crewly 1.14.1 → 1.15.0

package/dist/cli/cli/src/utils/native-toolchain.js

@@ -0,0 +1,146 @@
+/**
+ * Native-module build toolchain preflight.
+ *
+ * `node-pty` (and `better-sqlite3` on platforms without a prebuild) compile
+ * through node-gyp, which needs a C++ compiler, `make` and `python3`. When one
+ * is missing the operator sees forty lines of gyp output ending in
+ * `make: g++: No such file or directory` (server-install finding 11). This
+ * module answers three questions with no dependencies beyond node builtins
+ * — it runs from `preinstall`, before any dependency exists:
+ *
+ *   1. Is node-pty already built (or prebuilt) for this platform?
+ *   2. Which build tools are missing?
+ *   3. What is the one-line package-manager command that installs them?
+ *
+ * @module cli/utils/native-toolchain
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+/** Tools node-gyp needs to compile node-pty from source. */
+export const NATIVE_BUILD_TOOLS = [
+    { label: 'g++', candidates: ['g++', 'c++', 'clang++'] },
+    { label: 'make', candidates: ['make', 'gmake'] },
+    { label: 'python3', candidates: ['python3', 'python'] },
+];
+/** Package managers and the command that installs the full toolchain. */
+export const TOOLCHAIN_INSTALL_COMMANDS = [
+    { manager: 'apt-get', command: 'sudo apt-get update && sudo apt-get install -y build-essential python3' },
+    { manager: 'dnf', command: 'sudo dnf install -y gcc-c++ make python3' },
+    { manager: 'yum', command: 'sudo yum install -y gcc-c++ make python3' },
+    { manager: 'apk', command: 'sudo apk add --no-cache build-base python3' },
+    { manager: 'zypper', command: 'sudo zypper install -y gcc-c++ make python3' },
+    { manager: 'pacman', command: 'sudo pacman -S --needed base-devel python' },
+    { manager: 'brew', command: 'xcode-select --install   # or: brew install make python' },
+];
+/** Fallback hint when no known package manager is on PATH. */
+const GENERIC_INSTALL_HINT = 'install a C++ compiler (g++ or clang++), make and python3 with your package manager';
+/** Relative path of node-pty's compiled binding inside a package root. */
+const NODE_PTY_BINDING = path.join('node_modules', 'node-pty', 'build', 'Release', 'pty.node');
+/** Relative path of node-pty's prebuilds directory (absent in node-pty 1.x). */
+const NODE_PTY_PREBUILDS = path.join('node_modules', 'node-pty', 'prebuilds');
+/**
+ * Check whether an executable is on PATH without spawning a shell.
+ *
+ * @param bin - Executable name
+ * @param env - Environment to read PATH/PATHEXT from
+ * @returns true when an executable file with that name exists on PATH
+ */
+export function isOnPath(bin, env = process.env) {
+    const dirs = (env.PATH ?? '').split(path.delimiter).filter(Boolean);
+    const exts = process.platform === 'win32' ? (env.PATHEXT ?? '.EXE;.CMD;.BAT').split(';') : [''];
+    for (const dir of dirs) {
+        for (const ext of exts) {
+            const candidate = path.join(dir, bin + ext);
+            try {
+                fs.accessSync(candidate, fs.constants.X_OK);
+                if (fs.statSync(candidate).isFile())
+                    return true;
+            }
+            catch {
+                // not here — keep looking
+            }
+        }
+    }
+    return false;
+}
+/**
+ * Determine which build tools are missing.
+ *
+ * @param which - PATH lookup (injectable for tests)
+ * @returns Labels of the missing requirements, in {@link NATIVE_BUILD_TOOLS} order
+ */
+export function detectMissingBuildTools(which = isOnPath) {
+    // Call with a single argument: Array#some would otherwise pass (value, index,
+    // array) and the index would land in isOnPath's `env` parameter.
+    return NATIVE_BUILD_TOOLS.filter((req) => !req.candidates.some((bin) => which(bin))).map((req) => req.label);
+}
+/**
+ * Pick the install command for the first known package manager on PATH.
+ *
+ * @param which - PATH lookup (injectable for tests)
+ * @returns The install command, or a generic hint when none is recognised
+ */
+export function toolchainInstallHint(which = isOnPath) {
+    const match = TOOLCHAIN_INSTALL_COMMANDS.find((entry) => which(entry.manager));
+    return match ? match.command : GENERIC_INSTALL_HINT;
+}
+/**
+ * Inspect node-pty's install state under a package root.
+ *
+ * @param packageRoot - Directory containing `node_modules/`
+ * @param platform - Platform tag (defaults to the current one)
+ * @param arch - Arch tag (defaults to the current one)
+ * @returns Build/prebuild status
+ */
+export function nodePtyBuildStatus(packageRoot, platform = process.platform, arch = process.arch) {
+    return {
+        built: fs.existsSync(path.join(packageRoot, NODE_PTY_BINDING)),
+        prebuilt: fs.existsSync(path.join(packageRoot, NODE_PTY_PREBUILDS, `${platform}-${arch}`)),
+    };
+}
+/**
+ * Run the preflight: when node-pty has to be compiled and the toolchain is
+ * incomplete, produce ONE message naming the missing tools and the exact
+ * install command.
+ *
+ * @param options - Injection points
+ * @param options.packageRoot - Directory containing `node_modules/` (used to detect an existing build)
+ * @param options.which - PATH lookup
+ * @param options.platform - Platform tag for prebuild detection
+ * @param options.arch - Arch tag for prebuild detection
+ * @param options.force - Report missing tools even when node-pty is already built (doctor mode)
+ * @returns The check result
+ */
+export function checkNativeToolchain(options) {
+    const which = options.which ?? isOnPath;
+    const nodePty = nodePtyBuildStatus(options.packageRoot, options.platform, options.arch);
+    const missing = detectMissingBuildTools(which);
+    const installHint = toolchainInstallHint(which);
+    const needsBuild = !nodePty.built && !nodePty.prebuilt;
+    if (missing.length === 0 || (!needsBuild && !options.force)) {
+        return { ok: true, missing, installHint, nodePty, message: '' };
+    }
+    const message = formatToolchainMessage(missing, installHint, needsBuild);
+    return { ok: false, missing, installHint, nodePty, message };
+}
+/**
+ * Render the single warning line block.
+ *
+ * @param missing - Missing tool labels
+ * @param installHint - Install command
+ * @param needsBuild - Whether node-pty still has to be compiled
+ * @returns Multi-line message
+ */
+export function formatToolchainMessage(missing, installHint, needsBuild) {
+    const tools = missing.join(', ');
+    const consequence = needsBuild
+        ? 'node-pty has no prebuilt binary for this platform and must be compiled, so `npm install` will fail in node-gyp.'
+        : 'node-pty is currently built, but the next `npm rebuild` / upgrade will fail in node-gyp.';
+    return [
+        `[crewly] Missing native build tool${missing.length > 1 ? 's' : ''}: ${tools}.`,
+        `[crewly] ${consequence}`,
+        `[crewly] Install them, then re-run the install:`,
+        `[crewly]   ${installHint}`,
+    ].join('\n');
+}
+//# sourceMappingURL=native-toolchain.js.map

