happy2 0.0.5 → 0.0.11

package/packages/happy2-server/dist/modules/plugin/pluginFunctionResultAcquire.d.ts

@@ -0,0 +1,23 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+import type { PluginFunctionResult } from "./types.js";
+export type PluginFunctionResultAcquireResult = {
+    kind: "acquired";
+} | {
+    kind: "in_progress";
+    retryAt: number;
+} | {
+    kind: "replay";
+    result: PluginFunctionResult;
+};
+/**
+ * Creates, replays, waits for, or conditionally takes over the durable pluginFunctionResults lease for one Rig call.
+ * The transaction admits one live MCP executor at a time while retaining a completed outcome indefinitely for event redelivery and restart recovery.
+ */
+export declare function pluginFunctionResultAcquire(executor: DrizzleExecutor, input: {
+    callId: string;
+    leaseExpiresAt: number;
+    leaseToken: string;
+    now: number;
+    sessionId: string;
+}): Promise<PluginFunctionResultAcquireResult>;
+//# sourceMappingURL=pluginFunctionResultAcquire.d.ts.map

package/packages/happy2-server/dist/modules/plugin/pluginFunctionResultAcquire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginFunctionResultAcquire.d.ts","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginFunctionResultAcquire.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AAGtE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,MAAM,iCAAiC,GACvC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEvD;;;GAGG;AACH,wBAAsB,2BAA2B,CAC7C,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IACH,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACrB,GACF,OAAO,CAAC,iCAAiC,CAAC,CAoD5C"}

package/packages/happy2-server/dist/modules/plugin/pluginFunctionResultAcquire.js

@@ -0,0 +1,54 @@
+import { and, eq, sql } from "drizzle-orm";
+import { withTransaction } from "../drizzle.js";
+import { pluginFunctionResults } from "../schema.js";
+import { parsePluginFunctionResult } from "./impl/pluginFunctionResult.js";
+/**
+ * Creates, replays, waits for, or conditionally takes over the durable pluginFunctionResults lease for one Rig call.
+ * The transaction admits one live MCP executor at a time while retaining a completed outcome indefinitely for event redelivery and restart recovery.
+ */
+export async function pluginFunctionResultAcquire(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        const lockedUntil = new Date(input.leaseExpiresAt).toISOString();
+        const [inserted] = await tx
+            .insert(pluginFunctionResults)
+            .values({
+            sessionId: input.sessionId,
+            callId: input.callId,
+            leaseToken: input.leaseToken,
+            lockedUntil,
+        })
+            .onConflictDoNothing()
+            .returning({ callId: pluginFunctionResults.callId });
+        if (inserted)
+            return { kind: "acquired" };
+        const [row] = await tx
+            .select({
+            lockedUntil: pluginFunctionResults.lockedUntil,
+            resolutionJson: pluginFunctionResults.resolutionJson,
+            status: pluginFunctionResults.status,
+        })
+            .from(pluginFunctionResults)
+            .where(and(eq(pluginFunctionResults.sessionId, input.sessionId), eq(pluginFunctionResults.callId, input.callId)))
+            .limit(1);
+        if (!row)
+            throw new Error("Plugin function result disappeared during acquisition");
+        if (row?.status === "completed") {
+            if (row.resolutionJson === null)
+                throw new Error("Completed plugin function result is missing its resolution");
+            return { kind: "replay", result: parsePluginFunctionResult(row.resolutionJson) };
+        }
+        if (row?.lockedUntil && Date.parse(row.lockedUntil) > input.now)
+            return { kind: "in_progress", retryAt: Date.parse(row.lockedUntil) };
+        await tx
+            .update(pluginFunctionResults)
+            .set({
+            leaseToken: input.leaseToken,
+            lockedUntil,
+            status: "in_progress",
+            updatedAt: sql `CURRENT_TIMESTAMP`,
+        })
+            .where(and(eq(pluginFunctionResults.sessionId, input.sessionId), eq(pluginFunctionResults.callId, input.callId)));
+        return { kind: "acquired" };
+    });
+}
+//# sourceMappingURL=pluginFunctionResultAcquire.js.map

package/packages/happy2-server/dist/modules/plugin/pluginFunctionResultAcquire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginFunctionResultAcquire.js","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginFunctionResultAcquire.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAQ3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC7C,QAAyB,EACzB,KAMC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;QACjE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,qBAAqB,CAAC;aAC7B,MAAM,CAAC;YACJ,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,WAAW;SACd,CAAC;aACD,mBAAmB,EAAE;aACrB,SAAS,CAAC,EAAE,MAAM,EAAE,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC;QACzD,IAAI,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACjB,MAAM,CAAC;YACJ,WAAW,EAAE,qBAAqB,CAAC,WAAW;YAC9C,cAAc,EAAE,qBAAqB,CAAC,cAAc;YACpD,MAAM,EAAE,qBAAqB,CAAC,MAAM;SACvC,CAAC;aACD,IAAI,CAAC,qBAAqB,CAAC;aAC3B,KAAK,CACF,GAAG,CACC,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,EACpD,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CACjD,CACJ;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACnF,IAAI,GAAG,EAAE,MAAM,KAAK,WAAW,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,cAAc,KAAK,IAAI;gBAC3B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAClF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,yBAAyB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,GAAG,EAAE,WAAW,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,GAAG;YAC3D,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACzE,MAAM,EAAE;aACH,MAAM,CAAC,qBAAqB,CAAC;aAC7B,GAAG,CAAC;YACD,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,WAAW;YACX,MAAM,EAAE,aAAa;YACrB,SAAS,EAAE,GAAG,CAAA,mBAAmB;SACpC,CAAC;aACD,KAAK,CACF,GAAG,CACC,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,EACpD,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CACjD,CACJ,CAAC;QACN,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/plugin/pluginFunctionResultComplete.d.ts

