@codegame.dev/careerflow-mcp 1.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Shahab Yousefi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,398 @@
+# CareerFlow MCP Server
+
+Connect an AI assistant to [CareerFlow](https://careerflow.codegame.dev) so it can read and
+manage your tasks, track your time, message colleagues, work CRM deals, handle
+HR requests, and more — on your behalf.
+
+Works with any MCP-capable client — Claude Code, Claude Desktop, and others.
+
+> The server holds no privileges of its own. It calls the same REST API the web
+> app uses, authenticated as you, so your existing role still decides what it can
+> do — and the token's permissions narrow that further.
+
+---
+
+## Quick start
+
+### The one-command way
+
+```bash
+npx @codegame.dev/careerflow-mcp init
+```
+
+The setup wizard asks for your CareerFlow host and access token, detects which
+MCP clients you have installed, and writes the configuration into Claude Code,
+Claude Desktop, ZCode (Z.ai), or Cursor for you — or prints a ready-to-paste
+JSON block for any other client. Token input is hidden as you type; it is never
+passed on the command line.
+
+Flags prefill the answers, so an onboarding page can print a one-liner per
+company or client — only the token is still asked for (hidden):
+
+```bash
+npx @codegame.dev/careerflow-mcp init --base-url https://acme.careerflow.example --name acme --client claude-code
+npx @codegame.dev/careerflow-mcp init --base-url https://acme.careerflow.example --name acme --company-id 24 --client zcode
+```
+
+- `--base-url` — the CareerFlow host, so it is never typed by hand
+- `--name` — the server's name in the client config (default `careerflow`);
+  use one name per company or install, e.g. `acme`, `acme-staging`
+- `--company-id` — optional default company
+- `--client` — `claude-code`, `claude-desktop`, `zcode`, `cursor`, or `other`
+
+None of these flags is secret, so the one-liner is safe to publish. The access
+token is never accepted as a flag — argv is readable by other processes on the
+machine — so the wizard always prompts for it with hidden input.
+
+### The manual way
+
+1. Create an access token.
+
+   In CareerFlow: **Settings → Access Tokens → Create access token**.
+
+   Give it a name, an expiry, and only the permissions the assistant needs.
+
+   > **The token is shown once.** It is stored hashed and cannot be recovered
+   > afterwards. Copy it before closing the dialog.
+
+2. Add it to your client.
+
+**Claude Code**
+
+```bash
+claude mcp add careerflow \
+  --env CAREERFLOW_BASE_URL=https://your-careerflow-host \
+  --env CAREERFLOW_TOKEN=cf_pat_xxxxxxxx \
+  --env CAREERFLOW_COMPANY_ID=24 \
+  -- npx -y @codegame.dev/careerflow-mcp
+```
+
+**Claude Desktop** — add to `claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "careerflow": {
+      "command": "npx",
+      "args": ["-y", "@codegame.dev/careerflow-mcp"],
+      "env": {
+        "CAREERFLOW_BASE_URL": "https://your-careerflow-host",
+        "CAREERFLOW_TOKEN": "cf_pat_xxxxxxxx",
+        "CAREERFLOW_COMPANY_ID": "24"
+      }
+    }
+  }
+}
+```
+
+Config file locations:
+- macOS — `~/Library/Application Support/Claude/claude_desktop_config.json`
+- Windows — `%APPDATA%\Claude\claude_desktop_config.json`
+- Linux — `~/.config/Claude/claude_desktop_config.json`
+
+**ZCode (Z.ai)** — add to `~/.zcode/cli/config.json` (note the nested
+`mcp.servers`, different from most clients' `mcpServers`):
+
+```json
+{
+  "mcp": {
+    "servers": {
+      "careerflow": {
+        "type": "stdio",
+        "command": "npx",
+        "args": ["-y", "@codegame.dev/careerflow-mcp"],
+        "env": {
+          "CAREERFLOW_BASE_URL": "https://your-careerflow-host",
+          "CAREERFLOW_TOKEN": "cf_pat_xxxxxxxx",
+          "CAREERFLOW_COMPANY_ID": "24"
+        }
+      }
+    }
+  }
+}
+```
+
+For a project-shared server use `<repo>/.zcode/config.json` instead — but the
+token would then sit in a versioned file; prefer user scope.