package/dist/cli/cli/src/utils/native-toolchain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-toolchain.js","sourceRoot":"","sources":["../../../../../cli/src/utils/native-toolchain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAU7B,4DAA4D;AAC5D,MAAM,CAAC,MAAM,kBAAkB,GAAoC;IAClE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE;IACvD,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;IAChD,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;CACvD,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,0BAA0B,GAAwD;IAC9F,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,wEAAwE,EAAE;IACzG,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0CAA0C,EAAE;IACvE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0CAA0C,EAAE;IACvE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,4CAA4C,EAAE;IACzE,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,6CAA6C,EAAE;IAC7E,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,2CAA2C,EAAE;IAC3E,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,yDAAyD,EAAE;CACvF,CAAC;AAEF,8DAA8D;AAC9D,MAAM,oBAAoB,GAAG,qFAAqF,CAAC;AAEnH,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AAE/F,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW,EAAE,MAAyB,OAAO,CAAC,GAAG;IACzE,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;YAC5C,IAAI,CAAC;gBACJ,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC5C,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE;oBAAE,OAAO,IAAI,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACR,0BAA0B;YAC3B,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAkC,QAAQ;IACjF,8EAA8E;IAC9E,iEAAiE;IACjE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC9G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAkC,QAAQ;IAC9E,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC;AACrD,CAAC;AAUD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CACjC,WAAmB,EACnB,WAAmB,OAAO,CAAC,QAAQ,EACnC,OAAe,OAAO,CAAC,IAAI;IAE3B,OAAO;QACN,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAC9D,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,EAAE,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;KAC1F,CAAC;AACH,CAAC;AAgBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAMpC;IACA,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC;IACxC,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IAEvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAiB,EAAE,WAAmB,EAAE,UAAmB;IACjG,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,WAAW,GAAG,UAAU;QAC7B,CAAC,CAAC,iHAAiH;QACnH,CAAC,CAAC,0FAA0F,CAAC;IAC9F,OAAO;QACN,qCAAqC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,GAAG;QAC/E,YAAY,WAAW,EAAE;QACzB,iDAAiD;QACjD,cAAc,WAAW,EAAE;KAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC"}

package/dist/cli/cli/src/utils/package-root.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Package-root resolution for the CLI.
+ *
+ * `crewly service install` (and anything else that needs the install
+ * directory) used to walk up from `process.cwd()`, which only works when the
+ * operator happens to be inside the package directory. For a global npm
+ * install the CLI already knows where it lives — the entry script is inside
+ * the package — so resolve from the CLI's own location first and fall back to
+ * the cwd walk only for source checkouts run through `tsx`.
+ *
+ * `import.meta.url` cannot appear in this module (ts-jest compiles the CLI as
+ * CommonJS, where the meta-property is a compile error), so the ESM entry
+ * (`cli/src/index.ts`) registers its module directory via
+ * {@link setCliModuleDir}; `process.argv[1]` (realpath'd, so the global
+ * `bin` symlink resolves into the package) is the second anchor.
+ *
+ * @module cli/utils/package-root
+ */
+/**
+ * Register the directory of the CLI entry module so package-root resolution
+ * can anchor on it. Called once by `cli/src/index.ts`.
+ *
+ * @param dir - Absolute directory of the running CLI module
+ */
+export declare function setCliModuleDir(dir: string | null): void;
+/**
+ * Walk up from `startDir` looking for a `package.json` whose `name` is
+ * `crewly`.
+ *
+ * @param startDir - Directory to start searching from
+ * @returns Absolute package root, or null when no parent matches
+ */
+export declare function findPackageRoot(startDir: string): string | null;
+/**
+ * Candidate directories to anchor the package-root walk on, most reliable
+ * first: the registered CLI module dir, the realpath of the entry script
+ * (`process.argv[1]`), then the current working directory.
+ *
+ * @param argv1 - Entry script path (defaults to `process.argv[1]`)
+ * @param cwd - Working directory (defaults to `process.cwd()`)
+ * @returns Ordered, de-duplicated candidate directories
+ */
+export declare function packageRootCandidates(argv1?: string | undefined, cwd?: string): string[];
+/**
+ * Resolve the Crewly package root regardless of the caller's cwd.
+ *
+ * Tries each candidate from {@link packageRootCandidates} in order and returns
+ * the first that sits inside a Crewly package.
+ *
+ * @param argv1 - Entry script path (defaults to `process.argv[1]`)
+ * @param cwd - Working directory (defaults to `process.cwd()`)
+ * @returns Absolute package root, or null when none of the anchors is inside a Crewly install
+ */
+export declare function resolvePackageRoot(argv1?: string | undefined, cwd?: string): string | null;
+//# sourceMappingURL=package-root.d.ts.map

package/dist/cli/cli/src/utils/package-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-root.d.ts","sourceRoot":"","sources":["../../../../../cli/src/utils/package-root.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAWH;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAExD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAwB/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACpC,KAAK,GAAE,MAAM,GAAG,SAA2B,EAC3C,GAAG,GAAE,MAAsB,GACzB,MAAM,EAAE,CAYV;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CACjC,KAAK,GAAE,MAAM,GAAG,SAA2B,EAC3C,GAAG,GAAE,MAAsB,GACzB,MAAM,GAAG,IAAI,CAMf"}

package/dist/cli/cli/src/utils/package-root.js

@@ -0,0 +1,107 @@
+/**
+ * Package-root resolution for the CLI.
+ *
+ * `crewly service install` (and anything else that needs the install
+ * directory) used to walk up from `process.cwd()`, which only works when the
+ * operator happens to be inside the package directory. For a global npm
+ * install the CLI already knows where it lives — the entry script is inside
+ * the package — so resolve from the CLI's own location first and fall back to
+ * the cwd walk only for source checkouts run through `tsx`.
+ *
+ * `import.meta.url` cannot appear in this module (ts-jest compiles the CLI as
+ * CommonJS, where the meta-property is a compile error), so the ESM entry
+ * (`cli/src/index.ts`) registers its module directory via
+ * {@link setCliModuleDir}; `process.argv[1]` (realpath'd, so the global
+ * `bin` symlink resolves into the package) is the second anchor.
+ *
+ * @module cli/utils/package-root
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+/** Package name that identifies the Crewly install root. */
+const CREWLY_PACKAGE_NAME = 'crewly';
+/** Module directory registered by the ESM entry point (via `import.meta.url`). */
+let registeredModuleDir = null;
+/**
+ * Register the directory of the CLI entry module so package-root resolution
+ * can anchor on it. Called once by `cli/src/index.ts`.
+ *
+ * @param dir - Absolute directory of the running CLI module
+ */
+export function setCliModuleDir(dir) {
+    registeredModuleDir = dir;
+}
+/**
+ * Walk up from `startDir` looking for a `package.json` whose `name` is
+ * `crewly`.
+ *
+ * @param startDir - Directory to start searching from
+ * @returns Absolute package root, or null when no parent matches
+ */
+export function findPackageRoot(startDir) {
+    let current = path.resolve(startDir);
+    let parent = path.dirname(current);
+    // Stop once dirname() no longer changes the path (filesystem root).
+    for (;;) {
+        const pkgPath = path.join(current, 'package.json');
+        if (fs.existsSync(pkgPath)) {
+            try {
+                const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+                if (pkg.name === CREWLY_PACKAGE_NAME) {
+                    return current;
+                }
+            }
+            catch {
+                // Malformed package.json — keep searching
+            }
+        }
+        if (parent === current) {
+            return null;
+        }
+        current = parent;
+        parent = path.dirname(current);
+    }
+}
+/**
+ * Candidate directories to anchor the package-root walk on, most reliable
+ * first: the registered CLI module dir, the realpath of the entry script
+ * (`process.argv[1]`), then the current working directory.
+ *
+ * @param argv1 - Entry script path (defaults to `process.argv[1]`)
+ * @param cwd - Working directory (defaults to `process.cwd()`)
+ * @returns Ordered, de-duplicated candidate directories
+ */
+export function packageRootCandidates(argv1 = process.argv[1], cwd = process.cwd()) {
+    const candidates = [];
+    if (registeredModuleDir)
+        candidates.push(registeredModuleDir);
+    if (argv1) {
+        try {
+            candidates.push(path.dirname(fs.realpathSync(argv1)));
+        }
+        catch {
+            candidates.push(path.dirname(path.resolve(argv1)));
+        }
+    }
+    candidates.push(cwd);
+    return [...new Set(candidates)];
+}
+/**
+ * Resolve the Crewly package root regardless of the caller's cwd.
+ *
+ * Tries each candidate from {@link packageRootCandidates} in order and returns
+ * the first that sits inside a Crewly package.
+ *
+ * @param argv1 - Entry script path (defaults to `process.argv[1]`)
+ * @param cwd - Working directory (defaults to `process.cwd()`)
+ * @returns Absolute package root, or null when none of the anchors is inside a Crewly install
+ */
+export function resolvePackageRoot(argv1 = process.argv[1], cwd = process.cwd()) {
+    for (const dir of packageRootCandidates(argv1, cwd)) {
+        const root = findPackageRoot(dir);
+        if (root)
+            return root;
+    }
+    return null;
+}
+//# sourceMappingURL=package-root.js.map

