happy2 0.0.12 → 0.0.14

package/packages/happy2-server/dist/modules/agent/agentImageList.d.ts

@@ -1,8 +1,8 @@
 import { type AgentImageSummary } from "../chat/types.js";
 import { type DrizzleExecutor } from "../drizzle.js";
 /**
- * Lists agent images in creation order and the optional configured default after requiring server-administrator access.
- * Reading settings and definitions as one response gives management clients the exact selection context without exposing internal images.
+ * Lists agent images and the configured default to a caller allowed to manage images, assign them to chats, or select a runtime for plugin installation.
+ * Reading summaries as one response gives each authorized selection surface exact context without granting image mutation authority.
  */
 export declare function agentImageList(executor: DrizzleExecutor, actorUserId: string): Promise<{
     defaultImageId?: string;

package/packages/happy2-server/dist/modules/agent/agentImageList.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agentImageList.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentImageList.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAOrD;;;GAGG;AACH,wBAAsB,cAAc,CAChC,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC;IACP,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,iBAAiB,EAAE,CAAC;CAC/B,CAAC,CAuBD"}
+{"version":3,"file":"agentImageList.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentImageList.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAOrD;;;GAGG;AACH,wBAAsB,cAAc,CAChC,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC;IACP,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,iBAAiB,EAAE,CAAC;CAC/B,CAAC,CA2BD"}

package/packages/happy2-server/dist/modules/agent/agentImageList.js

@@ -4,13 +4,17 @@ import { agentImageSelection } from "./impl/agentImageSelection.js";
 import { agentImages, agentImageSettings } from "../schema.js";
 import { asAgentImage } from "./impl/asAgentImage.js";
 import { eq } from "drizzle-orm";
-import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+import { userRequireAnyPermission } from "../permission/userRequireAnyPermission.js";
 /**
- * Lists agent images in creation order and the optional configured default after requiring server-administrator access.
- * Reading settings and definitions as one response gives management clients the exact selection context without exposing internal images.
+ * Lists agent images and the configured default to a caller allowed to manage images, assign them to chats, or select a runtime for plugin installation.
+ * Reading summaries as one response gives each authorized selection surface exact context without granting image mutation authority.
  */
 export async function agentImageList(executor, actorUserId) {
-    await userRequireServerAdmin(executor, actorUserId);
+    await userRequireAnyPermission(executor, actorUserId, [
+        "manageImages",
+        "assignImagesToChats",
+        "managePlugins",
+    ]);
     const [settings, images] = await Promise.all([
         executor
             .select({

package/packages/happy2-server/dist/modules/agent/agentImageList.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentImageList.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentImageList.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAwB,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,QAAyB,EACzB,WAAmB;IAKnB,MAAM,sBAAsB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzC,QAAQ;aACH,MAAM,CAAC;YACJ,cAAc,EAAE,kBAAkB,CAAC,cAAc;SACpD,CAAC;aACD,IAAI,CAAC,kBAAkB,CAAC;aACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;aACnC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,QAAQ;aACH,MAAM,CAAC,mBAAmB,CAAC;aAC3B,IAAI,CAAC,WAAW,CAAC;aACjB,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;IACH,OAAO;QACH,GAAG,CAAC,QAAQ,EAAE,cAAc;YACxB,CAAC,CAAC;gBACI,cAAc,EAAE,QAAQ,CAAC,cAAc;aAC1C;YACH,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;KACnC,CAAC;AACN,CAAC"}
+{"version":3,"file":"agentImageList.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentImageList.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAwB,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,QAAyB,EACzB,WAAmB;IAKnB,MAAM,wBAAwB,CAAC,QAAQ,EAAE,WAAW,EAAE;QAClD,cAAc;QACd,qBAAqB;QACrB,eAAe;KAClB,CAAC,CAAC;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzC,QAAQ;aACH,MAAM,CAAC;YACJ,cAAc,EAAE,kBAAkB,CAAC,cAAc;SACpD,CAAC;aACD,IAAI,CAAC,kBAAkB,CAAC;aACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;aACnC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,QAAQ;aACH,MAAM,CAAC,mBAAmB,CAAC;aAC3B,IAAI,CAAC,WAAW,CAAC;aACjB,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;IACH,OAAO;QACH,GAAG,CAAC,QAAQ,EAAE,cAAc;YACxB,CAAC,CAAC;gBACI,cAAc,EAAE,QAAQ,CAAC,cAAc;aAC1C;YACH,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;KACnC,CAAC;AACN,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentImageRequestBuild.d.ts

@@ -1,7 +1,7 @@
 import { type AgentImageSummary, type MutationHint } from "../chat/types.js";
 import { type DrizzleExecutor } from "../drizzle.js";
 /**
- * Queues an administrator-selected agentImages definition for a fresh build and resets its prior terminal output.
+ * Queues a manageImages-authorized agentImages definition for a fresh build and resets its prior terminal output.
  * Recording the lifecycle transition with its audit and sync evidence gives workers and clients one authoritative build request.
  */
 export declare function agentImageRequestBuild(executor: DrizzleExecutor, input: {

