happy2 0.0.9 → 0.0.12

package/packages/happy2-server/dist/modules/plugin/pluginContainerInstanceInvalidate.d.ts

@@ -0,0 +1,12 @@
+import type { DrizzleExecutor } from "../drizzle.js";
+import type { MutationHint } from "../chat/types.js";
+/**
+ * Revokes one missing container incarnation in pluginInstallations only if it is still the installation's current authority.
+ * The guarded transaction prevents an old health check from invalidating a replacement and publishes the resulting failed lifecycle state.
+ */
+export declare function pluginContainerInstanceInvalidate(executor: DrizzleExecutor, input: {
+    installationId: string;
+    containerInstanceId: string;
+    detail: string;
+}): Promise<MutationHint | undefined>;
+//# sourceMappingURL=pluginContainerInstanceInvalidate.d.ts.map

package/packages/happy2-server/dist/modules/plugin/pluginContainerInstanceInvalidate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginContainerInstanceInvalidate.d.ts","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginContainerInstanceInvalidate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAMrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;GAGG;AACH,wBAAsB,iCAAiC,CACnD,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/E,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAwCnC"}

package/packages/happy2-server/dist/modules/plugin/pluginContainerInstanceInvalidate.js

@@ -0,0 +1,44 @@
+import { and, eq, sql } from "drizzle-orm";
+import { withTransaction } from "../drizzle.js";
+import { pluginInstallations } from "../schema.js";
+import { syncSequenceNext } from "../sync/syncSequenceNext.js";
+import { syncEventInsert } from "../sync/syncEventInsert.js";
+import { areaHint } from "../chat/areaHint.js";
+/**
+ * Revokes one missing container incarnation in pluginInstallations only if it is still the installation's current authority.
+ * The guarded transaction prevents an old health check from invalidating a replacement and publishes the resulting failed lifecycle state.
+ */
+export async function pluginContainerInstanceInvalidate(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        const [current] = await tx
+            .select({ id: pluginInstallations.id })
+            .from(pluginInstallations)
+            .where(and(eq(pluginInstallations.id, input.installationId), eq(pluginInstallations.containerInstanceId, input.containerInstanceId)))
+            .limit(1);
+        if (!current)
+            return undefined;
+        const sequence = await syncSequenceNext(tx);
+        const [updated] = await tx
+            .update(pluginInstallations)
+            .set({
+            containerInstanceId: null,
+            status: "failed",
+            statusDetail: input.detail,
+            lastError: "The recorded plugin container is not running.",
+            readyAt: null,
+            syncSequence: sequence,
+            updatedAt: sql `CURRENT_TIMESTAMP`,
+        })
+            .where(and(eq(pluginInstallations.id, input.installationId), eq(pluginInstallations.containerInstanceId, input.containerInstanceId)))
+            .returning({ id: pluginInstallations.id });
+        if (!updated)
+            return undefined;
+        await syncEventInsert(tx, {
+            sequence,
+            kind: "plugin.failed",
+            entityId: input.installationId,
+        });
+        return areaHint(sequence, "plugins");
+    });
+}
+//# sourceMappingURL=pluginContainerInstanceInvalidate.js.map

package/packages/happy2-server/dist/modules/plugin/pluginContainerInstanceInvalidate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginContainerInstanceInvalidate.js","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginContainerInstanceInvalidate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAG/C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACnD,QAAyB,EACzB,KAA8E;IAE9E,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,EAAE,EAAE,EAAE,mBAAmB,CAAC,EAAE,EAAE,CAAC;aACtC,IAAI,CAAC,mBAAmB,CAAC;aACzB,KAAK,CACF,GAAG,CACC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,KAAK,CAAC,cAAc,CAAC,EAChD,EAAE,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,CAAC,CACzE,CACJ;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,mBAAmB,CAAC;aAC3B,GAAG,CAAC;YACD,mBAAmB,EAAE,IAAI;YACzB,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,KAAK,CAAC,MAAM;YAC1B,SAAS,EAAE,+CAA+C;YAC1D,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,GAAG,CAAA,mBAAmB;SACpC,CAAC;aACD,KAAK,CACF,GAAG,CACC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,KAAK,CAAC,cAAc,CAAC,EAChD,EAAE,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,CAAC,CACzE,CACJ;aACA,SAAS,CAAC,EAAE,EAAE,EAAE,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,KAAK,CAAC,cAAc;SACjC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/plugin/pluginFindBySource.d.ts

