crewly 1.20.153 → 1.20.154

package/dist/cli/backend/src/types/v2/work-item.types.js

@@ -159,6 +159,13 @@ export const SLA_TERMINAL_WORK_ITEM_STATUSES = new Set([
 export const WORK_ITEM_BLOCK_SOURCES = {
     /** Blocked through the block API by the agent / a lead: stays blocked until unblocked. */
     EXPLICIT: 'explicit',
+    /**
+     * Parked by the reconciler because the agent sat on a terminal prompt
+     * (approval, trust, plan menu) for too long (#815). Resumed to `running`
+     * automatically when the prompt is gone; never re-queued or counted as a
+     * failure or retry.
+     */
+    WAITING_ON_HUMAN: 'waiting_on_human',
 };
 /**
  * Whether a WorkItem is blocked on purpose (block API) rather than parked by
@@ -175,6 +182,20 @@ export const WORK_ITEM_BLOCK_SOURCES = {
 export function isExplicitlyBlocked(wi) {
     return wi.status === 'blocked' && wi.blockSource === WORK_ITEM_BLOCK_SOURCES.EXPLICIT;
 }
+/**
+ * Whether a WorkItem was parked because its agent is waiting on a human (#815).
+ *
+ * @param wi - WorkItem (status + blockSource)
+ * @returns True for a `blocked` item with the waiting_on_human block source
+ *
+ * @example
+ * ```typescript
+ * if (isWaitingOnHumanBlocked(wi)) continue; // resumed by the waiting_on_human rule only
+ * ```
+ */
+export function isWaitingOnHumanBlocked(wi) {
+    return wi.status === 'blocked' && wi.blockSource === WORK_ITEM_BLOCK_SOURCES.WAITING_ON_HUMAN;
+}
 // ---------------------------------------------------------------------------
 // Valid State Transitions
 // ---------------------------------------------------------------------------
@@ -195,7 +216,9 @@ export const WORK_ITEM_TRANSITIONS = {
     // in TRANSITION_PERMISSIONS to TL/orchestrator/system — agents cannot
     // self-revive a running claim.
     running: new Set(['done', 'done_by_worker', 'failed', 'blocked', 'escalated', 'cancelled', 'queued']),
-    blocked: new Set(['queued', 'cancelled']),
+    // #815: blocked → running resumes an item the reconciler parked while its
+    // agent waited on a terminal prompt (blockSource 'waiting_on_human').
+    blocked: new Set(['queued', 'running', 'cancelled']),
     escalated: new Set(['queued', 'cancelled']),
     done_by_worker: new Set(['verified', 'rejected']),
     verified: new Set(),
@@ -226,73 +249,269 @@ export const DISPOSITION_REQUIRED_STATUSES = new Set(Object.keys(WORK_ITEM_TRANS
     // No outbound edge reaches a strictly terminal status.
     return ![...outbound].some((next) => TERMINAL_WORK_ITEM_STATUSES.has(next));
 }));
+/** All valid TransitionActorRole values. */
+export const TRANSITION_ACTOR_ROLES = [
+    ...WORK_ITEM_OWNERS,
+    'owner',
+];
+/**
+ * Normalise an actor argument. Anything that is not a known role — including
+ * `undefined`, `null` and `''` — yields `undefined`, which the gate refuses.
+ * There is deliberately no default role (#813: a missing actor used to
+ * become `'system'`, the most privileged role).
+ *
+ * @param input - Actor object, bare role, or nothing
+ * @returns The normalised actor, or undefined when no valid actor was given
+ *
+ * @example
+ * ```typescript
+ * normalizeTransitionActor('system');                       // { role: 'system' }
+ * normalizeTransitionActor({ role: 'team_lead', session }); // unchanged
+ * normalizeTransitionActor(undefined);                      // undefined → refused
+ * ```
+ */
+export function normalizeTransitionActor(input) {
+    if (input === null || input === undefined)
+        return undefined;
+    const actor = typeof input === 'string' ? { role: input } : input;
+    if (typeof actor !== 'object' || !TRANSITION_ACTOR_ROLES.includes(actor.role)) {
+        return undefined;
+    }
+    const session = typeof actor.session === 'string' && actor.session.trim() ? actor.session.trim() : undefined;
+    return { role: actor.role, ...(session ? { session } : {}), ...(actor.via ? { via: actor.via } : {}) };
+}
+/**
+ * Render an actor for logs and error messages: `team_lead(sam-1)`,
+ * `system[reconciler]`, `(none)`.
+ *
+ * @param actor - Normalised actor, or undefined
+ * @returns A short human-readable label
+ */
+export function describeTransitionActor(actor) {
+    if (!actor)
+        return '(none)';
+    return `${actor.role}${actor.session ? `(${actor.session})` : ''}${actor.via ? `[${actor.via}]` : ''}`;
+}
 // ---------------------------------------------------------------------------
-// Role-Based Transition Permissions
+// Review metadata (#813)
 // ---------------------------------------------------------------------------
 /**
- * Defines which roles are allowed to trigger specific status transitions.
+ * `WorkItem.metadata` key naming the session that must review a
+ * `done_by_worker` item, when set explicitly. Usually absent: the reviewer of
+ * record is then the target of the item's review WorkItem
+ * (`<id>:verify:<id>`), which the EventToWorkItemBridge routes to the
+ * worker's own lead, else the orchestrator. TaskPoolService fills it from
+ * there before calling the gate.
