happy2 0.0.5 → 0.0.9

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToAgent.d.ts

@@ -0,0 +1,12 @@
+import { type MutationHint } from "../chat/types.js";
+import { type DrizzleExecutor } from "../drizzle.js";
+/**
+ * Grants an agent access to a secret by inserting the unique agentSecretAgentAssignments relationship after administrator checks.
+ * Keeping the grant, audit entry, and sync event together prevents silent expansion of an agent's runtime credentials.
+ */
+export declare function agentSecretAttachToAgent(executor: DrizzleExecutor, input: {
+    actorUserId: string;
+    agentUserId: string;
+    secretId: string;
+}): Promise<MutationHint | undefined>;
+//# sourceMappingURL=agentSecretAttachToAgent.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToAgent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretAttachToAgent.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAttachToAgent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AAWtE;;;GAGG;AACH,wBAAsB,wBAAwB,CAC1C,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CACpB,GACF,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CA+CnC"}

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToAgent.js

@@ -0,0 +1,58 @@
+import { CollaborationError } from "../chat/types.js";
+import { withTransaction } from "../drizzle.js";
+import { agentSecretAgentAssignments, users } from "../schema.js";
+import { and, eq, isNull } from "drizzle-orm";
+import { areaHint } from "../chat/areaHint.js";
+import { chatAppendAudit } from "../chat/chatAppendAudit.js";
+import { syncEventInsert } from "../sync/syncEventInsert.js";
+import { syncSequenceNext } from "../sync/syncSequenceNext.js";
+import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+/**
+ * Grants an agent access to a secret by inserting the unique agentSecretAgentAssignments relationship after administrator checks.
+ * Keeping the grant, audit entry, and sync event together prevents silent expansion of an agent's runtime credentials.
+ */
+export async function agentSecretAttachToAgent(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        await userRequireServerAdmin(tx, input.actorUserId);
+        const [agent] = await tx
+            .select({
+            id: users.id,
+        })
+            .from(users)
+            .where(and(eq(users.id, input.agentUserId), eq(users.kind, "agent"), isNull(users.deletedAt)))
+            .limit(1);
+        if (!agent)
+            throw new CollaborationError("not_found", "Agent was not found");
+        const inserted = await tx
+            .insert(agentSecretAgentAssignments)
+            .values({
+            secretId: input.secretId,
+            agentUserId: input.agentUserId,
+            createdByUserId: input.actorUserId,
+        })
+            .onConflictDoNothing()
+            .returning({
+            secretId: agentSecretAgentAssignments.secretId,
+        });
+        if (!inserted.length)
+            return undefined;
+        const sequence = await syncSequenceNext(tx);
+        await syncEventInsert(tx, {
+            sequence,
+            kind: "agentSecret.attachedToAgent",
+            entityId: input.secretId,
+            actorUserId: input.actorUserId,
+        });
+        await chatAppendAudit(tx, {
+            actorUserId: input.actorUserId,
+            action: "agent_secret.attached_to_agent",
+            targetType: "user",
+            targetId: input.agentUserId,
+            after: {
+                secretId: input.secretId,
+            },
+        });
+        return areaHint(sequence, "agent-secrets");
+    });
+}
+//# sourceMappingURL=agentSecretAttachToAgent.js.map

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToAgent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretAttachToAgent.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAttachToAgent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC1C,QAAyB,EACzB,KAIC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC;YACJ,EAAE,EAAE,KAAK,CAAC,EAAE;SACf,CAAC;aACD,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CACF,GAAG,CACC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,EAC/B,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EACvB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAC1B,CACJ;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,2BAA2B,CAAC;aACnC,MAAM,CAAC;YACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,KAAK,CAAC,WAAW;SACrC,CAAC;aACD,mBAAmB,EAAE;aACrB,SAAS,CAAC;YACP,QAAQ,EAAE,2BAA2B,CAAC,QAAQ;SACjD,CAAC,CAAC;QACP,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,6BAA6B;YACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,gCAAgC;YACxC,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,KAAK,EAAE;gBACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;aAC3B;SACJ,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToChannel.d.ts