@@ -0,0 +1,13 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+import type { PluginFunctionResult } from "./types.js";
+/**
+ * Stores the terminal MCP outcome only while the caller owns the pluginFunctionResults lease for the Rig call.
+ * Lease fencing prevents a late or superseded executor from replacing the first durable resolution that Rig and every redelivery must observe.
+ */
+export declare function pluginFunctionResultComplete(executor: DrizzleExecutor, input: {
+    callId: string;
+    leaseToken: string;
+    result: PluginFunctionResult;
+    sessionId: string;
+}): Promise<PluginFunctionResult>;
+//# sourceMappingURL=pluginFunctionResultComplete.d.ts.map

package/packages/happy2-server/dist/modules/plugin/pluginFunctionResultComplete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginFunctionResultComplete.d.ts","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginFunctionResultComplete.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AAGtE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD;;;GAGG;AACH,wBAAsB,4BAA4B,CAC9C,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IACH,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACrB,GACF,OAAO,CAAC,oBAAoB,CAAC,CAsC/B"}

package/packages/happy2-server/dist/modules/plugin/pluginFunctionResultComplete.js

@@ -0,0 +1,37 @@
+import { and, eq, sql } from "drizzle-orm";
+import { withTransaction } from "../drizzle.js";
+import { pluginFunctionResults } from "../schema.js";
+import { parsePluginFunctionResult } from "./impl/pluginFunctionResult.js";
+/**
+ * Stores the terminal MCP outcome only while the caller owns the pluginFunctionResults lease for the Rig call.
+ * Lease fencing prevents a late or superseded executor from replacing the first durable resolution that Rig and every redelivery must observe.
+ */
+export async function pluginFunctionResultComplete(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        const [completed] = await tx
+            .update(pluginFunctionResults)
+            .set({
+            leaseToken: null,
+            lockedUntil: null,
+            resolutionJson: JSON.stringify(input.result),
+            status: "completed",
+            updatedAt: sql `CURRENT_TIMESTAMP`,
+        })
+            .where(and(eq(pluginFunctionResults.sessionId, input.sessionId), eq(pluginFunctionResults.callId, input.callId), eq(pluginFunctionResults.status, "in_progress"), eq(pluginFunctionResults.leaseToken, input.leaseToken)))
+            .returning({ resolutionJson: pluginFunctionResults.resolutionJson });
+        if (completed?.resolutionJson)
+            return parsePluginFunctionResult(completed.resolutionJson);
+        const [winner] = await tx
+            .select({
+            resolutionJson: pluginFunctionResults.resolutionJson,
+            status: pluginFunctionResults.status,
+        })
+            .from(pluginFunctionResults)
+            .where(and(eq(pluginFunctionResults.sessionId, input.sessionId), eq(pluginFunctionResults.callId, input.callId)))
+            .limit(1);
+        if (winner?.status === "completed" && winner.resolutionJson)
+            return parsePluginFunctionResult(winner.resolutionJson);
+        throw new Error("Plugin function result lease was lost before completion");
+    });
+}
+//# sourceMappingURL=pluginFunctionResultComplete.js.map

package/packages/happy2-server/dist/modules/plugin/pluginFunctionResultComplete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginFunctionResultComplete.js","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginFunctionResultComplete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAG3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAC9C,QAAyB,EACzB,KAKC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,qBAAqB,CAAC;aAC7B,GAAG,CAAC;YACD,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;YAC5C,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,GAAG,CAAA,mBAAmB;SACpC,CAAC;aACD,KAAK,CACF,GAAG,CACC,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,EACpD,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAC9C,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAAE,aAAa,CAAC,EAC/C,EAAE,CAAC,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CACzD,CACJ;aACA,SAAS,CAAC,EAAE,cAAc,EAAE,qBAAqB,CAAC,cAAc,EAAE,CAAC,CAAC;QACzE,IAAI,SAAS,EAAE,cAAc;YAAE,OAAO,yBAAyB,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC1F,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC;YACJ,cAAc,EAAE,qBAAqB,CAAC,cAAc;YACpD,MAAM,EAAE,qBAAqB,CAAC,MAAM;SACvC,CAAC;aACD,IAAI,CAAC,qBAAqB,CAAC;aAC3B,KAAK,CACF,GAAG,CACC,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,EACpD,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CACjD,CACJ;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,MAAM,EAAE,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,cAAc;YACvD,OAAO,yBAAyB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/plugin/pluginGetImage.d.ts