+ */
+export const WORK_ITEM_REVIEWER_KEY = 'reviewer';
+/**
+ * `WorkItem.metadata` key stamped when an overdue review was escalated to the
+ * orchestrator. From then on the orchestrator may render the verdict too.
+ */
+export const REVIEW_ESCALATED_TO_ORC_KEY = 'verifyEscalatedAt';
+/**
+ * `WorkItem.metadata` key stamped when a review still open at the TTL was
+ * escalated to the owner (replaces the old 24h auto-verify).
+ */
+export const REVIEW_ESCALATED_TO_OWNER_KEY = 'reviewOwnerEscalatedAt';
+/** The two verdict edges: the only way out of `done_by_worker`. */
+export const VERDICT_TRANSITIONS = new Set([
+    'done_by_worker→verified',
+    'done_by_worker→rejected',
+]);
+/**
+ * The session recorded as a WorkItem's reviewer, if any.
+ *
+ * @param item - WorkItem (only `metadata` is read)
+ * @returns The reviewer session, or undefined
+ */
+export function getWorkItemReviewer(item) {
+    const v = item.metadata?.[WORK_ITEM_REVIEWER_KEY];
+    return typeof v === 'string' && v.trim() ? v.trim() : undefined;
+}
+// ---------------------------------------------------------------------------
+// Transition Permissions (closed table)
+// ---------------------------------------------------------------------------
+/**
+ * Which actor roles may take each legal status edge.
+ *
+ * Format: `from→to` key → set of allowed {@link TransitionActorRole}s.
+ *
+ * **Closed (#813).** Every edge in {@link WORK_ITEM_TRANSITIONS} has an entry;
+ * an edge with no entry is refused for every actor, `system` included. The
+ * test suite fails if a legal edge is added without an entry here. `system`
+ * no longer bypasses the table: it is listed on the edges server code
+ * actually takes, and is absent from `done_by_worker→verified` — no timer,
+ * sweeper or fallback may certify work.
  *
- * Format: `from→to` key maps to a set of allowed WorkItemOwner roles.
- * If a transition is not listed here, any role may trigger it (backward compatible).
- * The 'system' role (reconciler) can always trigger any valid transition.
+ * The verdict edges ({@link VERDICT_TRANSITIONS}) additionally require the
+ * caller to be the item's reviewer — see {@link checkTransitionPermission}.
  */
 export const TRANSITION_PERMISSIONS = {
+    // --- queued ---
+    // Claims run server-side (claimFromPool → 'system'); agents / leads that
+    // move an item straight to running keep the access they always had.
+    'queued→running': new Set(['agent', 'team_lead', 'orchestrator', 'system']),
     // Only TL or orchestrator can propose tasks
     'queued→proposed': new Set(['team_lead', 'orchestrator']),
+    // Mission executor defers an item to a future slot
+    'queued→scheduled': new Set(['team_lead', 'orchestrator', 'system']),
+    'queued→cancelled': new Set(['team_lead', 'orchestrator', 'owner', 'system']),
+    // --- scheduled ---
+    'scheduled→queued': new Set(['team_lead', 'orchestrator', 'system']),
+    'scheduled→cancelled': new Set(['team_lead', 'orchestrator', 'owner', 'system']),
+    // --- proposed ---
     // Only the assigned agent can accept or reject a proposal
     'proposed→accepted': new Set(['agent']),
     'proposed→rejected': new Set(['agent']),
+    'proposed→cancelled': new Set(['team_lead', 'orchestrator', 'owner', 'system']),
+    // --- accepted ---
+    'accepted→running': new Set(['agent', 'system']),
+    'accepted→cancelled': new Set(['team_lead', 'orchestrator', 'owner', 'system']),
+    // --- running ---
+    // Simple done — allowed for agents (simple tasks) and system (reconciler)
+    'running→done': new Set(['agent', 'system', 'orchestrator']),
     // Only the assigned agent can report completion
     'running→done_by_worker': new Set(['agent']),
+    'running→failed': new Set(['agent', 'system']),
+    'running→blocked': new Set(['agent', 'team_lead', 'orchestrator', 'system']),
     // Only the assigned agent can escalate
     'running→escalated': new Set(['agent']),
-    // Only TL can verify or reject worker output
-    'done_by_worker→verified': new Set(['team_lead']),
-    'done_by_worker→rejected': new Set(['team_lead']),
-    // Simple done — allowed for agents (simple tasks) and system (reconciler)
-    'running→done': new Set(['agent', 'system', 'orchestrator']),
-    // TRANS-1 F-F: only TL / orchestrator / system may re-queue a rejected
-    // WorkItem. Without this entry, the backward-compat default-allow at
-    // isTransitionPermitted line ~322 lets any actor (including the agent
-    // whose work was rejected) re-queue itself — a self-revival hazard.
-    // BRIDGE-1 retry policy is the canonical re-queueing path; manual
-    // TL action (or system reconciler) is the only other legal path.
-    'rejected→queued': new Set(['team_lead', 'orchestrator', 'system']),
-    // failed→queued (BRIDGE-1 retry path) — same gate as rejected→queued.
-    // Agent cannot self-resurrect a failed WorkItem.
-    'failed→queued': new Set(['team_lead', 'orchestrator', 'system']),
-    // blocked→queued (dependency-resolution path) — system-only by
-    // default. The TaskPoolService.resolveBlockedDependents() helper
-    // is the canonical caller and runs as system.