@@ -0,0 +1,12 @@
+import { type MutationHint } from "../chat/types.js";
+import { type DrizzleExecutor } from "../drizzle.js";
+/**
+ * Grants a secret identifier to an existing channel through agentSecretChannelAssignments after validating server-administrator authority and channel eligibility.
+ * The assignment, audit entry, and sync event commit together so the resulting credential exposure is never silent or partially reported.
+ */
+export declare function agentSecretAttachToChannel(executor: DrizzleExecutor, input: {
+    actorUserId: string;
+    channelId: string;
+    secretId: string;
+}): Promise<MutationHint | undefined>;
+//# sourceMappingURL=agentSecretAttachToChannel.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToChannel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretAttachToChannel.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAttachToChannel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AAWtE;;;GAGG;AACH,wBAAsB,0BAA0B,CAC5C,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CACpB,GACF,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAgDnC"}

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToChannel.js

@@ -0,0 +1,59 @@
+import { CollaborationError } from "../chat/types.js";
+import { withTransaction } from "../drizzle.js";
+import { agentSecretChannelAssignments, chats } from "../schema.js";
+import { and, eq, inArray, isNull } from "drizzle-orm";
+import { areaHint } from "../chat/areaHint.js";
+import { chatAppendAudit } from "../chat/chatAppendAudit.js";
+import { syncEventInsert } from "../sync/syncEventInsert.js";
+import { syncSequenceNext } from "../sync/syncSequenceNext.js";
+import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+/**
+ * Grants a secret identifier to an existing channel through agentSecretChannelAssignments after validating server-administrator authority and channel eligibility.
+ * The assignment, audit entry, and sync event commit together so the resulting credential exposure is never silent or partially reported.
+ */
+export async function agentSecretAttachToChannel(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        await userRequireServerAdmin(tx, input.actorUserId);
+        const [channel] = await tx
+            .select({
+            id: chats.id,
+        })
+            .from(chats)
+            .where(and(eq(chats.id, input.channelId), inArray(chats.kind, ["public_channel", "private_channel"]), isNull(chats.deletedAt)))
+            .limit(1);
+        if (!channel)
+            throw new CollaborationError("not_found", "Channel was not found");
+        const inserted = await tx
+            .insert(agentSecretChannelAssignments)
+            .values({
+            secretId: input.secretId,
+            chatId: input.channelId,
+            createdByUserId: input.actorUserId,
+        })
+            .onConflictDoNothing()
+            .returning({
+            secretId: agentSecretChannelAssignments.secretId,
+        });
+        if (!inserted.length)
+            return undefined;
+        const sequence = await syncSequenceNext(tx);
+        await syncEventInsert(tx, {
+            sequence,
+            kind: "agentSecret.attachedToChannel",
+            entityId: input.secretId,
+            actorUserId: input.actorUserId,
+        });
+        await chatAppendAudit(tx, {
+            actorUserId: input.actorUserId,
+            action: "agent_secret.attached_to_channel",
+            targetType: "chat",
+            targetId: input.channelId,
+            chatId: input.channelId,
+            after: {
+                secretId: input.secretId,
+            },
+        });
+        return areaHint(sequence, "agent-secrets");
+    });
+}
+//# sourceMappingURL=agentSecretAttachToChannel.js.map

package/packages/happy2-server/dist/modules/agent/agentSecretAttachToChannel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretAttachToChannel.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAttachToChannel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,6BAA6B,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC5C,QAAyB,EACzB,KAIC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC;YACJ,EAAE,EAAE,KAAK,CAAC,EAAE;SACf,CAAC;aACD,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CACF,GAAG,CACC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,EAC7B,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC,EAC1D,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAC1B,CACJ;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,6BAA6B,CAAC;aACrC,MAAM,CAAC;YACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,SAAS;YACvB,eAAe,EAAE,KAAK,CAAC,WAAW;SACrC,CAAC;aACD,mBAAmB,EAAE;aACrB,SAAS,CAAC;YACP,QAAQ,EAAE,6BAA6B,CAAC,QAAQ;SACnD,CAAC,CAAC;QACP,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,+BAA+B;YACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,kCAAkC;YAC1C,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,MAAM,EAAE,KAAK,CAAC,SAAS;YACvB,KAAK,EAAE;gBACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;aAC3B;SACJ,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretAuthorizeManagement.d.ts