@@ -0,0 +1,17 @@
+import type { DrizzleExecutor } from "../drizzle.js";
+export interface StoredPluginImage {
+    pluginId: string;
+    shortName: string;
+    packageDigest: string;
+    packageDirectory: string;
+    storageKey: string;
+    contentType: string;
+    size: number;
+    checksumSha256: string;
+}
+/**
+ * Returns the private filesystem locator and public response metadata for one persisted plugin image after administrator authorization.
+ * This read-only boundary does not mutate durable state and prevents routes from reading package paths without a durable plugin record.
+ */
+export declare function pluginGetImage(executor: DrizzleExecutor, actorUserId: string, pluginId: string): Promise<StoredPluginImage>;
+//# sourceMappingURL=pluginGetImage.d.ts.map

package/packages/happy2-server/dist/modules/plugin/pluginGetImage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginGetImage.d.ts","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginGetImage.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAKrD,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAChC,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,CAAC,CAkB5B"}

package/packages/happy2-server/dist/modules/plugin/pluginGetImage.js

@@ -0,0 +1,29 @@
+import { eq } from "drizzle-orm";
+import { plugins } from "../schema.js";
+import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+import { PluginError } from "./types.js";
+/**
+ * Returns the private filesystem locator and public response metadata for one persisted plugin image after administrator authorization.
+ * This read-only boundary does not mutate durable state and prevents routes from reading package paths without a durable plugin record.
+ */
+export async function pluginGetImage(executor, actorUserId, pluginId) {
+    await userRequireServerAdmin(executor, actorUserId);
+    const [row] = await executor
+        .select({
+        pluginId: plugins.id,
+        shortName: plugins.shortName,
+        packageDigest: plugins.packageDigest,
+        packageDirectory: plugins.packageDirectory,
+        storageKey: plugins.imageStorageKey,
+        contentType: plugins.imageContentType,
+        size: plugins.imageSize,
+        checksumSha256: plugins.imageChecksumSha256,
+    })
+        .from(plugins)
+        .where(eq(plugins.id, pluginId))
+        .limit(1);
+    if (!row)
+        throw new PluginError("not_found", "System plugin was not found");
+    return row;
+}
+//# sourceMappingURL=pluginGetImage.js.map

package/packages/happy2-server/dist/modules/plugin/pluginGetImage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginGetImage.js","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginGetImage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAazC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,QAAyB,EACzB,WAAmB,EACnB,QAAgB;IAEhB,MAAM,sBAAsB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,QAAQ;SACvB,MAAM,CAAC;QACJ,QAAQ,EAAE,OAAO,CAAC,EAAE;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,UAAU,EAAE,OAAO,CAAC,eAAe;QACnC,WAAW,EAAE,OAAO,CAAC,gBAAgB;QACrC,IAAI,EAAE,OAAO,CAAC,SAAS;QACvB,cAAc,EAAE,OAAO,CAAC,mBAAmB;KAC9C,CAAC;SACD,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;SAC/B,KAAK,CAAC,CAAC,CAAC,CAAC;IACd,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC;AACf,CAAC"}

package/packages/happy2-server/dist/modules/plugin/pluginInstall.d.ts

@@ -0,0 +1,27 @@
+import type { DrizzleExecutor } from "../drizzle.js";
+import type { MutationHint } from "../chat/types.js";
+import type { PluginSecretProtector } from "./secrets.js";
+import { type PluginInstallationSummary, type PluginPackage } from "./types.js";
+export interface PluginPackageCandidate {
+    pluginId: string;
+    packageDirectory: string;
+    imageStorageKey: string;
+}
+/**
+ * Ensures one catalog package has a durable system plugin, then creates an independent installation with its own encrypted variables and container choice.
+ * The transaction commits plugins, pluginInstallations, pluginInstallationVariables, audit, and sync evidence together so no installation can reference a partial plugin record.
+ */
+export declare function pluginInstall(executor: DrizzleExecutor, secretProtector: PluginSecretProtector, input: {
+    actorUserId: string;
+    installationId: string;
+    plugin: PluginPackage;
+    candidate?: PluginPackageCandidate;
+    variables: Readonly<Record<string, string>>;
+    containerImageId?: string;
+}): Promise<{
+    hint: MutationHint;
+    installation: PluginInstallationSummary;
+    pluginCreated: boolean;
+    pluginId: string;
+}>;
+//# sourceMappingURL=pluginInstall.d.ts.map

package/packages/happy2-server/dist/modules/plugin/pluginInstall.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginInstall.d.ts","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginInstall.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAarD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAEH,KAAK,yBAAyB,EAE9B,KAAK,aAAa,EACrB,MAAM,YAAY,CAAC;AAOpB,MAAM,WAAW,sBAAsB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAC/B,QAAQ,EAAE,eAAe,EACzB,eAAe,EAAE,qBAAqB,EACtC,KAAK,EAAE;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B,GACF,OAAO,CAAC;IACP,IAAI,EAAE,YAAY,CAAC;IACnB,YAAY,EAAE,yBAAyB,CAAC;IACxC,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC,CA+JD"}

