9B;AA0BD,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,KAAwB,CAAC"}

package/dist/lib/chat/application/run-engine.service.js

@@ -28,7 +28,16 @@ class UnknownModelChoiceError extends Error {
     }
 }
 exports.UnknownModelChoiceError = UnknownModelChoiceError;
-/** Thrown when a run cannot start at all — the controller maps it to a 4xx. */
+/**
+ * Thrown when a run cannot start at all — the controller turns it into an
+ * error frame.
+ *
+ * **Rarely reachable over HTTP**: the copilot's kill switch now unregisters
+ * every controller (`copilot.module.ts`), so a disabled deployment 404s the run
+ * route rather than opening a stream to say no. Kept because the engine is
+ * drainable without a socket, and a caller that gets one anyway deserves a
+ * named reason rather than a 500.
+ */
 class CopilotDisabledError extends Error {
     constructor() {
         super('The copilot is disabled.');
@@ -81,9 +90,12 @@ let RunEngine = RunEngine_1 = class RunEngine {
     /** Runs one turn, yielding events as they happen. */
     async *run(input) {
         if (!this.config.enabled) {
-            // The operator's kill switch (ADR-0005 §10). Checked here rather
-            // than in a guard so the reason reaches the user as a normal
-            // answer instead of an opaque 403.
+            // The operator's kill switch (ADR-0005 §10), belt-and-braces —
+            // `CopilotModule.forRoot` registers no controller when it is off,
+            // so a disabled deployment 404s before it reaches this line. This
+            // is the guard against a future wiring change, and against a
+            // caller that drains the generator without going through HTTP
+            // (a tool, a job, a test).
             throw new CopilotDisabledError();
         }
         const runId = (0, node_crypto_1.randomUUID)();
@@ -154,6 +166,14 @@ let RunEngine = RunEngine_1 = class RunEngine {
         const history = await this.loadHistory(conversation.id);
         const usage = { inputTokens: 0, outputTokens: 0 };
         const assistantBlocks = [];
+        // Text the model has already streamed to the client but that no
+        // finished step has moved into `assistantBlocks` yet. A provider that
+        // throws mid-stream — a dropped connection, a malformed frame, a
+        // cancellation an adapter raises instead of ending the stream with —
+        // otherwise takes the whole partial answer with it: the person watched
+        // it arrive, and reopening the thread showed their question and
+        // silence.
+        const partial = { text: '' };
         let stopReason = 'end';
         try {
             stopReason = yield* this.loop({
@@ -167,10 +187,15 @@ let RunEngine = RunEngine_1 = class RunEngine {
                 history,
                 usage,
                 assistantBlocks,
+                partial,
                 startedAt
             });
         }
         catch (error) {
+            // Whatever the step had already said, before whatever went wrong.
+            if (partial.text) {
+                assistantBlocks.push({ type: 'text', text: partial.text });
+            }
             if ((0, copilot_domain_1.isAbortError)(error, input.signal)) {
                 stopReason = 'aborted';
             }
@@ -240,6 +265,9 @@ let RunEngine = RunEngine_1 = class RunEngine {
             if (turn.text) {
                 ctx.assistantBlocks.push({ type: 'text', text: turn.text });
             }
+            // Banked: anything that throws from here on must not append it a
+            // second time.
+            ctx.partial.text = '';
             ctx.assistantBlocks.push(...turn.toolUses);
             if (turn.stopReason === 'aborted')
                 return 'aborted';
@@ -326,7 +354,10 @@ let RunEngine = RunEngine_1 = class RunEngine {
     /** One model call, reduced to text, tool uses, usage and a stop reason. */
     async *streamTurn(ctx, messages, tools) {
         const toolUses = [];
-        let text = '';
+        // The turn's text lives on the caller's accumulator rather than in a
+        // local, so a stream that throws leaves what it had already said
+        // somewhere `run` can still persist it.
+        ctx.partial.text = '';
         let usage = { inputTokens: 0, outputTokens: 0 };
         let stopReason = 'end';
         const stream = ctx.provider.provider.stream({
@@ -338,7 +369,7 @@ let RunEngine = RunEngine_1 = class RunEngine {
         }, ctx.input.signal);
         for await (const event of stream) {
             if (event.type === 'text-delta') {
-                text += event.text;
+                ctx.partial.text += event.text;
                 // Yielded, not collected. Buffering these into an array and
                 // flushing after the provider's stream ends turns the whole
                 // feature off: the answer arrives in one burst when the model
@@ -358,7 +389,7 @@ let RunEngine = RunEngine_1 = class RunEngine {
                 stopReason = event.stopReason;
             }
         }
-        return { text, toolUses, usage, stopReason };
+        return { text: ctx.partial.text, toolUses, usage, stopReason };
     }
     /**
      * Authorizes, validates and runs one tool call, and writes its audit row.

package/dist/lib/chat/application/system-prompt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-prompt.d.ts","sourceRoot":"","sources":["../../../../src/lib/chat/application/system-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,KAAK,KAAK,EACb,MAAM,0BAA0B,CAAC;AAElC;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC3B,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAC9B,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,OAAO,EAAE,cAAc,CAAC;IACxB,wEAAwE;IACxE,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;;;;;;OAQG;IACH,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;IACnC;;;;OAIG;IACH,aAAa,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAsDxC;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAgHlE"}
+{"version":3,"file":"system-prompt.d.ts","sourceRoot":"","sources":["../../../../src/lib/chat/application/system-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,KAAK,KAAK,EACb,MAAM,0BAA0B,CAAC;AAElC;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC3B,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAC9B,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,OAAO,EAAE,cAAc,CAAC;IACxB,wEAAwE;IACxE,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;;;;;;OAQG;IACH,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;IACnC;;;;OAIG;IACH,aAAa,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AA6DxC;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAgHlE"}

package/dist/lib/chat/application/system-prompt.js

@@ -55,6 +55,13 @@ const SURFACE_GUIDANCE = new Map([
         'The person is looking at a list of entries of the content type named ' +
             'above. Take a question that names no type to be about that one.'
     ],
+    [
+        'create',
+        'The person is filling in a new entry of the content type named above. ' +
+            'It does not exist yet and has no id, so do not look it up and do ' +
+            'not offer to change an existing entry — help them write the ' +
+            'values for the record in front of them.'
+    ],
     [
         'palette',
         'This came from the command palette: one instruction, not a conversation. ' +