@@ -0,0 +1,7 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+/**
+ * Requires the actor to have an active profile and server-administrator role before any agent-secret management operation proceeds.
+ * A shared authorization entry point keeps secret assignment routes from drifting to weaker account or profile checks.
+ */
+export declare function agentSecretAuthorizeManagement(executor: DrizzleExecutor, actorUserId: string): Promise<void>;
+//# sourceMappingURL=agentSecretAuthorizeManagement.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentSecretAuthorizeManagement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretAuthorizeManagement.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAuthorizeManagement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;GAGG;AACH,wBAAsB,8BAA8B,CAChD,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/packages/happy2-server/dist/modules/agent/agentSecretAuthorizeManagement.js

@@ -0,0 +1,10 @@
+import {} from "../drizzle.js";
+import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+/**
+ * Requires the actor to have an active profile and server-administrator role before any agent-secret management operation proceeds.
+ * A shared authorization entry point keeps secret assignment routes from drifting to weaker account or profile checks.
+ */
+export async function agentSecretAuthorizeManagement(executor, actorUserId) {
+    await userRequireServerAdmin(executor, actorUserId);
+}
+//# sourceMappingURL=agentSecretAuthorizeManagement.js.map

package/packages/happy2-server/dist/modules/agent/agentSecretAuthorizeManagement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretAuthorizeManagement.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretAuthorizeManagement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAChD,QAAyB,EACzB,WAAmB;IAEnB,MAAM,sBAAsB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AACxD,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretBindingList.d.ts

@@ -0,0 +1,11 @@
+import { type AgentSecretBinding } from "./impl/agentSecretBinding.js";
+import { type DrizzleExecutor } from "../drizzle.js";
+/**
+ * Projects optional agent or chat Rig bindings with the union of direct-agent secrets and channel secrets available to an active agent member.
+ * Excluding channel grants after membership ends prevents a retained runtime binding from continuing to inherit chat-scoped credentials.
+ */
+export declare function agentSecretBindingList(executor: DrizzleExecutor, input?: {
+    agentUserId?: string;
+    chatId?: string;
+}): Promise<AgentSecretBinding[]>;
+//# sourceMappingURL=agentSecretBindingList.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentSecretBindingList.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretBindingList.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretBindingList.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AASrD;;;GAGG;AACH,wBAAsB,sBAAsB,CACxC,QAAQ,EAAE,eAAe,EACzB,KAAK,GAAE;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACd,GACP,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAiE/B"}