@@ -0,0 +1,9 @@
+import type { DrizzleExecutor } from "../drizzle.js";
+/**
+ * Finds the durable system plugin for one catalog source so installation orchestration can reuse its immutable package snapshot.
+ * This read-only lookup does not mutate durable state and exists to avoid copying package files for ordinary additional installations.
+ */
+export declare function pluginFindBySource(executor: DrizzleExecutor, sourceKind: "builtin", sourceReference: string): Promise<{
+    id: string;
+} | undefined>;
+//# sourceMappingURL=pluginFindBySource.d.ts.map

package/packages/happy2-server/dist/modules/plugin/pluginFindBySource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginFindBySource.d.ts","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginFindBySource.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD;;;GAGG;AACH,wBAAsB,kBAAkB,CACpC,QAAQ,EAAE,eAAe,EACzB,UAAU,EAAE,SAAS,EACrB,eAAe,EAAE,MAAM,GACxB,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CASrC"}

package/packages/happy2-server/dist/modules/plugin/pluginFindBySource.js

@@ -0,0 +1,15 @@
+import { and, eq } from "drizzle-orm";
+import { plugins } from "../schema.js";
+/**
+ * Finds the durable system plugin for one catalog source so installation orchestration can reuse its immutable package snapshot.
+ * This read-only lookup does not mutate durable state and exists to avoid copying package files for ordinary additional installations.
+ */
+export async function pluginFindBySource(executor, sourceKind, sourceReference) {
+    const [row] = await executor
+        .select({ id: plugins.id })
+        .from(plugins)
+        .where(and(eq(plugins.sourceKind, sourceKind), eq(plugins.sourceReference, sourceReference)))
+        .limit(1);
+    return row;
+}
+//# sourceMappingURL=pluginFindBySource.js.map

package/packages/happy2-server/dist/modules/plugin/pluginFindBySource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginFindBySource.js","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginFindBySource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,QAAyB,EACzB,UAAqB,EACrB,eAAuB;IAEvB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,QAAQ;SACvB,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;SAC1B,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CACF,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,CACxF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACd,OAAO,GAAG,CAAC;AACf,CAAC"}

package/packages/happy2-server/dist/modules/plugin/pluginFunctionResultAcquire.d.ts

@@ -0,0 +1,23 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+import type { PluginFunctionResult } from "./types.js";
+export type PluginFunctionResultAcquireResult = {
+    kind: "acquired";
+} | {
+    kind: "in_progress";
+    retryAt: number;
+} | {
+    kind: "replay";
+    result: PluginFunctionResult;
+};
+/**
+ * Creates, replays, waits for, or conditionally takes over the durable pluginFunctionResults lease for one Rig call.
+ * The transaction admits one live MCP executor at a time while retaining a completed outcome indefinitely for event redelivery and restart recovery.
+ */
+export declare function pluginFunctionResultAcquire(executor: DrizzleExecutor, input: {
+    callId: string;
+    leaseExpiresAt: number;
+    leaseToken: string;
+    now: number;
+    sessionId: string;
+}): Promise<PluginFunctionResultAcquireResult>;
+//# sourceMappingURL=pluginFunctionResultAcquire.d.ts.map

package/packages/happy2-server/dist/modules/plugin/pluginFunctionResultAcquire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginFunctionResultAcquire.d.ts","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginFunctionResultAcquire.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AAGtE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,MAAM,iCAAiC,GACvC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEvD;;;GAGG;AACH,wBAAsB,2BAA2B,CAC7C,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IACH,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACrB,GACF,OAAO,CAAC,iCAAiC,CAAC,CAoD5C"}

package/packages/happy2-server/dist/modules/plugin/pluginFunctionResultAcquire.js