package/packages/happy2-server/dist/modules/agent/agentImageRequestBuild.js

@@ -8,14 +8,14 @@ import { asAgentImage } from "./impl/asAgentImage.js";
 import { chatAppendAudit } from "../chat/chatAppendAudit.js";
 import { syncEventInsert } from "../sync/syncEventInsert.js";
 import { syncSequenceNext } from "../sync/syncSequenceNext.js";
-import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+import { userRequirePermission } from "../permission/userRequirePermission.js";
 /**
- * Queues an administrator-selected agentImages definition for a fresh build and resets its prior terminal output.
+ * Queues a manageImages-authorized agentImages definition for a fresh build and resets its prior terminal output.
  * Recording the lifecycle transition with its audit and sync evidence gives workers and clients one authoritative build request.
  */
 export async function agentImageRequestBuild(executor, input) {
     return withTransaction(executor, async (tx) => {
-        await userRequireServerAdmin(tx, input.actorUserId);
+        await userRequirePermission(tx, input.actorUserId, "manageImages");
         const [current] = await tx
             .select({
             status: agentImages.status,

package/packages/happy2-server/dist/modules/agent/agentImageRequestBuild.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentImageRequestBuild.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentImageRequestBuild.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AAEjG,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CACxC,QAAyB,EACzB,KAGC;IAKD,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC;YACJ,MAAM,EAAE,WAAW,CAAC,MAAM;SAC7B,CAAC;aACD,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;aACxC,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,2BAA2B,CAAC,CAAC;QACrF,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;YAC1B,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;QAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;YAC7B,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC;QAChF,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC;YACD,MAAM,EAAE,SAAS;YACjB,aAAa,EAAE,CAAC;YAChB,QAAQ,EAAE,EAAE;YACZ,iBAAiB,EAAE,CAAC;YACpB,gBAAgB,EAAE,IAAI;YACtB,iBAAiB,EAAE,IAAI;YACvB,gBAAgB,EAAE,GAAG,CAAA,mBAAmB;YACxC,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI;YACd,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,GAAG,CAAA,mBAAmB;SACpC,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;aACxC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACnE,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,6BAA6B;YACrC,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,KAAK,CAAC,OAAO;SAC1B,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,KAAK,CAAC,OAAO;YACvB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,OAAO;YACH,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;YACxC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;SAC7B,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"agentImageRequestBuild.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentImageRequestBuild.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AAEjG,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CACxC,QAAyB,EACzB,KAGC;IAKD,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QACnE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC;YACJ,MAAM,EAAE,WAAW,CAAC,MAAM;SAC7B,CAAC;aACD,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;aACxC,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,2BAA2B,CAAC,CAAC;QACrF,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;YAC1B,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;QAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;YAC7B,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC;QAChF,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC;YACD,MAAM,EAAE,SAAS;YACjB,aAAa,EAAE,CAAC;YAChB,QAAQ,EAAE,EAAE;YACZ,iBAAiB,EAAE,CAAC;YACpB,gBAAgB,EAAE,IAAI;YACtB,iBAAiB,EAAE,IAAI;YACvB,gBAAgB,EAAE,GAAG,CAAA,mBAAmB;YACxC,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI;YACd,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,GAAG,CAAA,mBAAmB;SACpC,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;aACxC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACnE,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,6BAA6B;YACrC,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,KAAK,CAAC,OAAO;SAC1B,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,KAAK,CAAC,OAAO;YACvB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,OAAO;YACH,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;YACxC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;SAC7B,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentImageSetDefault.d.ts

@@ -1,7 +1,7 @@
 import { type AgentImageSummary, type MutationHint } from "../chat/types.js";
 import { type DrizzleExecutor } from "../drizzle.js";
 /**
- * Selects a ready image in agentImageSettings as the server default after administrator authorization.
+ * Selects a ready image in agentImageSettings as the server default after manageImages authorization.
  * Coupling the setting with sync and audit records prevents clients from seeing an unexplained default-image change.
  */
 export declare function agentImageSetDefault(executor: DrizzleExecutor, input: {

package/packages/happy2-server/dist/modules/agent/agentImageSetDefault.js

@@ -8,14 +8,14 @@ import { asAgentImage } from "./impl/asAgentImage.js";
 import { chatAppendAudit } from "../chat/chatAppendAudit.js";
 import { syncEventInsert } from "../sync/syncEventInsert.js";
 import { syncSequenceNext } from "../sync/syncSequenceNext.js";
-import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+import { userRequirePermission } from "../permission/userRequirePermission.js";
 /**
- * Selects a ready image in agentImageSettings as the server default after administrator authorization.
+ * Selects a ready image in agentImageSettings as the server default after manageImages authorization.
  * Coupling the setting with sync and audit records prevents clients from seeing an unexplained default-image change.
  */
 export async function agentImageSetDefault(executor, input) {
     return withTransaction(executor, async (tx) => {
-        await userRequireServerAdmin(tx, input.actorUserId);
+        await userRequirePermission(tx, input.actorUserId, "manageImages");
         const [image] = await tx
             .select(agentImageSelection)
             .from(agentImages)

