happy2 0.0.5 → 0.0.11

package/packages/happy2-server/dist/modules/agent/agentImageSetDefault.js

@@ -0,0 +1,55 @@
+import { CollaborationError } from "../chat/types.js";
+import { withTransaction } from "../drizzle.js";
+import { agentImageSelection } from "./impl/agentImageSelection.js";
+import { agentImages, agentImageSettings } from "../schema.js";
+import { eq, sql } from "drizzle-orm";
+import { areaHint } from "../chat/areaHint.js";
+import { asAgentImage } from "./impl/asAgentImage.js";
+import { chatAppendAudit } from "../chat/chatAppendAudit.js";
+import { syncEventInsert } from "../sync/syncEventInsert.js";
+import { syncSequenceNext } from "../sync/syncSequenceNext.js";
+import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+/**
+ * Selects a ready image in agentImageSettings as the server default after administrator authorization.
+ * Coupling the setting with sync and audit records prevents clients from seeing an unexplained default-image change.
+ */
+export async function agentImageSetDefault(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        await userRequireServerAdmin(tx, input.actorUserId);
+        const [image] = await tx
+            .select(agentImageSelection)
+            .from(agentImages)
+            .where(eq(agentImages.id, input.imageId))
+            .limit(1);
+        if (!image)
+            throw new CollaborationError("not_found", "Agent image was not found");
+        if (image.status !== "ready" || !image.docker_image_id)
+            throw new CollaborationError("conflict", "Only a ready agent image can be the default");
+        await tx
+            .update(agentImageSettings)
+            .set({
+            defaultImageId: input.imageId,
+            updatedByUserId: input.actorUserId,
+            updatedAt: sql `CURRENT_TIMESTAMP`,
+        })
+            .where(eq(agentImageSettings.id, 1));
+        await chatAppendAudit(tx, {
+            actorUserId: input.actorUserId,
+            action: "agent_image.default_selected",
+            targetType: "agent_image",
+            targetId: input.imageId,
+        });
+        const sequence = await syncSequenceNext(tx);
+        await syncEventInsert(tx, {
+            sequence,
+            kind: "agentImage.defaultSelected",
+            entityId: input.imageId,
+            actorUserId: input.actorUserId,
+        });
+        return {
+            hint: areaHint(sequence, "agent-images"),
+            image: asAgentImage(image),
+        };
+    });
+}
+//# sourceMappingURL=agentImageSetDefault.js.map

package/packages/happy2-server/dist/modules/agent/agentImageSetDefault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentImageSetDefault.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentImageSetDefault.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AAEjG,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,QAAyB,EACzB,KAGC;IAKD,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,mBAAmB,CAAC;aAC3B,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;aACxC,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,2BAA2B,CAAC,CAAC;QACnF,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe;YAClD,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,6CAA6C,CAAC,CAAC;QAC5F,MAAM,EAAE;aACH,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACD,cAAc,EAAE,KAAK,CAAC,OAAO;YAC7B,eAAe,EAAE,KAAK,CAAC,WAAW;YAClC,SAAS,EAAE,GAAG,CAAA,mBAAmB;SACpC,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,8BAA8B;YACtC,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,KAAK,CAAC,OAAO;SAC1B,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,4BAA4B;YAClC,QAAQ,EAAE,KAAK,CAAC,OAAO;YACvB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,OAAO;YACH,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;YACxC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;SAC7B,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentImageTakeBuild.d.ts

@@ -0,0 +1,14 @@
+import { type AgentImageBuild } from "./impl/agentImageBuild.js";
+import { type DrizzleExecutor } from "../drizzle.js";
+import { type MutationHint } from "../chat/types.js";
+/**
+ * Atomically claims an eligible agentImages build, assigning a lease while retaining progress and logs from an abandoned attempt.
+ * A live competing lease returns retryAt while leaving agentImages unchanged, so restart recovery can requeue the same observable job exactly when it becomes claimable.
+ */
+export declare function agentImageTakeBuild(executor: DrizzleExecutor, imageId: string, workerId: string): Promise<{
+    build: AgentImageBuild;
+    hint: MutationHint;
+} | {
+    retryAt: string;
+} | undefined>;
+//# sourceMappingURL=agentImageTakeBuild.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentImageTakeBuild.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentImageTakeBuild.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentImageTakeBuild.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAQrD;;;GAGG;AACH,wBAAsB,mBAAmB,CACrC,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACjB,OAAO,CACJ;IACI,KAAK,EAAE,eAAe,CAAC;IACvB,IAAI,EAAE,YAAY,CAAC;CACtB,GACD;IACI,OAAO,EAAE,MAAM,CAAC;CACnB,GACD,SAAS,CACd,CA0EA"}