-    'blocked→queued': new Set(['team_lead', 'orchestrator', 'system']),
-    // TRANS-2: running→queued (releaseBack abandon path). Same gate as
-    // the other re-queue transitions — Reconciler revoke and TL manual
-    // release are the legitimate callers; agents cannot self-revive a
+    'running→cancelled': new Set(['team_lead', 'orchestrator', 'owner', 'system']),
+    // TRANS-2: running→queued (releaseBack abandon path). Reconciler revoke and
+    // TL manual release are the legitimate callers; agents cannot self-revive a
     // running claim by re-queueing it.
     'running→queued': new Set(['team_lead', 'orchestrator', 'system']),
+    // --- blocked / escalated ---
+    // blocked→queued (dependency-resolution path) — resolveBlockedDependents
+    // runs as system.
+    'blocked→queued': new Set(['team_lead', 'orchestrator', 'system']),
+    'blocked→cancelled': new Set(['team_lead', 'orchestrator', 'owner', 'system']),
+    // #815: resume after waiting_on_human — the reconciler only. Agents and
+    // leads unblock through blocked→queued.
+    'blocked→running': new Set(['system']),
+    'escalated→queued': new Set(['team_lead', 'orchestrator', 'system']),
+    'escalated→cancelled': new Set(['team_lead', 'orchestrator', 'owner', 'system']),
+    // --- verdicts (identity-checked, see checkTransitionPermission) ---
+    // No 'system': work is verified only by its reviewer.
+    'done_by_worker→verified': new Set(['team_lead', 'orchestrator', 'owner']),
+    // 'system' may send work BACK (SLA escalation timeout); it may never pass it.
+    'done_by_worker→rejected': new Set(['team_lead', 'orchestrator', 'owner', 'system']),
+    // --- re-queue after a verdict / failure ---
+    // TRANS-1 F-F: the agent whose work was rejected or failed cannot re-queue
+    // itself; BRIDGE-1 retry policy (system) and a lead are the legal paths.
+    'rejected→queued': new Set(['team_lead', 'orchestrator', 'system']),
+    'failed→queued': new Set(['team_lead', 'orchestrator', 'system']),
 };
 /**
- * Checks whether a role is permitted to trigger a specific status transition.
+ * Whether `actor` is the rightful reviewer of a `done_by_worker` item.
  *
- * If no explicit permission is defined for a transition, it is considered
- * open to all roles (backward compatible). The 'system' role always has
- * permission for any valid transition.
+ * - `owner`: always — the owner is the last escalation step.
+ * - `orchestrator`: when it is the recorded reviewer, when no reviewer was
+ *   recorded (items that predate reviewer stamping — the orchestrator is the
+ *   escalation reviewer), or once the review was escalated.
+ * - `team_lead`: only as the recorded reviewer, identified by session.
+ * - `system` (rejection only — the table keeps it off `verified`).
  *
- * @param from - Current status
+ * @param item - The WorkItem under review
+ * @param actor - The normalised caller
+ * @returns A decision (never throws)
+ */
+function checkReviewer(item, actor) {
+    if (actor.role === 'owner' || actor.role === 'system')
+        return { allowed: true };
+    const reviewer = getWorkItemReviewer(item);
+    if (actor.session && item.target && actor.session === item.target) {
+        return { allowed: false, reason: 'self_review', detail: `${actor.session} is the worker on this item and cannot review its own work` };
+    }
+    if (actor.session && reviewer && actor.session === reviewer)
+        return { allowed: true };
+    if (actor.role === 'orchestrator') {
+        const escalated = !!item.metadata?.[REVIEW_ESCALATED_TO_ORC_KEY] || !!item.metadata?.[REVIEW_ESCALATED_TO_OWNER_KEY];
+        if (!reviewer || escalated)
+            return { allowed: true };
+    }
+    return {
+        allowed: false,
+        reason: 'not_reviewer',
+        detail: reviewer
+            ? `only the reviewer (${reviewer}), the orchestrator after escalation, or the owner may render this verdict`
+            : 'no reviewer is recorded; only the orchestrator or the owner may render this verdict',
+    };
+}
+/**
+ * Decide whether `actor` may move `item` to status `to`.
+ *
+ * Deny by default (#813):
+ * 1. No actor → refused (`missing_actor`). There is no default role.
+ * 2. Edge not in {@link TRANSITION_PERMISSIONS} → refused for everyone
+ *    (`unlisted_transition`).
+ * 3. Role not listed for the edge → refused (`role_not_permitted`).
+ * 4. Verdict edges ({@link VERDICT_TRANSITIONS}) also require the caller to
+ *    be the item's reviewer, and never the worker itself.
+ *
+ * Checks permission only — state-machine legality is
+ * {@link isValidWorkItemTransition}'s job.