package/packages/happy2-server/dist/modules/agent/agentImageSetDefault.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentImageSetDefault.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentImageSetDefault.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AAEjG,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,QAAyB,EACzB,KAGC;IAKD,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,mBAAmB,CAAC;aAC3B,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;aACxC,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,2BAA2B,CAAC,CAAC;QACnF,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe;YAClD,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,6CAA6C,CAAC,CAAC;QAC5F,MAAM,EAAE;aACH,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACD,cAAc,EAAE,KAAK,CAAC,OAAO;YAC7B,eAAe,EAAE,KAAK,CAAC,WAAW;YAClC,SAAS,EAAE,GAAG,CAAA,mBAAmB;SACpC,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,8BAA8B;YACtC,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,KAAK,CAAC,OAAO;SAC1B,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,4BAA4B;YAClC,QAAQ,EAAE,KAAK,CAAC,OAAO;YACvB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,OAAO;YACH,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;YACxC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;SAC7B,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"agentImageSetDefault.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentImageSetDefault.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AAEjG,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,QAAyB,EACzB,KAGC;IAKD,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QACnE,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,mBAAmB,CAAC;aAC3B,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;aACxC,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,2BAA2B,CAAC,CAAC;QACnF,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe;YAClD,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,6CAA6C,CAAC,CAAC;QAC5F,MAAM,EAAE;aACH,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACD,cAAc,EAAE,KAAK,CAAC,OAAO;YAC7B,eAAe,EAAE,KAAK,CAAC,WAAW;YAClC,SAAS,EAAE,GAAG,CAAA,mBAAmB;SACpC,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,8BAA8B;YACtC,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,KAAK,CAAC,OAAO;SAC1B,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,4BAA4B;YAClC,QAAQ,EAAE,KAAK,CAAC,OAAO;YACvB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,OAAO;YACH,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;YACxC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;SAC7B,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretAssignmentDelete.d.ts

@@ -1,7 +1,7 @@
 import { type DrizzleExecutor } from "../drizzle.js";
 import { type MutationHint } from "../chat/types.js";
 /**
- * Removes every agentSecretAgentAssignments or agentSecretChannelAssignments row identified by an administrator-owned assignment.
+ * Removes all agentSecretAgentAssignments and agentSecretChannelAssignments for one secret after requiring manageSecrets permission.
  * Deleting the assignment alongside sync and audit evidence makes secret access disappear as one reviewable authorization change.
  */
 export declare function agentSecretAssignmentDelete(executor: DrizzleExecutor, input: {

package/packages/happy2-server/dist/modules/agent/agentSecretAssignmentDelete.js

@@ -6,14 +6,14 @@ import { eq } from "drizzle-orm";
 import { chatAppendAudit } from "../chat/chatAppendAudit.js";
 import { syncEventInsert } from "../sync/syncEventInsert.js";
 import { syncSequenceNext } from "../sync/syncSequenceNext.js";
-import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+import { userRequirePermission } from "../permission/userRequirePermission.js";
 /**
- * Removes every agentSecretAgentAssignments or agentSecretChannelAssignments row identified by an administrator-owned assignment.
+ * Removes all agentSecretAgentAssignments and agentSecretChannelAssignments for one secret after requiring manageSecrets permission.
  * Deleting the assignment alongside sync and audit evidence makes secret access disappear as one reviewable authorization change.
  */
 export async function agentSecretAssignmentDelete(executor, input) {
     return withTransaction(executor, async (tx) => {
-        await userRequireServerAdmin(tx, input.actorUserId);
+        await userRequirePermission(tx, input.actorUserId, "manageSecrets");
         await tx
             .delete(agentSecretAgentAssignments)
             .where(eq(agentSecretAgentAssignments.secretId, input.secretId));

package/packages/happy2-server/dist/modules/agent/agentSecretAssignmentDelete.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentSecretAssignmentDelete.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAssignmentDelete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAqB,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAC;AAE1F,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC7C,QAAyB,EACzB,KAGC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,EAAE;aACH,MAAM,CAAC,2BAA2B,CAAC;aACnC,KAAK,CAAC,EAAE,CAAC,2BAA2B,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrE,MAAM,EAAE;aACH,MAAM,CAAC,6BAA6B,CAAC;aACrC,KAAK,CAAC,EAAE,CAAC,6BAA6B,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,sBAAsB;YAC9B,UAAU,EAAE,cAAc;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;SAC3B,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"agentSecretAssignmentDelete.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAssignmentDelete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAqB,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAC;AAE1F,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC7C,QAAyB,EACzB,KAGC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QACpE,MAAM,EAAE;aACH,MAAM,CAAC,2BAA2B,CAAC;aACnC,KAAK,CAAC,EAAE,CAAC,2BAA2B,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrE,MAAM,EAAE;aACH,MAAM,CAAC,6BAA6B,CAAC;aACrC,KAAK,CAAC,EAAE,CAAC,6BAA6B,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,sBAAsB;YAC9B,UAAU,EAAE,cAAc;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;SAC3B,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretAssignmentList.d.ts

@@ -1,7 +1,7 @@
 import { type AgentSecretAssignment } from "./impl/agentSecretAssignment.js";
 import { type DrizzleExecutor } from "../drizzle.js";
 /**
- * Groups all direct-agent and channel secret assignments by secret identifier for an active server administrator.
+ * Groups secret assignments for a caller allowed to manage secrets or assign them to agents and channels.
  * Sorting both source rows and the merged result gives management clients stable agent and channel membership lists for each secret.
  */
 export declare function agentSecretAssignmentList(executor: DrizzleExecutor, actorUserId: string): Promise<AgentSecretAssignment[]>;

package/packages/happy2-server/dist/modules/agent/agentSecretAssignmentList.js

@@ -1,13 +1,13 @@
 import {} from "./impl/agentSecretAssignment.js";
 import {} from "../drizzle.js";
 import { agentSecretAgentAssignments, agentSecretChannelAssignments } from "../schema.js";
-import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+import { userRequireAnyPermission } from "../permission/userRequireAnyPermission.js";
 /**
- * Groups all direct-agent and channel secret assignments by secret identifier for an active server administrator.
+ * Groups secret assignments for a caller allowed to manage secrets or assign them to agents and channels.
  * Sorting both source rows and the merged result gives management clients stable agent and channel membership lists for each secret.
  */
 export async function agentSecretAssignmentList(executor, actorUserId) {
-    await userRequireServerAdmin(executor, actorUserId);
+    await userRequireAnyPermission(executor, actorUserId, ["manageSecrets", "assignSecrets"]);
     const [agentRows, channelRows] = await Promise.all([
         executor
             .select({