package/packages/happy2-server/dist/modules/agent/agentImageTakeBuild.js

@@ -0,0 +1,77 @@
+import {} from "./impl/agentImageBuild.js";
+import { withTransaction } from "../drizzle.js";
+import {} from "../chat/types.js";
+import { agentImages } from "../schema.js";
+import { and, eq, isNull, lte, or, sql } from "drizzle-orm";
+import { areaHint } from "../chat/areaHint.js";
+import { syncEventInsert } from "../sync/syncEventInsert.js";
+import { syncSequenceNext } from "../sync/syncSequenceNext.js";
+/**
+ * Atomically claims an eligible agentImages build, assigning a lease while retaining progress and logs from an abandoned attempt.
+ * A live competing lease returns retryAt while leaving agentImages unchanged, so restart recovery can requeue the same observable job exactly when it becomes claimable.
+ */
+export async function agentImageTakeBuild(executor, imageId, workerId) {
+    return withTransaction(executor, async (tx) => {
+        const now = new Date().toISOString();
+        const leaseExpiresAt = new Date(Date.now() + 60_000).toISOString();
+        const claimable = or(and(eq(agentImages.status, "pending"), sql `${agentImages.buildRequestedAt} IS NOT NULL`), and(eq(agentImages.status, "building"), or(isNull(agentImages.leaseExpiresAt), lte(agentImages.leaseExpiresAt, now))));
+        const [claimed] = await tx
+            .update(agentImages)
+            .set({
+            status: "building",
+            buildAttempt: sql `${agentImages.buildAttempt} + 1`,
+            buildProgress: sql `CASE WHEN ${agentImages.status} = 'building' THEN ${agentImages.buildProgress} ELSE 1 END`,
+            buildLog: sql `CASE WHEN ${agentImages.status} = 'building' THEN ${agentImages.buildLog} ELSE '' END`,
+            buildLogTruncated: sql `CASE WHEN ${agentImages.status} = 'building' THEN ${agentImages.buildLogTruncated} ELSE 0 END`,
+            lastBuildLogLine: sql `CASE WHEN ${agentImages.status} = 'building' THEN ${agentImages.lastBuildLogLine} ELSE NULL END`,
+            buildLogUpdatedAt: sql `CASE WHEN ${agentImages.status} = 'building' THEN ${agentImages.buildLogUpdatedAt} ELSE CURRENT_TIMESTAMP END`,
+            buildStartedAt: sql `CASE WHEN ${agentImages.status} = 'building' THEN ${agentImages.buildStartedAt} ELSE CURRENT_TIMESTAMP END`,
+            lastError: null,
+            workerId,
+            leaseExpiresAt,
+            updatedAt: sql `CURRENT_TIMESTAMP`,
+        })
+            .where(and(eq(agentImages.id, imageId), claimable))
+            .returning({
+            id: agentImages.id,
+            buildContext: agentImages.buildContext,
+            dockerfile: agentImages.dockerfile,
+            dockerTag: agentImages.dockerTag,
+        });
+        if (!claimed) {
+            const [leased] = await tx
+                .select({
+                leaseExpiresAt: agentImages.leaseExpiresAt,
+                status: agentImages.status,
+            })
+                .from(agentImages)
+                .where(eq(agentImages.id, imageId))
+                .limit(1);
+            if (leased?.status === "building" &&
+                leased.leaseExpiresAt &&
+                leased.leaseExpiresAt > now)
+                return { retryAt: leased.leaseExpiresAt };
+            return undefined;
+        }
+        const sequence = await syncSequenceNext(tx);
+        await syncEventInsert(tx, {
+            sequence,
+            kind: "agentImage.building",
+            entityId: imageId,
+        });
+        return {
+            build: {
+                id: claimed.id,
+                dockerfile: claimed.dockerfile,
+                dockerTag: claimed.dockerTag,
+                ...(claimed.buildContext
+                    ? {
+                        buildContext: claimed.buildContext,
+                    }
+                    : {}),
+            },
+            hint: areaHint(sequence, "agent-images"),
+        };
+    });
+}
+//# sourceMappingURL=agentImageTakeBuild.js.map