@@ -0,0 +1,54 @@
+import { and, eq, sql } from "drizzle-orm";
+import { withTransaction } from "../drizzle.js";
+import { pluginFunctionResults } from "../schema.js";
+import { parsePluginFunctionResult } from "./impl/pluginFunctionResult.js";
+/**
+ * Creates, replays, waits for, or conditionally takes over the durable pluginFunctionResults lease for one Rig call.
+ * The transaction admits one live MCP executor at a time while retaining a completed outcome indefinitely for event redelivery and restart recovery.
+ */
+export async function pluginFunctionResultAcquire(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        const lockedUntil = new Date(input.leaseExpiresAt).toISOString();
+        const [inserted] = await tx
+            .insert(pluginFunctionResults)
+            .values({
+            sessionId: input.sessionId,
+            callId: input.callId,
+            leaseToken: input.leaseToken,
+            lockedUntil,
+        })
+            .onConflictDoNothing()
+            .returning({ callId: pluginFunctionResults.callId });
+        if (inserted)
+            return { kind: "acquired" };
+        const [row] = await tx
+            .select({
+            lockedUntil: pluginFunctionResults.lockedUntil,
+            resolutionJson: pluginFunctionResults.resolutionJson,
+            status: pluginFunctionResults.status,
+        })
+            .from(pluginFunctionResults)
+            .where(and(eq(pluginFunctionResults.sessionId, input.sessionId), eq(pluginFunctionResults.callId, input.callId)))
+            .limit(1);
+        if (!row)
+            throw new Error("Plugin function result disappeared during acquisition");
+        if (row?.status === "completed") {
+            if (row.resolutionJson === null)
+                throw new Error("Completed plugin function result is missing its resolution");
+            return { kind: "replay", result: parsePluginFunctionResult(row.resolutionJson) };
+        }
+        if (row?.lockedUntil && Date.parse(row.lockedUntil) > input.now)
+            return { kind: "in_progress", retryAt: Date.parse(row.lockedUntil) };
+        await tx
+            .update(pluginFunctionResults)
+            .set({
+            leaseToken: input.leaseToken,
+            lockedUntil,
+            status: "in_progress",
+            updatedAt: sql `CURRENT_TIMESTAMP`,
+        })
+            .where(and(eq(pluginFunctionResults.sessionId, input.sessionId), eq(pluginFunctionResults.callId, input.callId)));
+        return { kind: "acquired" };
+    });
+}
+//# sourceMappingURL=pluginFunctionResultAcquire.js.map

package/packages/happy2-server/dist/modules/plugin/pluginFunctionResultAcquire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginFunctionResultAcquire.js","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginFunctionResultAcquire.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAQ3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC7C,QAAyB,EACzB,KAMC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;QACjE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,qBAAqB,CAAC;aAC7B,MAAM,CAAC;YACJ,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,WAAW;SACd,CAAC;aACD,mBAAmB,EAAE;aACrB,SAAS,CAAC,EAAE,MAAM,EAAE,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC;QACzD,IAAI,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACjB,MAAM,CAAC;YACJ,WAAW,EAAE,qBAAqB,CAAC,WAAW;YAC9C,cAAc,EAAE,qBAAqB,CAAC,cAAc;YACpD,MAAM,EAAE,qBAAqB,CAAC,MAAM;SACvC,CAAC;aACD,IAAI,CAAC,qBAAqB,CAAC;aAC3B,KAAK,CACF,GAAG,CACC,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,EACpD,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CACjD,CACJ;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACnF,IAAI,GAAG,EAAE,MAAM,KAAK,WAAW,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,cAAc,KAAK,IAAI;gBAC3B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAClF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,yBAAyB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,GAAG,EAAE,WAAW,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,GAAG;YAC3D,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACzE,MAAM,EAAE;aACH,MAAM,CAAC,qBAAqB,CAAC;aAC7B,GAAG,CAAC;YACD,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,WAAW;YACX,MAAM,EAAE,aAAa;YACrB,SAAS,EAAE,GAAG,CAAA,mBAAmB;SACpC,CAAC;aACD,KAAK,CACF,GAAG,CACC,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,EACpD,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CACjD,CACJ,CAAC;QACN,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/plugin/pluginFunctionResultComplete.d.ts

@@ -0,0 +1,13 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+import type { PluginFunctionResult } from "./types.js";
+/**
+ * Stores the terminal MCP outcome only while the caller owns the pluginFunctionResults lease for the Rig call.
+ * Lease fencing prevents a late or superseded executor from replacing the first durable resolution that Rig and every redelivery must observe.
+ */
+export declare function pluginFunctionResultComplete(executor: DrizzleExecutor, input: {
+    callId: string;
+    leaseToken: string;
+    result: PluginFunctionResult;
+    sessionId: string;
+}): Promise<PluginFunctionResult>;
+//# sourceMappingURL=pluginFunctionResultComplete.d.ts.map

package/packages/happy2-server/dist/modules/plugin/pluginFunctionResultComplete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginFunctionResultComplete.d.ts","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginFunctionResultComplete.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AAGtE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD;;;GAGG;AACH,wBAAsB,4BAA4B,CAC9C,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IACH,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACrB,GACF,OAAO,CAAC,oBAAoB,CAAC,CAsC/B"}

package/packages/happy2-server/dist/modules/plugin/pluginFunctionResultComplete.js