package/packages/happy2-server/dist/modules/agent/agentSecretAssignmentList.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentSecretAssignmentList.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAssignmentList.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAwB,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAC;AAE1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC3C,QAAyB,EACzB,WAAmB;IAEnB,MAAM,sBAAsB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/C,QAAQ;aACH,MAAM,CAAC;YACJ,QAAQ,EAAE,2BAA2B,CAAC,QAAQ;YAC9C,WAAW,EAAE,2BAA2B,CAAC,WAAW;SACvD,CAAC;aACD,IAAI,CAAC,2BAA2B,CAAC;aACjC,OAAO,CAAC,2BAA2B,CAAC,QAAQ,EAAE,2BAA2B,CAAC,WAAW,CAAC;QAC3F,QAAQ;aACH,MAAM,CAAC;YACJ,QAAQ,EAAE,6BAA6B,CAAC,QAAQ;YAChD,SAAS,EAAE,6BAA6B,CAAC,MAAM;SAClD,CAAC;aACD,IAAI,CAAC,6BAA6B,CAAC;aACnC,OAAO,CAAC,6BAA6B,CAAC,QAAQ,EAAE,6BAA6B,CAAC,MAAM,CAAC;KAC7F,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAAiC,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC,QAAgB,EAAE,EAAE;QAC7B,IAAI,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,UAAU,GAAG;gBACT,QAAQ;gBACR,YAAY,EAAE,EAAE;gBAChB,UAAU,EAAE,EAAE;aACjB,CAAC;YACF,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,UAAU,CAAC;IACtB,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,SAAS;QAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClF,KAAK,MAAM,GAAG,IAAI,WAAW;QAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAClD,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC9C,CAAC;AACN,CAAC"}
+{"version":3,"file":"agentSecretAssignmentList.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAssignmentList.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAwB,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAC;AAE1F,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC3C,QAAyB,EACzB,WAAmB;IAEnB,MAAM,wBAAwB,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;IAC1F,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/C,QAAQ;aACH,MAAM,CAAC;YACJ,QAAQ,EAAE,2BAA2B,CAAC,QAAQ;YAC9C,WAAW,EAAE,2BAA2B,CAAC,WAAW;SACvD,CAAC;aACD,IAAI,CAAC,2BAA2B,CAAC;aACjC,OAAO,CAAC,2BAA2B,CAAC,QAAQ,EAAE,2BAA2B,CAAC,WAAW,CAAC;QAC3F,QAAQ;aACH,MAAM,CAAC;YACJ,QAAQ,EAAE,6BAA6B,CAAC,QAAQ;YAChD,SAAS,EAAE,6BAA6B,CAAC,MAAM;SAClD,CAAC;aACD,IAAI,CAAC,6BAA6B,CAAC;aACnC,OAAO,CAAC,6BAA6B,CAAC,QAAQ,EAAE,6BAA6B,CAAC,MAAM,CAAC;KAC7F,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAAiC,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC,QAAgB,EAAE,EAAE;QAC7B,IAAI,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,UAAU,GAAG;gBACT,QAAQ;gBACR,YAAY,EAAE,EAAE;gBAChB,UAAU,EAAE,EAAE;aACjB,CAAC;YACF,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,UAAU,CAAC;IACtB,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,SAAS;QAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClF,KAAK,MAAM,GAAG,IAAI,WAAW;QAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAClD,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC9C,CAAC;AACN,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToAgent.d.ts

@@ -1,7 +1,7 @@
 import { type MutationHint } from "../chat/types.js";
 import { type DrizzleExecutor } from "../drizzle.js";
 /**
- * Grants an agent access to a secret by inserting the unique agentSecretAgentAssignments relationship after administrator checks.
+ * Grants an agent access by inserting agentSecretAgentAssignments after requiring assignSecrets permission.
  * Keeping the grant, audit entry, and sync event together prevents silent expansion of an agent's runtime credentials.
  */
 export declare function agentSecretAttachToAgent(executor: DrizzleExecutor, input: {

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToAgent.js

@@ -6,14 +6,14 @@ import { areaHint } from "../chat/areaHint.js";
 import { chatAppendAudit } from "../chat/chatAppendAudit.js";
 import { syncEventInsert } from "../sync/syncEventInsert.js";
 import { syncSequenceNext } from "../sync/syncSequenceNext.js";
-import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+import { userRequirePermission } from "../permission/userRequirePermission.js";
 /**
- * Grants an agent access to a secret by inserting the unique agentSecretAgentAssignments relationship after administrator checks.
+ * Grants an agent access by inserting agentSecretAgentAssignments after requiring assignSecrets permission.
  * Keeping the grant, audit entry, and sync event together prevents silent expansion of an agent's runtime credentials.
  */
 export async function agentSecretAttachToAgent(executor, input) {
     return withTransaction(executor, async (tx) => {
-        await userRequireServerAdmin(tx, input.actorUserId);
+        await userRequirePermission(tx, input.actorUserId, "assignSecrets");
         const [agent] = await tx
             .select({
             id: users.id,