package/dist/lib/chat/http/controllers/tool-permission.controller.d.ts

@@ -1,4 +1,5 @@
 import { type PublicUser } from '@orthacms/identity-server';
+import { OutboxWriter, UnitOfWork } from '@orthacms/database';
 import { ToolPermissionBroker } from '../../application/tool-permission.broker';
 import { DecideToolPermissionDto } from '../../application/dto/decide-tool-permission.dto';
 import { ExtendToolPermissionDto } from '../../application/dto/extend-tool-permission.dto';
@@ -34,8 +35,10 @@ import { ExtendToolPermissionDto } from '../../application/dto/extend-tool-permi
  */
 export declare class ToolPermissionController {
     private readonly broker;
-    constructor(broker: ToolPermissionBroker);
-    decide(runId: string, body: DecideToolPermissionDto, user: PublicUser, workspaceId: string): void;
+    private readonly uow;
+    private readonly outbox;
+    constructor(broker: ToolPermissionBroker, uow: UnitOfWork, outbox: OutboxWriter);
+    decide(runId: string, body: DecideToolPermissionDto, user: PublicUser, workspaceId: string): Promise<void>;
     /**
      * `POST /api/copilot/runs/:runId/permission/extend` — "I need more time".
      *

package/dist/lib/chat/http/controllers/tool-permission.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-permission.controller.d.ts","sourceRoot":"","sources":["../../../../../src/lib/chat/http/controllers/tool-permission.controller.ts"],"names":[],"mappings":"AAWA,OAAO,EAMH,KAAK,UAAU,EAClB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kDAAkD,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,kDAAkD,CAAC;AAE3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAGa,wBAAwB;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,oBAAoB;IAQzD,MAAM,CAC6B,KAAK,EAAE,MAAM,EACpC,IAAI,EAAE,uBAAuB,EACtB,IAAI,EAAE,UAAU,EACX,WAAW,EAAE,MAAM,GACxC,IAAI;IAiBP;;;;;;;;;;;;;OAaG;IAMH,MAAM,CAC6B,KAAK,EAAE,MAAM,EACpC,IAAI,EAAE,uBAAuB,EACtB,IAAI,EAAE,UAAU,EACX,WAAW,EAAE,MAAM,GACxC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE;CAY3B"}
+{"version":3,"file":"tool-permission.controller.d.ts","sourceRoot":"","sources":["../../../../../src/lib/chat/http/controllers/tool-permission.controller.ts"],"names":[],"mappings":"AAWA,OAAO,EAMH,KAAK,UAAU,EAClB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAEH,YAAY,EACZ,UAAU,EACb,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kDAAkD,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,kDAAkD,CAAC;AAE3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAGa,wBAAwB;IAE7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,MAAM,EAAE,oBAAoB,EAC5B,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,YAAY;IASnC,MAAM,CACuB,KAAK,EAAE,MAAM,EACpC,IAAI,EAAE,uBAAuB,EACtB,IAAI,EAAE,UAAU,EACX,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,IAAI,CAAC;IAwChB;;;;;;;;;;;;;OAaG;IAMH,MAAM,CAC6B,KAAK,EAAE,MAAM,EACpC,IAAI,EAAE,uBAAuB,EACtB,IAAI,EAAE,UAAU,EACX,WAAW,EAAE,MAAM,GACxC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE;CAY3B"}

package/dist/lib/chat/http/controllers/tool-permission.controller.js

@@ -6,6 +6,8 @@ const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
 const identity_server_1 = require("@orthacms/identity-server");
 const workspaces_server_1 = require("@orthacms/workspaces-server");
+const database_1 = require("@orthacms/database");
+const copilot_events_1 = require("../../../copilot.events");
 const tool_permission_broker_1 = require("../../application/tool-permission.broker");
 const decide_tool_permission_dto_1 = require("../../application/dto/decide-tool-permission.dto");
 const extend_tool_permission_dto_1 = require("../../application/dto/extend-tool-permission.dto");
@@ -41,10 +43,14 @@ const extend_tool_permission_dto_1 = require("../../application/dto/extend-tool-
  */
 let ToolPermissionController = class ToolPermissionController {
     broker;
-    constructor(broker) {
+    uow;
+    outbox;
+    constructor(broker, uow, outbox) {
         this.broker = broker;
+        this.uow = uow;
+        this.outbox = outbox;
     }
-    decide(runId, body, user, workspaceId) {
+    async decide(runId, body, user, workspaceId) {
         const delivered = this.broker.decide(runId, body.callId, body.decision, {
             userId: user.id,
             workspaceId
@@ -52,6 +58,21 @@ let ToolPermissionController = class ToolPermissionController {
         if (!delivered) {
             throw new common_1.NotFoundException('That request is no longer waiting for an answer.');
         }
+        // Recorded only when the decision was actually **delivered** — a late
+        // answer to a run that already gave up had no effect, and a row for it
+        // would report authority that was never granted. Same rule the outbox
+        // producers follow everywhere: audit what happened, not what was asked.
+        //
+        // This is the moment a person hands the agent authority it did not
+        // otherwise hold. The run's transcript records it too, but a transcript
+        // is a conversation the author can delete, not an audit store.
+        await this.uow.run(() => this.outbox.append((0, database_1.attachActor)([
+            (0, copilot_events_1.toolPermissionEvent)(runId, {
+                workspaceId,
+                callId: body.callId,
+                decision: body.decision
+            })
+        ], { id: user.id, email: user.email ?? null })));
     }
     /**
      * `POST /api/copilot/runs/:runId/permission/extend` — "I need more time".
@@ -92,7 +113,7 @@ tslib_1.__decorate([
     tslib_1.__param(3, (0, workspaces_server_1.CurrentWorkspace)()),
     tslib_1.__metadata("design:type", Function),
     tslib_1.__metadata("design:paramtypes", [String, decide_tool_permission_dto_1.DecideToolPermissionDto, Object, String]),
-    tslib_1.__metadata("design:returntype", void 0)
+    tslib_1.__metadata("design:returntype", Promise)
 ], ToolPermissionController.prototype, "decide", null);
 tslib_1.__decorate([
     (0, common_1.Post)('runs/:runId/permission/extend'),
@@ -112,5 +133,7 @@ exports.ToolPermissionController = ToolPermissionController = tslib_1.__decorate
     (0, common_1.UseGuards)(identity_server_1.PermissionsGuard, workspaces_server_1.WorkspaceGuard),
     (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.COPILOT_USE),
     (0, common_1.Controller)('copilot'),
-    tslib_1.__metadata("design:paramtypes", [tool_permission_broker_1.ToolPermissionBroker])
+    tslib_1.__metadata("design:paramtypes", [tool_permission_broker_1.ToolPermissionBroker,
+        database_1.UnitOfWork,
+        database_1.OutboxWriter])
 ], ToolPermissionController);