+ *
+ * @param item - The WorkItem (its current `status`, `target`, `metadata` are read)
  * @param to - Desired next status
- * @param actorRole - Role of the agent/system attempting the transition
- * @returns True if the role is permitted to trigger this transition
+ * @param actorInput - The caller (object or bare role); undefined is refused
+ * @returns `{ allowed: true }` or the refusal reason and a readable detail
+ *
+ * @example
+ * ```typescript
+ * checkTransitionPermission(wi, 'verified', { role: 'team_lead', session: 'sam' });
+ * // → { allowed: true } only when wi.metadata.reviewer === 'sam'
+ * ```
  */
-export function isTransitionPermitted(from, to, actorRole) {
-    // System role can always transition
-    if (actorRole === 'system')
-        return true;
-    const key = `${from}→${to}`;
+export function checkTransitionPermission(item, to, actorInput) {
+    const actor = normalizeTransitionActor(actorInput);
+    const key = `${item.status}→${to}`;
+    if (!actor) {
+        return { allowed: false, reason: 'missing_actor', detail: `no actor supplied for ${key}` };
+    }
     const allowed = TRANSITION_PERMISSIONS[key];
-    // If no explicit permission defined, allow any role (backward compatible)
-    if (!allowed)
-        return true;
-    return allowed.has(actorRole);
+    if (!allowed) {
+        return { allowed: false, reason: 'unlisted_transition', detail: `${key} is not in the transition permission table` };
+    }
+    if (!allowed.has(actor.role)) {
+        return { allowed: false, reason: 'role_not_permitted', detail: `role '${actor.role}' may not perform ${key}` };
+    }
+    if (VERDICT_TRANSITIONS.has(key))
+        return checkReviewer(item, actor);
+    return { allowed: true };
+}
+/**
+ * Boolean form of {@link checkTransitionPermission}.
+ *
+ * @param item - The WorkItem (its current status, target and metadata)
+ * @param to - Desired next status
+ * @param actor - The caller; undefined is refused
+ * @returns True if the actor may perform the transition
+ */
+export function isTransitionPermitted(item, to, actor) {
+    return checkTransitionPermission(item, to, actor).allowed;
+}
+/**
+ * Thrown when a transition is legal in the state machine but the actor may
+ * not take it. Controllers map it to HTTP 403.
+ */
+export class ForbiddenTransitionError extends Error {
+    /** Machine-readable refusal reason */
+    reason;
+    /**
+     * @param workItemId - The WorkItem the transition was attempted on
+     * @param from - Its current status
+     * @param to - The refused target status
+     * @param actor - Who attempted it
+     * @param decision - The refusal from {@link checkTransitionPermission}
+     */
+    constructor(workItemId, from, to, actor, decision) {
+        super(`Forbidden transition for WorkItem ${workItemId}: actor='${describeTransitionActor(actor)}' ` +
+            `not permitted to perform ${from} → ${to} (${decision.reason}: ${decision.detail}).`);
+        this.name = 'ForbiddenTransitionError';
+        this.reason = decision.reason;
+    }
 }
 // ---------------------------------------------------------------------------
 // Type Guards

package/dist/cli/backend/src/types/v2/work-item.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"work-item.types.js","sourceRoot":"","sources":["../../../../../../backend/src/types/v2/work-item.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAmBpC,qCAAqC;AACrC,MAAM,CAAC,MAAM,eAAe,GAA4B;IACtD,UAAU;IACV,cAAc;IACd,OAAO;IACP,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,SAAS;IACT,WAAW;CACH,CAAC;AAWX,sCAAsC;AACtC,MAAM,CAAC,MAAM,gBAAgB,GAA6B;IACxD,cAAc;IACd,WAAW;IACX,OAAO;IACP,QAAQ;CACA,CAAC;AA0DX,uCAAuC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAA8B;IAC3D,QAAQ;IACR,WAAW;IACX,UAAU;IACV,UAAU;IACV,SAAS;IACT,SAAS;IACT,WAAW;IACX,gBAAgB;IAChB,UAAU;IACV,UAAU;IACV,MAAM;IACN,QAAQ;IACR,WAAW;CACH,CAAC;AAEX,0DAA0D;AAC1D,MAAM,CAAC,MAAM,2BAA2B,GAAgC,IAAI,GAAG,CAAC;IAC9E,MAAM;IACN,UAAU;IACV,WAAW;CACZ,CAAC,CAAC;AAwFH,sEAAsE;AACtE,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAC;AAEtD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CACpC,EAA8B;IAE9B,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,wBAAwB,CAAC,CAAC;IACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,SAAS,GAAG,GAAmC,CAAC;IACtD,MAAM,MAAM,GACV,SAAS,CAAC,IAAI,KAAK,kBAAkB;QACrC,SAAS,CAAC,IAAI,KAAK,cAAc;QACjC,SAAS,CAAC,IAAI,KAAK,UAAU,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAgC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAA8B;IAC/D,OAAO,sBAAsB,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC;AAC7C,CAAC;AAGD,MAAM,CAAC,MAAM,6BAA6B,GAAG,gBAAgB,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,cAAc,CAAC,EAA4C;IACzE,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,6BAA6B,CAAC,CAAC;IACzD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC,SAAS,CAAC;IACjD,2EAA2E;IAC3E,kDAAkD;IAClD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC,SAAS,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAC1C,IAAI,GAAG,CAAiB;IACtB,MAAM;IACN,UAAU;IACV,WAAW;IACX,QAAQ;IACR,UAAU;CACX,CAAC,CAAC;AAEL,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;GAMG;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,0FAA0F;IAC1F,QAAQ,EAAE,UAAU;CACZ,CAAC;AAKX;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAA4C;IAC9E,OAAO,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,CAAC,WAAW,KAAK,uBAAuB,CAAC,QAAQ,CAAC;AACxF,CAAC;AAsND,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAwD;IACxF,MAAM,EAAU,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAC1E,SAAS,EAAO,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAChD,QAAQ,EAAQ,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IAC9D,QAAQ,EAAQ,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACjD,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,sEAAsE;IACtE,+BAA+B;IAC/B,OAAO,EAAS,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5G,OAAO,EAAS,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAChD,SAAS,EAAO,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAChD,cAAc,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACjD,QAAQ,EAAQ,IAAI,GAAG,EAAkB;IACzC,QAAQ,EAAQ,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,EAAY,IAAI,GAAG,EAAkB;IACzC,MAAM,EAAU,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IACnC,SAAS,EAAO,IAAI,GAAG,EAAkB;CAC1C,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAgC,IAAI,GAAG,CAC9E,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAsB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;IACzE,IAAI,2BAA2B,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,uDAAuD;IACvD,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9E,CAAC,CAAC,CACH,CAAC;AAEF,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA+C;IAChF,4CAA4C;IAC5C,iBAAiB,EAAW,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAClE,0DAA0D;IAC1D,mBAAmB,EAAS,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9C,mBAAmB,EAAS