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToAgent.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentSecretAttachToAgent.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAttachToAgent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC1C,QAAyB,EACzB,KAIC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC;YACJ,EAAE,EAAE,KAAK,CAAC,EAAE;SACf,CAAC;aACD,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CACF,GAAG,CACC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,EAC/B,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EACvB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAC1B,CACJ;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,2BAA2B,CAAC;aACnC,MAAM,CAAC;YACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,KAAK,CAAC,WAAW;SACrC,CAAC;aACD,mBAAmB,EAAE;aACrB,SAAS,CAAC;YACP,QAAQ,EAAE,2BAA2B,CAAC,QAAQ;SACjD,CAAC,CAAC;QACP,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,6BAA6B;YACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,gCAAgC;YACxC,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,KAAK,EAAE;gBACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;aAC3B;SACJ,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"agentSecretAttachToAgent.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAttachToAgent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC1C,QAAyB,EACzB,KAIC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC;YACJ,EAAE,EAAE,KAAK,CAAC,EAAE;SACf,CAAC;aACD,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CACF,GAAG,CACC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,EAC/B,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EACvB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAC1B,CACJ;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,2BAA2B,CAAC;aACnC,MAAM,CAAC;YACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,KAAK,CAAC,WAAW;SACrC,CAAC;aACD,mBAAmB,EAAE;aACrB,SAAS,CAAC;YACP,QAAQ,EAAE,2BAA2B,CAAC,QAAQ;SACjD,CAAC,CAAC;QACP,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,6BAA6B;YACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,gCAAgC;YACxC,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,KAAK,EAAE;gBACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;aAC3B;SACJ,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToChannel.d.ts

@@ -1,7 +1,7 @@
 import { type MutationHint } from "../chat/types.js";
 import { type DrizzleExecutor } from "../drizzle.js";
 /**
- * Grants a secret identifier to an existing channel through agentSecretChannelAssignments after validating server-administrator authority and channel eligibility.
+ * Grants a secret to an eligible channel through agentSecretChannelAssignments after requiring assignSecrets permission.
  * The assignment, audit entry, and sync event commit together so the resulting credential exposure is never silent or partially reported.
  */
 export declare function agentSecretAttachToChannel(executor: DrizzleExecutor, input: {

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToChannel.js

@@ -6,14 +6,14 @@ import { areaHint } from "../chat/areaHint.js";
 import { chatAppendAudit } from "../chat/chatAppendAudit.js";
 import { syncEventInsert } from "../sync/syncEventInsert.js";
 import { syncSequenceNext } from "../sync/syncSequenceNext.js";
-import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+import { userRequirePermission } from "../permission/userRequirePermission.js";
 /**
- * Grants a secret identifier to an existing channel through agentSecretChannelAssignments after validating server-administrator authority and channel eligibility.
+ * Grants a secret to an eligible channel through agentSecretChannelAssignments after requiring assignSecrets permission.
  * The assignment, audit entry, and sync event commit together so the resulting credential exposure is never silent or partially reported.
  */
 export async function agentSecretAttachToChannel(executor, input) {
     return withTransaction(executor, async (tx) => {
-        await userRequireServerAdmin(tx, input.actorUserId);
+        await userRequirePermission(tx, input.actorUserId, "assignSecrets");
         const [channel] = await tx
             .select({
             id: chats.id,

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToChannel.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentSecretAttachToChannel.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAttachToChannel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,6BAA6B,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC5C,QAAyB,EACzB,KAIC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC;YACJ,EAAE,EAAE,KAAK,CAAC,EAAE;SACf,CAAC;aACD,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CACF,GAAG,CACC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,EAC7B,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC,EAC1D,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAC1B,CACJ;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,6BAA6B,CAAC;aACrC,MAAM,CAAC;YACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,SAAS;YACvB,eAAe,EAAE,KAAK,CAAC,WAAW;SACrC,CAAC;aACD,mBAAmB,EAAE;aACrB,SAAS,CAAC;YACP,QAAQ,EAAE,6BAA6B,CAAC,QAAQ;SACnD,CAAC,CAAC;QACP,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,+BAA+B;YACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,kCAAkC;YAC1C,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,MAAM,EAAE,KAAK,CAAC,SAAS;YACvB,KAAK,EAAE;gBACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;aAC3B;SACJ,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"agentSecretAttachToChannel.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAttachToChannel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,6BAA6B,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC5C,QAAyB,EACzB,KAIC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QACpE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC;YACJ,EAAE,EAAE,KAAK,CAAC,EAAE;SACf,CAAC;aACD,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CACF,GAAG,CACC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,EAC7B,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC,EAC1D,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAC1B,CACJ;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,6BAA6B,CAAC;aACrC,MAAM,CAAC;YACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,SAAS;YACvB,eAAe,EAAE,KAAK,CAAC,WAAW;SACrC,CAAC;aACD,mBAAmB,EAAE;aACrB,SAAS,CAAC;YACP,QAAQ,EAAE,6BAA6B,CAAC,QAAQ;SACnD,CAAC,CAAC;QACP,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,+BAA+B;YACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,kCAAkC;YAC1C,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,MAAM,EAAE,KAAK,CAAC,SAAS;YACvB,KAAK,EAAE;gBACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;aAC3B;SACJ,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretAuthorizeManagement.d.ts