package/dist/cli/cli/src/utils/package-root.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-root.js","sourceRoot":"","sources":["../../../../../cli/src/utils/package-root.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,4DAA4D;AAC5D,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAErC,kFAAkF;AAClF,IAAI,mBAAmB,GAAkB,IAAI,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAkB;IACjD,mBAAmB,GAAG,GAAG,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC/C,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEnC,oEAAoE;IACpE,SAAS,CAAC;QACT,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACnD,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACJ,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAsB,CAAC;gBAC/E,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;oBACtC,OAAO,OAAO,CAAC;gBAChB,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,0CAA0C;YAC3C,CAAC;QACF,CAAC;QAED,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;QACjB,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACpC,QAA4B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAC3C,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,mBAAmB;QAAE,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC9D,IAAI,KAAK,EAAE,CAAC;QACX,IAAI,CAAC;YACJ,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACR,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;IACF,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CACjC,QAA4B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAC3C,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,KAAK,MAAM,GAAG,IAAI,qBAAqB,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/cli/cli/src/utils/version-check.d.ts

@@ -32,11 +32,27 @@ export interface VersionCheckResult {
     updateAvailable: boolean;
 }
 /**
- * Reads the current Crewly version from the root package.json.
+ * Register the directory of the CLI's own entry module so version lookups
+ * resolve the *installed* Crewly package rather than whatever project the
+ * user happens to be standing in.
  *
+ * @param dir - Absolute directory of the CLI entry module (null clears it)
+ */
+export declare function registerCliModuleDir(dir: string | null): void;
+/**
+ * Reads the installed Crewly version from the package's own package.json.
+ *
+ * Resolution starts from the CLI module's location — never from
+ * `process.cwd()`. The old cwd-based lookup returned `1.0.0` (the hardcoded
+ * fallback) from any directory outside the package and, worse, reported a
+ * *different* project's version when run inside one (server-install finding 5).
+ *
+ * @param startDir - Directory to walk up from (defaults to the registered
+ *   CLI module dir, then the entry script's real path)
  * @returns The version string from package.json
+ * @throws Error if no package.json with `"name": "crewly"` is found above startDir
  */
-export declare function getLocalVersion(): string;
+export declare function getLocalVersion(startDir?: string): string;
 /**
  * Reads the disk-cached version check result.
  *

package/dist/cli/cli/src/utils/version-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version-check.d.ts","sourceRoot":"","sources":["../../../../../cli/src/utils/version-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAUH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC,kCAAkC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,2CAA2C;IAC3C,eAAe,EAAE,OAAO,CAAC;CACzB;AAwCD;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAKxC;AAeD;;;;GAIG;AACH,wBAAgB,SAAS,IAAI,YAAY,GAAG,IAAI,CAe/C;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAgBhD;AAsBD;;;;;GAKG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,kBAAkB,CAAC,CA4ClE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAW7E"}
+{"version":3,"file":"version-check.d.ts","sourceRoot":"","sources":["../../../../../cli/src/utils/version-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAUH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC,kCAAkC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,2CAA2C;IAC3C,eAAe,EAAE,OAAO,CAAC;CACzB;AA8CD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAE7D;AAqBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CASzD;AAeD;;;;GAIG;AACH,wBAAgB,SAAS,IAAI,YAAY,GAAG,IAAI,CAe/C;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAgBhD;AAsBD;;;;;GAKG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,kBAAkB,CAAC,CA4ClE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAW7E"}

package/dist/cli/cli/src/utils/version-check.js

@@ -11,7 +11,7 @@
  *
  * @module cli/utils/version-check
  */
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs';
+import { readFileSync, writeFileSync, existsSync, mkdirSync, realpathSync } from 'fs';
 import path from 'path';
 import os from 'os';
 import chalk from 'chalk';
@@ -47,14 +47,61 @@ function findPackageRoot(startDir) {
         current = parent;
     }
 }
+/**
+ * Directory of the CLI entry module, registered by `cli/src/index.ts` from
+ * `import.meta.url`. Kept out of this module because ts-jest compiles tests
+ * as CommonJS where `import.meta` is a syntax error (see
+ * `backend/src/utils/node-require.utils.ts` for the banked lessons).
+ */
+let cliModuleDir = null;
+/**
+ * Register the directory of the CLI's own entry module so version lookups
+ * resolve the *installed* Crewly package rather than whatever project the
+ * user happens to be standing in.
+ *
+ * @param dir - Absolute directory of the CLI entry module (null clears it)
+ */
+export function registerCliModuleDir(dir) {
+    cliModuleDir = dir;
+}
+/**
+ * Best-effort directory of the running CLI when nothing was registered:
+ * the real path of the entry script (`process.argv[1]`), which for a global
+ * install resolves through the `bin` symlink into the package tree.
+ *
+ * @returns Directory of the entry script, or null when unavailable
+ */
+function entryScriptDir() {
+    const entry = process.argv[1];
+    if (!entry)
+        return null;
+    try {
+        return path.dirname(realpathSync(entry));
+    }
+    catch {
+        return null;
+    }
+}
 // ========================= Functions =========================
 /**
- * Reads the current Crewly version from the root package.json.
+ * Reads the installed Crewly version from the package's own package.json.
  *
+ * Resolution starts from the CLI module's location — never from
+ * `process.cwd()`. The old cwd-based lookup returned `1.0.0` (the hardcoded
+ * fallback) from any directory outside the package and, worse, reported a
+ * *different* project's version when run inside one (server-install finding 5).
+ *
+ * @param startDir - Directory to walk up from (defaults to the registered
+ *   CLI module dir, then the entry script's real path)
  * @returns The version string from package.json
+ * @throws Error if no package.json with `"name": "crewly"` is found above startDir
  */
-export function getLocalVersion() {
-    const root = findPackageRoot(process.cwd());
+export function getLocalVersion(startDir) {
+    const from = startDir ?? cliModuleDir ?? entryScriptDir();
+    if (!from) {
+        throw new Error('Could not determine the Crewly CLI module location for version lookup');
+    }
+    const root = findPackageRoot(from);
     const pkgPath = path.join(root, 'package.json');
     const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
     return pkg.version;