@@ -0,0 +1,37 @@
+import { and, eq, sql } from "drizzle-orm";
+import { withTransaction } from "../drizzle.js";
+import { pluginFunctionResults } from "../schema.js";
+import { parsePluginFunctionResult } from "./impl/pluginFunctionResult.js";
+/**
+ * Stores the terminal MCP outcome only while the caller owns the pluginFunctionResults lease for the Rig call.
+ * Lease fencing prevents a late or superseded executor from replacing the first durable resolution that Rig and every redelivery must observe.
+ */
+export async function pluginFunctionResultComplete(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        const [completed] = await tx
+            .update(pluginFunctionResults)
+            .set({
+            leaseToken: null,
+            lockedUntil: null,
+            resolutionJson: JSON.stringify(input.result),
+            status: "completed",
+            updatedAt: sql `CURRENT_TIMESTAMP`,
+        })
+            .where(and(eq(pluginFunctionResults.sessionId, input.sessionId), eq(pluginFunctionResults.callId, input.callId), eq(pluginFunctionResults.status, "in_progress"), eq(pluginFunctionResults.leaseToken, input.leaseToken)))
+            .returning({ resolutionJson: pluginFunctionResults.resolutionJson });
+        if (completed?.resolutionJson)
+            return parsePluginFunctionResult(completed.resolutionJson);
+        const [winner] = await tx
+            .select({
+            resolutionJson: pluginFunctionResults.resolutionJson,
+            status: pluginFunctionResults.status,
+        })
+            .from(pluginFunctionResults)
+            .where(and(eq(pluginFunctionResults.sessionId, input.sessionId), eq(pluginFunctionResults.callId, input.callId)))
+            .limit(1);
+        if (winner?.status === "completed" && winner.resolutionJson)
+            return parsePluginFunctionResult(winner.resolutionJson);
+        throw new Error("Plugin function result lease was lost before completion");
+    });
+}
+//# sourceMappingURL=pluginFunctionResultComplete.js.map

package/packages/happy2-server/dist/modules/plugin/pluginFunctionResultComplete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginFunctionResultComplete.js","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginFunctionResultComplete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAG3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAC9C,QAAyB,EACzB,KAKC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,qBAAqB,CAAC;aAC7B,GAAG,CAAC;YACD,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;YAC5C,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,GAAG,CAAA,mBAAmB;SACpC,CAAC;aACD,KAAK,CACF,GAAG,CACC,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,EACpD,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAC9C,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAAE,aAAa,CAAC,EAC/C,EAAE,CAAC,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CACzD,CACJ;aACA,SAAS,CAAC,EAAE,cAAc,EAAE,qBAAqB,CAAC,cAAc,EAAE,CAAC,CAAC;QACzE,IAAI,SAAS,EAAE,cAAc;YAAE,OAAO,yBAAyB,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC1F,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC;YACJ,cAAc,EAAE,qBAAqB,CAAC,cAAc;YACpD,MAAM,EAAE,qBAAqB,CAAC,MAAM;SACvC,CAAC;aACD,IAAI,CAAC,qBAAqB,CAAC;aAC3B,KAAK,CACF,GAAG,CACC,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,EACpD,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CACjD,CACJ;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,MAAM,EAAE,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,cAAc;YACvD,OAAO,yBAAyB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/plugin/pluginGetImage.d.ts

@@ -0,0 +1,17 @@
+import type { DrizzleExecutor } from "../drizzle.js";
+export interface StoredPluginImage {
+    pluginId: string;
+    shortName: string;
+    packageDigest: string;
+    packageDirectory: string;
+    storageKey: string;
+    contentType: string;
+    size: number;
+    checksumSha256: string;
+}
+/**
+ * Returns the private filesystem locator and public response metadata for one persisted plugin image after administrator authorization.
+ * This read-only boundary does not mutate durable state and prevents routes from reading package paths without a durable plugin record.
+ */
+export declare function pluginGetImage(executor: DrizzleExecutor, actorUserId: string, pluginId: string): Promise<StoredPluginImage>;
+//# sourceMappingURL=pluginGetImage.d.ts.map

package/packages/happy2-server/dist/modules/plugin/pluginGetImage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginGetImage.d.ts","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginGetImage.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAKrD,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAChC,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,CAAC,CAkB5B"}