package/packages/happy2-server/dist/modules/agent/agentImageTakeBuild.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentImageTakeBuild.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentImageTakeBuild.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAqB,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,QAAyB,EACzB,OAAe,EACf,QAAgB;IAWhB,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACnE,MAAM,SAAS,GAAG,EAAE,CAChB,GAAG,CACC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,EACjC,GAAG,CAAA,GAAG,WAAW,CAAC,gBAAgB,cAAc,CACnD,EACD,GAAG,CACC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,EAClC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAC/E,CACJ,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC;YACD,MAAM,EAAE,UAAU;YAClB,YAAY,EAAE,GAAG,CAAA,GAAG,WAAW,CAAC,YAAY,MAAM;YAClD,aAAa,EAAE,GAAG,CAAA,aAAa,WAAW,CAAC,MAAM,sBAAsB,WAAW,CAAC,aAAa,aAAa;YAC7G,QAAQ,EAAE,GAAG,CAAA,aAAa,WAAW,CAAC,MAAM,sBAAsB,WAAW,CAAC,QAAQ,cAAc;YACpG,iBAAiB,EAAE,GAAG,CAAA,aAAa,WAAW,CAAC,MAAM,sBAAsB,WAAW,CAAC,iBAAiB,aAAa;YACrH,gBAAgB,EAAE,GAAG,CAAA,aAAa,WAAW,CAAC,MAAM,sBAAsB,WAAW,CAAC,gBAAgB,gBAAgB;YACtH,iBAAiB,EAAE,GAAG,CAAA,aAAa,WAAW,CAAC,MAAM,sBAAsB,WAAW,CAAC,iBAAiB,6BAA6B;YACrI,cAAc,EAAE,GAAG,CAAA,aAAa,WAAW,CAAC,MAAM,sBAAsB,WAAW,CAAC,cAAc,6BAA6B;YAC/H,SAAS,EAAE,IAAI;YACf,QAAQ;YACR,cAAc;YACd,SAAS,EAAE,GAAG,CAAA,mBAAmB;SACpC,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;aAClD,SAAS,CAAC;YACP,EAAE,EAAE,WAAW,CAAC,EAAE;YAClB,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,SAAS,EAAE,WAAW,CAAC,SAAS;SACnC,CAAC,CAAC;QACP,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;iBACpB,MAAM,CAAC;gBACJ,cAAc,EAAE,WAAW,CAAC,cAAc;gBAC1C,MAAM,EAAE,WAAW,CAAC,MAAM;aAC7B,CAAC;iBACD,IAAI,CAAC,WAAW,CAAC;iBACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;iBAClC,KAAK,CAAC,CAAC,CAAC,CAAC;YACd,IACI,MAAM,EAAE,MAAM,KAAK,UAAU;gBAC7B,MAAM,CAAC,cAAc;gBACrB,MAAM,CAAC,cAAc,GAAG,GAAG;gBAE3B,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,OAAO;SACpB,CAAC,CAAC;QACH,OAAO;YACH,KAAK,EAAE;gBACH,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,CAAC,OAAO,CAAC,YAAY;oBACpB,CAAC,CAAC;wBACI,YAAY,EAAE,OAAO,CAAC,YAAY;qBACrC;oBACH,CAAC,CAAC,EAAE,CAAC;aACZ;YACD,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;SAC3C,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentRunAttach.d.ts