package/dist/cli/cli/src/utils/version-check.js.map

@@ -1 +1 @@
-{"version":3,"file":"version-check.js","sourceRoot":"","sources":["../../../../../cli/src/utils/version-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AA0BzF,mEAAmE;AAEnE;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,QAAgB;IACxC,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAErC,OAAO,IAAI,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACnD,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC;gBACJ,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBACvD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC3B,OAAO,OAAO,CAAC;gBAChB,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,0CAA0C;YAC3C,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACd,uGAAuG,CACvG,CAAC;QACH,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IAClB,CAAC;AACF,CAAC;AAED,gEAAgE;AAEhE;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC9B,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,OAAO,GAAG,CAAC,OAAiB,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY;IACpB,OAAO,IAAI,CAAC,IAAI,CACf,EAAE,CAAC,OAAO,EAAE,EACZ,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAClC,uBAAuB,CAAC,gBAAgB,CACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS;IACxB,IAAI,CAAC;QACJ,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;QACjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAiB,CAAC;QACnD,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC9C,OAAO,MAAM,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe;IACzC,IAAI,CAAC;QACJ,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,GAAiB;YAC1B,aAAa,EAAE,OAAO;YACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACnC,CAAC;QACF,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACR,iCAAiC;IAClC,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,MAAc,EAAE,OAAe;IACtD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5E,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IACnC,MAAM,cAAc,GAAG,eAAe,EAAE,CAAC;IAEzC,oBAAoB;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAC9D,IAAI,GAAG,GAAG,uBAAuB,CAAC,YAAY,EAAE,CAAC;YAChD,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YAC7E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,eAAe,EAAE,CAAC;QACjF,CAAC;IACF,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CACzB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,uBAAuB,CAAC,kBAAkB,CAC1C,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,uBAAuB,CAAC,gBAAgB,EAAE;YACtE,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE;SACzC,CAAC,CAAC;QACH,YAAY,CAAC,OAAO,CAAC,CAAC;QAEtB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QACxE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA0B,CAAC;QAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;QAE3C,IAAI,aAAa,EAAE,CAAC;YACnB,UAAU,CAAC,aAAa,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,eAAe,GACpB,aAAa,KAAK,IAAI,IAAI,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;QAEzE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IACxE,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,MAAc;IACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC;IACvH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACnN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACzJ,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACjB,CAAC"}
+{"version":3,"file":"version-check.js","sourceRoot":"","sources":["../../../../../cli/src/utils/version-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AACtF,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AA0BzF,mEAAmE;AAEnE;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,QAAgB;IACxC,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAErC,OAAO,IAAI,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACnD,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC;gBACJ,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBACvD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC3B,OAAO,OAAO,CAAC;gBAChB,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,0CAA0C;YAC3C,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACd,uGAAuG,CACvG,CAAC;QACH,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IAClB,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,IAAI,YAAY,GAAkB,IAAI,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAkB;IACtD,YAAY,GAAG,GAAG,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc;IACtB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,gEAAgE;AAEhE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,QAAiB;IAChD,MAAM,IAAI,GAAG,QAAQ,IAAI,YAAY,IAAI,cAAc,EAAE,CAAC;IAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,OAAO,GAAG,CAAC,OAAiB,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY;IACpB,OAAO,IAAI,CAAC,IAAI,CACf,EAAE,CAAC,OAAO,EAAE,EACZ,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAClC,uBAAuB,CAAC,gBAAgB,CACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS;IACxB,IAAI,CAAC;QACJ,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;QACjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAiB,CAAC;QACnD,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC9C,OAAO,MAAM,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe;IACzC,IAAI,CAAC;QACJ,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,GAAiB;YAC1B,aAAa,EAAE,OAAO;YACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACnC,CAAC;QACF,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACR,iCAAiC;IAClC,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,MAAc,EAAE,OAAe;IACtD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5E,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IACnC,MAAM,cAAc,GAAG,eAAe,EAAE,CAAC;IAEzC,oBAAoB;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAC9D,IAAI,GAAG,GAAG,uBAAuB,CAAC,YAAY,EAAE,CAAC;YAChD,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YAC7E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,eAAe,EAAE,CAAC;QACjF,CAAC;IACF,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CACzB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,uBAAuB,CAAC,kBAAkB,CAC1C,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,uBAAuB,CAAC,gBAAgB,EAAE;YACtE,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE;SACzC,CAAC,CAAC;QACH,YAAY,CAAC,OAAO,CAAC,CAAC;QAEtB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QACxE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA0B,CAAC;QAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;QAE3C,IAAI,aAAa,EAAE,CAAC;YACnB,UAAU,CAAC,aAAa,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,eAAe,GACpB,aAAa,KAAK,IAAI,IAAI,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;QAEzE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IACxE,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,MAAc;IACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC;IACvH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACnN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACzJ,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACjB,CAAC"}

package/dist/cli/config/constants.d.ts

@@ -223,6 +223,59 @@ export declare const WEB_CONSTANTS: {
         readonly FALLBACK_POLL_INTERVAL: 5000;
     };
 };
+/**
+ * Network exposure + API token authentication for the OSS server.
+ *
+ * The REST API and WebSocket endpoints are open to loopback callers (local
+ * skills, the local dashboard) and require a shared API token from every
+ * other address. See README "Securing a server install".
+ */
+export declare const API_SECURITY_CONSTANTS: {
+    /** Environment variable names */
+    readonly ENV: {
+        /** Host/interface the HTTP server binds to (default: all interfaces) */
+        readonly BIND_HOST: "CREWLY_BIND_HOST";
+        /** Pinned API token; when unset one is generated on first boot */
+        readonly API_TOKEN: "CREWLY_API_TOKEN";
+        /** Set to `1` to honour `X-Forwarded-For` when classifying loopback callers */
+        readonly TRUST_PROXY: "CREWLY_TRUST_PROXY";
+        /** Set to `1`/`true` to force headless (no display) detection */
+        readonly HEADLESS: "CREWLY_HEADLESS";
+    };
+    /** Default bind host — every interface, for backward compatibility */
+    readonly DEFAULT_BIND_HOST: "0.0.0.0";
+    /** Loopback-only bind host suggested in the startup warning */
+    readonly LOOPBACK_BIND_HOST: "127.0.0.1";
+    /** File (relative to CREWLY_HOME) holding the generated API token */
+    readonly TOKEN_FILE_NAME: "api-token";
+    /** Random bytes in a generated token (hex-encoded → 64 chars) */
+    readonly TOKEN_BYTES: 32;
+    /** POSIX mode for the token file (owner read/write only) */
+    readonly TOKEN_FILE_MODE: 384;
+    /** Hex characters of sha256(token) recorded for audit purposes */
+    readonly FINGERPRINT_HEX_LENGTH: 8;
+    /** Request header carrying the token */
+    readonly TOKEN_HEADER: "x-crewly-token";
+    /** Cookie name carrying the token (lets `<img>`/asset/WS requests pass) */
+    readonly TOKEN_COOKIE: "crewly_token";
+    /** Query-string parameter carrying the token (WebSocket + dashboard deep link) */
+    readonly TOKEN_QUERY_PARAM: "token";
+    /** localStorage key the dashboard stores the token under */
+    readonly TOKEN_STORAGE_KEY: "crewly_api_token";
+    /** `WWW-Authenticate` scheme advertised on 401 so clients can detect the challenge */
+    readonly AUTH_SCHEME: "Crewly-Token";
+    /** Error codes returned in `{ success: false, error }` */
+    readonly ERRORS: {
+        readonly UNAUTHORIZED: "unauthorized";
+        readonly OWNER_APPROVAL_REQUIRED: "owner_approval_required";
+    };
+    /** Actor recorded on approvals performed with the owner token */
+    readonly OWNER_ACTOR: "owner";
+    /** Hint appended to 401 responses */
+    readonly UNAUTHORIZED_HINT: "Non-loopback callers must send the API token: `Authorization: Bearer <token>`, `X-Crewly-Token: <token>` or a `crewly_token` cookie. Run `crewly token` on the server to print it.";
+    /** Loopback addresses that bypass token auth */
+    readonly LOOPBACK_ADDRESSES: readonly ["127.0.0.1", "::1", "::ffff:127.0.0.1"];
+};
 /**
  * Timing and interval configurations used across domains
  */