@@ -1,7 +1,8 @@
 import { type DrizzleExecutor } from "../drizzle.js";
+import type { Permission } from "../permission/types.js";
 /**
- * Requires the actor to have an active profile and server-administrator role before any agent-secret management operation proceeds.
- * A shared authorization entry point keeps secret assignment routes from drifting to weaker account or profile checks.
+ * Requires the actor's requested secret-management capability before any external Rig secret operation proceeds.
+ * A shared authorization entry point keeps non-database secret lifecycle work aligned with the same grants enforced by durable actions.
  */
-export declare function agentSecretAuthorizeManagement(executor: DrizzleExecutor, actorUserId: string): Promise<void>;
+export declare function agentSecretAuthorizeManagement(executor: DrizzleExecutor, actorUserId: string, permission: Extract<Permission, "manageSecrets" | "assignSecrets">): Promise<void>;
 //# sourceMappingURL=agentSecretAuthorizeManagement.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentSecretAuthorizeManagement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agentSecretAuthorizeManagement.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAuthorizeManagement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;GAGG;AACH,wBAAsB,8BAA8B,CAChD,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAEf"}
+{"version":3,"file":"agentSecretAuthorizeManagement.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAuthorizeManagement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD;;;GAGG;AACH,wBAAsB,8BAA8B,CAChD,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,eAAe,GAAG,eAAe,CAAC,GACnE,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/packages/happy2-server/dist/modules/agent/agentSecretAuthorizeManagement.js

@@ -1,10 +1,10 @@
 import {} from "../drizzle.js";
-import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+import { userRequirePermission } from "../permission/userRequirePermission.js";
 /**
- * Requires the actor to have an active profile and server-administrator role before any agent-secret management operation proceeds.
- * A shared authorization entry point keeps secret assignment routes from drifting to weaker account or profile checks.
+ * Requires the actor's requested secret-management capability before any external Rig secret operation proceeds.
+ * A shared authorization entry point keeps non-database secret lifecycle work aligned with the same grants enforced by durable actions.
  */
-export async function agentSecretAuthorizeManagement(executor, actorUserId) {
-    await userRequireServerAdmin(executor, actorUserId);
+export async function agentSecretAuthorizeManagement(executor, actorUserId, permission) {
+    await userRequirePermission(executor, actorUserId, permission);
 }
 //# sourceMappingURL=agentSecretAuthorizeManagement.js.map

package/packages/happy2-server/dist/modules/agent/agentSecretAuthorizeManagement.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentSecretAuthorizeManagement.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAuthorizeManagement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAChD,QAAyB,EACzB,WAAmB;IAEnB,MAAM,sBAAsB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"agentSecretAuthorizeManagement.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAuthorizeManagement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAChD,QAAyB,EACzB,WAAmB,EACnB,UAAkE;IAElE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AACnE,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretDetachFromAgent.d.ts

@@ -1,7 +1,7 @@
 import { type DrizzleExecutor } from "../drizzle.js";
 import { type MutationHint } from "../chat/types.js";
 /**
- * Revokes a direct agent secret grant by deleting its agentSecretAgentAssignments row under administrator authorization.
+ * Revokes a direct grant by deleting agentSecretAgentAssignments after requiring assignSecrets permission.
  * Publishing revocation and audit evidence in the same commit ensures future runs cannot retain a grant clients still believe exists.
  */
 export declare function agentSecretDetachFromAgent(executor: DrizzleExecutor, input: {

package/packages/happy2-server/dist/modules/agent/agentSecretDetachFromAgent.js

@@ -6,14 +6,14 @@ import { areaHint } from "../chat/areaHint.js";
 import { chatAppendAudit } from "../chat/chatAppendAudit.js";
 import { syncEventInsert } from "../sync/syncEventInsert.js";
 import { syncSequenceNext } from "../sync/syncSequenceNext.js";
-import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+import { userRequirePermission } from "../permission/userRequirePermission.js";
 /**
- * Revokes a direct agent secret grant by deleting its agentSecretAgentAssignments row under administrator authorization.
+ * Revokes a direct grant by deleting agentSecretAgentAssignments after requiring assignSecrets permission.
  * Publishing revocation and audit evidence in the same commit ensures future runs cannot retain a grant clients still believe exists.
  */
 export async function agentSecretDetachFromAgent(executor, input) {
     return withTransaction(executor, async (tx) => {
-        await userRequireServerAdmin(tx, input.actorUserId);
+        await userRequirePermission(tx, input.actorUserId, "assignSecrets");
         const removed = await tx
             .delete(agentSecretAgentAssignments)
             .where(and(eq(agentSecretAgentAssignments.secretId, input.secretId), eq(agentSecretAgentAssignments.agentUserId, input.agentUserId)))

package/packages/happy2-server/dist/modules/agent/agentSecretDetachFromAgent.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentSecretDetachFromAgent.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretDetachFromAgent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAqB,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC5C,QAAyB,EACzB,KAIC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,2BAA2B,CAAC;aACnC,KAAK,CACF,GAAG,CACC,EAAE,CAAC,2BAA2B,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EACxD,EAAE,CAAC,2BAA2B,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CACjE,CACJ;aACA,SAAS,CAAC;YACP,QAAQ,EAAE,2BAA2B,CAAC,QAAQ;SACjD,CAAC,CAAC;QACP,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,+BAA+B;YACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,kCAAkC;YAC1C,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,KAAK,EAAE;gBACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;aAC3B;SACJ,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"agentSecretDetachFromAgent.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretDetachFromAgent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAqB,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC5C,QAAyB,EACzB,KAIC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,2BAA2B,CAAC;aACnC,KAAK,CACF,GAAG,CACC,EAAE,CAAC,2BAA2B,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EACxD,EAAE,CAAC,2BAA2B,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CACjE,CACJ;aACA,SAAS,CAAC;YACP,QAAQ,EAAE,2BAA2B,CAAC,QAAQ;SACjD,CAAC,CAAC;QACP,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,+BAA+B;YACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,kCAAkC;YAC1C,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,KAAK,EAAE;gBACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;aAC3B;SACJ,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretDetachFromChannel.d.ts