+
+Restart the client. Ask it *"what are my tasks?"* to confirm the connection.
+
+### Configuration
+
+| Variable | Required | Description |
+| --- | --- | --- |
+| `CAREERFLOW_BASE_URL` | yes | API root, e.g. `https://api.example.com` |
+| `CAREERFLOW_TOKEN` | yes | Your personal access token (`cf_pat_…`) |
+| `CAREERFLOW_COMPANY_ID` | no | Default company, so tools need no `company_id` per call |
+| `CAREERFLOW_TIMEOUT_MS` | no | Request timeout, default `30000` |
+| `CAREERFLOW_GROUPS` | no | Register only these comma-separated tool groups |
+| `CAREERFLOW_EXCLUDE_GROUPS` | no | Register everything except these comma-separated groups |
+
+The token is read only from the environment, never from command-line arguments —
+argv is readable by other processes on the same machine.
+
+---
+
+## What you can ask for
+
+**Daily work**
+- "What am I working on today?" · "Anything overdue?"
+- "Mark the login-bug task done."
+- "Start a timer on task 412." · "Log 45 minutes on the report task."
+- "Add a comment on task 88 saying the API is now deployed."
+- "Add a checklist to task 12 with three items." · "Attach this link to task 40."
+
+**Supervising a team**
+- "What is Sara working on?" · "Show everything pending review."
+- "Create a task 'Prepare Q3 report' in Sprint 12, assign it to Ali, due Friday, high priority."
+- "Move task 91 to Done." · "Accept task 77 and score it 4.5."
+- "Create a project called 'Website Redesign' and add Sara as manager."
+
+**Sales & CRM**
+- "Show my open deals." · "Create a lead for Acme Corp from the website form."
+- "Move the Acme deal to Negotiation and set the amount to $12,000."
+- "Log a call with the Beta Inc contact." · "What's in my pipeline this month?"
+
+**HR & people ops**
+- "Show my latest payroll slip." · "Accept my performance review."
+- "List open job applications for the Backend Engineer posting."
+- "Am I registered for the current loan lottery?" · "Check in my mood: 4, feeling good today."
+- "Reserve lunch for tomorrow."
+
+**Around the work**
+- "Any new announcements?" · "Message Reza that the deploy finished."
+- "Create a chat group for the launch team with Sara, Ali, and Reza."
+- "Open a support ticket about the slow dashboard load."
+
+---
+
+## Tools
+
+164 tools. The everyday surface
+([only part of it can be registered](#registering-only-the-tool-groups-you-need)):
+
+| Group | Tools |
+| --- | --- |
+| **Identity & structure** | `whoami`, `list_companies`, `list_projects`, `list_boards`, `list_project_members`, `find_user` |
+| **Tasks** | `list_my_tasks`, `search_tasks`, `get_task`, `create_task`, `update_task`, `complete_task`, `assign_task`, `move_task`, `review_task`, `list_task_comments`, `add_task_comment` |
+| **Kanban (boards, labels, checklists, attachments)** | `create_board`, `edit_board`, `archive_board`, `list_labels`, `create_label`, `delete_label`, `add_task_checklist`, `add_checklist_item`, `complete_checklist_item`, `delete_checklist`, `add_task_link_attachment`, `delete_task_attachment`, `archive_task`, `duplicate_task`, `list_recurring_tasks`, `create_recurring_task`, `delete_recurring_task`, `list_kanban_activity` |
+| **Projects** | `create_project`, `update_project`, `archive_project`, `project_stats`, `invite_project_member`, `authorize_project_member` |
+| **Time** | `start_timer`, `stop_timer`, `log_time`, `list_task_time` |
+| **Chat** | `list_chats`, `read_messages`, `send_message`, `create_chat_group`, `edit_chat_group`, `manage_chat_group_members`, `list_chat_group_members`, `leave_chat_group`, `mute_chat`, `edit_chat_message`, `delete_chat_message`, `mark_message_seen` |
+| **Workplace** | `list_announcements`, `list_surveys`, `list_my_attendance` |
+| **Company & user admin** | `create_user`, `update_user`, `set_user_status`, `set_user_role`, `get_user`, `list_roles`, `get_organization_chart`, `get_company`, `list_organization_units` |