package/packages/happy2-server/dist/modules/agent/agentSecretBindingList.js

@@ -0,0 +1,69 @@
+import {} from "./impl/agentSecretBinding.js";
+import {} from "../drizzle.js";
+import { and, eq, inArray, isNull } from "drizzle-orm";
+import { agentRigBindings, agentSecretAgentAssignments, agentSecretChannelAssignments, chatMembers, } from "../schema.js";
+/**
+ * Projects optional agent or chat Rig bindings with the union of direct-agent secrets and channel secrets available to an active agent member.
+ * Excluding channel grants after membership ends prevents a retained runtime binding from continuing to inherit chat-scoped credentials.
+ */
+export async function agentSecretBindingList(executor, input = {}) {
+    const conditions = [
+        input.agentUserId ? eq(agentRigBindings.userId, input.agentUserId) : undefined,
+        input.chatId ? eq(agentRigBindings.chatId, input.chatId) : undefined,
+    ].filter((condition) => condition !== undefined);
+    const bindings = await executor
+        .select({
+        agentUserId: agentRigBindings.userId,
+        chatId: agentRigBindings.chatId,
+        sessionId: agentRigBindings.sessionId,
+        activeMemberUserId: chatMembers.userId,
+    })
+        .from(agentRigBindings)
+        .leftJoin(chatMembers, and(eq(chatMembers.chatId, agentRigBindings.chatId), eq(chatMembers.userId, agentRigBindings.userId), isNull(chatMembers.leftAt)))
+        .where(conditions.length ? and(...conditions) : undefined)
+        .orderBy(agentRigBindings.userId, agentRigBindings.chatId);
+    if (!bindings.length)
+        return [];
+    const agentUserIds = [...new Set(bindings.map((binding) => binding.agentUserId))];
+    const chatIds = [...new Set(bindings.map((binding) => binding.chatId))];
+    const [agentRows, channelRows] = await Promise.all([
+        executor
+            .select({
+            secretId: agentSecretAgentAssignments.secretId,
+            agentUserId: agentSecretAgentAssignments.agentUserId,
+        })
+            .from(agentSecretAgentAssignments)
+            .where(inArray(agentSecretAgentAssignments.agentUserId, agentUserIds)),
+        executor
+            .select({
+            secretId: agentSecretChannelAssignments.secretId,
+            chatId: agentSecretChannelAssignments.chatId,
+        })
+            .from(agentSecretChannelAssignments)
+            .where(inArray(agentSecretChannelAssignments.chatId, chatIds)),
+    ]);
+    const agentSecrets = new Map();
+    const channelSecrets = new Map();
+    for (const row of agentRows) {
+        const ids = agentSecrets.get(row.agentUserId) ?? new Set();
+        ids.add(row.secretId);
+        agentSecrets.set(row.agentUserId, ids);
+    }
+    for (const row of channelRows) {
+        const ids = channelSecrets.get(row.chatId) ?? new Set();
+        ids.add(row.secretId);
+        channelSecrets.set(row.chatId, ids);
+    }
+    return bindings.map((binding) => ({
+        agentUserId: binding.agentUserId,
+        chatId: binding.chatId,
+        sessionId: binding.sessionId,
+        secretIds: [
+            ...new Set([
+                ...(agentSecrets.get(binding.agentUserId) ?? []),
+                ...(binding.activeMemberUserId ? (channelSecrets.get(binding.chatId) ?? []) : []),
+            ]),
+        ].sort(),
+    }));
+}
+//# sourceMappingURL=agentSecretBindingList.js.map

package/packages/happy2-server/dist/modules/agent/agentSecretBindingList.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretBindingList.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretBindingList.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAwB,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAY,MAAM,aAAa,CAAC;AACjE,OAAO,EACH,gBAAgB,EAChB,2BAA2B,EAC3B,6BAA6B,EAC7B,WAAW,GACd,MAAM,cAAc,CAAC;AAEtB;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CACxC,QAAyB,EACzB,KAAK,GAGD,EAAE;IAEN,MAAM,UAAU,GAAG;QACf,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;QAC9E,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;KACvE,CAAC,MAAM,CAAC,CAAC,SAAS,EAAoB,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,MAAM,QAAQ;SAC1B,MAAM,CAAC;QACJ,WAAW,EAAE,gBAAgB,CAAC,MAAM;QACpC,MAAM,EAAE,gBAAgB,CAAC,MAAM;QAC/B,SAAS,EAAE,gBAAgB,CAAC,SAAS;QACrC,kBAAkB,EAAE,WAAW,CAAC,MAAM;KACzC,CAAC;SACD,IAAI,CAAC,gBAAgB,CAAC;SACtB,QAAQ,CACL,WAAW,EACX,GAAG,CACC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAC/C,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAC/C,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAC7B,CACJ;SACA,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;SACzD,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/C,QAAQ;aACH,MAAM,CAAC;YACJ,QAAQ,EAAE,2BAA2B,CAAC,QAAQ;YAC9C,WAAW,EAAE,2BAA2B,CAAC,WAAW;SACvD,CAAC;aACD,IAAI,CAAC,2BAA2B,CAAC;aACjC,KAAK,CAAC,OAAO,CAAC,2BAA2B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC1E,QAAQ;aACH,MAAM,CAAC;YACJ,QAAQ,EAAE,6BAA6B,CAAC,QAAQ;YAChD,MAAM,EAAE,6BAA6B,CAAC,MAAM;SAC/C,CAAC;aACD,IAAI,CAAC,6BAA6B,CAAC;aACnC,KAAK,CAAC,OAAO,CAAC,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACrE,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QAChE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE;YACP,GAAG,IAAI,GAAG,CAAC;gBACP,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;gBAChD,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACpF,CAAC;SACL,CAAC,IAAI,EAAE;KACX,CAAC,CAAC,CAAC;AACR,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretDetachFromAgent.d.ts