package/dist/lib/copilot.events.d.ts

@@ -0,0 +1,56 @@
+import { type DomainEvent } from '@orthacms/database';
+/**
+ * The domain events the copilot context raises.
+ *
+ * Two things are recorded and two deliberately are not, and the line between
+ * them is whether a person granted the agent something.
+ *
+ * **Recorded.** A **skill** is standing instruction: it changes what the
+ * copilot does in a workspace for everyone, on every future run, and a skill
+ * flipped to `auto` runs without anybody asking for it. A **tool permission**
+ * is the same decision at one moment — a person allowing one parked call to
+ * proceed. Both are authority granted to an agent by a human, which is the
+ * thing an audit trail exists for.
+ *
+ * **Not recorded.** Starting a run raises nothing: a run is a conversation
+ * turn, and everything a run actually *does* is already audited at the point it
+ * does it — an applied change is an `entry.*` row carrying its own `runId`
+ * (ADR-0009 applies directly, so there is no separate approval to record).
+ * Renaming a conversation raises nothing either; it is a title on the author's
+ * own thread. Both would be usage metrics in a log that has no way to filter
+ * them out.
+ */
+export declare const COPILOT_EVENT_KINDS: {
+    /** A skill was written into a workspace. */
+    readonly SKILL_CREATED: "copilot.skill.created";
+    /**
+     * A skill was edited.
+     *
+     * `mode` and `enabled` are the two that matter: `auto` means it applies
+     * without being asked for, and a disabled skill is indistinguishable from
+     * one that never matched.
+     */
+    readonly SKILL_UPDATED: "copilot.skill.updated";
+    /** A skill was deleted. */
+    readonly SKILL_DELETED: "copilot.skill.deleted";
+    /**
+     * A person allowed or refused one tool call in a running turn.
+     *
+     * Bounded by human interaction — one decision per parked call — so this is
+     * not the volume problem auditing runs would be. It is the moment a human
+     * hands the agent authority it did not otherwise hold, and the run's own
+     * transcript is not an audit store.
+     */
+    readonly TOOL_PERMISSION_DECIDED: "copilot.tool_permission.decided";
+};
+/** Builds a copilot-skill {@link DomainEvent}, stamping the aggregate type + id. */
+export declare function copilotSkillEvent(kind: string, skillId: string, payload: Record<string, unknown>): DomainEvent;
+/**
+ * Builds the `copilot.tool_permission.decided` event.
+ *
+ * The aggregate is the **run**, because that is the thing the decision is
+ * about and the handle a reviewer has: a transcript is read by run id, and the
+ * tool call this answered is one field inside it.
+ */
+export declare function toolPermissionEvent(runId: string, payload: Record<string, unknown>): DomainEvent;
+//# sourceMappingURL=copilot.events.d.ts.map

package/dist/lib/copilot.events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"copilot.events.d.ts","sourceRoot":"","sources":["../../src/lib/copilot.events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB;IAC5B,4CAA4C;;IAE5C;;;;;;OAMG;;IAEH,2BAA2B;;IAE3B;;;;;;;OAOG;;CAEG,CAAC;AAEX,oFAAoF;AACpF,wBAAgB,iBAAiB,CAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,WAAW,CAOb;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,WAAW,CAOb"}

package/dist/lib/copilot.events.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COPILOT_EVENT_KINDS = void 0;
+exports.copilotSkillEvent = copilotSkillEvent;
+exports.toolPermissionEvent = toolPermissionEvent;
+const database_1 = require("@orthacms/database");
+/**
+ * The domain events the copilot context raises.
+ *
+ * Two things are recorded and two deliberately are not, and the line between
+ * them is whether a person granted the agent something.
+ *
+ * **Recorded.** A **skill** is standing instruction: it changes what the
+ * copilot does in a workspace for everyone, on every future run, and a skill
+ * flipped to `auto` runs without anybody asking for it. A **tool permission**
+ * is the same decision at one moment — a person allowing one parked call to
+ * proceed. Both are authority granted to an agent by a human, which is the
+ * thing an audit trail exists for.
+ *
+ * **Not recorded.** Starting a run raises nothing: a run is a conversation
+ * turn, and everything a run actually *does* is already audited at the point it
+ * does it — an applied change is an `entry.*` row carrying its own `runId`
+ * (ADR-0009 applies directly, so there is no separate approval to record).
+ * Renaming a conversation raises nothing either; it is a title on the author's
+ * own thread. Both would be usage metrics in a log that has no way to filter
+ * them out.
+ */
+exports.COPILOT_EVENT_KINDS = {
+    /** A skill was written into a workspace. */
+    SKILL_CREATED: 'copilot.skill.created',
+    /**
+     * A skill was edited.
+     *
+     * `mode` and `enabled` are the two that matter: `auto` means it applies
+     * without being asked for, and a disabled skill is indistinguishable from
+     * one that never matched.
+     */
+    SKILL_UPDATED: 'copilot.skill.updated',
+    /** A skill was deleted. */
+    SKILL_DELETED: 'copilot.skill.deleted',
+    /**
+     * A person allowed or refused one tool call in a running turn.
+     *
+     * Bounded by human interaction — one decision per parked call — so this is
+     * not the volume problem auditing runs would be. It is the moment a human
+     * hands the agent authority it did not otherwise hold, and the run's own
+     * transcript is not an audit store.
+     */
+    TOOL_PERMISSION_DECIDED: 'copilot.tool_permission.decided'
+};
+/** Builds a copilot-skill {@link DomainEvent}, stamping the aggregate type + id. */
+function copilotSkillEvent(kind, skillId, payload) {
+    return (0, database_1.createDomainEvent)({
+        kind,
+        aggregateType: 'copilot_skill',
+        aggregateId: skillId,
+        payload
+    });
+}
+/**
+ * Builds the `copilot.tool_permission.decided` event.
+ *
+ * The aggregate is the **run**, because that is the thing the decision is
+ * about and the handle a reviewer has: a transcript is read by run id, and the
+ * tool call this answered is one field inside it.
+ */
+function toolPermissionEvent(runId, payload) {
+    return (0, database_1.createDomainEvent)({
+        kind: exports.COPILOT_EVENT_KINDS.TOOL_PERMISSION_DECIDED,
+        aggregateType: 'copilot_run',
+        aggregateId: runId,
+        payload
+    });
+}