,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9C,gDAAgD;IAChD,wBAAwB,EAAI,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9C,uCAAuC;IACvC,mBAAmB,EAAS,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9C,6CAA6C;IAC7C,yBAAyB,EAAG,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IAClD,yBAAyB,EAAG,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IAClD,0EAA0E;IAC1E,cAAc,EAAc,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,oEAAoE;IACpE,kEAAkE;IAClE,iEAAiE;IACjE,iBAAiB,EAAW,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IAC5E,sEAAsE;IACtE,iDAAiD;IACjD,eAAe,EAAa,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IAC5E,+DAA+D;IAC/D,iEAAiE;IACjE,8CAA8C;IAC9C,gBAAgB,EAAY,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IAC5E,mEAAmE;IACnE,mEAAmE;IACnE,kEAAkE;IAClE,mCAAmC;IACnC,gBAAgB,EAAY,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;CAC7E,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAoB,EACpB,EAAkB,EAClB,SAAwB;IAExB,oCAAoC;IACpC,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAE5C,0EAA0E;IAC1E,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAQ,eAAqC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAoB,EAAE,EAAkB;IAChF,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;QAC1B,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QAC5B,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;QAC7B,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAC7B,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC;QAC/B,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAC7B,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAC9B,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC;QACjC,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QACjC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAClC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CACnC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAA0B;IACpE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,wBAAwB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,yBAAyB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACpG,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,wBAAwB,EAAE,CAAC;YACrF,MAAM,CAAC,IAAI,CACT,yBAAyB,wBAAwB,+CAA+C,CACjG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,yCAAyC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IACxC,yEAAyE;IACzE,4EAA4E;IAC5E,6CAA6C;IAC7C,MAAM,aAAa,GAAmB,OAAO;QAC3C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,WAAW;YACX,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,QAAQ,CAAC;IACf,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,MAAM,EAAE;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,MAAM,EAAE,aAAa;QACrB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,CAAC;QACb,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,mBAAmB;QACnD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,CAAC;QACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,SAAU,CAAC,CAAC,CAAC,CAAC,SAAS;KACvD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"work-item.types.js","sourceRoot":"","sources":["../../../../../../backend/src/types/v2/work-item.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAmBpC,qCAAqC;AACrC,MAAM,CAAC,MAAM,eAAe,GAA4B;IACtD,UAAU;IACV,cAAc;IACd,OAAO;IACP,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,SAAS;IACT,WAAW;CACH,CAAC;AAWX,sCAAsC;AACtC,MAAM,CAAC,MAAM,gBAAgB,GAA6B;IACxD,cAAc;IACd,WAAW;IACX,OAAO;IACP,QAAQ;CACA,CAAC;AA0DX,uCAAuC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAA8B;IAC3D,QAAQ;IACR,WAAW;IACX,UAAU;IACV,UAAU;IACV,SAAS;IACT,SAAS;IACT,WAAW;IACX,gBAAgB;IAChB,UAAU;IACV,UAAU;IACV,MAAM;IACN,QAAQ;IACR,WAAW;CACH,CAAC;AAEX,0DAA0D;AAC1D,MAAM,CAAC,MAAM,2BAA2B,GAAgC,IAAI,GAAG,CAAC;IAC9E,MAAM;IACN,UAAU;IACV,WAAW;CACZ,CAAC,CAAC;AAwFH,sEAAsE;AACtE,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAC;AAEtD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CACpC,EAA8B;IAE9B,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,wBAAwB,CAAC,CAAC;IACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,SAAS,GAAG,GAAmC,CAAC;IACtD,MAAM,MAAM,GACV,SAAS,CAAC,IAAI,KAAK,kBAAkB;QACrC,SAAS,CAAC,IAAI,KAAK,cAAc;QACjC,SAAS,CAAC,IAAI,KAAK,UAAU,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAgC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAA8B;IAC/D,OAAO,sBAAsB,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC;AAC7C,CAAC;AAGD,MAAM,CAAC,MAAM,6BAA6B,GAAG,gBAAgB,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,cAAc,CAAC,EAA4C;IACzE,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,6BAA6B,CAAC,CAAC;IACzD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC,SAAS,CAAC;IACjD,2EAA2E;IAC3E,kDAAkD;IAClD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC,SAAS,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAC1C,IAAI,GAAG,CAAiB;IACtB,MAAM;IACN,UAAU;IACV,WAAW;IACX,QAAQ;IACR,UAAU;CACX,CAAC,CAAC;AAEL,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;GAMG;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,0FAA0F;IAC1F,QAAQ,EAAE,UAAU;IACpB;;;;;OAKG;IACH,gBAAgB,EAAE,kBAAkB;CAC5B,CAAC;AAKX;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAA4C;IAC9E,OAAO,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,CAAC,WAAW,KAAK,uBAAuB,CAAC,QAAQ,CAAC;AACxF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,EAA4C;IAClF,OAAO,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,CAAC,WAAW,KAAK,uBAAuB,CAAC,gBAAgB,CAAC;AAChG,CAAC;AAsND,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAwD;IACxF,MAAM,EAAU,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAC1E,SAAS,EAAO,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAChD,QAAQ,EAAQ,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IAC9D,QAAQ,EAAQ,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACjD,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,sEAAsE;IACtE,+BAA+B;IAC/B,OAAO,EAAS,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5G,0EAA0E;IAC1E,sEAAsE;IACtE,OAAO,EAAS,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAC3D,SAAS,EAAO,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAChD,cAAc,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACjD,QAAQ,EAAQ,IAAI,GAAG,EAAkB;IACzC,QAAQ,EAAQ,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,EAAY,IAAI,GAAG,EAAkB;IACzC,MAAM,EAAU,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IACnC,SAAS,EAAO,IAAI,GAAG,EAAkB;CAC1C,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAgC,IAAI,GAAG,CAC9E,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAsB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;IACzE,IAAI,2BAA2B,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,uDAAuD;IACvD,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9E,CAAC,CAAC,CACH,CAAC;AAaF,4CAA4C;AAC5C,MAAM,CAAC,MAAM,sBAAsB,GAAmC;IACpE,GAAG,gBAAgB;IACnB,OAAO;CACC,CAAC;AAqBX;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAA8C;IAE9C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,KAAK,GAAoB,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACnF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAE,sBAA4C,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrG,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7G,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAkC;IACxE,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,OAAO,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACzG,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,mBAAmB,CAAC;AAE/D;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,wBAAwB,CAAC;AAEtE,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IAC9D,yBAAyB;IACzB,yBAAyB;CAC1B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IAClE,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,sBAAsB,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED,8EAA8E;AAC9E,wCAAwC;AACxC,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAqD;IACtF,iBAAiB;IACjB,yEAAyE;IACzE,oEAAoE;IACpE,gBAAgB,EAAY,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IACrF,4CAA4C;IAC5C,iBAAiB,EAAW,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAClE,mDAAmD;IACnD,kBAAkB,EAAU,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IAC5E,kBAAkB,EAAU,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrF,oBAAoB;IACpB,kBAAkB,EAAU,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IAC5E,qBAAqB,EAAO,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrF,mBAAmB;IACnB,0DAA0D;IAC1D,mBAAmB,EAAS,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9C,mBAAmB,EAAS,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9C,oBAAoB,EAAQ,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrF,mBAAmB;IACnB,kBAAkB,EAAU,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxD,oBAAoB,EAAQ,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrF,kBAAkB;IAClB,0EAA0E;IAC1E,cAAc,EAAc,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IACxE,gDAAgD;IAChD,wBAAwB,EAAI,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9C,gBAAgB,EAAY,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxD,iBAAiB,EAAW,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IACrF,uCAAuC;IACvC,mBAAmB,EAAS,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9C,mBAAmB,EAAS,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrF,4EAA4E;IAC5E,4EAA4E;IAC5E,mCAAmC;IACnC,gBAAgB,EAAY,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IAC5E,8BAA8B;IAC9B,yEAAyE;IACzE,kBAAkB;IAClB,gBAAgB,EAAY,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IAC5E,mBAAmB,EAAS,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrF,wEAAwE;IACxE,wCAAwC;IACxC,iBAAiB,EAAW,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/C,kBAAkB,EAAU,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IAC5E,qBAAqB,EAAO,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrF,qEAAqE;IACrE,sDAAsD;IACtD,yBAAyB,EAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;IAC3E,8EAA8E;IAC9E,yBAAyB,EAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrF,6CAA6C;IAC7C,2EAA2E;IAC3E,yEAAyE;IACzE,iBAAiB,EAAW,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IAC5E,eAAe,EAAa,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;CAC7E,CAAC;AAeF;;;;;;;;;;;;;GAaG;AACH,SAAS,aAAa,CACpB,IAA2C,EAC3C,KAAsB;IAEtB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,4DAA4D,EAAE,CAAC;IACzI,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtF,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAClC,MAAM,SAAS,GACb,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,6BAA6B,CAAC,CAAC;QACrG,IAAI,CAAC,QAAQ,IAAI,SAAS;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACvD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,QAAQ;YACd,CAAC,CAAC,sBAAsB,QAAQ,4EAA4E;YAC5G,CAAC,CAAC,qFAAqF;KAC1F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAsD,EACtD,EAAkB,EAClB,UAAmD;IAEnD,MAAM,KAAK,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,yBAAyB,GAAG,EAAE,EAAE,CAAC;IAC7F,CAAC;IACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,GAAG,4CAA4C,EAAE,CAAC;IACvH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,SAAS,KAAK,CAAC,IAAI,qBAAqB,GAAG,EAAE,EAAE,CAAC;IACjH,CAAC;IACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAsD,EACtD,EAAkB,EAClB,KAA8C;IAE9C,OAAO,yBAAyB,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,sCAAsC;IAC7B,MAAM,CAAyB;IAExC;;;;;;OAMG;IACH,YACE,UAAkB,EAClB,IAAoB,EACpB,EAAkB,EAClB,KAAkC,EAClC,QAAyD;QAEzD,KAAK,CACH,qCAAqC,UAAU,YAAY,uBAAuB,CAAC,KAAK,CAAC,IAAI;YAC3F,4BAA4B,IAAI,MAAM,EAAE,KAAK,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CACvF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAChC,CAAC;CACF;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAQ,eAAqC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAoB,EAAE,EAAkB;IAChF,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;QAC1B,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QAC5B,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;QAC7B,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAC7B,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC;QAC/B,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAC7B,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAC9B,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC;QACjC,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QACjC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAClC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CACnC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAA0B;IACpE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,wBAAwB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,yBAAyB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACpG,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,wBAAwB,EAAE,CAAC;YACrF,MAAM,CAAC,IAAI,CACT,yBAAyB,wBAAwB,+CAA+C,CACjG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,yCAAyC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IACxC,yEAAyE;IACzE,4EAA4E;IAC5E,6CAA6C;IAC7C,MAAM,aAAa,GAAmB,OAAO;QAC3C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,WAAW;YACX,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,QAAQ,CAAC;IACf,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,MAAM,EAAE;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,MAAM,EAAE,aAAa;QACrB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,CAAC;QACb,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,mBAAmB;QACnD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,CAAC;QACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,SAAU,CAAC,CAAC,CAAC,CAAC,SAAS;KACvD,CAAC;AACJ,CAAC"}

package/dist/cli/backend/src/utils/secret-env.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Secret environment variable guard
+ *
+ * Environment variables whose names mark them as secrets (API keys, tokens,
+ * passwords) must never be set by typing `export KEY="value"` into a
+ * terminal: the shell echoes the line, so the value lands in scrollback, in
+ * the persistent session log (~/.crewly/logs/sessions/) and in the
+ * terminal-output API. Secrets go into a session through its spawn
+ * environment instead (`createSession(..., { env })`).