@@ -0,0 +1,11 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+/**
+ * Attaches the durable Rig run identifier to the matching agentTurns record once the turn is in an attachable state.
+ * The guarded write prevents callbacks from associating a run with the wrong chat turn or overwriting an existing run.
+ */
+export declare function agentRunAttach(executor: DrizzleExecutor, input: {
+    runId: string;
+    sessionId: string;
+    text: string;
+}): Promise<void>;
+//# sourceMappingURL=agentRunAttach.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentRunAttach.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentRunAttach.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentRunAttach.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AAItE;;;GAGG;AACH,wBAAsB,cAAc,CAChC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IACH,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CAChB,GACF,OAAO,CAAC,IAAI,CAAC,CAkCf"}

package/packages/happy2-server/dist/modules/agent/agentRunAttach.js

@@ -0,0 +1,31 @@
+import { withTransaction } from "../drizzle.js";
+import { agentTurns, messages } from "../schema.js";
+import { and, eq, isNull, sql } from "drizzle-orm";
+/**
+ * Attaches the durable Rig run identifier to the matching agentTurns record once the turn is in an attachable state.
+ * The guarded write prevents callbacks from associating a run with the wrong chat turn or overwriting an existing run.
+ */
+export async function agentRunAttach(executor, input) {
+    await withTransaction(executor, async (tx) => {
+        const [turn] = await tx
+            .select({
+            userMessageId: agentTurns.userMessageId,
+        })
+            .from(agentTurns)
+            .innerJoin(messages, eq(messages.id, agentTurns.userMessageId))
+            .where(and(eq(agentTurns.sessionId, input.sessionId), eq(agentTurns.status, "running"), isNull(agentTurns.runId), eq(messages.text, input.text)))
+            .orderBy(agentTurns.createdAt, agentTurns.userMessageId)
+            .limit(1);
+        if (!turn)
+            return;
+        await tx
+            .update(agentTurns)
+            .set({
+            runId: input.runId,
+            updatedAt: sql `CURRENT_TIMESTAMP`,
+            lastError: null,
+        })
+            .where(and(eq(agentTurns.userMessageId, turn.userMessageId), eq(agentTurns.status, "running"), isNull(agentTurns.runId)));
+    });
+}
+//# sourceMappingURL=agentRunAttach.js.map

package/packages/happy2-server/dist/modules/agent/agentRunAttach.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentRunAttach.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentRunAttach.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEnD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,QAAyB,EACzB,KAIC;IAED,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC;YACJ,aAAa,EAAE,UAAU,CAAC,aAAa;SAC1C,CAAC;aACD,IAAI,CAAC,UAAU,CAAC;aAChB,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;aAC9D,KAAK,CACF,GAAG,CACC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,EACzC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,EAChC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EACxB,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAChC,CACJ;aACA,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,aAAa,CAAC;aACvD,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,EAAE;aACH,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC;YACD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,GAAG,CAAA,mBAAmB;YACjC,SAAS,EAAE,IAAI;SAClB,CAAC;aACD,KAAK,CACF,GAAG,CACC,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,EAChD,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,EAChC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAC3B,CACJ,CAAC;IACV,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretAssignmentDelete.d.ts

@@ -0,0 +1,11 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+import { type MutationHint } from "../chat/types.js";
+/**
+ * Removes every agentSecretAgentAssignments or agentSecretChannelAssignments row identified by an administrator-owned assignment.
+ * Deleting the assignment alongside sync and audit evidence makes secret access disappear as one reviewable authorization change.
+ */
+export declare function agentSecretAssignmentDelete(executor: DrizzleExecutor, input: {
+    actorUserId: string;
+    secretId: string;
+}): Promise<MutationHint>;
+//# sourceMappingURL=agentSecretAssignmentDelete.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentSecretAssignmentDelete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretAssignmentDelete.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAssignmentDelete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAUrD;;;GAGG;AACH,wBAAsB,2BAA2B,CAC7C,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CACpB,GACF,OAAO,CAAC,YAAY,CAAC,CAwBvB"}