@@ -1,8 +1,8 @@
 import { type DrizzleExecutor } from "../drizzle.js";
 import { type MutationHint } from "../chat/types.js";
 /**
- * Revokes a channel's secret grant by removing the selected agentSecretChannelAssignments relationship after authorization.
- * The shared audit and sync transition makes the loss of runtime access immediate and attributable to its administrator.
+ * Revokes a channel grant from agentSecretChannelAssignments after requiring assignSecrets permission.
+ * The shared audit and sync transition makes the loss of runtime access immediate and attributable.
  */
 export declare function agentSecretDetachFromChannel(executor: DrizzleExecutor, input: {
     actorUserId: string;

package/packages/happy2-server/dist/modules/agent/agentSecretDetachFromChannel.js

@@ -6,14 +6,14 @@ import { areaHint } from "../chat/areaHint.js";
 import { chatAppendAudit } from "../chat/chatAppendAudit.js";
 import { syncEventInsert } from "../sync/syncEventInsert.js";
 import { syncSequenceNext } from "../sync/syncSequenceNext.js";
-import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+import { userRequirePermission } from "../permission/userRequirePermission.js";
 /**
- * Revokes a channel's secret grant by removing the selected agentSecretChannelAssignments relationship after authorization.
- * The shared audit and sync transition makes the loss of runtime access immediate and attributable to its administrator.
+ * Revokes a channel grant from agentSecretChannelAssignments after requiring assignSecrets permission.
+ * The shared audit and sync transition makes the loss of runtime access immediate and attributable.
  */
 export async function agentSecretDetachFromChannel(executor, input) {
     return withTransaction(executor, async (tx) => {
-        await userRequireServerAdmin(tx, input.actorUserId);
+        await userRequirePermission(tx, input.actorUserId, "assignSecrets");
         const removed = await tx
             .delete(agentSecretChannelAssignments)
             .where(and(eq(agentSecretChannelAssignments.secretId, input.secretId), eq(agentSecretChannelAssignments.chatId, input.channelId)))

package/packages/happy2-server/dist/modules/agent/agentSecretDetachFromChannel.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentSecretDetachFromChannel.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretDetachFromChannel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAqB,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAC9C,QAAyB,EACzB,KAIC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,6BAA6B,CAAC;aACrC,KAAK,CACF,GAAG,CACC,EAAE,CAAC,6BAA6B,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAC1D,EAAE,CAAC,6BAA6B,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAC5D,CACJ;aACA,SAAS,CAAC;YACP,QAAQ,EAAE,6BAA6B,CAAC,QAAQ;SACnD,CAAC,CAAC;QACP,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,iCAAiC;YACvC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,oCAAoC;YAC5C,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,MAAM,EAAE,KAAK,CAAC,SAAS;YACvB,KAAK,EAAE;gBACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;aAC3B;SACJ,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"agentSecretDetachFromChannel.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretDetachFromChannel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAqB,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAC9C,QAAyB,EACzB,KAIC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,6BAA6B,CAAC;aACrC,KAAK,CACF,GAAG,CACC,EAAE,CAAC,6BAA6B,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAC1D,EAAE,CAAC,6BAA6B,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAC5D,CACJ;aACA,SAAS,CAAC;YACP,QAAQ,EAAE,6BAA6B,CAAC,QAAQ;SACnD,CAAC,CAAC;QACP,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,iCAAiC;YACvC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,oCAAoC;YAC5C,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,MAAM,EAAE,KAAK,CAAC,SAAS;YACvB,KAAK,EAAE;gBACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;aAC3B;SACJ,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretRecordRegistration.d.ts

@@ -1,7 +1,7 @@
 import { type DrizzleExecutor } from "../drizzle.js";
 import { type MutationHint } from "../chat/types.js";
 /**
- * Records an administrator-authorized agent-secret registration as a global sync event and audit entry.
+ * Records a manageSecrets-authorized agent-secret registration as a global sync event and audit entry.
  * The transaction keeps both durable records on the same sequence so observers cannot see an unaudited registration signal.
  */
 export declare function agentSecretRecordRegistration(executor: DrizzleExecutor, input: {

package/packages/happy2-server/dist/modules/agent/agentSecretRecordRegistration.js

@@ -4,14 +4,14 @@ import { areaHint } from "../chat/areaHint.js";
 import { chatAppendAudit } from "../chat/chatAppendAudit.js";
 import { syncEventInsert } from "../sync/syncEventInsert.js";
 import { syncSequenceNext } from "../sync/syncSequenceNext.js";
-import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+import { userRequirePermission } from "../permission/userRequirePermission.js";
 /**
- * Records an administrator-authorized agent-secret registration as a global sync event and audit entry.
+ * Records a manageSecrets-authorized agent-secret registration as a global sync event and audit entry.
  * The transaction keeps both durable records on the same sequence so observers cannot see an unaudited registration signal.
  */
 export async function agentSecretRecordRegistration(executor, input) {
     return withTransaction(executor, async (tx) => {
-        await userRequireServerAdmin(tx, input.actorUserId);
+        await userRequirePermission(tx, input.actorUserId, "manageSecrets");
         const sequence = await syncSequenceNext(tx);
         await syncEventInsert(tx, {
             sequence,

package/packages/happy2-server/dist/modules/agent/agentSecretRecordRegistration.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentSecretRecordRegistration.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretRecordRegistration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAqB,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAC/C,QAAyB,EACzB,KAGC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,wBAAwB;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,yBAAyB;YACjC,UAAU,EAAE,cAAc;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;SAC3B,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"agentSecretRecordRegistration.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretRecordRegistration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAqB,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAC/C,QAAyB,EACzB,KAGC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,wBAAwB;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,yBAAyB;YACjC,UAAU,EAAE,cAAc;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;SAC3B,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSkillHomeGet.d.ts

