crewly 1.20.303 → 1.20.304

package/dist/backend/backend/src/services/team-move/team-move-journal.js

@@ -0,0 +1,198 @@
+/**
+ * Team move journal — resumable, idempotent steps.
+ *
+ * Every move keeps a directory `~/.crewly/team-moves/<moveId>/` with
+ * `journal.json` (which steps finished and what they produced) and
+ * `state.json` (what Cloud last asked for). A step that is recorded as done is
+ * skipped when the move is resumed after a crash or restart, and the step
+ * functions themselves are written so that running one twice is harmless.
+ *
+ * @module services/team-move/team-move-journal
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { TEAM_MOVE_CONSTANTS } from '../../constants.js';
+import { atomicWriteJson, safeReadJson } from '../../utils/file-io.utils.js';
+import { getCrewlyHomePath } from '../core/crewly-home.utils.js';
+/** Move ids are Cloud-made; accept only path-safe ones. */
+const MOVE_ID_PATTERN = /^[A-Za-z0-9_-]{8,64}$/;
+/**
+ * Whether a string is a usable move id.
+ *
+ * @param value - Candidate
+ * @returns True for path-safe ids
+ */
+export function isMoveId(value) {
+    return typeof value === 'string' && MOVE_ID_PATTERN.test(value);
+}
+/**
+ * Directory of all moves on this machine.
+ *
+ * @param home - Crewly home (default: the process's)
+ * @returns Absolute path
+ */
+export function teamMovesRoot(home = getCrewlyHomePath()) {
+    return path.join(home, TEAM_MOVE_CONSTANTS.HOME_DIR);
+}
+/**
+ * Directory of one move.
+ *
+ * @param moveId - Move id
+ * @param home - Crewly home
+ * @returns Absolute path
+ * @throws Error for an id that is not path-safe
+ */
+export function moveDirFor(moveId, home = getCrewlyHomePath()) {
+    if (!isMoveId(moveId))
+        throw new Error('invalid move id');
+    return path.join(teamMovesRoot(home), moveId);
+}
+/** Journal and state of one move. */
+export class MoveJournal {
+    moveId;
+    dir;
+    journalFile;
+    stateFile;
+    entries = null;
+    now;
+    /**
+     * @param moveId - Move id
+     * @param home - Crewly home
+     * @param now - Clock (tests)
+     */
+    constructor(moveId, home = getCrewlyHomePath(), now = () => new Date().toISOString()) {
+        this.moveId = moveId;
+        this.dir = moveDirFor(moveId, home);
+        this.journalFile = path.join(this.dir, 'journal.json');
+        this.stateFile = path.join(this.dir, 'state.json');
+        this.now = now;
+    }
+    /** Create the move directory. */
+    async ensure() {
+        await fs.mkdir(this.dir, { recursive: true });
+    }
+    async load() {
+        if (!this.entries) {
+            const raw = await safeReadJson(this.journalFile, { entries: [] });
+            this.entries = Array.isArray(raw.entries) ? raw.entries : [];
+        }
+        return this.entries;
+    }
+    async append(entry) {
+        const entries = await this.load();
+        entries.push(entry);
+        await this.ensure();
+        await atomicWriteJson(this.journalFile, { entries });
+    }
+    /**
+     * All entries, oldest first.
+     *
+     * @returns Journal entries
+     */
+    async list() {
+        return [...(await this.load())];
+    }
+    /**
+     * Whether a step finished.
+     *
+     * @param step - Step name
+     * @returns True when its last entry is `done`
+     */
+    async isDone(step) {
+        const entries = await this.load();
+        for (let i = entries.length - 1; i >= 0; i--) {
+            if (entries[i].step === step)
+                return entries[i].state === 'done';
+        }
+        return false;
+    }
+    /**
+     * What a finished step recorded.
+     *
+     * @param step - Step name
+     * @returns The `detail` of its last `done` entry, or undefined
+     */
+    async detailOf(step) {
+        const entries = await this.load();
+        for (let i = entries.length - 1; i >= 0; i--) {
+            const e = entries[i];
+            if (e.step === step && e.state === 'done')
+                return e.detail;
+        }
+        return undefined;
+    }
+    /**
+     * Run a step once. A step already `done` is skipped and its recorded detail
+     * returned; a failure is recorded and rethrown.
+     *
+     * @param step - Step name
+     * @param fn - The step; its return value is stored as the step's detail
+     * @returns The step's detail (fresh or recorded)
+     */
+    async run(step, fn) {
+        if (await this.isDone(step))
+            return (await this.detailOf(step));
+        await this.append({ step, state: 'started', at: this.now() });
+        try {
+            const detail = await fn();
+            await this.append({ step, state: 'done', at: this.now(), ...(detail === undefined ? {} : { detail }) });
+            return detail;
+        }
+        catch (error) {
+            await this.append({ step, state: 'failed', at: this.now(), error: error instanceof Error ? error.message : String(error) });
+            throw error;
+        }
+    }
+    /**
+     * Forget a step so it runs again (e.g. a retry after the owner fixed something).
+     *
+     * @param step - Step name
+     */
+    async reset(step) {
+        const entries = (await this.load()).filter((e) => e.step !== step);
+        this.entries = entries;
+        await this.ensure();
+        await atomicWriteJson(this.journalFile, { entries });
+    }
+    /**
+     * Read `state.json`.
+     *
+     * @returns The state, or null before the first write
+     */
+    async readState() {
+        return safeReadJson(this.stateFile, null);
+    }
+    /**
+     * Merge a patch into `state.json`.
+     *
+     * @param patch - Fields to set
+     * @returns The new state
+     */
+    async writeState(patch) {
+        const current = await this.readState();
+        const next = {
+            moveId: this.moveId,
+            teamId: current?.teamId ?? patch.teamId ?? '',
+            teamName: current?.teamName ?? patch.teamName ?? '',
+            action: current?.action ?? null,
+            phase: current?.phase ?? 'idle',
+            ...current,
+            ...patch,
+            updatedAt: this.now(),
+        };
+        await this.ensure();
+        await atomicWriteJson(this.stateFile, next);
+        return next;
+    }
+}
+/**
+ * Ids of the moves that have a directory on this machine.
+ *
+ * @param home - Crewly home
+ * @returns Move ids
+ */
+export async function listLocalMoveIds(home = getCrewlyHomePath()) {
+    const entries = await fs.readdir(teamMovesRoot(home), { withFileTypes: true }).catch(() => []);
+    return entries.filter((e) => e.isDirectory() && isMoveId(e.name)).map((e) => e.name);
+}
+//# sourceMappingURL=team-move-journal.js.map