package/packages/happy2-server/dist/modules/agent/agentSecretAssignmentDelete.js

@@ -0,0 +1,39 @@
+import { withTransaction } from "../drizzle.js";
+import {} from "../chat/types.js";
+import { agentSecretAgentAssignments, agentSecretChannelAssignments } from "../schema.js";
+import { areaHint } from "../chat/areaHint.js";
+import { eq } from "drizzle-orm";
+import { chatAppendAudit } from "../chat/chatAppendAudit.js";
+import { syncEventInsert } from "../sync/syncEventInsert.js";
+import { syncSequenceNext } from "../sync/syncSequenceNext.js";
+import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+/**
+ * Removes every agentSecretAgentAssignments or agentSecretChannelAssignments row identified by an administrator-owned assignment.
+ * Deleting the assignment alongside sync and audit evidence makes secret access disappear as one reviewable authorization change.
+ */
+export async function agentSecretAssignmentDelete(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        await userRequireServerAdmin(tx, input.actorUserId);
+        await tx
+            .delete(agentSecretAgentAssignments)
+            .where(eq(agentSecretAgentAssignments.secretId, input.secretId));
+        await tx
+            .delete(agentSecretChannelAssignments)
+            .where(eq(agentSecretChannelAssignments.secretId, input.secretId));
+        const sequence = await syncSequenceNext(tx);
+        await syncEventInsert(tx, {
+            sequence,
+            kind: "agentSecret.deleted",
+            entityId: input.secretId,
+            actorUserId: input.actorUserId,
+        });
+        await chatAppendAudit(tx, {
+            actorUserId: input.actorUserId,
+            action: "agent_secret.deleted",
+            targetType: "agent_secret",
+            targetId: input.secretId,
+        });
+        return areaHint(sequence, "agent-secrets");
+    });
+}
+//# sourceMappingURL=agentSecretAssignmentDelete.js.map

package/packages/happy2-server/dist/modules/agent/agentSecretAssignmentDelete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretAssignmentDelete.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAssignmentDelete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAqB,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAC;AAE1F,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC7C,QAAyB,EACzB,KAGC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,EAAE;aACH,MAAM,CAAC,2BAA2B,CAAC;aACnC,KAAK,CAAC,EAAE,CAAC,2BAA2B,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrE,MAAM,EAAE;aACH,MAAM,CAAC,6BAA6B,CAAC;aACrC,KAAK,CAAC,EAAE,CAAC,6BAA6B,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,sBAAsB;YAC9B,UAAU,EAAE,cAAc;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;SAC3B,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretAssignmentList.d.ts

@@ -0,0 +1,8 @@
+import { type AgentSecretAssignment } from "./impl/agentSecretAssignment.js";
+import { type DrizzleExecutor } from "../drizzle.js";
+/**
+ * Groups all direct-agent and channel secret assignments by secret identifier for an active server administrator.
+ * Sorting both source rows and the merged result gives management clients stable agent and channel membership lists for each secret.
+ */
+export declare function agentSecretAssignmentList(executor: DrizzleExecutor, actorUserId: string): Promise<AgentSecretAssignment[]>;
+//# sourceMappingURL=agentSecretAssignmentList.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentSecretAssignmentList.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretAssignmentList.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAssignmentList.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAIrD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC3C,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAoClC"}

package/packages/happy2-server/dist/modules/agent/agentSecretAssignmentList.js

@@ -0,0 +1,46 @@
+import {} from "./impl/agentSecretAssignment.js";
+import {} from "../drizzle.js";
+import { agentSecretAgentAssignments, agentSecretChannelAssignments } from "../schema.js";
+import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+/**
+ * Groups all direct-agent and channel secret assignments by secret identifier for an active server administrator.
+ * Sorting both source rows and the merged result gives management clients stable agent and channel membership lists for each secret.
+ */
+export async function agentSecretAssignmentList(executor, actorUserId) {
+    await userRequireServerAdmin(executor, actorUserId);
+    const [agentRows, channelRows] = await Promise.all([
+        executor
+            .select({
+            secretId: agentSecretAgentAssignments.secretId,
+            agentUserId: agentSecretAgentAssignments.agentUserId,
+        })
+            .from(agentSecretAgentAssignments)
+            .orderBy(agentSecretAgentAssignments.secretId, agentSecretAgentAssignments.agentUserId),
+        executor
+            .select({
+            secretId: agentSecretChannelAssignments.secretId,
+            channelId: agentSecretChannelAssignments.chatId,
+        })
+            .from(agentSecretChannelAssignments)
+            .orderBy(agentSecretChannelAssignments.secretId, agentSecretChannelAssignments.chatId),
+    ]);
+    const assignments = new Map();
+    const get = (secretId) => {
+        let assignment = assignments.get(secretId);
+        if (!assignment) {
+            assignment = {
+                secretId,
+                agentUserIds: [],
+                channelIds: [],
+            };
+            assignments.set(secretId, assignment);
+        }
+        return assignment;
+    };
+    for (const row of agentRows)
+        get(row.secretId).agentUserIds.push(row.agentUserId);
+    for (const row of channelRows)
+        get(row.secretId).channelIds.push(row.channelId);
+    return [...assignments.values()].sort((left, right) => left.secretId.localeCompare(right.secretId));
+}
+//# sourceMappingURL=agentSecretAssignmentList.js.map