package/dist/cli/config/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../config/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH;;GAEG;AACH,eAAO,MAAM,gBAAgB;IAC5B;;OAEG;;QAEF,gEAAgE;;QAEhE,2DAA2D;;QAE3D,kEAAkE;;QAElE,sDAAsD;;QAEtD,+DAA+D;;;IAIhE;;OAEG;;QAEF,iCAAiC;;QAEjC,+BAA+B;;QAE/B,kCAAkC;;QAElC,yBAAyB;;QAEzB,8BAA8B;;QAE9B,iCAAiC;;QAEjC,8BAA8B;;QAE9B,+BAA+B;;QAE/B,sBAAsB;;QAEtB,+BAA+B;;QAE/B,6BAA6B;;QAE7B,oCAAoC;;QAEpC,qCAAqC;;QAErC,4BAA4B;;QAE5B,qDAAqD;;QAErD,4BAA4B;;QAE5B,2CAA2C;;QAE3C,mDAAmD;;;IAIpD;;;OAGG;;QAEF,+CAA+C;;QAE/C,4CAA4C;;QAE5C,6EAA6E;;QAE7E,oDAAoD;;QAEpD,+EAA+E;;QAE/E,yEAAyE;;;IAI1E;;OAEG;;QAEF,4CAA4C;;QAE5C,2CAA2C;;;IAI5C;;OAEG;;QAEF,uDAAuD;;QAEvD,2DAA2D;;QAE3D,uDAAuD;;QAEvD,+CAA+C;;QAE/C,0DAA0D;;QAE1D,sDAAsD;;;IAIvD;;OAEG;;QAEF,mEAAmE;;;IAIpE;;OAEG;;;;;;;;;IAUH;;OAEG;;QAEF,6CAA6C;;QAE7C,uCAAuC;;QAEvC,yCAAyC;;;CAGjC,CAAC;AAIX;;GAEG;AACH,eAAO,MAAM,wBAAwB;IACpC;;OAEG;;QAEF,oDAAoD;;QAEpD,uBAAuB;;QAEvB,iBAAiB;;;CAGT,CAAC;AAIX;;;GAGG;AACH,eAAO,MAAM,kBAAkB;IAC9B,uCAAuC;;IAEvC,6BAA6B;;IAE7B,kEAAkE;;CAEzD,CAAC;AAIX;;GAEG;AACH,eAAO,MAAM,aAAa;IACzB;;OAEG;;QAEF,sCAAsC;;QAEtC,+CAA+C;;;IAIhD;;OAEG;;QAEF,4BAA4B;;QAE5B,oBAAoB;;QAEpB,iCAAiC;;QAEjC,oCAAoC;;QAEpC,qCAAqC;;QAErC,oCAAoC;;QAEpC,gCAAgC;;QAEhC,2BAA2B;;;IAI5B;;OAEG;;QAEF,2DAA2D;;QAE3D,sDAAsD;;QAEtD,+DAA+D;;QAE/D,0DAA0D;;QAE1D,8CAA8C;;QAE9C,2DAA2D;;;CAGnD,CAAC;AAIX;;GAEG;AACH,eAAO,MAAM,gBAAgB;IAC5B;;OAEG;;QAEF,mDAAmD;;QAEnD,4CAA4C;;QAE5C,iDAAiD;;;IAIlD;;OAEG;;QAEF,yCAAyC;;QAEzC,0CAA0C;;QAE1C,0CAA0C;;QAE1C,gDAAgD;;QAEhD,0CAA0C;;QAE1C,oCAAoC;;QAEpC,oDAAoD;;QAEpD,wCAAwC;;;IAIzC;;OAEG;;QAEF,iDAAiD;;QAEjD,uCAAuC;;QAEvC,0CAA0C;;QAE1C,gDAAgD;;QAEhD,8CAA8C;;QAE9C,wDAAwD;;QAExD,4DAA4D;;QAE5D,6DAA6D;;QAE7D,sDAAsD;;QAEtD,wCAAwC;;QAExC,2DAA2D;;QAE3D,uDAAuD;;QAEvD,4CAA4C;;QAE5C,0CAA0C;;QAE1C,2CAA2C;;QAE3C,+BAA+B;;QAE/B,qCAAqC;;QAErC,2CAA2C;;QAE3C,iDAAiD;;;CAGzC,CAAC;AAIX;;GAEG;AACH,eAAO,MAAM,iBAAiB;IAC7B;;OAEG;;QAEF,6DAA6D;;QAE7D,iEAAiE;;QAEjE,+CAA+C;;;IAIhD;;OAEG;;QAEF,uCAAuC;;QAEvC,8BAA8B;;QAE9B,oCAAoC;;QAEpC,iCAAiC;;QAEjC,uCAAuC;;;CAG/B,CAAC;AAIX;;GAEG;AACH,eAAO,MAAM,aAAa;IACzB,sEAAsE;;IAEtE,6BAA6B;;IAE7B,sBAAsB;;IAEtB,sBAAsB;;IAEtB,mBAAmB;;IAEnB,iBAAiB;;IAEjB,uBAAuB;;IAEvB,4BAA4B;;CAEnB,CAAC;AAIX;;;GAGG;AACH,eAAO,MAAM,iBAAiB;IAC7B;;OAEG;;QAEF,yCAAyC;;QAEzC,8BAA8B;;QAE9B,kCAAkC;;QAElC,+BAA+B;;;;;QAK/B,+BAA+B;;;;IAKhC;;OAEG;;;;;IAMH;;OAEG;;QAEF,0BAA0B;;QAE1B,2BAA2B;;QAE3B,gDAAgD;;;;;;;;;QAShD,uCAAuC;;;IAIxC;;OAEG;;;;;;;;;;;IAYH;;OAEG;;;;;;;;IASH;;OAEG;;QAEF,8DAA8D;;;IAI/D;;OAEG;;;;;IAMH;;OAEG;;;;IAKH;;OAEG;;QAEF,kDAAkD;;QAElD,8BAA8B;;QAE9B,yCAAyC;;QAEzC,kCAAkC;;;IAInC;;OAEG;;IAGH;;OAEG;;;;;;;IAQH;;OAEG;;CASM,CAAC;AAIX;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;IAC3B;;OAEG;;QAED,uDAAuD;;QAEvD,gEAAgE;;QAEhE,8DAA8D;;QAE9D,uCAAuC;;QAEvC,kDAAkD;;QAElD,8CAA8C;;QAE9C,iBAAiB;;QAEjB,yBAAyB;;QAEzB,uDAAuD;;QAEvD,8DAA8D;;QAE9D,uBAAuB;;QAEvB,uBAAuB;;QAEvB,oDAAoD;;QAEpD,kCAAkC;;QAElC,gDAAgD;;;IAIlD;;OAEG;;QAED,uBAAuB;;QAEvB,sCAAsC;;QAEtC,wBAAwB;;QAExB,0BAA0B;;QAE1B,4BAA4B;;;IAI9B;;OAEG;;QAED,sBAAsB;;QAEtB,sBAAsB;;QAEtB,uBAAuB;;QAEvB,qBAAqB;;QAErB,2BAA2B;;QAE3B,iDAAiD;;QAEjD,mCAAmC;;;IAIrC;;OAEG;;QAED,mDAAmD;;QAEnD,qDAAqD;;;;;QAKrD,uCAAuC;;QAEvC,iDAAiD;;QAEjD,wDAAwD;;QAExD,oDAAoD;;;IAItD;;OAEG;;QAED,mDAAmD;;QAEnD,uDAAuD;;QAEvD,+BAA+B;;QAE/B,+BAA+B;;;IAIjC;;OAEG;;QAED,6BAA6B;;QAE7B,uCAAuC;;;IAIzC;;OAEG;;QAED,gCAAgC;;QAEhC,yBAAyB;;QAEzB,6BAA6B;;QAE7B,0BAA0B;;QAE1B,yBAAyB;;;CAGnB,CAAC;AAIX;;GAEG;AACH,eAAO,MAAM,sBAAsB;IACjC;;OAEG;;QAED,sEAAsE;;QAEtE,qEAAqE;;QAErE,gDAAgD;;;IAIlD;;OAEG;;QAED,oCAAoC;;QAEpC,gCAAgC;;QAEhC,8CAA8C;;;IAIhD;;OAEG;;QAED,0CAA0C;;QAE1C,+CAA+C;;QAE/C,4CAA4C;;;IAI9C;;OAEG;;QAED,uCAAuC;;QAEvC,wCAAwC;;QAExC,wCAAwC;;;IAI1C;;OAEG;;QAED,0CAA0C;;QAS1C,2CAA2C;;QAS3C,iCAAiC;;;IAWnC;;OAEG;;QAED,wCAAwC;;QAExC,gCAAgC;;QAEhC,kCAAkC;;QAElC,+BAA+B;;;CAGzB,CAAC;AAIX;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;IACzC,oEAAoE;;IAEpE,+CAA+C;;IAE/C,4DAA4D;;CAEpD,CAAC;AAIX;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;IAC5C,qEAAqE;;IAErE,gGAAgG;;IAEhG;;;yEAGqE;;IAErE;;+EAE2E;;IAE3E,6EAA6E;;IAE7E,8DAA8D;;IAE9D;;mFAE+E;;IAE/E;;;oDAGgD;;CAEvC,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;IAC7C,qEAAqE;;IAErE,4FAA4F;;IAE5F,0EAA0E;;IAE1E,qDAAqD;;IAErD,oDAAoD;;CAE3C,CAAC;AAIX;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;IACnC,kFAAkF;;IAElF,+DAA+D;;IAE/D,6EAA6E;;IAE7E,uEAAuE;;IAEvE,4CAA4C;;IAE5C,kEAAkE;;IAElE,0DAA0D;;IAE1D,2EAA2E;;IAE3E;;;;;;OAMG;;CAEM,CAAC;AAIX;;;GAGG;AACH,eAAO,MAAM,gBAAgB;IAC5B,gEAAgE;;IAEhE,0DAA0D;;IAE1D,+DAA+D;;CAEtD,CAAC;AAIX;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;IAC7B,iGAAiG;;IAEjG,8DAA8D;;CAErD,CAAC;AAIX;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;IACnC,iEAAiE;;IAEjE,+CAA+C;;IAE/C,sDAAsD;;IAEtD,8DAA8D;;CAErD,CAAC;AAIX;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;IACjC,kEAAkE;;IAElE,qEAAqE;;IAErE,4EAA4E;;IAE5E,+CAA+C;;IAE/C,sDAAsD;;IAEtD,2DAA2D;;IAE3D,2DAA2D;;IAE3D,iDAAiD;;IAEjD,2DAA2D;;IAE3D,iDAAiD;;IAEjD,oEAAoE;;IAEpE,uEAAuE;;IAEvE,uEAAuE;;IAEvE,8EAA8E;;IAE9E,0FAA0F;;IAE1F,oFAAoF;2BAgB/E,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAClB,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;IAC1C,2DAA2D;;IAE3D,6CAA6C;;IAE7C,yDAAyD;;IAEzD,+DAA+D;;IAE/D,8CAA8C;;IAE9C,mCAAmC;;IAEnC,0CAA0C;;IAE1C,2CAA2C;;IAE3C,0CAA0C;;IAE1C,yBAAyB;;CAEhB,CAAC;AAIX;;;;GAIG;AACH,eAAO,MAAM,eAAe;IAC3B;;OAEG;;QAEF,2DAA2D;;QAE3D,kDAAkD;;;IAInD;;OAEG;;IAGH;;OAEG;;IAGH;;OAEG;;QAEF,wCAAwC;;QAExC,wCAAwC;;;IAIzC;;OAEG;;QAEF,6BAA6B;;QAE7B,+BAA+B;;;IAIhC;;OAEG;;QAEF,uDAAuD;;;CAG/C,CAAC;AAEX,mCAAmC;AACnC,eAAO,MAAM,iBAAiB,MAA4C,CAAC;AAM3E;;GAEG;AACH,eAAO,MAAM,eAAe;IAC3B,gCAAgC;;QAE/B,yBAAyB;;QAEzB,yBAAyB;;QAEzB,qDAAqD;;QAErD,2DAA2D;;QAE3D,uDAAuD;;QAEvD,uDAAuD;;;IAGxD,mDAAmD;;QAElD,+CAA+C;;QAE/C,kDAAkD;;QAElD,6DAA6D;;;IAG9D,yBAAyB;;QAExB,4CAA4C;;QAE5C,+CAA+C;;;IAGhD,yDAAyD;;QAExD,0BAA0B;;QAE1B,0BAA0B;;QAE1B,qBAAqB;;QAErB,kDAAkD;;;CAG1C,CAAC;AAEX;;GAEG;AACH,MAAM,MAAM,WAAW,GACtB,CAAC,OAAO,gBAAgB,CAAC,cAAc,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,cAAc,CAAC,CAAC;AACxF,MAAM,MAAM,aAAa,GACxB,CAAC,OAAO,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;AAC5F,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAC7F,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;AACjG,MAAM,MAAM,mBAAmB,GAC9B,CAAC,OAAO,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;AACxG,MAAM,MAAM,cAAc,GACzB,CAAC,OAAO,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAChH,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,gBAAgB,CAAC,SAAS,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,SAAS,CAAC,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../config/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH;;GAEG;AACH,eAAO,MAAM,gBAAgB;IAC5B;;OAEG;;QAEF,gEAAgE;;QAEhE,2DAA2D;;QAE3D,kEAAkE;;QAElE,sDAAsD;;QAEtD,+DAA+D;;;IAIhE;;OAEG;;QAEF,iCAAiC;;QAEjC,+BAA+B;;QAE/B,kCAAkC;;QAElC,yBAAyB;;QAEzB,8BAA8B;;QAE9B,iCAAiC;;QAEjC,8BAA8B;;QAE9B,+BAA+B;;QAE/B,sBAAsB;;QAEtB,+BAA+B;;QAE/B,6BAA6B;;QAE7B,oCAAoC;;QAEpC,qCAAqC;;QAErC,4BAA4B;;QAE5B,qDAAqD;;QAErD,4BAA4B;;QAE5B,2CAA2C;;QAE3C,mDAAmD;;;IAIpD;;;OAGG;;QAEF,+CAA+C;;QAE/C,4CAA4C;;QAE5C,6EAA6E;;QAE7E,oDAAoD;;QAEpD,+EAA+E;;QAE/E,yEAAyE;;;IAI1E;;OAEG;;QAEF,4CAA4C;;QAE5C,2CAA2C;;;IAI5C;;OAEG;;QAEF,uDAAuD;;QAEvD,2DAA2D;;QAE3D,uDAAuD;;QAEvD,+CAA+C;;QAE/C,0DAA0D;;QAE1D,sDAAsD;;;IAIvD;;OAEG;;QAEF,mEAAmE;;;IAIpE;;OAEG;;;;;;;;;IAUH;;OAEG;;QAEF,6CAA6C;;QAE7C,uCAAuC;;QAEvC,yCAAyC;;;CAGjC,CAAC;AAIX;;GAEG;AACH,eAAO,MAAM,wBAAwB;IACpC;;OAEG;;QAEF,oDAAoD;;QAEpD,uBAAuB;;QAEvB,iBAAiB;;;CAGT,CAAC;AAIX;;;GAGG;AACH,eAAO,MAAM,kBAAkB;IAC9B,uCAAuC;;IAEvC,6BAA6B;;IAE7B,kEAAkE;;CAEzD,CAAC;AAIX;;GAEG;AACH,eAAO,MAAM,aAAa;IACzB;;OAEG;;QAEF,sCAAsC;;QAEtC,+CAA+C;;;IAIhD;;OAEG;;QAEF,4BAA4B;;QAE5B,oBAAoB;;QAEpB,iCAAiC;;QAEjC,oCAAoC;;QAEpC,qCAAqC;;QAErC,oCAAoC;;QAEpC,gCAAgC;;QAEhC,2BAA2B;;;IAI5B;;OAEG;;QAEF,2DAA2D;;QAE3D,sDAAsD;;QAEtD,+DAA+D;;QAE/D,0DAA0D;;QAE1D,8CAA8C;;QAE9C,2DAA2D;;;CAGnD,CAAC;AAIX;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;IAClC,iCAAiC;;QAEhC,wEAAwE;;QAExE,kEAAkE;;QAElE,+EAA+E;;QAE/E,iEAAiE;;;IAGlE,sEAAsE;;IAEtE,+DAA+D;;IAE/D,qEAAqE;;IAErE,iEAAiE;;IAEjE,4DAA4D;;IAE5D,kEAAkE;;IAElE,wCAAwC;;IAExC,2EAA2E;;IAE3E,kFAAkF;;IAElF,4DAA4D;;IAE5D,sFAAsF;;IAEtF,0DAA0D;;;;;IAK1D,iEAAiE;;IAEjE,qCAAqC;;IAGrC,gDAAgD;;CAEvC,CAAC;AAIX;;GAEG;AACH,eAAO,MAAM,gBAAgB;IAC5B;;OAEG;;QAEF,mDAAmD;;QAEnD,4CAA4C;;QAE5C,iDAAiD;;;IAIlD;;OAEG;;QAEF,yCAAyC;;QAEzC,0CAA0C;;QAE1C,0CAA0C;;QAE1C,gDAAgD;;QAEhD,0CAA0C;;QAE1C,oCAAoC;;QAEpC,oDAAoD;;QAEpD,wCAAwC;;;IAIzC;;OAEG;;QAEF,iDAAiD;;QAEjD,uCAAuC;;QAEvC,0CAA0C;;QAE1C,gDAAgD;;QAEhD,8CAA8C;;QAE9C,wDAAwD;;QAExD,4DAA4D;;QAE5D,6DAA6D;;QAE7D,sDAAsD;;QAEtD,wCAAwC;;QAExC,2DAA2D;;QAE3D,uDAAuD;;QAEvD,4CAA4C;;QAE5C,0CAA0C;;QAE1C,2CAA2C;;QAE3C,+BAA+B;;QAE/B,qCAAqC;;QAErC,2CAA2C;;QAE3C,iDAAiD;;;CAGzC,CAAC;AAIX;;GAEG;AACH,eAAO,MAAM,iBAAiB;IAC7B;;OAEG;;QAEF,6DAA6D;;QAE7D,iEAAiE;;QAEjE,+CAA+C;;;IAIhD;;OAEG;;QAEF,uCAAuC;;QAEvC,8BAA8B;;QAE9B,oCAAoC;;QAEpC,iCAAiC;;QAEjC,uCAAuC;;;CAG/B,CAAC;AAIX;;GAEG;AACH,eAAO,MAAM,aAAa;IACzB,sEAAsE;;IAEtE,6BAA6B;;IAE7B,sBAAsB;;IAEtB,sBAAsB;;IAEtB,mBAAmB;;IAEnB,iBAAiB;;IAEjB,uBAAuB;;IAEvB,4BAA4B;;CAEnB,CAAC;AAIX;;;GAGG;AACH,eAAO,MAAM,iBAAiB;IAC7B;;OAEG;;QAEF,yCAAyC;;QAEzC,8BAA8B;;QAE9B,kCAAkC;;QAElC,+BAA+B;;;;;QAK/B,+BAA+B;;;;IAKhC;;OAEG;;;;;IAMH;;OAEG;;QAEF,0BAA0B;;QAE1B,2BAA2B;;QAE3B,gDAAgD;;;;;;;;;QAShD,uCAAuC;;;IAIxC;;OAEG;;;;;;;;;;;IAYH;;OAEG;;;;;;;;IASH;;OAEG;;QAEF,8DAA8D;;;IAI/D;;OAEG;;;;;IAMH;;OAEG;;;;IAKH;;OAEG;;QAEF,kDAAkD;;QAElD,8BAA8B;;QAE9B,yCAAyC;;QAEzC,kCAAkC;;;IAInC;;OAEG;;IAGH;;OAEG;;;;;;;IAQH;;OAEG;;CASM,CAAC;AAIX;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;IAC3B;;OAEG;;QAED,uDAAuD;;QAEvD,gEAAgE;;QAEhE,8DAA8D;;QAE9D,uCAAuC;;QAEvC,kDAAkD;;QAElD,8CAA8C;;QAE9C,iBAAiB;;QAEjB,yBAAyB;;QAEzB,uDAAuD;;QAEvD,8DAA8D;;QAE9D,uBAAuB;;QAEvB,uBAAuB;;QAEvB,oDAAoD;;QAEpD,kCAAkC;;QAElC,gDAAgD;;;IAIlD;;OAEG;;QAED,uBAAuB;;QAEvB,sCAAsC;;QAEtC,wBAAwB;;QAExB,0BAA0B;;QAE1B,4BAA4B;;;IAI9B;;OAEG;;QAED,sBAAsB;;QAEtB,sBAAsB;;QAEtB,uBAAuB;;QAEvB,qBAAqB;;QAErB,2BAA2B;;QAE3B,iDAAiD;;QAEjD,mCAAmC;;;IAIrC;;OAEG;;QAED,mDAAmD;;QAEnD,qDAAqD;;;;;QAKrD,uCAAuC;;QAEvC,iDAAiD;;QAEjD,wDAAwD;;QAExD,oDAAoD;;;IAItD;;OAEG;;QAED,mDAAmD;;QAEnD,uDAAuD;;QAEvD,+BAA+B;;QAE/B,+BAA+B;;;IAIjC;;OAEG;;QAED,6BAA6B;;QAE7B,uCAAuC;;;IAIzC;;OAEG;;QAED,gCAAgC;;QAEhC,yBAAyB;;QAEzB,6BAA6B;;QAE7B,0BAA0B;;QAE1B,yBAAyB;;;CAGnB,CAAC;AAIX;;GAEG;AACH,eAAO,MAAM,sBAAsB;IACjC;;OAEG;;QAED,sEAAsE;;QAEtE,qEAAqE;;QAErE,gDAAgD;;;IAIlD;;OAEG;;QAED,oCAAoC;;QAEpC,gCAAgC;;QAEhC,8CAA8C;;;IAIhD;;OAEG;;QAED,0CAA0C;;QAE1C,+CAA+C;;QAE/C,4CAA4C;;;IAI9C;;OAEG;;QAED,uCAAuC;;QAEvC,wCAAwC;;QAExC,wCAAwC;;;IAI1C;;OAEG;;QAED,0CAA0C;;QAS1C,2CAA2C;;QAS3C,iCAAiC;;;IAWnC;;OAEG;;QAED,wCAAwC;;QAExC,gCAAgC;;QAEhC,kCAAkC;;QAElC,+BAA+B;;;CAGzB,CAAC;AAIX;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;IACzC,oEAAoE;;IAEpE,+CAA+C;;IAE/C,4DAA4D;;CAEpD,CAAC;AAIX;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;IAC5C,qEAAqE;;IAErE,gGAAgG;;IAEhG;;;yEAGqE;;IAErE;;+EAE2E;;IAE3E,6EAA6E;;IAE7E,8DAA8D;;IAE9D;;mFAE+E;;IAE/E;;;oDAGgD;;CAEvC,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;IAC7C,qEAAqE;;IAErE,4FAA4F;;IAE5F,0EAA0E;;IAE1E,qDAAqD;;IAErD,oDAAoD;;CAE3C,CAAC;AAIX;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;IACnC,kFAAkF;;IAElF,+DAA+D;;IAE/D,6EAA6E;;IAE7E,uEAAuE;;IAEvE,4CAA4C;;IAE5C,kEAAkE;;IAElE,0DAA0D;;IAE1D,2EAA2E;;IAE3E;;;;;;OAMG;;CAEM,CAAC;AAIX;;;GAGG;AACH,eAAO,MAAM,gBAAgB;IAC5B,gEAAgE;;IAEhE,0DAA0D;;IAE1D,+DAA+D;;CAEtD,CAAC;AAIX;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;IAC7B,iGAAiG;;IAEjG,8DAA8D;;CAErD,CAAC;AAIX;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;IACnC,iEAAiE;;IAEjE,+CAA+C;;IAE/C,sDAAsD;;IAEtD,8DAA8D;;CAErD,CAAC;AAIX;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;IACjC,kEAAkE;;IAElE,qEAAqE;;IAErE,4EAA4E;;IAE5E,+CAA+C;;IAE/C,sDAAsD;;IAEtD,2DAA2D;;IAE3D,2DAA2D;;IAE3D,iDAAiD;;IAEjD,2DAA2D;;IAE3D,iDAAiD;;IAEjD,oEAAoE;;IAEpE,uEAAuE;;IAEvE,uEAAuE;;IAEvE,8EAA8E;;IAE9E,0FAA0F;;IAE1F,oFAAoF;2BAgB/E,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAClB,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;IAC1C,2DAA2D;;IAE3D,6CAA6C;;IAE7C,yDAAyD;;IAEzD,+DAA+D;;IAE/D,8CAA8C;;IAE9C,mCAAmC;;IAEnC,0CAA0C;;IAE1C,2CAA2C;;IAE3C,0CAA0C;;IAE1C,yBAAyB;;CAEhB,CAAC;AAIX;;;;GAIG;AACH,eAAO,MAAM,eAAe;IAC3B;;OAEG;;QAEF,2DAA2D;;QAE3D,kDAAkD;;;IAInD;;OAEG;;IAGH;;OAEG;;IAGH;;OAEG;;QAEF,wCAAwC;;QAExC,wCAAwC;;;IAIzC;;OAEG;;QAEF,6BAA6B;;QAE7B,+BAA+B;;;IAIhC;;OAEG;;QAEF,uDAAuD;;;CAG/C,CAAC;AAEX,mCAAmC;AACnC,eAAO,MAAM,iBAAiB,MAA4C,CAAC;AAM3E;;GAEG;AACH,eAAO,MAAM,eAAe;IAC3B,gCAAgC;;QAE/B,yBAAyB;;QAEzB,yBAAyB;;QAEzB,qDAAqD;;QAErD,2DAA2D;;QAE3D,uDAAuD;;QAEvD,uDAAuD;;;IAGxD,mDAAmD;;QAElD,+CAA+C;;QAE/C,kDAAkD;;QAElD,6DAA6D;;;IAG9D,yBAAyB;;QAExB,4CAA4C;;QAE5C,+CAA+C;;;IAGhD,yDAAyD;;QAExD,0BAA0B;;QAE1B,0BAA0B;;QAE1B,qBAAqB;;QAErB,kDAAkD;;;CAG1C,CAAC;AAEX;;GAEG;AACH,MAAM,MAAM,WAAW,GACtB,CAAC,OAAO,gBAAgB,CAAC,cAAc,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,cAAc,CAAC,CAAC;AACxF,MAAM,MAAM,aAAa,GACxB,CAAC,OAAO,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;AAC5F,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAC7F,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;AACjG,MAAM,MAAM,mBAAmB,GAC9B,CAAC,OAAO,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;AACxG,MAAM,MAAM,cAAc,GACzB,CAAC,OAAO,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAChH,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,gBAAgB,CAAC,SAAS,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,SAAS,CAAC,CAAC"}