package/packages/happy2-server/dist/modules/plugin/pluginInstall.js

@@ -0,0 +1,175 @@
+import { and, eq } from "drizzle-orm";
+import { withTransaction } from "../drizzle.js";
+import { agentImages, pluginInstallations, pluginInstallationVariables, plugins, } from "../schema.js";
+import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+import { chatAppendAudit } from "../chat/chatAppendAudit.js";
+import { syncSequenceNext } from "../sync/syncSequenceNext.js";
+import { syncEventInsert } from "../sync/syncEventInsert.js";
+import { areaHint } from "../chat/areaHint.js";
+import { PluginError, } from "./types.js";
+import { pluginInstallationSelection } from "./impl/installationSelection.js";
+import { asPluginInstallation } from "./impl/asInstallation.js";
+import { installedManifest } from "./impl/installedManifest.js";
+const MAX_VARIABLE_BYTES = 64 * 1024;
+/**
+ * Ensures one catalog package has a durable system plugin, then creates an independent installation with its own encrypted variables and container choice.
+ * The transaction commits plugins, pluginInstallations, pluginInstallationVariables, audit, and sync evidence together so no installation can reference a partial plugin record.
+ */
+export async function pluginInstall(executor, secretProtector, input) {
+    return withTransaction(executor, async (tx) => {
+        await userRequireServerAdmin(tx, input.actorUserId);
+        const [existing] = await tx
+            .select({ id: plugins.id, manifestJson: plugins.manifestJson })
+            .from(plugins)
+            .where(and(eq(plugins.sourceKind, input.plugin.source.kind), eq(plugins.sourceReference, input.plugin.source.reference)))
+            .limit(1);
+        let pluginId;
+        let manifest;
+        let pluginCreated = false;
+        if (existing) {
+            pluginId = existing.id;
+            manifest = installedManifest(existing.manifestJson);
+        }
+        else {
+            if (!input.candidate)
+                throw new Error("A new system plugin requires a persisted package candidate");
+            pluginId = input.candidate.pluginId;
+            manifest = input.plugin.manifest;
+            await tx.insert(plugins).values({
+                id: pluginId,
+                displayName: manifest.displayName,
+                shortName: manifest.shortName,
+                description: manifest.description,
+                sourceKind: input.plugin.source.kind,
+                sourceReference: input.plugin.source.reference,
+                sourceVersion: manifest.version,
+                packageDigest: input.plugin.packageDigest,
+                manifestJson: JSON.stringify(manifest),
+                packageDirectory: input.candidate.packageDirectory,
+                imageStorageKey: input.candidate.imageStorageKey,
+                imageContentType: input.plugin.image.contentType,
+                imageSize: input.plugin.image.size,
+                imageWidth: input.plugin.image.width,
+                imageHeight: input.plugin.image.height,
+                imageThumbhash: input.plugin.image.thumbhash,
+                imageChecksumSha256: input.plugin.image.checksumSha256,
+                installedByUserId: input.actorUserId,
+            });
+            pluginCreated = true;
+        }
+        const definitions = manifest.variables;
+        const mcp = manifest.mcp;
+        validateVariables(definitions, input.variables);
+        const selectionRequired = mcp?.type === "stdio" && !mcp.container;
+        if (selectionRequired && !input.containerImageId)
+            throw new PluginError("broken_configuration", "containerImageId is required for this stdio MCP plugin");
+        if (!selectionRequired && input.containerImageId)
+            throw new PluginError("broken_configuration", "containerImageId is not accepted for this plugin");
+        if (input.containerImageId) {
+            const [image] = await tx
+                .select({ id: agentImages.id })
+                .from(agentImages)
+                .where(and(eq(agentImages.id, input.containerImageId), eq(agentImages.status, "ready")))
+                .limit(1);
+            if (!image)
+                throw new PluginError("broken_configuration", "The selected container image does not exist or is not ready");
+        }
+        const id = input.installationId;
+        const status = mcp ? "preparing" : "ready";
+        const [created] = await tx
+            .insert(pluginInstallations)
+            .values({
+            id,
+            pluginId,
+            containerImageId: input.containerImageId,
+            containerName: mcp?.type === "stdio" ? `happy2-plugin-${id}` : null,
+            status,
+            statusDetail: mcp
+                ? "Plugin runtime is queued for preparation."
+                : "Plugin skills are installed.",
+            installedByUserId: input.actorUserId,
+            readyAt: mcp ? null : new Date().toISOString(),
+        })
+            .returning({ id: pluginInstallations.id });
+        if (!created)
+            throw new Error("Plugin installation was not created");
+        for (const definition of definitions) {
+            const value = input.variables[definition.key];
+            await tx.insert(pluginInstallationVariables).values({
+                installationId: id,
+                key: definition.key,
+                kind: definition.kind,
+                ...(definition.kind === "secret"
+                    ? {
+                        secretCiphertext: await secretProtector.protect(value, {
+                            installationId: id,
+                            key: definition.key,
+                        }),
+                    }
+                    : { textValue: value }),
+            });
+        }
+        await chatAppendAudit(tx, {
+            actorUserId: input.actorUserId,
+            action: "plugin.installed",
+            targetType: "plugin_installation",
+            targetId: id,
+            after: {
+                pluginId,
+                shortName: manifest.shortName,
+                version: manifest.version,
+                mcpType: mcp?.type,
+                variableKeys: definitions.map(({ key }) => key),
+                containerImageId: input.containerImageId,
+            },
+        });
+        const sequence = await syncSequenceNext(tx);
+        if (pluginCreated)
+            await tx
+                .update(plugins)
+                .set({ syncSequence: sequence })
+                .where(eq(plugins.id, pluginId));
+        const [updated] = await tx
+            .update(pluginInstallations)
+            .set({ syncSequence: sequence })
+            .where(eq(pluginInstallations.id, id))
+            .returning({ id: pluginInstallations.id });
+        if (!updated)
+            throw new Error("Plugin installation was not updated");
+        await syncEventInsert(tx, {
+            sequence,
+            kind: "plugin.installed",
+            entityId: id,
+            actorUserId: input.actorUserId,
+        });
+        const [projection] = await tx
+            .select(pluginInstallationSelection)
+            .from(pluginInstallations)
+            .innerJoin(plugins, eq(pluginInstallations.pluginId, plugins.id))
+            .where(eq(pluginInstallations.id, id))
+            .limit(1);
+        if (!projection)
+            throw new Error("Plugin installation projection was not found");
+        return {
+            hint: areaHint(sequence, "plugins"),
+            installation: asPluginInstallation(projection),
+            pluginCreated,
+            pluginId,
+        };
+    });
+}
+function validateVariables(definitions, values) {
+    const expected = new Set(definitions.map(({ key }) => key));
+    const unexpected = Object.keys(values).find((key) => !expected.has(key));
+    if (unexpected)
+        throw new PluginError("broken_configuration", `Unexpected plugin variable ${unexpected}`);
+    for (const definition of definitions) {
+        const value = values[definition.key];
+        if (typeof value !== "string" ||
+            !value ||
+            value.includes("\u0000") ||
+            Buffer.byteLength(value, "utf8") > MAX_VARIABLE_BYTES)
+            throw new PluginError("broken_configuration", `${definition.key} must be a valid environment value between 1 byte and 64 KiB`);
+    }
+}
+//# sourceMappingURL=pluginInstall.js.map