package/packages/happy2-server/dist/modules/agent/agentSecretAssignmentList.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretAssignmentList.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAssignmentList.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAwB,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAC;AAE1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC3C,QAAyB,EACzB,WAAmB;IAEnB,MAAM,sBAAsB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/C,QAAQ;aACH,MAAM,CAAC;YACJ,QAAQ,EAAE,2BAA2B,CAAC,QAAQ;YAC9C,WAAW,EAAE,2BAA2B,CAAC,WAAW;SACvD,CAAC;aACD,IAAI,CAAC,2BAA2B,CAAC;aACjC,OAAO,CAAC,2BAA2B,CAAC,QAAQ,EAAE,2BAA2B,CAAC,WAAW,CAAC;QAC3F,QAAQ;aACH,MAAM,CAAC;YACJ,QAAQ,EAAE,6BAA6B,CAAC,QAAQ;YAChD,SAAS,EAAE,6BAA6B,CAAC,MAAM;SAClD,CAAC;aACD,IAAI,CAAC,6BAA6B,CAAC;aACnC,OAAO,CAAC,6BAA6B,CAAC,QAAQ,EAAE,6BAA6B,CAAC,MAAM,CAAC;KAC7F,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAAiC,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC,QAAgB,EAAE,EAAE;QAC7B,IAAI,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,UAAU,GAAG;gBACT,QAAQ;gBACR,YAAY,EAAE,EAAE;gBAChB,UAAU,EAAE,EAAE;aACjB,CAAC;YACF,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,UAAU,CAAC;IACtB,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,SAAS;QAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClF,KAAK,MAAM,GAAG,IAAI,WAAW;QAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAClD,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC9C,CAAC;AACN,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToAgent.d.ts

@@ -0,0 +1,12 @@
+import { type MutationHint } from "../chat/types.js";
+import { type DrizzleExecutor } from "../drizzle.js";
+/**
+ * Grants an agent access to a secret by inserting the unique agentSecretAgentAssignments relationship after administrator checks.
+ * Keeping the grant, audit entry, and sync event together prevents silent expansion of an agent's runtime credentials.
+ */
+export declare function agentSecretAttachToAgent(executor: DrizzleExecutor, input: {
+    actorUserId: string;
+    agentUserId: string;
+    secretId: string;
+}): Promise<MutationHint | undefined>;
+//# sourceMappingURL=agentSecretAttachToAgent.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToAgent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretAttachToAgent.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAttachToAgent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AAWtE;;;GAGG;AACH,wBAAsB,wBAAwB,CAC1C,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CACpB,GACF,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CA+CnC"}

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToAgent.js

@@ -0,0 +1,58 @@
+import { CollaborationError } from "../chat/types.js";
+import { withTransaction } from "../drizzle.js";
+import { agentSecretAgentAssignments, users } from "../schema.js";
+import { and, eq, isNull } from "drizzle-orm";
+import { areaHint } from "../chat/areaHint.js";
+import { chatAppendAudit } from "../chat/chatAppendAudit.js";
+import { syncEventInsert } from "../sync/syncEventInsert.js";
+import { syncSequenceNext } from "../sync/syncSequenceNext.js";
+import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+/**
+ * Grants an agent access to a secret by inserting the unique agentSecretAgentAssignments relationship after administrator checks.
+ * Keeping the grant, audit entry, and sync event together prevents silent expansion of an agent's runtime credentials.
+ */
+export async function agentSecretAttachToAgent(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        await userRequireServerAdmin(tx, input.actorUserId);
+        const [agent] = await tx
+            .select({
+            id: users.id,
+        })
+            .from(users)
+            .where(and(eq(users.id, input.agentUserId), eq(users.kind, "agent"), isNull(users.deletedAt)))
+            .limit(1);
+        if (!agent)
+            throw new CollaborationError("not_found", "Agent was not found");
+        const inserted = await tx
+            .insert(agentSecretAgentAssignments)
+            .values({
+            secretId: input.secretId,
+            agentUserId: input.agentUserId,
+            createdByUserId: input.actorUserId,
+        })
+            .onConflictDoNothing()
+            .returning({
+            secretId: agentSecretAgentAssignments.secretId,
+        });
+        if (!inserted.length)
+            return undefined;
+        const sequence = await syncSequenceNext(tx);
+        await syncEventInsert(tx, {
+            sequence,
+            kind: "agentSecret.attachedToAgent",
+            entityId: input.secretId,
+            actorUserId: input.actorUserId,
+        });
+        await chatAppendAudit(tx, {
+            actorUserId: input.actorUserId,
+            action: "agent_secret.attached_to_agent",
+            targetType: "user",
+            targetId: input.agentUserId,
+            after: {
+                secretId: input.secretId,
+            },
+        });
+        return areaHint(sequence, "agent-secrets");
+    });
+}
+//# sourceMappingURL=agentSecretAttachToAgent.js.map