@@ -0,0 +1,12 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+import { type MutationHint } from "../chat/types.js";
+/**
+ * Revokes a direct agent secret grant by deleting its agentSecretAgentAssignments row under administrator authorization.
+ * Publishing revocation and audit evidence in the same commit ensures future runs cannot retain a grant clients still believe exists.
+ */
+export declare function agentSecretDetachFromAgent(executor: DrizzleExecutor, input: {
+    actorUserId: string;
+    agentUserId: string;
+    secretId: string;
+}): Promise<MutationHint | undefined>;
+//# sourceMappingURL=agentSecretDetachFromAgent.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentSecretDetachFromAgent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretDetachFromAgent.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretDetachFromAgent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAUrD;;;GAGG;AACH,wBAAsB,0BAA0B,CAC5C,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CACpB,GACF,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAiCnC"}

package/packages/happy2-server/dist/modules/agent/agentSecretDetachFromAgent.js

@@ -0,0 +1,44 @@
+import { withTransaction } from "../drizzle.js";
+import {} from "../chat/types.js";
+import { agentSecretAgentAssignments } from "../schema.js";
+import { and, eq } from "drizzle-orm";
+import { areaHint } from "../chat/areaHint.js";
+import { chatAppendAudit } from "../chat/chatAppendAudit.js";
+import { syncEventInsert } from "../sync/syncEventInsert.js";
+import { syncSequenceNext } from "../sync/syncSequenceNext.js";
+import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+/**
+ * Revokes a direct agent secret grant by deleting its agentSecretAgentAssignments row under administrator authorization.
+ * Publishing revocation and audit evidence in the same commit ensures future runs cannot retain a grant clients still believe exists.
+ */
+export async function agentSecretDetachFromAgent(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        await userRequireServerAdmin(tx, input.actorUserId);
+        const removed = await tx
+            .delete(agentSecretAgentAssignments)
+            .where(and(eq(agentSecretAgentAssignments.secretId, input.secretId), eq(agentSecretAgentAssignments.agentUserId, input.agentUserId)))
+            .returning({
+            secretId: agentSecretAgentAssignments.secretId,
+        });
+        if (!removed.length)
+            return undefined;
+        const sequence = await syncSequenceNext(tx);
+        await syncEventInsert(tx, {
+            sequence,
+            kind: "agentSecret.detachedFromAgent",
+            entityId: input.secretId,
+            actorUserId: input.actorUserId,
+        });
+        await chatAppendAudit(tx, {
+            actorUserId: input.actorUserId,
+            action: "agent_secret.detached_from_agent",
+            targetType: "user",
+            targetId: input.agentUserId,
+            after: {
+                secretId: input.secretId,
+            },
+        });
+        return areaHint(sequence, "agent-secrets");
+    });
+}
+//# sourceMappingURL=agentSecretDetachFromAgent.js.map

package/packages/happy2-server/dist/modules/agent/agentSecretDetachFromAgent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretDetachFromAgent.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretDetachFromAgent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAqB,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC5C,QAAyB,EACzB,KAIC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,2BAA2B,CAAC;aACnC,KAAK,CACF,GAAG,CACC,EAAE,CAAC,2BAA2B,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EACxD,EAAE,CAAC,2BAA2B,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CACjE,CACJ;aACA,SAAS,CAAC;YACP,QAAQ,EAAE,2BAA2B,CAAC,QAAQ;SACjD,CAAC,CAAC;QACP,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,+BAA+B;YACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,kCAAkC;YAC1C,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,KAAK,EAAE;gBACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;aAC3B;SACJ,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretDetachFromChannel.d.ts

@@ -0,0 +1,12 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+import { type MutationHint } from "../chat/types.js";
+/**
+ * Revokes a channel's secret grant by removing the selected agentSecretChannelAssignments relationship after authorization.
+ * The shared audit and sync transition makes the loss of runtime access immediate and attributable to its administrator.
+ */
+export declare function agentSecretDetachFromChannel(executor: DrizzleExecutor, input: {
+    actorUserId: string;
+    channelId: string;
+    secretId: string;
+}): Promise<MutationHint | undefined>;
+//# sourceMappingURL=agentSecretDetachFromChannel.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentSecretDetachFromChannel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretDetachFromChannel.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretDetachFromChannel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAUrD;;;GAGG;AACH,wBAAsB,4BAA4B,CAC9C,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CACpB,GACF,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAkCnC"}

package/packages/happy2-server/dist/modules/agent/agentSecretDetachFromChannel.js