package/dist/lib/copilot.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"copilot.module.d.ts","sourceRoot":"","sources":["../../src/lib/copilot.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAU,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAIH,KAAK,aAAa,EAClB,KAAK,eAAe,EACvB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAEH,KAAK,oBAAoB,EAC5B,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAqBlE,qDAAqD;AACrD,MAAM,WAAW,oBAAoB;IACjC,sEAAsE;IACtE,SAAS,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3C,0DAA0D;IAC1D,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACpC,+DAA+D;IAC/D,MAAM,EAAE,mBAAmB,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,qBACa,aAAa;IACtB,mEAAmE;IACnE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa;CAwG/D"}
+{"version":3,"file":"copilot.module.d.ts","sourceRoot":"","sources":["../../src/lib/copilot.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAU,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAIH,KAAK,aAAa,EAClB,KAAK,eAAe,EACvB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAEH,KAAK,oBAAoB,EAC5B,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAqBlE,qDAAqD;AACrD,MAAM,WAAW,oBAAoB;IACjC,sEAAsE;IACtE,SAAS,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3C,0DAA0D;IAC1D,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACpC,+DAA+D;IAC/D,MAAM,EAAE,mBAAmB,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,qBACa,aAAa;IACtB,mEAAmE;IACnE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa;CAiI/D"}

package/dist/lib/copilot.module.js

@@ -47,11 +47,17 @@ let CopilotModule = CopilotModule_1 = class CopilotModule {
         // and its order is the preference order (`catalogue()` renders in it,
         // and the admin's picker opens on its first entry).
         const [first] = options.providers;
-        if (!first) {
-            throw new Error('CopilotModule requires at least one model provider — the first one registered ' +
+        if (!first && options.config.enabled) {
+            throw new Error('CopilotModule is enabled but has no model provider — the first one registered ' +
                 'is what serves a run that names none.');
         }
-        const resolver = options.resolve ?? (() => first.name);
+        // A disabled copilot registers no controller, so nothing can reach the
+        // resolver and there is no default to name. It still has to resolve to
+        // *something*: the module binds `MODEL_RESOLVER` either way, because the
+        // switch must not change the shape of the DI graph. Asking for a
+        // provider through it fails in `ModelRegistry.get`, naming the empty
+        // catalogue, which is the same error an unknown name gets.
+        const resolver = options.resolve ?? (() => first?.name ?? '');
         return {
             module: CopilotModule_1,
             global: true,
@@ -62,34 +68,52 @@ let CopilotModule = CopilotModule_1 = class CopilotModule {
             // so a deployment running the copilot *without* MCP still has one,
             // and one running both has exactly one.
             imports: [database_1.DatabaseModule, tools_server_1.ToolsModule],
-            controllers: [
-                create_run_controller_1.CreateRunController,
-                // Before `GetConversationController`: `conversations/:id` and
-                // `models` can't collide (different first segments), but keep
-                // the read routes grouped after the run route.
-                list_models_controller_1.ListModelsController,
-                list_conversations_controller_1.ListConversationsController,
-                // `PATCH conversations/:id`. No ordering hazard with the `GET`
-                // wildcard below — Express matches method and path together —
-                // but it reads with the other conversation routes.
-                update_conversation_controller_1.UpdateConversationController,
-                // Before `GetConversationController`, whose `conversations/:id`
-                // is the only wildcard here — Express matches in declaration
-                // order, so the literal-prefixed routes go first.
-                proposals_controller_1.ProposalsController,
-                // Before `GetConversationController` for the same reason as
-                // the others: its `conversations/:id` is the only wildcard, and
-                // Express matches in declaration order.
-                tool_permission_controller_1.ToolPermissionController,
-                // Both skill controllers before the conversation wildcard, for
-                // the same declaration-order reason as the rest. `skills` and
-                // `skills/:id` live in different controllers and cannot
-                // collide (different segment counts); `skills/manage` is
-                // declared above `skills/:id` inside the manage controller.
-                list_skills_controller_1.ListSkillsController,
-                manage_skills_controller_1.ManageSkillsController,
-                get_conversation_controller_1.GetConversationController
-            ],
+            // **The kill switch, applied where MCP applies its own**
+            // (`mcp.module.ts`): a disabled deployment registers no copilot
+            // controller at all, so every `/api/copilot/*` route 404s.
+            //
+            // It used to be read in one place only — `RunEngine.run` — which
+            // made "off" mean *the send button returns an error frame*. The
+            // panel, the Agents view, the model catalogue, the conversation and
+            // skill routes and the tables all stayed live, so a deployment that
+            // had opted out still offered the whole feature and refused at the
+            // last step. Off is now off.
+            //
+            // The providers, the registry and the skill catalogue below stay
+            // bound either way. They cost nothing unbuilt, and the shared
+            // `ToolRegistry` must not change shape with this switch — the MCP
+            // endpoint serves the same catalogue, and a tool contributed by
+            // `content` is registered against `ToolsModule`, not this one.
+            controllers: options.config.enabled
+                ? [
+                    create_run_controller_1.CreateRunController,
+                    // Before `GetConversationController`: `conversations/:id` and
+                    // `models` can't collide (different first segments), but keep
+                    // the read routes grouped after the run route.
+                    list_models_controller_1.ListModelsController,
+                    list_conversations_controller_1.ListConversationsController,
+                    // `PATCH conversations/:id`. No ordering hazard with the `GET`
+                    // wildcard below — Express matches method and path together —
+                    // but it reads with the other conversation routes.
+                    update_conversation_controller_1.UpdateConversationController,
+                    // Before `GetConversationController`, whose `conversations/:id`
+                    // is the only wildcard here — Express matches in declaration
+                    // order, so the literal-prefixed routes go first.
+                    proposals_controller_1.ProposalsController,
+                    // Before `GetConversationController` for the same reason as
+                    // the others: its `conversations/:id` is the only wildcard, and
+                    // Express matches in declaration order.
+                    tool_permission_controller_1.ToolPermissionController,
+                    // Both skill controllers before the conversation wildcard, for
+                    // the same declaration-order reason as the rest. `skills` and
+                    // `skills/:id` live in different controllers and cannot
+                    // collide (different segment counts); `skills/manage` is
+                    // declared above `skills/:id` inside the manage controller.
+                    list_skills_controller_1.ListSkillsController,
+                    manage_skills_controller_1.ManageSkillsController,
+                    get_conversation_controller_1.GetConversationController
+                ]
+                : [],
             providers: [
                 { provide: copilot_tokens_1.COPILOT_CONFIG, useValue: options.config },
                 {