+| **CRM — contacts, deals, activities** | `crm_search_contacts`, `crm_get_contact`, `crm_create_contact`, `crm_update_contact`, `crm_delete_contact`, `crm_contact_timeline`, `crm_search_deals`, `crm_get_deal`, `crm_create_deal`, `crm_update_deal`, `crm_delete_deal`, `crm_deal_stage_summary`, `crm_add_deal_next_step`, `crm_list_deal_line_items`, `crm_add_deal_line_item`, `crm_delete_deal_line_item`, `crm_search_activities`, `crm_create_activity`, `crm_complete_activity`, `crm_delete_activity`, `crm_dashboard_summary`, `crm_dashboard_pipeline` |
+| **CRM — pipelines & config** | `crm_list_pipelines`, `crm_create_pipeline`, `crm_delete_pipeline`, `crm_list_stages`, `crm_create_stage`, `crm_delete_stage`, `crm_list_lead_sources`, `crm_create_lead_source`, `crm_list_tags`, `crm_create_tag`, `crm_assign_tag`, `crm_list_custom_fields`, `crm_create_custom_field`, `crm_settings` |
+| **HR — payroll, discipline, careers, onboarding, cafeteria** | `list_my_payrolls`, `respond_to_payroll`, `list_my_performance_reviews`, `respond_to_performance_review`, `list_disciplinary_notes`, `estimate_disciplinary_penalty`, `create_disciplinary_note`, `list_administrative_notes`, `get_administrative_note`, `create_administrative_note`, `list_careers`, `list_career_requests`, `update_career_request_status`, `get_onboarding_checklist`, `set_onboarding_stage`, `list_food_schedules`, `reserve_food`, `list_my_food_reservations`, `mood_checkin` |
+| **Benefit fund (loans & lotteries)** | `benefit_fund_my_dashboard`, `benefit_fund_hr_dashboard`, `list_benefit_fund_loan_types`, `list_benefit_fund_loans`, `request_benefit_fund_loan`, `update_benefit_fund_loan_status`, `pay_benefit_fund_loan_installment`, `list_benefit_fund_lotteries`, `register_for_lottery`, `respond_to_lottery_win`, `benefit_fund_settings`, `list_benefit_fund_membership_requests`, `request_benefit_fund_membership`, `review_benefit_fund_membership_request` |
+| **Forms** | `list_forms`, `get_form`, `list_form_submissions`, `update_form_submission_status`, `message_form_submission` |
+| **CMS** | `list_posts`, `get_post`, `create_post`, `update_post`, `delete_post`, `list_custom_pages`, `get_custom_page` |
+| **Dev tickets (support)** | `list_dev_tickets`, `get_dev_ticket`, `create_dev_ticket`, `reply_to_dev_ticket` |
+| **Misc (addresses, surveys, announcements, billing)** | `list_my_addresses`, `add_address`, `create_survey`, `delete_survey`, `list_survey_answers`, `answer_survey`, `create_announcement`, `delete_announcement`, `list_transactions`, `list_payment_orders` |
+
+---
+
+## Registering only the tool groups you need
+
+Every registered tool's schema lands in the model's context, so a client that
+loads all 164 tools spends real tokens on descriptions before you ask anything.
+If the assistant only works one domain — a sales assistant, a task bot —
+register just that slice:
+
+```json
+{
+  "mcpServers": {
+    "careerflow": {
+      "command": "npx",
+      "args": ["-y", "@codegame.dev/careerflow-mcp"],
+      "env": {
+        "CAREERFLOW_BASE_URL": "https://your-careerflow-host",
+        "CAREERFLOW_TOKEN": "cf_pat_xxxxxxxx",
+        "CAREERFLOW_GROUPS": "workspace,tasks,time"
+      }
+    }
+  }
+}
+```
+
+Group names (matching rows in the table above, `crm` covering both CRM rows,
+`chat` both chat modules):
+
+`workspace`, `tasks`, `kanban`, `projects`, `time`, `chat`, `workplace`,
+`admin`, `crm`, `hr`, `benefit-funds`, `forms`, `cms`, `dev-tickets`, `misc`
+
+`CAREERFLOW_GROUPS` is an allowlist; `CAREERFLOW_EXCLUDE_GROUPS` removes the
+named groups from the full set. An unknown name fails at startup with the valid
+list. Group filtering is a context-size control only — the token's scopes still
+decide what actually works.