+ *
+ * @module utils/secret-env
+ */
+/**
+ * Whether an environment variable name denotes a secret.
+ *
+ * @param key - Environment variable name
+ * @returns True for names like OPENAI_API_KEY, ANTHROPIC_API_KEY, GITHUB_TOKEN
+ *
+ * @example
+ * ```ts
+ * isSecretEnvKey('GEMINI_API_KEY'); // true
+ * isSecretEnvKey('CREWLY_SESSION_NAME'); // false
+ * ```
+ */
+export declare function isSecretEnvKey(key: string): boolean;
+/**
+ * Throws when asked to type a secret into a terminal.
+ *
+ * The error names the variable only, never the value.
+ *
+ * @param key - Environment variable name about to be exported in a terminal
+ * @throws Error when `key` is a secret name (see isSecretEnvKey)
+ */
+export declare function assertNotSecretEnvKey(key: string): void;
+/** A secret's variable name and value, for masking by value */
+export interface SecretEnvValue {
+    /** Variable name, used in the mask */
+    name: string;
+    /** The secret value to mask wherever it appears */
+    value: string;
+}
+/**
+ * Collects the values of every secret-named variable in one or more env maps.
+ *
+ * Used to mask secrets by exact value, which catches secrets no pattern can
+ * recognise (a Slack signing secret is plain hex). Longest values come first
+ * so a value that contains another is masked whole.
+ *
+ * @param envs - Env maps to read (e.g. process.env and a session's spawn env)
+ * @returns Distinct secret values with their names, longest first
+ */
+export declare function collectSecretEnvValues(...envs: ReadonlyArray<Record<string, string | undefined> | undefined>): SecretEnvValue[];
+/**
+ * Replaces every occurrence of the given secret values with `[REDACTED <NAME>]`.
+ *
+ * @param text - Text to mask
+ * @param secrets - Values to mask (see collectSecretEnvValues)
+ * @returns The text with every listed value masked
+ */
+export declare function redactSecretEnvValues(text: string, secrets: readonly SecretEnvValue[]): string;
+//# sourceMappingURL=secret-env.d.ts.map

package/dist/cli/backend/src/utils/secret-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-env.d.ts","sourceRoot":"","sources":["../../../../../backend/src/utils/secret-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAQvD;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC9B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;CACd;AAKD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACrC,GAAG,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC,GACpE,cAAc,EAAE,CAWlB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAM9F"}

package/dist/cli/backend/src/utils/secret-env.js

@@ -0,0 +1,89 @@
+/**
+ * Secret environment variable guard
+ *
+ * Environment variables whose names mark them as secrets (API keys, tokens,
+ * passwords) must never be set by typing `export KEY="value"` into a
+ * terminal: the shell echoes the line, so the value lands in scrollback, in
+ * the persistent session log (~/.crewly/logs/sessions/) and in the
+ * terminal-output API. Secrets go into a session through its spawn
+ * environment instead (`createSession(..., { env })`).
+ *
+ * @module utils/secret-env
+ */
+/**
+ * Name suffixes that mark an environment variable as secret. Matched
+ * case-insensitively at the end of the name, after `_` or at the start
+ * (so `API_KEY`, `OPENAI_API_KEY` and `GITHUB_TOKEN` match, `TOKENIZER` does not).
+ */
+const SECRET_ENV_NAME_RE = /(?:^|_)(?:API_KEY|KEY_SECRET|SECRET|SECRET_KEY|TOKEN|ACCESS_TOKEN|PASSWORD|PASSWD|PRIVATE_KEY)$/i;
+/**
+ * Whether an environment variable name denotes a secret.