package/dist/lib/infrastructure/model-registry.d.ts

@@ -1,7 +1,7 @@
 import { type ModelProvider, type ModelRegistry } from '@orthacms/copilot-domain';
 /** One provider the host offers, under the name runs refer to it by. */
 export interface ProviderRegistration {
-    /** Unique, operator-chosen name — `claude`, `ollama-big`, `fake`. */
+    /** Unique, operator-chosen name — `claude`, `ollama-big`, `local`. */
     name: string;
     /** The adapter instance, already constructed with its own config. */
     provider: ModelProvider;

package/dist/lib/infrastructure/model-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model-registry.d.ts","sourceRoot":"","sources":["../../../src/lib/infrastructure/model-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,KAAK,aAAa,EAClB,KAAK,aAAa,EACrB,MAAM,0BAA0B,CAAC;AAElC,wEAAwE;AACxE,MAAM,WAAW,oBAAoB;IACjC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,QAAQ,EAAE,aAAa,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAC9B,aAAa,EAAE,SAAS,oBAAoB,EAAE,GAC/C,aAAa,CA+Cf"}
+{"version":3,"file":"model-registry.d.ts","sourceRoot":"","sources":["../../../src/lib/infrastructure/model-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,KAAK,aAAa,EAClB,KAAK,aAAa,EACrB,MAAM,0BAA0B,CAAC;AAElC,wEAAwE;AACxE,MAAM,WAAW,oBAAoB;IACjC,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,QAAQ,EAAE,aAAa,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAC9B,aAAa,EAAE,SAAS,oBAAoB,EAAE,GAC/C,aAAa,CA+Cf"}

package/dist/lib/skills/http/controllers/manage-skills.controller.d.ts

@@ -1,3 +1,4 @@
+import { OutboxWriter, UnitOfWork } from '@orthacms/database';
 import { type PublicUser } from '@orthacms/identity-server';
 import { SkillCatalogService, type SkillSummary } from '../../application/skill-catalog.service';
 import { SkillRepository, type SkillRecord } from '../../infrastructure/persistence/skill.repository';
@@ -27,7 +28,14 @@ import { UpdateSkillDto } from '../../application/dto/update-skill.dto';
 export declare class ManageSkillsController {
     private readonly skills;
     private readonly catalog;
-    constructor(skills: SkillRepository, catalog: SkillCatalogService);
+    private readonly uow;
+    private readonly outbox;
+    constructor(skills: SkillRepository, catalog: SkillCatalogService, uow: UnitOfWork, outbox: OutboxWriter);
+    /**
+     * Appends one `copilot.skill.*` event from inside the active unit of work,
+     * stamped with the administrator who made the change.
+     */
+    private emit;
     /**
      * Every skill the manage page lists — code skills (read-only) and all of
      * the workspace's rows, disabled ones included.
@@ -39,7 +47,7 @@ export declare class ManageSkillsController {
     manageList(workspaceId: string): Promise<SkillSummary[]>;
     read(id: string, workspaceId: string): Promise<SkillRecord>;
     create(body: CreateSkillDto, user: PublicUser, workspaceId: string): Promise<SkillRecord>;
-    update(id: string, body: UpdateSkillDto, workspaceId: string): Promise<SkillRecord>;
+    update(id: string, body: UpdateSkillDto, user: PublicUser, workspaceId: string): Promise<SkillRecord>;
     /**
      * Deletes a skill.
      *
@@ -48,7 +56,7 @@ export declare class ManageSkillsController {
      * turn that ran with it holds its own name/title snapshot, so the
      * transcript survives.
      */
-    remove(id: string, workspaceId: string): Promise<void>;
+    remove(id: string, user: PublicUser, workspaceId: string): Promise<void>;
     /**
      * Refuses a name a code skill or another row already holds.
      *

package/dist/lib/skills/http/controllers/manage-skills.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manage-skills.controller.d.ts","sourceRoot":"","sources":["../../../../../src/lib/skills/http/controllers/manage-skills.controller.ts"],"names":[],"mappings":"AAiBA,OAAO,EAMH,KAAK,UAAU,EAClB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACH,mBAAmB,EACnB,KAAK,YAAY,EACpB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACH,eAAe,EACf,KAAK,WAAW,EACnB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAGa,sBAAsB;IAE3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,mBAAmB;IAGjD;;;;;;;OAOG;IAGG,UAAU,CACQ,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,YAAY,EAAE,CAAC;IAOpB,IAAI,CACsB,EAAE,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,WAAW,CAAC;IAYjB,MAAM,CACA,IAAI,EAAE,cAAc,EACb,IAAI,EAAE,UAAU,EACX,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,WAAW,CAAC;IAmBjB,MAAM,CACoB,EAAE,EAAE,MAAM,EAC9B,IAAI,EAAE,cAAc,EACR,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,WAAW,CAAC;IAoBvB;;;;;;;OAOG;IAKG,MAAM,CACoB,EAAE,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,IAAI,CAAC;IAOhB;;;;;;;;;OASG;YACW,cAAc;CAiB/B"}
+{"version":3,"file":"manage-skills.controller.d.ts","sourceRoot":"","sources":["../../../../../src/lib/skills/http/controllers/manage-skills.controller.ts"],"names":[],"mappings":"AAiBA,OAAO,EAEH,YAAY,EACZ,UAAU,EACb,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EAMH,KAAK,UAAU,EAClB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACH,mBAAmB,EACnB,KAAK,YAAY,EACpB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACH,eAAe,EACf,KAAK,WAAW,EACnB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAGa,sBAAsB;IAE3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAHN,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,mBAAmB,EAC5B,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,YAAY;IAGzC;;;OAGG;YACW,IAAI;IAclB;;;;;;;OAOG;IAGG,UAAU,CACQ,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,YAAY,EAAE,CAAC;IAOpB,IAAI,CACsB,EAAE,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,WAAW,CAAC;IAYjB,MAAM,CACA,IAAI,EAAE,cAAc,EACb,IAAI,EAAE,UAAU,EACX,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,WAAW,CAAC;IAoCjB,MAAM,CACoB,EAAE,EAAE,MAAM,EAC9B,IAAI,EAAE,cAAc,EACb,IAAI,EAAE,UAAU,EACX,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,WAAW,CAAC;IAwCvB;;;;;;;OAOG;IAKG,MAAM,CACoB,EAAE,EAAE,MAAM,EACvB,IAAI,EAAE,UAAU,EACX,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,IAAI,CAAC;IAuBhB;;;;;;;;;OASG;YACW,cAAc;CAiB/B"}