@@ -0,0 +1,4 @@
+import type { DrizzleExecutor } from "../drizzle.js";
+/** Derives one session's host-mounted isolated home from its durable Rig binding cwd and does not mutate durable state. This boundary centralizes the sandbox layout contract used by plugin skill reconciliation. */
+export declare function agentSkillHomeGet(executor: DrizzleExecutor, sessionId: string): Promise<string>;
+//# sourceMappingURL=agentSkillHomeGet.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentSkillHomeGet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSkillHomeGet.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentSkillHomeGet.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD,sNAAsN;AACtN,wBAAsB,iBAAiB,CACnC,QAAQ,EAAE,eAAe,EACzB,SAAS,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAQjB"}

package/packages/happy2-server/dist/modules/agent/agentSkillHomeGet.js

@@ -0,0 +1,15 @@
+import { eq } from "drizzle-orm";
+import { dirname, join } from "node:path";
+import { agentRigBindings } from "../schema.js";
+/** Derives one session's host-mounted isolated home from its durable Rig binding cwd and does not mutate durable state. This boundary centralizes the sandbox layout contract used by plugin skill reconciliation. */
+export async function agentSkillHomeGet(executor, sessionId) {
+    const [binding] = await executor
+        .select({ cwd: agentRigBindings.cwd })
+        .from(agentRigBindings)
+        .where(eq(agentRigBindings.sessionId, sessionId))
+        .limit(1);
+    if (!binding)
+        throw new Error("Agent Rig binding was not found for skill reconciliation");
+    return join(dirname(binding.cwd), "home");
+}
+//# sourceMappingURL=agentSkillHomeGet.js.map

package/packages/happy2-server/dist/modules/agent/agentSkillHomeGet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSkillHomeGet.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSkillHomeGet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,sNAAsN;AACtN,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACnC,QAAyB,EACzB,SAAiB;IAEjB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,QAAQ;SAC3B,MAAM,CAAC,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,EAAE,CAAC;SACrC,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;SAChD,KAAK,CAAC,CAAC,CAAC,CAAC;IACd,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC1F,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSkillHomeGet.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=agentSkillHomeGet.test.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentSkillHomeGet.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSkillHomeGet.test.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentSkillHomeGet.test.ts"],"names":[],"mappings":""}

package/packages/happy2-server/dist/modules/agent/agentSkillHomeGet.test.js

@@ -0,0 +1,17 @@
+import { describe, expect, it, vi } from "vitest";
+import { agentSkillHomeGet } from "./agentSkillHomeGet.js";
+function executorWithBinding(binding) {
+    const limit = vi.fn().mockResolvedValue(binding ? [binding] : []);
+    const where = vi.fn(() => ({ limit }));
+    const from = vi.fn(() => ({ where }));
+    return { select: vi.fn(() => ({ from })) };
+}
+describe("agentSkillHomeGet", () => {
+    it("derives the isolated home beside the durable Rig working directory", async () => {
+        await expect(agentSkillHomeGet(executorWithBinding({ cwd: "/sessions/run/worktree" }), "session-1")).resolves.toBe("/sessions/run/home");
+    });
+    it("rejects sessions without a durable Rig binding", async () => {
+        await expect(agentSkillHomeGet(executorWithBinding(undefined), "missing")).rejects.toThrow("Agent Rig binding was not found for skill reconciliation");
+    });
+});
+//# sourceMappingURL=agentSkillHomeGet.test.js.map

package/packages/happy2-server/dist/modules/agent/agentSkillHomeGet.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSkillHomeGet.test.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSkillHomeGet.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,SAAS,mBAAmB,CAAC,OAAoC;IAC7D,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACtC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAgC,CAAC;AAC7E,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,MAAM,CACR,iBAAiB,CAAC,mBAAmB,CAAC,EAAE,GAAG,EAAE,wBAAwB,EAAE,CAAC,EAAE,WAAW,CAAC,CACzF,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACtF,0DAA0D,CAC7D,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentTurnGetPluginContext.d.ts

@@ -0,0 +1,23 @@
+import type { DrizzleExecutor } from "../drizzle.js";
+export interface AgentPluginReferencedUser {
+    id: string;
+    username: string;
+    firstName: string;
+    lastName?: string;
+    kind: "human" | "agent";
+    triggeredTurn: boolean;
+}
+/**
+ * Resolves the exact running agent turn, its triggering sender, and every concrete user mention recorded on that message.
+ * This read-only boundary keeps plugin capabilities tied to durable turn provenance instead of inferring authority from a reusable Rig session.
+ */
+export declare function agentTurnGetPluginContext(executor: DrizzleExecutor, input: {
+    runId: string;
+    sessionId: string;
+}): Promise<{
+    agentUserId: string;
+    chatId: string;
+    triggeredByUserId: string;
+    users: AgentPluginReferencedUser[];
+} | undefined>;
+//# sourceMappingURL=agentTurnGetPluginContext.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentTurnGetPluginContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentTurnGetPluginContext.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentTurnGetPluginContext.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD,MAAM,WAAW,yBAAyB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,aAAa,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC3C,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CACJ;IACI,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,yBAAyB,EAAE,CAAC;CACtC,GACD,SAAS,CACd,CAuEA"}