package/packages/happy2-server/dist/modules/plugin/pluginInstall.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginInstall.js","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginInstall.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACH,WAAW,EACX,mBAAmB,EACnB,2BAA2B,EAC3B,OAAO,GACV,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAG/C,OAAO,EACH,WAAW,GAId,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEhE,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAQrC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,QAAyB,EACzB,eAAsC,EACtC,KAOC;IAOD,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;aAC9D,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CACF,GAAG,CACC,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAChD,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAC7D,CACJ;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,QAAgB,CAAC;QACrB,IAAI,QAAwB,CAAC;QAC7B,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,QAAQ,EAAE,CAAC;YACX,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC;YACvB,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,KAAK,CAAC,SAAS;gBAChB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAClF,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;YACpC,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;YACjC,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;gBAC5B,EAAE,EAAE,QAAQ;gBACZ,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI;gBACpC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS;gBAC9C,aAAa,EAAE,QAAQ,CAAC,OAAO;gBAC/B,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;gBACzC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;gBACtC,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,gBAAgB;gBAClD,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe;gBAChD,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW;gBAChD,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI;gBAClC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK;gBACpC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM;gBACtC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS;gBAC5C,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc;gBACtD,iBAAiB,EAAE,KAAK,CAAC,WAAW;aACvC,CAAC,CAAC;YACH,aAAa,GAAG,IAAI,CAAC;QACzB,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,SAAS,CAAC;QACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;QACzB,iBAAiB,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,iBAAiB,GAAG,GAAG,EAAE,IAAI,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;QAClE,IAAI,iBAAiB,IAAI,CAAC,KAAK,CAAC,gBAAgB;YAC5C,MAAM,IAAI,WAAW,CACjB,sBAAsB,EACtB,wDAAwD,CAC3D,CAAC;QACN,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,gBAAgB;YAC5C,MAAM,IAAI,WAAW,CACjB,sBAAsB,EACtB,kDAAkD,CACrD,CAAC;QACN,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YACzB,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;iBAC9B,IAAI,CAAC,WAAW,CAAC;iBACjB,KAAK,CACF,GAAG,CACC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,gBAAgB,CAAC,EAC1C,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAClC,CACJ;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YACd,IAAI,CAAC,KAAK;gBACN,MAAM,IAAI,WAAW,CACjB,sBAAsB,EACtB,6DAA6D,CAChE,CAAC;QACV,CAAC;QAED,MAAM,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC;QAChC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3C,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,mBAAmB,CAAC;aAC3B,MAAM,CAAC;YACJ,EAAE;YACF,QAAQ;YACR,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,aAAa,EAAE,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;YACnE,MAAM;YACN,YAAY,EAAE,GAAG;gBACb,CAAC,CAAC,2CAA2C;gBAC7C,CAAC,CAAC,8BAA8B;YACpC,iBAAiB,EAAE,KAAK,CAAC,WAAW;YACpC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACjD,CAAC;aACD,SAAS,CAAC,EAAE,EAAE,EAAE,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAE,CAAC;YAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,MAAM,CAAC;gBAChD,cAAc,EAAE,EAAE;gBAClB,GAAG,EAAE,UAAU,CAAC,GAAG;gBACnB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,GAAG,CAAC,UAAU,CAAC,IAAI,KAAK,QAAQ;oBAC5B,CAAC,CAAC;wBACI,gBAAgB,EAAE,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE;4BACnD,cAAc,EAAE,EAAE;4BAClB,GAAG,EAAE,UAAU,CAAC,GAAG;yBACtB,CAAC;qBACL;oBACH,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;aAC9B,CAAC,CAAC;QACP,CAAC;QACD,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,qBAAqB;YACjC,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE;gBACH,QAAQ;gBACR,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,OAAO,EAAE,GAAG,EAAE,IAAI;gBAClB,YAAY,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC;gBAC/C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;aAC3C;SACJ,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,aAAa;YACb,MAAM,EAAE;iBACH,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;iBAC/B,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,mBAAmB,CAAC;aAC3B,GAAG,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACrC,SAAS,CAAC,EAAE,EAAE,EAAE,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrE,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,EAAE;YACZ,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,2BAA2B,CAAC;aACnC,IAAI,CAAC,mBAAmB,CAAC;aACzB,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;aAChE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACrC,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACjF,OAAO;YACH,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;YACnC,YAAY,EAAE,oBAAoB,CAAC,UAAU,CAAC;YAC9C,aAAa;YACb,QAAQ;SACX,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,iBAAiB,CACtB,WAAwC,EACxC,MAAwC;IAExC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,IAAI,UAAU;QACV,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,8BAA8B,UAAU,EAAE,CAAC,CAAC;IAC9F,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrC,IACI,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,KAAK;YACN,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACxB,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,kBAAkB;YAErD,MAAM,IAAI,WAAW,CACjB,sBAAsB,EACtB,GAAG,UAAU,CAAC,GAAG,8DAA8D,CAClF,CAAC;IACV,CAAC;AACL,CAAC"}