+
+---
+
+## Permissions
+
+Each token carries an explicit permission list. A tool call that needs a
+permission the token lacks fails with a message naming the missing one — create a
+new token with it added. The full list is shown on the token creation screen in
+**Settings → Access Tokens → Create access token**; it's summarized here too.
+
+Every scope comes in a `:read`/`:write` pair; some also accept a `:own` suffix
+(e.g. `tasks:write:own`) that narrows the write to records the token's owner
+created, owns, or is assigned to — ask CareerFlow support or check the token
+creation screen if you want that narrower grant.
+
+| Group | Scopes | Covers |
+| --- | --- | --- |
+| Personal | `profile`, `files` | your own profile, sessions, addresses, onboarding; file/image/video uploads |
+| Work | `tasks`, `projects`, `time`, `chat` | kanban boards/tasks/checklists/labels, projects & membership, time tracking, chat & groups |
+| CRM | `crm_contacts`, `crm_deals`, `crm_activities`, `crm_settings` | contacts/leads, deals, activities, and CRM configuration (pipelines, stages, tags, custom fields) |
+| Company | `company`, `users`, `roles`, `attendance` | company profile & org chart, user admin, roles, attendance |
+| HR | `surveys`, `announcements`, `forms`, `payroll`, `performance`, `benefit_fund`, `notes`, `careers` | surveys, announcements, form builder, payroll/performance slips, benefit fund loans & lotteries, disciplinary/administrative notes, recruiting |
+| Content | `cms` | posts, custom pages, categories |
+| Billing | `billing`, `dev_tickets` | payment/product orders, transactions, support tickets |
+| Platform (staff-only) | `admin` | charts, logs, and other platform-admin surfaces — only issuable to CareerFlow staff accounts |
+
+Grant the narrowest set that does the job. A read-only assistant needs only
+`profile:read`, `tasks:read`, and `projects:read`.
+
+### Security notes
+
+- A token acts as you, limited to its permissions. Treat it like a password.
+- It cannot exceed your own role — the API enforces the same checks as the web app.
+- A token cannot create, edit, or manage another token — token management is a
+  session-only action in the web app, so a leaked token cannot widen itself.
+- Revoke any token you no longer use: **Settings → Access Tokens → Revoke**.
+  Revocation takes effect immediately.
+- Several tools deliver something real and cannot be undone from inside the
+  tool call — `send_message`, `create_administrative_note`,
+  `message_form_submission` send to real people; `create_user`,
+  `set_user_status`, `set_user_role` change real accounts;
+  `request_benefit_fund_loan`, `update_benefit_fund_loan_status`,
+  `pay_benefit_fund_loan_installment`, and `respond_to_lottery_win` touch real
+  money. Their descriptions ask the assistant to confirm details with you
+  first — grant the underlying `:write` scope only if you want that
+  capability at all.
+
+---
+
+## Running from source
+
+```bash
+git clone https://gitlab.com/dev.codegames/careerflow-mcp
+cd careerflow-mcp
+npm install
+npm run build
+```
+
+Point your client at the built entry point:
+
+```json
+{
+  "mcpServers": {
+    "careerflow": {
+      "command": "node",
+      "args": ["/absolute/path/to/careerflow-mcp/dist/index.js"],
+      "env": { "CAREERFLOW_BASE_URL": "…", "CAREERFLOW_TOKEN": "…" }
+    }
+  }
+}
+```
+
+### Docker
+
+```bash
+docker build -t careerflow-mcp .