package/dist/backend/backend/src/services/team-move/team-move-journal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-move-journal.js","sourceRoot":"","sources":["../../../../../../backend/src/services/team-move/team-move-journal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAGjE,2DAA2D;AAC3D,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,iBAAiB,EAAE;IAC9D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,OAAe,iBAAiB,EAAE;IAC3E,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,qCAAqC;AACrC,MAAM,OAAO,WAAW;IAaX;IAZF,GAAG,CAAS;IACJ,WAAW,CAAS;IACpB,SAAS,CAAS;IAC3B,OAAO,GAA0B,IAAI,CAAC;IAC7B,GAAG,CAAe;IAEnC;;;;OAIG;IACH,YACW,MAAc,EACvB,OAAe,iBAAiB,EAAE,EAClC,MAAoB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAFzC,WAAM,GAAN,MAAM,CAAQ;QAIvB,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACvD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,iCAAiC;IACjC,KAAK,CAAC,MAAM;QACV,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,MAAM,YAAY,CAA+B,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YAChG,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,KAAmB;QACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI;QACR,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,OAAO,CAAC,CAAC,CAAE,CAAC,KAAK,KAAK,MAAM,CAAC;QACrE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAc,IAAY;QACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;YACtB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;gBAAE,OAAO,CAAC,CAAC,MAAuB,CAAC;QAC9E,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,EAAoB;QAC7C,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAI,IAAI,CAAC,CAAM,CAAC;QACxE,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YACxG,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5H,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,IAAY;QACtB,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS;QACb,OAAO,YAAY,CAAwB,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,KAA6D;QAC5E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,GAAmB;YAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;YAC7C,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE;YACnD,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI;YAC/B,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,MAAM;YAC/B,GAAG,OAAO;YACV,GAAG,KAAK;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe,iBAAiB,EAAE;IACvE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/F,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC"}