package/packages/happy2-server/dist/modules/plugin/pluginInstallationGetRuntimeConfiguration.d.ts

@@ -0,0 +1,9 @@
+import type { DrizzleExecutor } from "../drizzle.js";
+import type { PluginSecretProtector } from "./secrets.js";
+import { type PluginRuntimeConfiguration } from "./types.js";
+/**
+ * Resolves one installed manifest into its private runtime configuration, revealing encrypted values only for process environment or remote header materialization.
+ * This read-only boundary does not mutate durable state and keeps secret recovery out of routes, catalog projections, and lifecycle orchestration.
+ */
+export declare function pluginInstallationGetRuntimeConfiguration(executor: DrizzleExecutor, secretProtector: PluginSecretProtector, installationId: string): Promise<PluginRuntimeConfiguration>;
+//# sourceMappingURL=pluginInstallationGetRuntimeConfiguration.d.ts.map

package/packages/happy2-server/dist/modules/plugin/pluginInstallationGetRuntimeConfiguration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginInstallationGetRuntimeConfiguration.d.ts","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginInstallationGetRuntimeConfiguration.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAOrD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAe,KAAK,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAG1E;;;GAGG;AACH,wBAAsB,yCAAyC,CAC3D,QAAQ,EAAE,eAAe,EACzB,eAAe,EAAE,qBAAqB,EACtC,cAAc,EAAE,MAAM,GACvB,OAAO,CAAC,0BAA0B,CAAC,CA0HrC"}

package/packages/happy2-server/dist/modules/plugin/pluginInstallationGetRuntimeConfiguration.js

@@ -0,0 +1,111 @@
+import { eq } from "drizzle-orm";
+import { agentImages, pluginInstallations, pluginInstallationVariables, plugins, } from "../schema.js";
+import { PluginError } from "./types.js";
+import { installedManifest } from "./impl/installedManifest.js";
+/**
+ * Resolves one installed manifest into its private runtime configuration, revealing encrypted values only for process environment or remote header materialization.
+ * This read-only boundary does not mutate durable state and keeps secret recovery out of routes, catalog projections, and lifecycle orchestration.
+ */
+export async function pluginInstallationGetRuntimeConfiguration(executor, secretProtector, installationId) {
+    const [row] = await executor
+        .select({
+        id: pluginInstallations.id,
+        pluginId: plugins.id,
+        shortName: plugins.shortName,
+        manifestJson: plugins.manifestJson,
+        packageDigest: plugins.packageDigest,
+        packageDirectory: plugins.packageDirectory,
+        containerName: pluginInstallations.containerName,
+        containerImageId: pluginInstallations.containerImageId,
+        selectedImageTag: agentImages.dockerTag,
+        selectedImageStatus: agentImages.status,
+    })
+        .from(pluginInstallations)
+        .innerJoin(plugins, eq(pluginInstallations.pluginId, plugins.id))
+        .leftJoin(agentImages, eq(agentImages.id, pluginInstallations.containerImageId))
+        .where(eq(pluginInstallations.id, installationId))
+        .limit(1);
+    if (!row)
+        throw new PluginError("not_found", "Plugin installation was not found");
+    const manifest = installedManifest(row.manifestJson);
+    const installedPackage = {
+        installationId: row.id,
+        pluginId: row.pluginId,
+        shortName: row.shortName,
+        packageDirectory: row.packageDirectory,
+        packageDigest: row.packageDigest,
+    };
+    if (!manifest.mcp)
+        return { ...installedPackage, type: "skills_only" };
+    const variableRows = await executor
+        .select({
+        key: pluginInstallationVariables.key,
+        kind: pluginInstallationVariables.kind,
+        textValue: pluginInstallationVariables.textValue,
+        secretCiphertext: pluginInstallationVariables.secretCiphertext,
+    })
+        .from(pluginInstallationVariables)
+        .where(eq(pluginInstallationVariables.installationId, installationId));
+    const environment = {};
+    for (const definition of manifest.variables) {
+        const variable = variableRows.find(({ key }) => key === definition.key);
+        if (!variable || variable.kind !== definition.kind)
+            throw new PluginError("broken_configuration", `Plugin variable ${definition.key} is missing or has the wrong kind`);
+        if (definition.kind === "secret") {
+            if (!variable.secretCiphertext)
+                throw new PluginError("broken_configuration", `Plugin secret ${definition.key} is missing`);
+            try {
+                environment[definition.key] = await secretProtector.reveal(variable.secretCiphertext, { installationId, key: definition.key });
+            }
+            catch {
+                throw new PluginError("broken_configuration", `Plugin secret ${definition.key} cannot be decrypted`);
+            }
+        }
+        else {
+            if (!variable.textValue)
+                throw new PluginError("broken_configuration", `Plugin variable ${definition.key} is missing`);
+            environment[definition.key] = variable.textValue;
+        }
+    }
+    if (manifest.mcp.type === "remote") {
+        const headers = Object.fromEntries(Object.entries(manifest.mcp.headers).map(([key, template]) => [
+            key,
+            template.replace(/\$\{([^}]+)\}/g, (_match, variable) => {
+                const value = environment[variable];
+                if (value === undefined)
+                    throw new PluginError("broken_configuration", `Remote MCP header references missing variable ${variable}`);
+                return value;
+            }),
+        ]));
+        if (Object.values(headers).some((value) => /\r|\n/.test(value)))
+            throw new PluginError("broken_configuration", "Resolved remote MCP headers may not contain newlines");
+        return {
+            ...installedPackage,
+            type: "remote",
+            url: manifest.mcp.url,
+            headers,
+        };
+    }
+    if (!row.containerName)
+        throw new PluginError("broken_configuration", "Plugin container name is missing");
+    let imageTag;
+    if (manifest.mcp.container) {
+        imageTag = `happy2-plugin:${row.packageDigest.replace(/^sha256:/, "")}`;
+    }
+    else {
+        if (!row.containerImageId || !row.selectedImageTag || row.selectedImageStatus !== "ready")
+            throw new PluginError("broken_configuration", "Selected plugin container image is missing or not ready");
+        imageTag = row.selectedImageTag;
+    }
+    return {
+        ...installedPackage,
+        type: "stdio",
+        command: manifest.mcp.command,
+        args: manifest.mcp.args,
+        environment,
+        containerName: row.containerName,
+        imageTag,
+        ...(manifest.mcp.container ? { bundledDockerfile: manifest.mcp.container.dockerfile } : {}),
+    };
+}
+//# sourceMappingURL=pluginInstallationGetRuntimeConfiguration.js.map