+```
+
+```json
+{
+  "mcpServers": {
+    "careerflow": {
+      "command": "docker",
+      "args": [
+        "run", "-i", "--rm",
+        "-e", "CAREERFLOW_BASE_URL",
+        "-e", "CAREERFLOW_TOKEN",
+        "-e", "CAREERFLOW_COMPANY_ID",
+        "careerflow-mcp"
+      ],
+      "env": {
+        "CAREERFLOW_BASE_URL": "https://your-careerflow-host",
+        "CAREERFLOW_TOKEN": "cf_pat_xxxxxxxx",
+        "CAREERFLOW_COMPANY_ID": "24"
+      }
+    }
+  }
+}
+```
+
+`-i` is required: the server speaks MCP over stdin/stdout.
+
+---
+
+## Troubleshooting
+
+**"CareerFlow rejected the access token"** — the token is revoked, expired, or
+mistyped. Check it in Settings → Access Tokens, and create a new one if needed.
+
+**"The access token does not carry the scope this action needs"** — the token is
+missing a permission. Create a new one with that permission added.
+
+**"Company ID is not valid"** — your role does not permit that read, or
+`CAREERFLOW_COMPANY_ID` points at a company you do not belong to. Run `whoami` to
+see which company you are in.
+
+**Tools do not appear** — restart the client after editing its config. Verify the
+server starts on its own:
+
+```bash
+CAREERFLOW_TOKEN=cf_pat_xxx CAREERFLOW_BASE_URL=https://host npx @codegame.dev/careerflow-mcp
+```
+
+It should print `careerflow-mcp connected (api: …)` to stderr and wait. Ctrl-C to exit.
+
+---
+
+## Requirements
+
+- Node.js 18 or newer
+- A CareerFlow instance with personal access tokens enabled (migration 99 applied)
+
+## Development
+
+```bash
+npm run dev          # tsc --watch
+npm run typecheck    # types only
+npm run format       # prettier
+npm run smoke        # boot the built server and verify tool registration
+```
+
+### Publishing
+
+`npm run prepublishOnly` (typecheck, build, smoke) runs automatically on
+`npm publish`. On GitLab, the `publish` job in `.gitlab-ci.yml` publishes when
+a `v*` tag is pushed and the job is confirmed manually; it needs `NPM_TOKEN`
+(set it as a masked CI/CD variable under Settings > CI/CD > Variables):
+
+```bash
+git tag v1.1.0 && git push origin v1.1.0
+# then confirm the `publish` job in CI/CD > Pipelines
+```
+
+Or publish from a machine that is already verified with npm: `npm publish`.
+
+### Compatibility
+
+This client tracks the CareerFlow REST API. Behaviours it deliberately works
+around, worth knowing before changing a tool:
+
+- `kanbans/tasks/edit`, `crm/deals/edit`, and `users/edit` all replace the
+  whole row — a field left out falls back to a default (or null) rather than
+  keeping its current value. `update_task`, `crm_update_deal`, and
+  `update_user` each read the record first and merge onto it, so a partial
+  change cannot silently clear untouched fields. Apply the same read-then-merge
+  pattern to any other endpoint discovered to have this behavior.
+- Several endpoints reject an unscoped company-wide read unless the caller holds
+  an admin role, so tools pass the caller's own user id to mean "mine".
+- A few `search` endpoints require a filter the API otherwise has no "all"
+  value for — e.g. `careers/requests/search` requires `status`. `list_career_requests`
+  reflects that by making the field required rather than optional.

package/dist/client.js

@@ -0,0 +1,110 @@
+export class ApiError extends Error {
+    status;
+    errors;
+    constructor(message, status, errors) {
+        super(message);
+        this.status = status;
+        this.errors = errors;
+        this.name = "ApiError";
+    }
+}
+/**
+ * Flattens the API's nested error map into one readable line, so a tool result
+ * tells the caller which field was rejected and why instead of "request failed".