package/dist/backend/backend/src/services/team-move/team-move-preflight.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Target preflight: can this machine take a team? Reports its Crewly version,
+ * free disk space, the machine-only tools the team needs and which agent
+ * runtimes are logged in. Cloud shows the result to the owner and refuses a
+ * target that is too old or full.
+ *
+ * @module services/team-move/team-move-preflight
+ */
+import type { TeamMovePreflight } from './team-move.types.js';
+/** Collaborators of the preflight (all injectable for tests). */
+export interface PreflightDeps {
+    crewlyVersion: string;
+    /** Directory whose file system must hold the package (default: the home). */
+    diskPath: string;
+    /** Free bytes under `diskPath`; null when it cannot be read. */
+    freeDisk?: (dir: string) => Promise<number | null>;
+    /** Whether a command is on PATH. */
+    hasCommand?: (binary: string) => boolean;
+    /** Which runtimes are installed and logged in, by runtime id. */
+    runtimeLogins?: () => Promise<Record<string, boolean>>;
+}
+/**
+ * Free bytes of the file system holding a directory.
+ *
+ * @param dir - Any path on it (the nearest existing parent is used)
+ * @returns Bytes available to this user, or null
+ */
+export declare function freeDiskBytes(dir: string): Promise<number | null>;
+/**
+ * Whether a command is on PATH (including the directories Crewly adds for its
+ * harnesses and the usual Homebrew/Linux locations a launchd-started backend
+ * does not inherit).
+ *
+ * @param binary - Command name
+ * @returns True when found
+ */
+export declare function commandOnPath(binary: string): boolean;
+/**
+ * Check which of a list of tools exist.
+ *
+ * @param tools - Tool names (keys of TEAM_MOVE_CONSTANTS.TOOL_BINARIES)
+ * @param hasCommand - PATH check
+ * @returns Tool name to present/absent
+ */
+export declare function checkTools(tools: readonly string[], hasCommand?: (binary: string) => boolean): Record<string, boolean>;
+/**
+ * Preflight of this machine as the target of a move.
+ *
+ * @param deps - Version, disk path and probes
+ * @param requiredTools - Tools to check (the full known list when the package is not known yet)
+ * @returns What Cloud receives with the target's public key
+ */
+export declare function runPreflight(deps: PreflightDeps, requiredTools?: readonly string[]): Promise<TeamMovePreflight>;
+/**
+ * Whether a version can take part in a move.
+ *
+ * @param version - Crewly version
+ * @returns True when at least {@link TEAM_MOVE_CONSTANTS.MIN_CREWLY_VERSION}
+ */
+export declare function isVersionCompatible(version: string): boolean;
+/**
+ * Whether a disk can hold a package of the given size once it is downloaded
+ * and unpacked (ciphertext + unpacked copy + headroom).
+ *
+ * @param freeBytes - Free bytes
+ * @param packageBytes - Ciphertext size
+ * @param unpackedBytes - Uncompressed size from the manifest
+ * @returns True when there is room
+ */
+export declare function hasRoomFor(freeBytes: number, packageBytes: number, unpackedBytes: number): boolean;
+//# sourceMappingURL=team-move-preflight.d.ts.map

package/dist/backend/backend/src/services/team-move/team-move-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-move-preflight.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/team-move/team-move-preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnD,oCAAoC;IACpC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAavE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAIrD;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,UAAU,GAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAuB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKrI;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,aAAa,EAAE,aAAa,GAAE,SAAS,MAAM,EAAoC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAStJ;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAElG"}