package/packages/happy2-server/dist/modules/plugin/pluginInstallationGetRuntimeConfiguration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginInstallationGetRuntimeConfiguration.js","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginInstallationGetRuntimeConfiguration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EACH,WAAW,EACX,mBAAmB,EACnB,2BAA2B,EAC3B,OAAO,GACV,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,WAAW,EAAmC,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC3D,QAAyB,EACzB,eAAsC,EACtC,cAAsB;IAEtB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,QAAQ;SACvB,MAAM,CAAC;QACJ,EAAE,EAAE,mBAAmB,CAAC,EAAE;QAC1B,QAAQ,EAAE,OAAO,CAAC,EAAE;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,aAAa,EAAE,mBAAmB,CAAC,aAAa;QAChD,gBAAgB,EAAE,mBAAmB,CAAC,gBAAgB;QACtD,gBAAgB,EAAE,WAAW,CAAC,SAAS;QACvC,mBAAmB,EAAE,WAAW,CAAC,MAAM;KAC1C,CAAC;SACD,IAAI,CAAC,mBAAmB,CAAC;SACzB,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;SAChE,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;SAC/E,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;SACjD,KAAK,CAAC,CAAC,CAAC,CAAC;IACd,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,mCAAmC,CAAC,CAAC;IAClF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,gBAAgB,GAAG;QACrB,cAAc,EAAE,GAAG,CAAC,EAAE;QACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,aAAa,EAAE,GAAG,CAAC,aAAa;KACnC,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,GAAG;QAAE,OAAO,EAAE,GAAG,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACvE,MAAM,YAAY,GAAG,MAAM,QAAQ;SAC9B,MAAM,CAAC;QACJ,GAAG,EAAE,2BAA2B,CAAC,GAAG;QACpC,IAAI,EAAE,2BAA2B,CAAC,IAAI;QACtC,SAAS,EAAE,2BAA2B,CAAC,SAAS;QAChD,gBAAgB,EAAE,2BAA2B,CAAC,gBAAgB;KACjE,CAAC;SACD,IAAI,CAAC,2BAA2B,CAAC;SACjC,KAAK,CAAC,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;IAC3E,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,CAAC,GAAG,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;YAC9C,MAAM,IAAI,WAAW,CACjB,sBAAsB,EACtB,mBAAmB,UAAU,CAAC,GAAG,mCAAmC,CACvE,CAAC;QACN,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,gBAAgB;gBAC1B,MAAM,IAAI,WAAW,CACjB,sBAAsB,EACtB,iBAAiB,UAAU,CAAC,GAAG,aAAa,CAC/C,CAAC;YACN,IAAI,CAAC;gBACD,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,eAAe,CAAC,MAAM,CACtD,QAAQ,CAAC,gBAAgB,EACzB,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAC1C,CAAC;YACN,CAAC;YAAC,MAAM,CAAC;gBACL,MAAM,IAAI,WAAW,CACjB,sBAAsB,EACtB,iBAAiB,UAAU,CAAC,GAAG,sBAAsB,CACxD,CAAC;YACN,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,QAAQ,CAAC,SAAS;gBACnB,MAAM,IAAI,WAAW,CACjB,sBAAsB,EACtB,mBAAmB,UAAU,CAAC,GAAG,aAAa,CACjD,CAAC;YACN,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC;QACrD,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAC9B,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC1D,GAAG;YACH,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,QAAgB,EAAE,EAAE;gBAC5D,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;gBACpC,IAAI,KAAK,KAAK,SAAS;oBACnB,MAAM,IAAI,WAAW,CACjB,sBAAsB,EACtB,iDAAiD,QAAQ,EAAE,CAC9D,CAAC;gBACN,OAAO,KAAK,CAAC;YACjB,CAAC,CAAC;SACL,CAAC,CACL,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3D,MAAM,IAAI,WAAW,CACjB,sBAAsB,EACtB,sDAAsD,CACzD,CAAC;QACN,OAAO;YACH,GAAG,gBAAgB;YACnB,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG;YACrB,OAAO;SACV,CAAC;IACN,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,aAAa;QAClB,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,kCAAkC,CAAC,CAAC;IACtF,IAAI,QAAgB,CAAC;IACrB,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACzB,QAAQ,GAAG,iBAAiB,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;IAC5E,CAAC;SAAM,CAAC;QACJ,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,mBAAmB,KAAK,OAAO;YACrF,MAAM,IAAI,WAAW,CACjB,sBAAsB,EACtB,yDAAyD,CAC5D,CAAC;QACN,QAAQ,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACpC,CAAC;IACD,OAAO;QACH,GAAG,gBAAgB;QACnB,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO;QAC7B,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI;QACvB,WAAW;QACX,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,QAAQ;QACR,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9F,CAAC;AACN,CAAC"}