package/packages/happy2-server/dist/modules/plugin/pluginGetImage.js

@@ -0,0 +1,29 @@
+import { eq } from "drizzle-orm";
+import { plugins } from "../schema.js";
+import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+import { PluginError } from "./types.js";
+/**
+ * Returns the private filesystem locator and public response metadata for one persisted plugin image after administrator authorization.
+ * This read-only boundary does not mutate durable state and prevents routes from reading package paths without a durable plugin record.
+ */
+export async function pluginGetImage(executor, actorUserId, pluginId) {
+    await userRequireServerAdmin(executor, actorUserId);
+    const [row] = await executor
+        .select({
+        pluginId: plugins.id,
+        shortName: plugins.shortName,
+        packageDigest: plugins.packageDigest,
+        packageDirectory: plugins.packageDirectory,
+        storageKey: plugins.imageStorageKey,
+        contentType: plugins.imageContentType,
+        size: plugins.imageSize,
+        checksumSha256: plugins.imageChecksumSha256,
+    })
+        .from(plugins)
+        .where(eq(plugins.id, pluginId))
+        .limit(1);
+    if (!row)
+        throw new PluginError("not_found", "System plugin was not found");
+    return row;
+}
+//# sourceMappingURL=pluginGetImage.js.map

package/packages/happy2-server/dist/modules/plugin/pluginGetImage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginGetImage.js","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginGetImage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAazC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,QAAyB,EACzB,WAAmB,EACnB,QAAgB;IAEhB,MAAM,sBAAsB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,QAAQ;SACvB,MAAM,CAAC;QACJ,QAAQ,EAAE,OAAO,CAAC,EAAE;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,UAAU,EAAE,OAAO,CAAC,eAAe;QACnC,WAAW,EAAE,OAAO,CAAC,gBAAgB;QACrC,IAAI,EAAE,OAAO,CAAC,SAAS;QACvB,cAAc,EAAE,OAAO,CAAC,mBAAmB;KAC9C,CAAC;SACD,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;SAC/B,KAAK,CAAC,CAAC,CAAC,CAAC;IACd,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC;AACf,CAAC"}

package/packages/happy2-server/dist/modules/plugin/pluginInstall.d.ts

@@ -0,0 +1,27 @@
+import type { DrizzleExecutor } from "../drizzle.js";
+import type { MutationHint } from "../chat/types.js";
+import type { PluginSecretProtector } from "./secrets.js";
+import { type PluginInstallationSummary, type PluginPackage } from "./types.js";
+export interface PluginPackageCandidate {
+    pluginId: string;
+    packageDirectory: string;
+    imageStorageKey: string;
+}
+/**
+ * Ensures one catalog package has a durable system plugin, then creates an independent installation with its own encrypted variables and container choice.
+ * The transaction commits plugins, pluginInstallations, pluginInstallationVariables, audit, and sync evidence together so no installation can reference a partial plugin record.
+ */
+export declare function pluginInstall(executor: DrizzleExecutor, secretProtector: PluginSecretProtector, input: {
+    actorUserId: string;
+    installationId: string;
+    plugin: PluginPackage;
+    candidate?: PluginPackageCandidate;
+    variables: Readonly<Record<string, string>>;
+    containerImageId?: string;
+}): Promise<{
+    hint: MutationHint;
+    installation: PluginInstallationSummary;
+    pluginCreated: boolean;
+    pluginId: string;
+}>;
+//# sourceMappingURL=pluginInstall.d.ts.map

package/packages/happy2-server/dist/modules/plugin/pluginInstall.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginInstall.d.ts","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginInstall.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAarD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAEH,KAAK,yBAAyB,EAE9B,KAAK,aAAa,EACrB,MAAM,YAAY,CAAC;AAQpB,MAAM,WAAW,sBAAsB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAC/B,QAAQ,EAAE,eAAe,EACzB,eAAe,EAAE,qBAAqB,EACtC,KAAK,EAAE;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B,GACF,OAAO,CAAC;IACP,IAAI,EAAE,YAAY,CAAC;IACnB,YAAY,EAAE,yBAAyB,CAAC;IACxC,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC,CAmKD"}