+ */
+function describeErrors(body) {
+    if (body.error?.message) {
+        return body.error.message;
+    }
+    const errors = body.errors;
+    if (!errors || Array.isArray(errors)) {
+        return null;
+    }
+    const parts = [];
+    for (const [field, reasons] of Object.entries(errors)) {
+        if (reasons && typeof reasons === "object") {
+            for (const reason of Object.values(reasons)) {
+                parts.push(`${field}: ${reason}`);
+            }
+        }
+    }
+    return parts.length ? parts.join("; ") : null;
+}
+export class CareerFlowClient {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    get defaultCompanyId() {
+        return this.config.companyId;
+    }
+    async get(path, query = {}) {
+        const url = new URL(`${this.config.baseUrl}/${path}`);
+        for (const [key, value] of Object.entries(query)) {
+            if (value !== undefined && value !== null && value !== "") {
+                url.searchParams.set(key, String(value));
+            }
+        }
+        return this.request(url.toString(), { method: "GET" });
+    }
+    async post(path, body = {}) {
+        const url = `${this.config.baseUrl}/${path}`;
+        const payload = {};
+        for (const [key, value] of Object.entries(body)) {
+            if (value !== undefined && value !== null) {
+                payload[key] = value;
+            }
+        }
+        return this.request(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(payload)
+        });
+    }
+    async request(url, init) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.config.timeoutMs);
+        let response;
+        try {
+            response = await fetch(url, {
+                ...init,
+                signal: controller.signal,
+                headers: {
+                    ...(init.headers ?? {}),
+                    token: this.config.token,
+                    Accept: "application/json"
+                }
+            });
+        }
+        catch (error) {
+            if (error instanceof Error && error.name === "AbortError") {
+                throw new ApiError(`Request timed out after ${this.config.timeoutMs}ms`, 408);
+            }
+            throw new ApiError(`Could not reach CareerFlow at ${this.config.baseUrl}: ${error.message}`, 0);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        const text = await response.text();
+        let body;
+        try {
+            body = text ? JSON.parse(text) : { successful: false };
+        }
+        catch {
+            throw new ApiError(`CareerFlow returned a non-JSON response (HTTP ${response.status})`, response.status);
+        }
+        if (response.status === 401) {
+            throw new ApiError("CareerFlow rejected the access token. It may be revoked, expired, or mistyped.", 401, body.errors);
+        }
+        if (response.status === 403) {
+            throw new ApiError(describeErrors(body) ??
+                "The access token does not carry the scope this action needs. " +
+                    "Re-create it in Settings > Access Tokens with the required scope.", 403, body.errors);
+        }
+        if (!response.ok || !body.successful) {
+            throw new ApiError(describeErrors(body) ?? `CareerFlow request failed (HTTP ${response.status})`, response.status, body.errors);
+        }
+        return body;
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAmBA,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGxB;IACA;IAHV,YACC,OAAe,EACN,MAAc,EACd,MAAgB;QAEzB,KAAK,CAAC,OAAO,CAAC,CAAA;QAHL,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAU;QAGzB,IAAI,CAAC,IAAI,GAAG,UAAU,CAAA;IACvB,CAAC;CACD;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,IAAiB;IACxC,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAA;IAC1B,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC1B,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,OAAiC,CAAC,EAAE,CAAC;gBACvE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,MAAM,EAAE,CAAC,CAAA;YAClC,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC9C,CAAC;AAED,MAAM,OAAO,gBAAgB;IACC;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,IAAI,gBAAgB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAA;IAC7B,CAAC;IAED,KAAK,CAAC,GAAG,CAAc,IAAY,EAAE,QAAiC,EAAE;QACvE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC,CAAA;QACrD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;YACzC,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAI,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,KAAK,CAAC,IAAI,CAAc,IAAY,EAAE,OAAgC,