package/packages/happy2-server/dist/modules/plugin/pluginInstallationGetStatus.d.ts

@@ -0,0 +1,11 @@
+import type { DrizzleExecutor } from "../drizzle.js";
+import { type PluginInstallationStatus } from "./types.js";
+/**
+ * Returns the current status and identity needed to authorize one installed plugin MCP connection without exposing its configuration.
+ * This read-only lookup does not mutate durable state and keeps MCP readiness enforcement at the installation boundary.
+ */
+export declare function pluginInstallationGetStatus(executor: DrizzleExecutor, installationId: string): Promise<{
+    id: string;
+    status: PluginInstallationStatus;
+}>;
+//# sourceMappingURL=pluginInstallationGetStatus.d.ts.map

package/packages/happy2-server/dist/modules/plugin/pluginInstallationGetStatus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginInstallationGetStatus.d.ts","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginInstallationGetStatus.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAe,KAAK,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAExE;;;GAGG;AACH,wBAAsB,2BAA2B,CAC7C,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,MAAM,GACvB,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,wBAAwB,CAAA;CAAE,CAAC,CAQ3D"}

package/packages/happy2-server/dist/modules/plugin/pluginInstallationGetStatus.js

@@ -0,0 +1,18 @@
+import { eq } from "drizzle-orm";
+import { pluginInstallations } from "../schema.js";
+import { PluginError } from "./types.js";
+/**
+ * Returns the current status and identity needed to authorize one installed plugin MCP connection without exposing its configuration.
+ * This read-only lookup does not mutate durable state and keeps MCP readiness enforcement at the installation boundary.
+ */
+export async function pluginInstallationGetStatus(executor, installationId) {
+    const [row] = await executor
+        .select({ id: pluginInstallations.id, status: pluginInstallations.status })
+        .from(pluginInstallations)
+        .where(eq(pluginInstallations.id, installationId))
+        .limit(1);
+    if (!row)
+        throw new PluginError("not_found", "Plugin installation was not found");
+    return { id: row.id, status: row.status };
+}
+//# sourceMappingURL=pluginInstallationGetStatus.js.map

package/packages/happy2-server/dist/modules/plugin/pluginInstallationGetStatus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginInstallationGetStatus.js","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginInstallationGetStatus.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,WAAW,EAAiC,MAAM,YAAY,CAAC;AAExE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC7C,QAAyB,EACzB,cAAsB;IAEtB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,QAAQ;SACvB,MAAM,CAAC,EAAE,EAAE,EAAE,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,mBAAmB,CAAC,MAAM,EAAE,CAAC;SAC1E,IAAI,CAAC,mBAAmB,CAAC;SACzB,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;SACjD,KAAK,CAAC,CAAC,CAAC,CAAC;IACd,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,mCAAmC,CAAC,CAAC;IAClF,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAkC,EAAE,CAAC;AAC1E,CAAC"}

package/packages/happy2-server/dist/modules/plugin/pluginInstallationList.d.ts

@@ -0,0 +1,8 @@
+import type { DrizzleExecutor } from "../drizzle.js";
+import type { PluginInstallationSummary } from "./types.js";
+/**
+ * Lists durable system plugin installations and their latest lifecycle state for an active server administrator.
+ * This read-only action does not mutate durable state and centralizes authorization before installation health is joined into the catalog.
+ */
+export declare function pluginInstallationList(executor: DrizzleExecutor, actorUserId: string): Promise<PluginInstallationSummary[]>;
+//# sourceMappingURL=pluginInstallationList.d.ts.map

package/packages/happy2-server/dist/modules/plugin/pluginInstallationList.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginInstallationList.d.ts","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginInstallationList.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIrD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAI5D;;;GAGG;AACH,wBAAsB,sBAAsB,CACxC,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAQtC"}