@@ -0,0 +1,45 @@
+import { withTransaction } from "../drizzle.js";
+import {} from "../chat/types.js";
+import { agentSecretChannelAssignments } from "../schema.js";
+import { and, eq } from "drizzle-orm";
+import { areaHint } from "../chat/areaHint.js";
+import { chatAppendAudit } from "../chat/chatAppendAudit.js";
+import { syncEventInsert } from "../sync/syncEventInsert.js";
+import { syncSequenceNext } from "../sync/syncSequenceNext.js";
+import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+/**
+ * Revokes a channel's secret grant by removing the selected agentSecretChannelAssignments relationship after authorization.
+ * The shared audit and sync transition makes the loss of runtime access immediate and attributable to its administrator.
+ */
+export async function agentSecretDetachFromChannel(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        await userRequireServerAdmin(tx, input.actorUserId);
+        const removed = await tx
+            .delete(agentSecretChannelAssignments)
+            .where(and(eq(agentSecretChannelAssignments.secretId, input.secretId), eq(agentSecretChannelAssignments.chatId, input.channelId)))
+            .returning({
+            secretId: agentSecretChannelAssignments.secretId,
+        });
+        if (!removed.length)
+            return undefined;
+        const sequence = await syncSequenceNext(tx);
+        await syncEventInsert(tx, {
+            sequence,
+            kind: "agentSecret.detachedFromChannel",
+            entityId: input.secretId,
+            actorUserId: input.actorUserId,
+        });
+        await chatAppendAudit(tx, {
+            actorUserId: input.actorUserId,
+            action: "agent_secret.detached_from_channel",
+            targetType: "chat",
+            targetId: input.channelId,
+            chatId: input.channelId,
+            after: {
+                secretId: input.secretId,
+            },
+        });
+        return areaHint(sequence, "agent-secrets");
+    });
+}
+//# sourceMappingURL=agentSecretDetachFromChannel.js.map

package/packages/happy2-server/dist/modules/agent/agentSecretDetachFromChannel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretDetachFromChannel.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretDetachFromChannel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAqB,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAC9C,QAAyB,EACzB,KAIC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,6BAA6B,CAAC;aACrC,KAAK,CACF,GAAG,CACC,EAAE,CAAC,6BAA6B,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAC1D,EAAE,CAAC,6BAA6B,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAC5D,CACJ;aACA,SAAS,CAAC;YACP,QAAQ,EAAE,6BAA6B,CAAC,QAAQ;SACnD,CAAC,CAAC;QACP,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,iCAAiC;YACvC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,oCAAoC;YAC5C,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,MAAM,EAAE,KAAK,CAAC,SAAS;YACvB,KAAK,EAAE;gBACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;aAC3B;SACJ,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentSecretRecordRegistration.d.ts

@@ -0,0 +1,11 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+import { type MutationHint } from "../chat/types.js";
+/**
+ * Records an administrator-authorized agent-secret registration as a global sync event and audit entry.
+ * The transaction keeps both durable records on the same sequence so observers cannot see an unaudited registration signal.
+ */
+export declare function agentSecretRecordRegistration(executor: DrizzleExecutor, input: {
+    actorUserId: string;
+    secretId: string;
+}): Promise<MutationHint>;
+//# sourceMappingURL=agentSecretRecordRegistration.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentSecretRecordRegistration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretRecordRegistration.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretRecordRegistration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAOrD;;;GAGG;AACH,wBAAsB,6BAA6B,CAC/C,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CACpB,GACF,OAAO,CAAC,YAAY,CAAC,CAkBvB"}

package/packages/happy2-server/dist/modules/agent/agentSecretRecordRegistration.js