package/packages/happy2-server/dist/modules/plugin/pluginInstall.js

@@ -0,0 +1,180 @@
+import { and, eq } from "drizzle-orm";
+import { withTransaction } from "../drizzle.js";
+import { agentImages, pluginInstallations, pluginInstallationVariables, plugins, } from "../schema.js";
+import { userRequireServerAdmin } from "../chat/userRequireServerAdmin.js";
+import { chatAppendAudit } from "../chat/chatAppendAudit.js";
+import { syncSequenceNext } from "../sync/syncSequenceNext.js";
+import { syncEventInsert } from "../sync/syncEventInsert.js";
+import { areaHint } from "../chat/areaHint.js";
+import { PluginError, } from "./types.js";
+import { pluginInstallationSelection } from "./impl/installationSelection.js";
+import { asPluginInstallation } from "./impl/asInstallation.js";
+import { installedManifest } from "./impl/installedManifest.js";
+import { effectiveContainer } from "./impl/effectiveContainer.js";
+const MAX_VARIABLE_BYTES = 64 * 1024;
+/**
+ * Ensures one catalog package has a durable system plugin, then creates an independent installation with its own encrypted variables and container choice.
+ * The transaction commits plugins, pluginInstallations, pluginInstallationVariables, audit, and sync evidence together so no installation can reference a partial plugin record.
+ */
+export async function pluginInstall(executor, secretProtector, input) {
+    return withTransaction(executor, async (tx) => {
+        await userRequireServerAdmin(tx, input.actorUserId);
+        const [existing] = await tx
+            .select({ id: plugins.id, manifestJson: plugins.manifestJson })
+            .from(plugins)
+            .where(and(eq(plugins.sourceKind, input.plugin.source.kind), eq(plugins.sourceReference, input.plugin.source.reference)))
+            .limit(1);
+        let pluginId;
+        let manifest;
+        let pluginCreated = false;
+        if (existing) {
+            pluginId = existing.id;
+            manifest = installedManifest(existing.manifestJson);
+        }
+        else {
+            if (!input.candidate)
+                throw new Error("A new system plugin requires a persisted package candidate");
+            pluginId = input.candidate.pluginId;
+            manifest = input.plugin.manifest;
+            await tx.insert(plugins).values({
+                id: pluginId,
+                displayName: manifest.displayName,
+                shortName: manifest.shortName,
+                description: manifest.description,
+                sourceKind: input.plugin.source.kind,
+                sourceReference: input.plugin.source.reference,
+                sourceVersion: manifest.version,
+                packageDigest: input.plugin.packageDigest,
+                manifestJson: JSON.stringify(manifest),
+                packageDirectory: input.candidate.packageDirectory,
+                imageStorageKey: input.candidate.imageStorageKey,
+                imageContentType: input.plugin.image.contentType,
+                imageSize: input.plugin.image.size,
+                imageWidth: input.plugin.image.width,
+                imageHeight: input.plugin.image.height,
+                imageThumbhash: input.plugin.image.thumbhash,
+                imageChecksumSha256: input.plugin.image.checksumSha256,
+                installedByUserId: input.actorUserId,
+            });
+            pluginCreated = true;
+        }
+        const definitions = manifest.variables;
+        const mcp = manifest.mcp;
+        const localContainer = effectiveContainer(manifest);
+        validateVariables(definitions, input.variables);
+        const selectionRequired = Boolean(localContainer && !localContainer.dockerfile);
+        if (selectionRequired && !input.containerImageId)
+            throw new PluginError("broken_configuration", "containerImageId is required for this stdio MCP plugin");
+        if (!selectionRequired && input.containerImageId)
+            throw new PluginError("broken_configuration", "containerImageId is not accepted for this plugin");
+        if (input.containerImageId) {
+            const [image] = await tx
+                .select({ id: agentImages.id })
+                .from(agentImages)
+                .where(and(eq(agentImages.id, input.containerImageId), eq(agentImages.status, "ready")))
+                .limit(1);
+            if (!image)
+                throw new PluginError("broken_configuration", "The selected container image does not exist or is not ready");
+        }
+        const id = input.installationId;
+        const hasRuntime = Boolean(localContainer || mcp?.type === "remote");
+        const status = hasRuntime ? "preparing" : "ready";
+        const [created] = await tx
+            .insert(pluginInstallations)
+            .values({
+            id,
+            pluginId,
+            containerImageId: input.containerImageId,
+            containerName: localContainer ? `happy2-plugin-${id}` : null,
+            status,
+            statusDetail: hasRuntime
+                ? "Plugin runtime is queued for preparation."
+                : "Plugin skills are installed.",
+            installedByUserId: input.actorUserId,
+            readyAt: hasRuntime ? null : new Date().toISOString(),
+        })
+            .returning({ id: pluginInstallations.id });
+        if (!created)
+            throw new Error("Plugin installation was not created");
+        for (const definition of definitions) {
+            const value = input.variables[definition.key];
+            await tx.insert(pluginInstallationVariables).values({
+                installationId: id,
+                key: definition.key,
+                kind: definition.kind,
+                ...(definition.kind === "secret"
+                    ? {
+                        secretCiphertext: await secretProtector.protect(value, {
+                            installationId: id,
+                            key: definition.key,
+                        }),
+                    }
+                    : { textValue: value }),
+            });
+        }
+        await chatAppendAudit(tx, {
+            actorUserId: input.actorUserId,
+            action: "plugin.installed",
+            targetType: "plugin_installation",
+            targetId: id,
+            after: {
+                pluginId,
+                shortName: manifest.shortName,
+                version: manifest.version,
+                mcpType: mcp?.type,
+                container: Boolean(localContainer),
+                containerPermissions: localContainer?.permissions ?? [],
+                variableKeys: definitions.map(({ key }) => key),
+                containerImageId: input.containerImageId,
+            },
+        });
+        const sequence = await syncSequenceNext(tx);
+        if (pluginCreated)
+            await tx
+                .update(plugins)
+                .set({ syncSequence: sequence })
+                .where(eq(plugins.id, pluginId));
+        const [updated] = await tx
+            .update(pluginInstallations)
+            .set({ syncSequence: sequence })
+            .where(eq(pluginInstallations.id, id))
+            .returning({ id: pluginInstallations.id });
+        if (!updated)
+            throw new Error("Plugin installation was not updated");
+        await syncEventInsert(tx, {
+            sequence,
+            kind: "plugin.installed",
+            entityId: id,
+            actorUserId: input.actorUserId,
+        });
+        const [projection] = await tx
+            .select(pluginInstallationSelection)
+            .from(pluginInstallations)
+            .innerJoin(plugins, eq(pluginInstallations.pluginId, plugins.id))
+            .where(eq(pluginInstallations.id, id))
+            .limit(1);
+        if (!projection)
+            throw new Error("Plugin installation projection was not found");
+        return {
+            hint: areaHint(sequence, "plugins"),
+            installation: asPluginInstallation(projection),
+            pluginCreated,
+            pluginId,
+        };
+    });
+}
+function validateVariables(definitions, values) {
+    const expected = new Set(definitions.map(({ key }) => key));
+    const unexpected = Object.keys(values).find((key) => !expected.has(key));
+    if (unexpected)
+        throw new PluginError("broken_configuration", `Unexpected plugin variable ${unexpected}`);
+    for (const definition of definitions) {
+        const value = values[definition.key];
+        if (typeof value !== "string" ||
+            !value ||
+            value.includes("\u0000") ||
+            Buffer.byteLength(value, "utf8") > MAX_VARIABLE_BYTES)
+            throw new PluginError("broken_configuration", `${definition.key} must be a valid environment value between 1 byte and 64 KiB`);
+    }
+}
+//# sourceMappingURL=pluginInstall.js.map