EAAE;QACvE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAA;QAC5C,MAAM,OAAO,GAA4B,EAAE,CAAA;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC3C,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACrB,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAI,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC7B,CAAC,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,GAAW,EAAE,IAAiB;QACtD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAEzE,IAAI,QAAkB,CAAA;QACtB,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC3B,GAAG,IAAI;gBACP,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE;oBACR,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;oBACvB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;oBACxB,MAAM,EAAE,kBAAkB;iBAC1B;aACD,CAAC,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC3D,MAAM,IAAI,QAAQ,CAAC,2BAA2B,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,GAAG,CAAC,CAAA;YAC9E,CAAC;YACD,MAAM,IAAI,QAAQ,CAAC,iCAAiC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAM,KAAe,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;QAC3G,CAAC;gBAAS,CAAC;YACV,YAAY,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,IAAI,IAAoB,CAAA;QAExB,IAAI,CAAC;YACJ,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC,CAAC,CAAE,EAAE,UAAU,EAAE,KAAK,EAAqB,CAAA;QAC/F,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,QAAQ,CAAC,iDAAiD,QAAQ,CAAC,MAAM,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;QACzG,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7B,MAAM,IAAI,QAAQ,CACjB,gFAAgF,EAChF,GAAG,EACH,IAAI,CAAC,MAAM,CACX,CAAA;QACF,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7B,MAAM,IAAI,QAAQ,CACjB,cAAc,CAAC,IAAI,CAAC;gBACnB,+DAA+D;oBAC9D,mEAAmE,EACrE,GAAG,EACH,IAAI,CAAC,MAAM,CACX,CAAA;QACF,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACtC,MAAM,IAAI,QAAQ,CACjB,cAAc,CAAC,IAAI,CAAC,IAAI,mCAAmC,QAAQ,CAAC,MAAM,GAAG,EAC7E,QAAQ,CAAC,MAAM,EACf,IAAI,CAAC,MAAM,CACX,CAAA;QACF,CAAC;QAED,OAAO,IAAI,CAAA;IACZ,CAAC;CACD"}

package/dist/config.js

@@ -0,0 +1,37 @@
+/**
+ * Runtime configuration, read once at startup from the environment.
+ *
+ * The token is never accepted as a CLI argument: argv is visible to every other
+ * process on the machine, while the environment of a process is not.
+ */
+function normaliseBaseUrl(raw) {
+    return raw.replace(/\/+$/, "");
+}
+export function loadConfig() {
+    const token = process.env.CAREERFLOW_TOKEN?.trim();
+    const baseUrl = process.env.CAREERFLOW_BASE_URL?.trim();
+    if (!token) {
+        throw new Error("CAREERFLOW_TOKEN is not set. Create a personal access token in CareerFlow " +
+            "under Settings > Access Tokens, then expose it to this server as CAREERFLOW_TOKEN.");
+    }
+    if (!baseUrl) {
+        throw new Error("CAREERFLOW_BASE_URL is not set. Point it at your CareerFlow API root, e.g. https://api.example.com");
+    }
+    const companyIdRaw = process.env.CAREERFLOW_COMPANY_ID?.trim();
+    const companyId = companyIdRaw ? Number(companyIdRaw) : undefined;
+    if (companyIdRaw && !Number.isFinite(companyId)) {
+        throw new Error(`CAREERFLOW_COMPANY_ID must be a number, got "${companyIdRaw}"`);
+    }
+    const timeoutRaw = process.env.CAREERFLOW_TIMEOUT_MS?.trim();
+    const timeoutMs = timeoutRaw ? Number(timeoutRaw) : 30_000;
+    if (timeoutRaw && !Number.isFinite(timeoutMs)) {
+        throw new Error(`CAREERFLOW_TIMEOUT_MS must be a number, got "${timeoutRaw}"`);
+    }
+    return {
+        baseUrl: normaliseBaseUrl(baseUrl),
+        token,
+        companyId,
+        timeoutMs
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,SAAS,gBAAgB,CAAC,GAAW;IACpC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAC/B,CAAC;AAED,MAAM,UAAU,UAAU;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAA;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAA;IAEvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACd,4EAA4E;YAC3E,oFAAoF,CACrF,CAAA;IACF,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACd,oGAAoG,CACpG,CAAA;IACF,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAA;IAC9D,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAEjE,IAAI,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,gDAAgD,YAAY,GAAG,CAAC,CAAA;IACjF,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAA;IAC5D,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IAE1D,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,gDAAgD,UAAU,GAAG,CAAC,CAAA;IAC/E,CAAC;IAED,OAAO;QACN,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC;QAClC,KAAK;QACL,SAAS;QACT,SAAS;KACT,CAAA;AACF,CAAC"}