package/dist/lib/skills/http/controllers/manage-skills.controller.js

@@ -4,6 +4,8 @@ exports.ManageSkillsController = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
+const database_1 = require("@orthacms/database");
+const copilot_events_1 = require("../../../copilot.events");
 const identity_server_1 = require("@orthacms/identity-server");
 const workspaces_server_1 = require("@orthacms/workspaces-server");
 const skill_catalog_service_1 = require("../../application/skill-catalog.service");
@@ -34,9 +36,23 @@ const update_skill_dto_1 = require("../../application/dto/update-skill.dto");
 let ManageSkillsController = class ManageSkillsController {
     skills;
     catalog;
-    constructor(skills, catalog) {
+    uow;
+    outbox;
+    constructor(skills, catalog, uow, outbox) {
         this.skills = skills;
         this.catalog = catalog;
+        this.uow = uow;
+        this.outbox = outbox;
+    }
+    /**
+     * Appends one `copilot.skill.*` event from inside the active unit of work,
+     * stamped with the administrator who made the change.
+     */
+    async emit(kind, skillId, payload, user) {
+        await this.outbox.append((0, database_1.attachActor)([(0, copilot_events_1.copilotSkillEvent)(kind, skillId, payload)], {
+            id: user.id,
+            email: user.email ?? null
+        }));
     }
     /**
      * Every skill the manage page lists — code skills (read-only) and all of
@@ -58,18 +74,30 @@ let ManageSkillsController = class ManageSkillsController {
     }
     async create(body, user, workspaceId) {
         await this.assertNameFree(body.name, workspaceId);
-        return this.skills.create({
-            workspaceId,
-            name: body.name,
-            title: body.title,
-            description: body.description,
-            instructions: body.instructions,
-            mode: body.mode ?? 'manual',
-            enabled: body.enabled ?? true,
-            createdBy: user.id
+        return this.uow.run(async () => {
+            const created = await this.skills.create({
+                workspaceId,
+                name: body.name,
+                title: body.title,
+                description: body.description,
+                instructions: body.instructions,
+                mode: body.mode ?? 'manual',
+                enabled: body.enabled ?? true,
+                createdBy: user.id
+            });
+            await this.emit(copilot_events_1.COPILOT_EVENT_KINDS.SKILL_CREATED, created.id, {
+                workspaceId,
+                name: created.name,
+                title: created.title,
+                // `auto` means it runs without anybody asking for it, which
+                // is the fact that makes a skill worth an audit row.
+                mode: created.mode,
+                enabled: created.enabled
+            }, user);
+            return created;
         });
     }
-    async update(id, body, workspaceId) {
+    async update(id, body, user, workspaceId) {
         // An empty patch cannot mean anything, and answering 200 to it would
         // report success for a write that never happened. The pipe cannot catch
         // this: every property is legitimately optional on its own.
@@ -79,11 +107,26 @@ let ManageSkillsController = class ManageSkillsController {
         if (body.name !== undefined) {
             await this.assertNameFree(body.name, workspaceId, id);
         }
-        const updated = await this.skills.update(id, workspaceId, body);
-        if (!updated) {
-            throw new common_1.NotFoundException('Skill not found.');
-        }
-        return updated;
+        const existing = await this.skills.find(id, workspaceId);
+        return this.uow.run(async () => {
+            const updated = await this.skills.update(id, workspaceId, body);
+            if (!updated) {
+                throw new common_1.NotFoundException('Skill not found.');
+            }
+            await this.emit(copilot_events_1.COPILOT_EVENT_KINDS.SKILL_UPDATED, id, {
+                workspaceId,
+                name: updated.name,
+                // The keys the caller sent — a patch, so "what changed" is
+                // the request rather than the row.
+                fields: Object.keys(body),
+                mode: { from: existing?.mode ?? null, to: updated.mode },
+                enabled: {
+                    from: existing?.enabled ?? null,
+                    to: updated.enabled
+                }
+            }, user);
+            return updated;
+        });
     }
     /**
      * Deletes a skill.
@@ -93,11 +136,22 @@ let ManageSkillsController = class ManageSkillsController {
      * turn that ran with it holds its own name/title snapshot, so the
      * transcript survives.
      */
-    async remove(id, workspaceId) {
-        const removed = await this.skills.remove(id, workspaceId);
-        if (!removed) {
-            throw new common_1.NotFoundException('Skill not found.');
-        }
+    async remove(id, user, workspaceId) {
+        const existing = await this.skills.find(id, workspaceId);
+        await this.uow.run(async () => {
+            const removed = await this.skills.remove(id, workspaceId);
+            if (!removed) {
+                throw new common_1.NotFoundException('Skill not found.');
+            }
+            // The skill's own details, because after this commits there is
+            // nowhere left to look them up.
+            await this.emit(copilot_events_1.COPILOT_EVENT_KINDS.SKILL_DELETED, id, {
+                workspaceId,
+                name: existing?.name ?? null,
+                title: existing?.title ?? null,
+                mode: existing?.mode ?? null
+            }, user);
+        });
     }
     /**
      * Refuses a name a code skill or another row already holds.
@@ -157,9 +211,10 @@ tslib_1.__decorate([
     (0, swagger_1.ApiResponse)({ status: 409, description: 'The new name is already taken.' }),
     tslib_1.__param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
     tslib_1.__param(1, (0, common_1.Body)()),
-    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__param(2, (0, identity_server_1.CurrentUser)()),
+    tslib_1.__param(3, (0, workspaces_server_1.CurrentWorkspace)()),
     tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [String, update_skill_dto_1.UpdateSkillDto, String]),
+    tslib_1.__metadata("design:paramtypes", [String, update_skill_dto_1.UpdateSkillDto, Object, String]),
     tslib_1.__metadata("design:returntype", Promise)
 ], ManageSkillsController.prototype, "update", null);
 tslib_1.__decorate([
@@ -168,9 +223,10 @@ tslib_1.__decorate([
     (0, common_1.HttpCode)(common_1.HttpStatus.NO_CONTENT),
     (0, swagger_1.ApiOperation)({ summary: 'Delete a skill' }),
     tslib_1.__param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
-    tslib_1.__param(1, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__param(1, (0, identity_server_1.CurrentUser)()),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
     tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [String, String]),
+    tslib_1.__metadata("design:paramtypes", [String, Object, String]),
     tslib_1.__metadata("design:returntype", Promise)
 ], ManageSkillsController.prototype, "remove", null);
 exports.ManageSkillsController = ManageSkillsController = tslib_1.__decorate([
@@ -178,5 +234,7 @@ exports.ManageSkillsController = ManageSkillsController = tslib_1.__decorate([
     (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.COPILOT_SKILLS_MANAGE),
     (0, common_1.Controller)('copilot'),
     tslib_1.__metadata("design:paramtypes", [skill_repository_1.SkillRepository,
-        skill_catalog_service_1.SkillCatalogService])
+        skill_catalog_service_1.SkillCatalogService,
+        database_1.UnitOfWork,
+        database_1.OutboxWriter])
 ], ManageSkillsController);