package/dist/cli/config/constants.js

@@ -227,6 +227,60 @@ export const WEB_CONSTANTS = {
         FALLBACK_POLL_INTERVAL: 5000,
     },
 };
+// ========================= API SECURITY CONSTANTS =========================
+/**
+ * Network exposure + API token authentication for the OSS server.
+ *
+ * The REST API and WebSocket endpoints are open to loopback callers (local
+ * skills, the local dashboard) and require a shared API token from every
+ * other address. See README "Securing a server install".
+ */
+export const API_SECURITY_CONSTANTS = {
+    /** Environment variable names */
+    ENV: {
+        /** Host/interface the HTTP server binds to (default: all interfaces) */
+        BIND_HOST: 'CREWLY_BIND_HOST',
+        /** Pinned API token; when unset one is generated on first boot */
+        API_TOKEN: 'CREWLY_API_TOKEN',
+        /** Set to `1` to honour `X-Forwarded-For` when classifying loopback callers */
+        TRUST_PROXY: 'CREWLY_TRUST_PROXY',
+        /** Set to `1`/`true` to force headless (no display) detection */
+        HEADLESS: 'CREWLY_HEADLESS',
+    },
+    /** Default bind host — every interface, for backward compatibility */
+    DEFAULT_BIND_HOST: '0.0.0.0',
+    /** Loopback-only bind host suggested in the startup warning */
+    LOOPBACK_BIND_HOST: '127.0.0.1',
+    /** File (relative to CREWLY_HOME) holding the generated API token */
+    TOKEN_FILE_NAME: 'api-token',
+    /** Random bytes in a generated token (hex-encoded → 64 chars) */
+    TOKEN_BYTES: 32,
+    /** POSIX mode for the token file (owner read/write only) */
+    TOKEN_FILE_MODE: 0o600,
+    /** Hex characters of sha256(token) recorded for audit purposes */
+    FINGERPRINT_HEX_LENGTH: 8,
+    /** Request header carrying the token */
+    TOKEN_HEADER: 'x-crewly-token',
+    /** Cookie name carrying the token (lets `<img>`/asset/WS requests pass) */
+    TOKEN_COOKIE: 'crewly_token',
+    /** Query-string parameter carrying the token (WebSocket + dashboard deep link) */
+    TOKEN_QUERY_PARAM: 'token',
+    /** localStorage key the dashboard stores the token under */
+    TOKEN_STORAGE_KEY: 'crewly_api_token',
+    /** `WWW-Authenticate` scheme advertised on 401 so clients can detect the challenge */
+    AUTH_SCHEME: 'Crewly-Token',
+    /** Error codes returned in `{ success: false, error }` */
+    ERRORS: {
+        UNAUTHORIZED: 'unauthorized',
+        OWNER_APPROVAL_REQUIRED: 'owner_approval_required',
+    },
+    /** Actor recorded on approvals performed with the owner token */
+    OWNER_ACTOR: 'owner',
+    /** Hint appended to 401 responses */
+    UNAUTHORIZED_HINT: 'Non-loopback callers must send the API token: `Authorization: Bearer <token>`, `X-Crewly-Token: <token>` or a `crewly_token` cookie. Run `crewly token` on the server to print it.',
+    /** Loopback addresses that bypass token auth */
+    LOOPBACK_ADDRESSES: ['127.0.0.1', '::1', '::ffff:127.0.0.1'],
+};
 // ========================= TIMING CONSTANTS =========================
 /**
  * Timing and interval configurations used across domains