+ *
+ * @param key - Environment variable name
+ * @returns True for names like OPENAI_API_KEY, ANTHROPIC_API_KEY, GITHUB_TOKEN
+ *
+ * @example
+ * ```ts
+ * isSecretEnvKey('GEMINI_API_KEY'); // true
+ * isSecretEnvKey('CREWLY_SESSION_NAME'); // false
+ * ```
+ */
+export function isSecretEnvKey(key) {
+    return SECRET_ENV_NAME_RE.test(key);
+}
+/**
+ * Throws when asked to type a secret into a terminal.
+ *
+ * The error names the variable only, never the value.
+ *
+ * @param key - Environment variable name about to be exported in a terminal
+ * @throws Error when `key` is a secret name (see isSecretEnvKey)
+ */
+export function assertNotSecretEnvKey(key) {
+    if (isSecretEnvKey(key)) {
+        throw new Error(`Refusing to type secret environment variable ${key} into a terminal ` +
+            '(it would be echoed into scrollback and session logs). ' +
+            'Pass it in the session spawn environment: createSession(name, cwd, { env }).');
+    }
+}
+/** Values shorter than this are not masked: too likely to match ordinary text */
+const MIN_MASKABLE_SECRET_LENGTH = 12;
+/**
+ * Collects the values of every secret-named variable in one or more env maps.
+ *
+ * Used to mask secrets by exact value, which catches secrets no pattern can
+ * recognise (a Slack signing secret is plain hex). Longest values come first
+ * so a value that contains another is masked whole.
+ *
+ * @param envs - Env maps to read (e.g. process.env and a session's spawn env)
+ * @returns Distinct secret values with their names, longest first
+ */
+export function collectSecretEnvValues(...envs) {
+    const byValue = new Map();
+    for (const env of envs) {
+        if (!env)
+            continue;
+        for (const [name, value] of Object.entries(env)) {
+            if (value && value.length >= MIN_MASKABLE_SECRET_LENGTH && isSecretEnvKey(name) && !byValue.has(value)) {
+                byValue.set(value, name);
+            }
+        }
+    }
+    return Array.from(byValue, ([value, name]) => ({ name, value })).sort((a, b) => b.value.length - a.value.length);
+}
+/**
+ * Replaces every occurrence of the given secret values with `[REDACTED <NAME>]`.
+ *
+ * @param text - Text to mask
+ * @param secrets - Values to mask (see collectSecretEnvValues)
+ * @returns The text with every listed value masked
+ */
+export function redactSecretEnvValues(text, secrets) {
+    let out = text;
+    for (const { name, value } of secrets) {
+        if (out.includes(value))
+            out = out.split(value).join(`[REDACTED ${name}]`);
+    }
+    return out;
+}
+//# sourceMappingURL=secret-env.js.map

package/dist/cli/backend/src/utils/secret-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-env.js","sourceRoot":"","sources":["../../../../../backend/src/utils/secret-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,kGAAkG,CAAC;AAE9H;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,OAAO,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAChD,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACd,gDAAgD,GAAG,mBAAmB;YACrE,yDAAyD;YACzD,8EAA8E,CAC/E,CAAC;IACH,CAAC;AACF,CAAC;AAUD,iFAAiF;AACjF,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAEtC;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACrC,GAAG,IAAmE;IAEtE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,0BAA0B,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC1B,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAClH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,OAAkC;IACrF,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/cli/cli/src/commands/onboard.d.ts

@@ -284,7 +284,7 @@ export declare function createTeamFromTemplate(template: TeamTemplate, runtimeTy
  * - .crewly/
  * - .crewly/docs/
  * - .crewly/memory/
- * - .crewly/tasks/
+ * - .crewly/tickets/ (the project backlog, see specs/2026-09-28-project-tickets.md)
  * - .crewly/teams/
  *
  * If a template is provided, copies goals.md and team.json from the

package/dist/cli/cli/src/commands/onboard.js

@@ -44,7 +44,7 @@ import chalk from 'chalk';
 import { checkSkillsInstalled, installAllSkills, countBundledSkills, } from '../utils/marketplace.js';
 import { listTemplates, getTemplate, getTemplatesDir, listOnboardingStarters, getDefaultStarterTemplate, } from '../utils/templates.js';
 import { CLI_CONSTANTS } from '../constants.js';
-import { HARNESS_CONSTANTS } from '../../../backend/src/constants.js';
+import { HARNESS_CONSTANTS, PROJECT_TICKET_CONSTANTS } from '../../../backend/src/constants.js';
 import { createCliHarnessService, getBackendPort, isBackendRunning, localBackendUrl, pickLoginDriver, } from '../utils/harness-engine.js';
 import { askReadline, createReadlineIO } from '../utils/prompt-io.js';
 import { runHarnessSetup } from './harness-setup.js';
@@ -560,7 +560,7 @@ export function createTeamFromTemplate(template, runtimeType = HARNESS_CONSTANTS
  * - .crewly/
  * - .crewly/docs/
  * - .crewly/memory/
- * - .crewly/tasks/
+ * - .crewly/tickets/ (the project backlog, see specs/2026-09-28-project-tickets.md)
  * - .crewly/teams/
  *
  * If a template is provided, copies goals.md and team.json from the
@@ -583,7 +583,7 @@ export function scaffoldCrewlyDirectory(projectDir = process.cwd(), template) {
     }
     try {
         if (!alreadyExisted) {
-            const subdirs = ['docs', 'memory', 'tasks', 'teams'];
+            const subdirs = ['docs', 'memory', PROJECT_TICKET_CONSTANTS.DIR_NAME, 'teams'];
             for (const subdir of subdirs) {
                 mkdirSync(join(crewlyDir, subdir), { recursive: true });
             }