package/dist/lib/skills/infrastructure/persistence/skill.repository.d.ts

@@ -1,4 +1,4 @@
-import { type Database } from '@orthacms/database';
+import { UnitOfWork } from '@orthacms/database';
 import type { Skill, SkillMode } from '@orthacms/copilot-domain';
 /** A CMS skill as the manage page reads it — the row, plus its provenance. */
 export interface SkillRecord extends Skill {
@@ -43,8 +43,15 @@ export interface UpdateSkillInput {
  * and same reason, as `ConversationRepository`.
  */
 export declare class SkillRepository {
-    private readonly db;
-    constructor(db: Database);
+    private readonly uow;
+    constructor(uow: UnitOfWork);
+    /**
+     * The executor to run against: the ambient transaction when a caller opened
+     * one, the base connection otherwise — so a skill write and the
+     * `copilot.skill.*` event describing it commit together. Outside a unit of
+     * work this is exactly the old behaviour.
+     */
+    private get db();
     /**
      * The workspace's skills, oldest first.
      *

package/dist/lib/skills/infrastructure/persistence/skill.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill.repository.d.ts","sourceRoot":"","sources":["../../../../../src/lib/skills/infrastructure/persistence/skill.repository.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAGjE,8EAA8E;AAC9E,MAAM,WAAW,WAAY,SAAQ,KAAK;IACtC,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,8BAA8B;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,mDAAmD;IACnD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,8BAA8B;IAC9B,SAAS,EAAE,IAAI,CAAC;IAChB,iBAAiB;IACjB,SAAS,EAAE,IAAI,CAAC;CACnB;AAED,mCAAmC;AACnC,MAAM,WAAW,gBAAgB;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,qBACa,eAAe;IACM,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ;IAE3D;;;;;;;OAOG;IACG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAgB1E;;;;OAIG;IACG,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAcxE,iEAAiE;IAC3D,UAAU,CACZ,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAc9B,0BAA0B;IACpB,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC;IAQ3D;;;;;;OAMG;IACG,MAAM,CACR,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gBAAgB,GACxB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAc9B,oEAAoE;IAC9D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAYlE"}
+{"version":3,"file":"skill.repository.d.ts","sourceRoot":"","sources":["../../../../../src/lib/skills/infrastructure/persistence/skill.repository.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAiB,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAGjE,8EAA8E;AAC9E,MAAM,WAAW,WAAY,SAAQ,KAAK;IACtC,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,8BAA8B;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,mDAAmD;IACnD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,8BAA8B;IAC9B,SAAS,EAAE,IAAI,CAAC;IAChB,iBAAiB;IACjB,SAAS,EAAE,IAAI,CAAC;CACnB;AAED,mCAAmC;AACnC,MAAM,WAAW,gBAAgB;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,qBACa,eAAe;IACZ,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,UAAU;IAE5C;;;;;OAKG;IACH,OAAO,KAAK,EAAE,GAEb;IAED;;;;;;;OAOG;IACG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAgB1E;;;;OAIG;IACG,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAcxE,iEAAiE;IAC3D,UAAU,CACZ,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAc9B,0BAA0B;IACpB,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC;IAQ3D;;;;;;OAMG;IACG,MAAM,CACR,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gBAAgB,GACxB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAc9B,oEAAoE;IAC9D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAYlE"}

package/dist/lib/skills/infrastructure/persistence/skill.repository.js

@@ -16,9 +16,18 @@ const skills_1 = require("../schema/skills");
  * and same reason, as `ConversationRepository`.
  */
 let SkillRepository = class SkillRepository {
-    db;
-    constructor(db) {
-        this.db = db;
+    uow;
+    constructor(uow) {
+        this.uow = uow;
+    }
+    /**
+     * The executor to run against: the ambient transaction when a caller opened
+     * one, the base connection otherwise — so a skill write and the
+     * `copilot.skill.*` event describing it commit together. Outside a unit of
+     * work this is exactly the old behaviour.
+     */
+    get db() {
+        return this.uow.current();
     }
     /**
      * The workspace's skills, oldest first.
@@ -95,8 +104,7 @@ let SkillRepository = class SkillRepository {
 exports.SkillRepository = SkillRepository;
 exports.SkillRepository = SkillRepository = tslib_1.__decorate([
     (0, common_1.Injectable)(),
-    tslib_1.__param(0, (0, database_1.InjectDatabase)()),
-    tslib_1.__metadata("design:paramtypes", [Object])
+    tslib_1.__metadata("design:paramtypes", [database_1.UnitOfWork])
 ], SkillRepository);
 /** The row, with `source` stamped — a database row is always a CMS skill. */
 function toRecord(row) {