package/packages/happy2-server/dist/modules/plugin/pluginInstall.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginInstall.js","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginInstall.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACH,WAAW,EACX,mBAAmB,EACnB,2BAA2B,EAC3B,OAAO,GACV,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAG/C,OAAO,EACH,WAAW,GAId,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAQrC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,QAAyB,EACzB,eAAsC,EACtC,KAOC;IAOD,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;aAC9D,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CACF,GAAG,CACC,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAChD,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAC7D,CACJ;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,QAAgB,CAAC;QACrB,IAAI,QAAwB,CAAC;QAC7B,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,QAAQ,EAAE,CAAC;YACX,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC;YACvB,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,KAAK,CAAC,SAAS;gBAChB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAClF,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;YACpC,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;YACjC,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;gBAC5B,EAAE,EAAE,QAAQ;gBACZ,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI;gBACpC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS;gBAC9C,aAAa,EAAE,QAAQ,CAAC,OAAO;gBAC/B,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;gBACzC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;gBACtC,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,gBAAgB;gBAClD,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe;gBAChD,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW;gBAChD,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI;gBAClC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK;gBACpC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM;gBACtC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS;gBAC5C,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc;gBACtD,iBAAiB,EAAE,KAAK,CAAC,WAAW;aACvC,CAAC,CAAC;YACH,aAAa,GAAG,IAAI,CAAC;QACzB,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,SAAS,CAAC;QACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;QACzB,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACpD,iBAAiB,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,iBAAiB,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAChF,IAAI,iBAAiB,IAAI,CAAC,KAAK,CAAC,gBAAgB;YAC5C,MAAM,IAAI,WAAW,CACjB,sBAAsB,EACtB,wDAAwD,CAC3D,CAAC;QACN,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,gBAAgB;YAC5C,MAAM,IAAI,WAAW,CACjB,sBAAsB,EACtB,kDAAkD,CACrD,CAAC;QACN,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YACzB,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;iBAC9B,IAAI,CAAC,WAAW,CAAC;iBACjB,KAAK,CACF,GAAG,CACC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,gBAAgB,CAAC,EAC1C,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAClC,CACJ;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YACd,IAAI,CAAC,KAAK;gBACN,MAAM,IAAI,WAAW,CACjB,sBAAsB,EACtB,6DAA6D,CAChE,CAAC;QACV,CAAC;QAED,MAAM,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC;QAChC,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,mBAAmB,CAAC;aAC3B,MAAM,CAAC;YACJ,EAAE;YACF,QAAQ;YACR,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;YAC5D,MAAM;YACN,YAAY,EAAE,UAAU;gBACpB,CAAC,CAAC,2CAA2C;gBAC7C,CAAC,CAAC,8BAA8B;YACpC,iBAAiB,EAAE,KAAK,CAAC,WAAW;YACpC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACxD,CAAC;aACD,SAAS,CAAC,EAAE,EAAE,EAAE,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAE,CAAC;YAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,MAAM,CAAC;gBAChD,cAAc,EAAE,EAAE;gBAClB,GAAG,EAAE,UAAU,CAAC,GAAG;gBACnB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,GAAG,CAAC,UAAU,CAAC,IAAI,KAAK,QAAQ;oBAC5B,CAAC,CAAC;wBACI,gBAAgB,EAAE,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE;4BACnD,cAAc,EAAE,EAAE;4BAClB,GAAG,EAAE,UAAU,CAAC,GAAG;yBACtB,CAAC;qBACL;oBACH,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;aAC9B,CAAC,CAAC;QACP,CAAC;QACD,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,qBAAqB;YACjC,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE;gBACH,QAAQ;gBACR,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,OAAO,EAAE,GAAG,EAAE,IAAI;gBAClB,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC;gBAClC,oBAAoB,EAAE,cAAc,EAAE,WAAW,IAAI,EAAE;gBACvD,YAAY,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC;gBAC/C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;aAC3C;SACJ,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,aAAa;YACb,MAAM,EAAE;iBACH,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;iBAC/B,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,mBAAmB,CAAC;aAC3B,GAAG,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACrC,SAAS,CAAC,EAAE,EAAE,EAAE,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrE,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,EAAE;YACZ,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,2BAA2B,CAAC;aACnC,IAAI,CAAC,mBAAmB,CAAC;aACzB,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;aAChE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACrC,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACjF,OAAO;YACH,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;YACnC,YAAY,EAAE,oBAAoB,CAAC,UAAU,CAAC;YAC9C,aAAa;YACb,QAAQ;SACX,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,iBAAiB,CACtB,WAAwC,EACxC,MAAwC;IAExC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,IAAI,UAAU;QACV,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,8BAA8B,UAAU,EAAE,CAAC,CAAC;IAC9F,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrC,IACI,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,KAAK;YACN,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACxB,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,kBAAkB;YAErD,MAAM,IAAI,WAAW,CACjB,sBAAsB,EACtB,GAAG,UAAU,CAAC,GAAG,8DAA8D,CAClF,CAAC;IACV,CAAC;AACL,CAAC"}