@@ -0,0 +1,31 @@
+import { withTransaction } from "../drizzle.js";
+import {} from "../chat/types.js";
+import { areaHint } from "../chat/areaHint.js";
+import { chatAppendAudit } from "../chat/chatAppendAudit.js";
+import { syncEventInsert } from "../sync/syncEventInsert.js";
+import { syncSequenceNext } from "../sync/syncSequenceNext.js";
+import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+/**
+ * Records an administrator-authorized agent-secret registration as a global sync event and audit entry.
+ * The transaction keeps both durable records on the same sequence so observers cannot see an unaudited registration signal.
+ */
+export async function agentSecretRecordRegistration(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        await userRequireServerAdmin(tx, input.actorUserId);
+        const sequence = await syncSequenceNext(tx);
+        await syncEventInsert(tx, {
+            sequence,
+            kind: "agentSecret.registered",
+            entityId: input.secretId,
+            actorUserId: input.actorUserId,
+        });
+        await chatAppendAudit(tx, {
+            actorUserId: input.actorUserId,
+            action: "agent_secret.registered",
+            targetType: "agent_secret",
+            targetId: input.secretId,
+        });
+        return areaHint(sequence, "agent-secrets");
+    });
+}
+//# sourceMappingURL=agentSecretRecordRegistration.js.map

package/packages/happy2-server/dist/modules/agent/agentSecretRecordRegistration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSecretRecordRegistration.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentSecretRecordRegistration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAqB,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAC/C,QAAyB,EACzB,KAGC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,wBAAwB;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,yBAAyB;YACjC,UAAU,EAAE,cAAc;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;SAC3B,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentTurnCheckpoint.d.ts

@@ -0,0 +1,14 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+/**
+ * Stores the latest acknowledged Rig event position on the leased agentTurns row when the checkpoint moves forward.
+ * Ownership and monotonicity checks let a resumed worker continue safely without an older callback rewinding progress.
+ */
+export declare function agentTurnCheckpoint(executor: DrizzleExecutor, input: {
+    agentUserId: string;
+    baselineMessageCount: number;
+    lastSessionEventId?: string;
+    runId?: string;
+    userMessageId: string;
+    workerId: string;
+}): Promise<boolean>;
+//# sourceMappingURL=agentTurnCheckpoint.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentTurnCheckpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentTurnCheckpoint.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentTurnCheckpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AAItE;;;GAGG;AACH,wBAAsB,mBAAmB,CACrC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CACpB,GACF,OAAO,CAAC,OAAO,CAAC,CAmClB"}

package/packages/happy2-server/dist/modules/agent/agentTurnCheckpoint.js

@@ -0,0 +1,35 @@
+import { withTransaction } from "../drizzle.js";
+import { agentTurns } from "../schema.js";
+import { and, eq, sql } from "drizzle-orm";
+/**
+ * Stores the latest acknowledged Rig event position on the leased agentTurns row when the checkpoint moves forward.
+ * Ownership and monotonicity checks let a resumed worker continue safely without an older callback rewinding progress.
+ */
+export async function agentTurnCheckpoint(executor, input) {
+    // Use the repository's transactional write boundary so checkpoint
+    // persistence completes before session streaming begins.
+    const changed = await withTransaction(executor, (tx) => tx
+        .update(agentTurns)
+        .set({
+        baselineMessageCount: input.baselineMessageCount,
+        ...(input.lastSessionEventId === undefined
+            ? {}
+            : {
+                lastSessionEventId: input.lastSessionEventId,
+            }),
+        ...(input.runId === undefined
+            ? {}
+            : {
+                runId: input.runId,
+            }),
+        leaseExpiresAt: new Date(Date.now() + 45_000).toISOString(),
+        updatedAt: sql `CURRENT_TIMESTAMP`,
+        lastError: null,
+    })
+        .where(and(eq(agentTurns.userMessageId, input.userMessageId), eq(agentTurns.agentUserId, input.agentUserId), eq(agentTurns.workerId, input.workerId), eq(agentTurns.status, "running")))
+        .returning({
+        id: agentTurns.userMessageId,
+    }));
+    return changed.length === 1;
+}
+//# sourceMappingURL=agentTurnCheckpoint.js.map

package/packages/happy2-server/dist/modules/agent/agentTurnCheckpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentTurnCheckpoint.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentTurnCheckpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAE3C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,QAAyB,EACzB,KAOC;IAED,kEAAkE;IAClE,yDAAyD;IACzD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CACnD,EAAE;SACG,MAAM,CAAC,UAAU,CAAC;SAClB,GAAG,CAAC;QACD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS;YACtC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACI,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;aAC/C,CAAC;QACR,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS;YACzB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACI,KAAK,EAAE,KAAK,CAAC,KAAK;aACrB,CAAC;QACR,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE;QAC3D,SAAS,EAAE,GAAG,CAAA,mBAAmB;QACjC,SAAS,EAAE,IAAI;KAClB,CAAC;SACD,KAAK,CACF,GAAG,CACC,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,EACjD,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,EAC7C,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EACvC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CACnC,CACJ;SACA,SAAS,CAAC;QACP,EAAE,EAAE,UAAU,CAAC,aAAa;KAC/B,CAAC,CACT,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;AAChC,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentTurnComplete.d.ts