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToAgent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretAttachToAgent.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAttachToAgent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC1C,QAAyB,EACzB,KAIC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC;YACJ,EAAE,EAAE,KAAK,CAAC,EAAE;SACf,CAAC;aACD,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CACF,GAAG,CACC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,EAC/B,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EACvB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAC1B,CACJ;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,2BAA2B,CAAC;aACnC,MAAM,CAAC;YACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,KAAK,CAAC,WAAW;SACrC,CAAC;aACD,mBAAmB,EAAE;aACrB,SAAS,CAAC;YACP,QAAQ,EAAE,2BAA2B,CAAC,QAAQ;SACjD,CAAC,CAAC;QACP,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,6BAA6B;YACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,gCAAgC;YACxC,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,KAAK,EAAE;gBACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;aAC3B;SACJ,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToChannel.d.ts

@@ -0,0 +1,12 @@
+import { type MutationHint } from "../chat/types.js";
+import { type DrizzleExecutor } from "../drizzle.js";
+/**
+ * Grants a secret identifier to an existing channel through agentSecretChannelAssignments after validating server-administrator authority and channel eligibility.
+ * The assignment, audit entry, and sync event commit together so the resulting credential exposure is never silent or partially reported.
+ */
+export declare function agentSecretAttachToChannel(executor: DrizzleExecutor, input: {
+    actorUserId: string;
+    channelId: string;
+    secretId: string;
+}): Promise<MutationHint | undefined>;
+//# sourceMappingURL=agentSecretAttachToChannel.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToChannel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretAttachToChannel.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAttachToChannel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AAWtE;;;GAGG;AACH,wBAAsB,0BAA0B,CAC5C,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CACpB,GACF,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAgDnC"}

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToChannel.js

@@ -0,0 +1,59 @@
+import { CollaborationError } from "../chat/types.js";
+import { withTransaction } from "../drizzle.js";
+import { agentSecretChannelAssignments, chats } from "../schema.js";
+import { and, eq, inArray, isNull } from "drizzle-orm";
+import { areaHint } from "../chat/areaHint.js";
+import { chatAppendAudit } from "../chat/chatAppendAudit.js";
+import { syncEventInsert } from "../sync/syncEventInsert.js";
+import { syncSequenceNext } from "../sync/syncSequenceNext.js";
+import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+/**
+ * Grants a secret identifier to an existing channel through agentSecretChannelAssignments after validating server-administrator authority and channel eligibility.
+ * The assignment, audit entry, and sync event commit together so the resulting credential exposure is never silent or partially reported.
+ */
+export async function agentSecretAttachToChannel(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        await userRequireServerAdmin(tx, input.actorUserId);
+        const [channel] = await tx
+            .select({
+            id: chats.id,
+        })
+            .from(chats)
+            .where(and(eq(chats.id, input.channelId), inArray(chats.kind, ["public_channel", "private_channel"]), isNull(chats.deletedAt)))
+            .limit(1);
+        if (!channel)
+            throw new CollaborationError("not_found", "Channel was not found");
+        const inserted = await tx
+            .insert(agentSecretChannelAssignments)
+            .values({
+            secretId: input.secretId,
+            chatId: input.channelId,
+            createdByUserId: input.actorUserId,
+        })
+            .onConflictDoNothing()
+            .returning({
+            secretId: agentSecretChannelAssignments.secretId,
+        });
+        if (!inserted.length)
+            return undefined;
+        const sequence = await syncSequenceNext(tx);
+        await syncEventInsert(tx, {
+            sequence,
+            kind: "agentSecret.attachedToChannel",
+            entityId: input.secretId,
+            actorUserId: input.actorUserId,
+        });
+        await chatAppendAudit(tx, {
+            actorUserId: input.actorUserId,
+            action: "agent_secret.attached_to_channel",
+            targetType: "chat",
+            targetId: input.channelId,
+            chatId: input.channelId,
+            after: {
+                secretId: input.secretId,
+            },
+        });
+        return areaHint(sequence, "agent-secrets");
+    });
+}
+//# sourceMappingURL=agentSecretAttachToChannel.js.map