package/packages/happy2-server/dist/modules/plugin/pluginInstallationGetRuntimeConfiguration.d.ts

@@ -0,0 +1,9 @@
+import type { DrizzleExecutor } from "../drizzle.js";
+import type { PluginSecretProtector } from "./secrets.js";
+import { type PluginRuntimeConfiguration } from "./types.js";
+/**
+ * Resolves one installed manifest into its private runtime configuration, revealing encrypted values only for process environment or remote header materialization.
+ * This read-only boundary does not mutate durable state and keeps secret recovery out of routes, catalog projections, and lifecycle orchestration.
+ */
+export declare function pluginInstallationGetRuntimeConfiguration(executor: DrizzleExecutor, secretProtector: PluginSecretProtector, installationId: string): Promise<PluginRuntimeConfiguration>;
+//# sourceMappingURL=pluginInstallationGetRuntimeConfiguration.d.ts.map

package/packages/happy2-server/dist/modules/plugin/pluginInstallationGetRuntimeConfiguration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginInstallationGetRuntimeConfiguration.d.ts","sourceRoot":"","sources":["../../../sources/modules/plugin/pluginInstallationGetRuntimeConfiguration.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAOrD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAe,KAAK,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAI1E;;;GAGG;AACH,wBAAsB,yCAAyC,CAC3D,QAAQ,EAAE,eAAe,EACzB,eAAe,EAAE,qBAAqB,EACtC,cAAc,EAAE,MAAM,GACvB,OAAO,CAAC,0BAA0B,CAAC,CAoIrC"}