package/dist/lib/utils/copilot-plugin.d.ts

@@ -20,6 +20,10 @@ export interface CopilotPluginOptions {
      * misspelled, could point at a provider nobody registered, and had to be
      * kept in step with this list on every change. A deployment that should
      * not reach a backend does not register it.
+     *
+     * **May be empty only while `config.enabled` is false.** A copilot that is
+     * on and has nothing to call is a misconfiguration, and fails at
+     * construction rather than on the first message.
      */
     providers: readonly ProviderRegistration[];
     /** Optional custom handler picking a provider per run (plain code). */
@@ -50,13 +54,16 @@ export interface CopilotPluginOptions {
  * engine, the capability profile, and the transcript tables this plugin now
  * owns and migrates.
  *
+ * Each entry is a backend this deployment actually configured. An enabled
+ * copilot needs at least one; a disabled one needs none, and a checkout with no
+ * keys registers none.
+ *
  * @example
  * ```typescript
  * CopilotPlugin({
  *     providers: [
  *         { name: 'claude', provider: createAnthropicProvider(providers.claude) },
- *         { name: 'ollama', provider: createOpenAiProvider(providers.ollama) },
- *         { name: 'fake', provider: createFakeProvider() }
+ *         { name: 'ollama', provider: createOpenAiProvider(providers.ollama) }
  *     ],
  *     config: config.plugins.copilot
  * });

package/dist/lib/utils/copilot-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"copilot-plugin.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/copilot-plugin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAEH,KAAK,aAAa,EAClB,KAAK,eAAe,EACvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAEnE,0DAA0D;AAC1D,MAAM,MAAM,6BAA6B,GAAG,YAAY,GAAG;IACvD,aAAa,EAAE,mBAAmB,CAAC;CACtC,CAAC;AAEF,wDAAwD;AACxD,MAAM,WAAW,oBAAoB;IACjC;;;;;;;;;;;;OAYG;IACH,SAAS,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3C,uEAAuE;IACvE,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACpC,+DAA+D;IAC/D,MAAM,EAAE,mBAAmB,CAAC;CAC/B;AAsDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,aAAa,CACzB,OAAO,EAAE,oBAAoB,GAC9B,6BAA6B,CAa/B"}
+{"version":3,"file":"copilot-plugin.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/copilot-plugin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAEH,KAAK,aAAa,EAClB,KAAK,eAAe,EACvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAEnE,0DAA0D;AAC1D,MAAM,MAAM,6BAA6B,GAAG,YAAY,GAAG;IACvD,aAAa,EAAE,mBAAmB,CAAC;CACtC,CAAC;AAEF,wDAAwD;AACxD,MAAM,WAAW,oBAAoB;IACjC;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3C,uEAAuE;IACvE,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACpC,+DAA+D;IAC/D,MAAM,EAAE,mBAAmB,CAAC;CAC/B;AA+DD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,aAAa,CACzB,OAAO,EAAE,oBAAoB,GAC9B,6BAA6B,CAa/B"}

package/dist/lib/utils/copilot-plugin.js

@@ -6,19 +6,28 @@ const copilot_domain_1 = require("@orthacms/copilot-domain");
 const copilot_module_1 = require("../copilot.module");
 /**
  * Validate the wiring **eagerly** (like `ContentPlugin`'s registry and
- * `I18nServerPlugin`'s locales): an empty provider list, or a provider
- * declaring no models, is a misconfiguration that should fail at construction —
- * before boot — rather than on the first chat message, where it is most
- * expensive to diagnose.
+ * `I18nServerPlugin`'s locales): a provider declaring no models, or an enabled
+ * copilot with no provider at all, is a misconfiguration that should fail at
+ * construction — before boot — rather than on the first chat message, where it
+ * is most expensive to diagnose.
+ *
+ * **The empty list is only a misconfiguration when the copilot is on.** A
+ * deployment that has not set `enabled` mounts no controllers and can serve no
+ * run, so it needs no backend — and that is the ordinary state of a fresh
+ * checkout, which configures no keys. There is no scripted offline adapter to
+ * fall back on: the fake provider is a private test fixture, so a host with no
+ * keys registers nothing rather than registering something that answers every
+ * question with a canned sentence.
  *
  * Name uniqueness is enforced by `buildModelRegistry`, which the module builds
  * from the same list.
  */
 function assertOptions(options) {
     const names = options.providers.map((entry) => entry.name);
-    if (names.length === 0) {
-        throw new Error('CopilotPlugin requires at least one model provider. Register one at the composition root, ' +
-            "e.g. `providers: [{ name: 'fake', provider: createFakeProvider() }]`.");
+    if (names.length === 0 && options.config.enabled) {
+        throw new Error('CopilotPlugin is enabled but has no model provider. Configure a backend and register it at ' +
+            "the composition root, e.g. `providers: [{ name: 'claude', provider: createAnthropicProvider(…) }]` " +
+            '— or leave the copilot off.');
     }
     for (const entry of options.providers) {
         if (entry.provider.models().length === 0) {
@@ -59,13 +68,16 @@ function assertOptions(options) {
  * engine, the capability profile, and the transcript tables this plugin now
  * owns and migrates.
  *
+ * Each entry is a backend this deployment actually configured. An enabled
+ * copilot needs at least one; a disabled one needs none, and a checkout with no
+ * keys registers none.
+ *
  * @example
  * ```typescript
  * CopilotPlugin({
  *     providers: [
  *         { name: 'claude', provider: createAnthropicProvider(providers.claude) },
- *         { name: 'ollama', provider: createOpenAiProvider(providers.ollama) },
- *         { name: 'fake', provider: createFakeProvider() }
+ *         { name: 'ollama', provider: createOpenAiProvider(providers.ollama) }
  *     ],
  *     config: config.plugins.copilot
  * });

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@orthacms/copilot-server",
-    "version": "0.4.2",
+    "version": "0.5.0",
     "description": "@orthacms/copilot-server — part of Ortha CMS.",
     "license": "MIT",
     "homepage": "https://github.com/ortha-source/ortha-cms/tree/main/packages/copilot/server",
@@ -28,12 +28,12 @@
     "dependencies": {
         "@nestjs/common": "^11.0.0",
         "@nestjs/swagger": "^11.4.6",
-        "@orthacms/bootstrap-server": "^0.4.2",
-        "@orthacms/copilot-domain": "^0.4.2",
-        "@orthacms/database": "^0.4.2",
-        "@orthacms/identity-server": "^0.4.2",
-        "@orthacms/tools-server": "^0.4.2",
-        "@orthacms/workspaces-server": "^0.4.2",
+        "@orthacms/bootstrap-server": "^0.5.0",
+        "@orthacms/copilot-domain": "^0.5.0",
+        "@orthacms/database": "^0.5.0",
+        "@orthacms/identity-server": "^0.5.0",
+        "@orthacms/tools-server": "^0.5.0",
+        "@orthacms/workspaces-server": "^0.5.0",
         "class-transformer": "^0.5.1",
         "class-validator": "^0.15.1",
         "drizzle-orm": "^0.45.0",