@@ -0,0 +1,18 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+import { type MessageSummary, type MutationHint } from "../chat/types.js";
+/**
+ * Completes a running agent turn only for its current worker, publishing or updating the final assistant message and all chat projections.
+ * Fixing the terminal status and completion event at this boundary keeps successful runs distinct from the failure reply path while sharing lease-safe finalization.
+ */
+export declare function agentTurnComplete(executor: DrizzleExecutor, input: {
+    agentUserId: string;
+    actorUserId: string;
+    sessionId: string;
+    userMessageId: string;
+    text: string;
+    workerId: string;
+}): Promise<{
+    message: MessageSummary;
+    hint: MutationHint;
+} | undefined>;
+//# sourceMappingURL=agentTurnComplete.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentTurnComplete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentTurnComplete.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentTurnComplete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAG1E;;;GAGG;AACH,wBAAsB,iBAAiB,CACnC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CACpB,GACF,OAAO,CACJ;IACI,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,YAAY,CAAC;CACtB,GACD,SAAS,CACd,CAMA"}

package/packages/happy2-server/dist/modules/agent/agentTurnComplete.js

@@ -0,0 +1,15 @@
+import {} from "../drizzle.js";
+import {} from "../chat/types.js";
+import { finishAgentTurn } from "./impl/finishAgentTurn.js";
+/**
+ * Completes a running agent turn only for its current worker, publishing or updating the final assistant message and all chat projections.
+ * Fixing the terminal status and completion event at this boundary keeps successful runs distinct from the failure reply path while sharing lease-safe finalization.
+ */
+export async function agentTurnComplete(executor, input) {
+    return finishAgentTurn(executor, {
+        ...input,
+        eventKind: "message.completed",
+        status: "complete",
+    });
+}
+//# sourceMappingURL=agentTurnComplete.js.map

package/packages/happy2-server/dist/modules/agent/agentTurnComplete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentTurnComplete.js","sourceRoot":"","sources":["../../../sources/modules/agent/agentTurnComplete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,MAAM,eAAe,CAAC;AACrD,OAAO,EAA0C,MAAM,kBAAkB,CAAC;AAE1E,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACnC,QAAyB,EACzB,KAOC;IAQD,OAAO,eAAe,CAAC,QAAQ,EAAE;QAC7B,GAAG,KAAK;QACR,SAAS,EAAE,mBAAmB;QAC9B,MAAM,EAAE,UAAU;KACrB,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/agent/agentTurnFail.d.ts

@@ -0,0 +1,18 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+import { type MessageSummary, type MutationHint } from "../chat/types.js";
+/**
+ * Fails a running agent turn only for its current worker, retaining the error and publishing the standard failure reply with terminal chat projections.
+ * Fixing the failed status, event kind, and user-visible text here prevents worker callers from reporting an inconsistent terminal outcome.
+ */
+export declare function agentTurnFail(executor: DrizzleExecutor, input: {
+    agentUserId: string;
+    actorUserId: string;
+    error: string;
+    sessionId: string;
+    userMessageId: string;
+    workerId: string;
+}): Promise<{
+    message: MessageSummary;
+    hint: MutationHint;
+} | undefined>;
+//# sourceMappingURL=agentTurnFail.d.ts.map

package/packages/happy2-server/dist/modules/agent/agentTurnFail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentTurnFail.d.ts","sourceRoot":"","sources":["../../../sources/modules/agent/agentTurnFail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAG1E;;;GAGG;AACH,wBAAsB,aAAa,CAC/B,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CACpB,GACF,OAAO,CACJ;IACI,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,YAAY,CAAC;CACtB,GACD,SAAS,CACd,CAYA"}