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToChannel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretAttachToChannel.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAttachToChannel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,6BAA6B,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC5C,QAAyB,EACzB,KAIC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC;YACJ,EAAE,EAAE,KAAK,CAAC,EAAE;SACf,CAAC;aACD,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CACF,GAAG,CACC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,EAC7B,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC,EAC1D,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAC1B,CACJ;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,6BAA6B,CAAC;aACrC,MAAM,CAAC;YACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,SAAS;YACvB,eAAe,EAAE,KAAK,CAAC,WAAW;SACrC,CAAC;aACD,mBAAmB,EAAE;aACrB,SAAS,CAAC;YACP,QAAQ,EAAE,6BAA6B,CAAC,QAAQ;SACnD,CAAC,CAAC;QACP,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,+BAA+B;YACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,kCAAkC;YAC1C,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,MAAM,EAAE,KAAK,CAAC,SAAS;YACvB,KAAK,EAAE;gBACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;aAC3B;SACJ,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretAuthorizeManagement.d.ts

@@ -0,0 +1,7 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+/**
+ * Requires the actor to have an active profile and server-administrator role before any agent-secret management operation proceeds.
+ * A shared authorization entry point keeps secret assignment routes from drifting to weaker account or profile checks.
+ */
+export declare function agentSecretAuthorizeManagement(executor: DrizzleExecutor, actorUserId: string): Promise<void>;
+//# sourceMappingURL=agentSecretAuthorizeManagement.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentSecretAuthorizeManagement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretAuthorizeManagement.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAuthorizeManagement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;GAGG;AACH,wBAAsB,8BAA8B,CAChD,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/packages/happy2-server/dist/modules/agent/agentSecretAuthorizeManagement.js

@@ -0,0 +1,10 @@
+import {} from "../drizzle.js";
+import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+/**
+ * Requires the actor to have an active profile and server-administrator role before any agent-secret management operation proceeds.
+ * A shared authorization entry point keeps secret assignment routes from drifting to weaker account or profile checks.
+ */
+export async function agentSecretAuthorizeManagement(executor, actorUserId) {
+    await userRequireServerAdmin(executor, actorUserId);
+}
+//# sourceMappingURL=agentSecretAuthorizeManagement.js.map

package/packages/happy2-server/dist/modules/agent/agentSecretAuthorizeManagement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretAuthorizeManagement.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAuthorizeManagement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAChD,QAAyB,EACzB,WAAmB;IAEnB,MAAM,sBAAsB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AACxD,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretBindingList.d.ts

@@ -0,0 +1,11 @@
+import { type AgentSecretBinding } from "./impl/agentSecretBinding.js";
+import { type DrizzleExecutor } from "../drizzle.js";
+/**
+ * Projects optional agent or chat Rig bindings with the union of direct-agent secrets and channel secrets available to an active agent member.
+ * Excluding channel grants after membership ends prevents a retained runtime binding from continuing to inherit chat-scoped credentials.
+ */
+export declare function agentSecretBindingList(executor: DrizzleExecutor, input?: {
+    agentUserId?: string;
+    chatId?: string;
+}): Promise<AgentSecretBinding[]>;
+//# sourceMappingURL=agentSecretBindingList.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentSecretBindingList.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretBindingList.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretBindingList.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AASrD;;;GAGG;AACH,wBAAsB,sBAAsB,CACxC,QAAQ,EAAE,eAAe,EACzB,KAAK,GAAE;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACd,GACP,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAiE/B"}