package/dist/backend/backend/src/services/team-move/team-move-preflight.js

@@ -0,0 +1,102 @@
+/**
+ * Target preflight: can this machine take a team? Reports its Crewly version,
+ * free disk space, the machine-only tools the team needs and which agent
+ * runtimes are logged in. Cloud shows the result to the owner and refuses a
+ * target that is too old or full.
+ *
+ * @module services/team-move/team-move-preflight
+ */
+import * as fs from 'node:fs/promises';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { TEAM_MOVE_CONSTANTS } from '../../constants.js';
+import { buildHarnessPath, resolveExecutable } from '../harness/harness-exec.utils.js';
+import { compareVersions } from '../harness/harness-status.service.js';
+/**
+ * Free bytes of the file system holding a directory.
+ *
+ * @param dir - Any path on it (the nearest existing parent is used)
+ * @returns Bytes available to this user, or null
+ */
+export async function freeDiskBytes(dir) {
+    let probe = dir;
+    for (let i = 0; i < 10; i++) {
+        try {
+            const stat = await fs.statfs(probe);
+            return Number(stat.bavail) * Number(stat.bsize);
+        }
+        catch {
+            const parent = path.dirname(probe);
+            if (parent === probe)
+                return null;
+            probe = parent;
+        }
+    }
+    return null;
+}
+/**
+ * Whether a command is on PATH (including the directories Crewly adds for its
+ * harnesses and the usual Homebrew/Linux locations a launchd-started backend
+ * does not inherit).
+ *
+ * @param binary - Command name
+ * @returns True when found
+ */
+export function commandOnPath(binary) {
+    const extra = ['/opt/homebrew/bin', '/usr/local/bin', '/usr/bin', '/bin', path.join(os.homedir(), '.local', 'bin')];
+    const searchPath = [buildHarnessPath(process.env['PATH']), ...extra].join(path.delimiter);
+    return resolveExecutable(binary, searchPath) !== null;
+}
+/**
+ * Check which of a list of tools exist.
+ *
+ * @param tools - Tool names (keys of TEAM_MOVE_CONSTANTS.TOOL_BINARIES)
+ * @param hasCommand - PATH check
+ * @returns Tool name to present/absent
+ */
+export function checkTools(tools, hasCommand = commandOnPath) {
+    const binaries = TEAM_MOVE_CONSTANTS.TOOL_BINARIES;
+    const out = {};
+    for (const tool of tools)
+        out[tool] = hasCommand(binaries[tool] ?? tool);
+    return out;
+}
+/**
+ * Preflight of this machine as the target of a move.
+ *
+ * @param deps - Version, disk path and probes
+ * @param requiredTools - Tools to check (the full known list when the package is not known yet)
+ * @returns What Cloud receives with the target's public key
+ */
+export async function runPreflight(deps, requiredTools = TEAM_MOVE_CONSTANTS.KNOWN_TOOLS) {
+    const free = await (deps.freeDisk ?? freeDiskBytes)(deps.diskPath);
+    const runtimes = deps.runtimeLogins ? await deps.runtimeLogins().catch(() => ({})) : {};
+    return {
+        crewlyVersion: deps.crewlyVersion,
+        freeDiskBytes: free ?? 0,
+        tools: checkTools(requiredTools, deps.hasCommand),
+        runtimes,
+    };
+}
+/**
+ * Whether a version can take part in a move.
+ *
+ * @param version - Crewly version
+ * @returns True when at least {@link TEAM_MOVE_CONSTANTS.MIN_CREWLY_VERSION}
+ */
+export function isVersionCompatible(version) {
+    return /^\d+\.\d+\.\d+/.test(version) && compareVersions(version, TEAM_MOVE_CONSTANTS.MIN_CREWLY_VERSION) >= 0;
+}
+/**
+ * Whether a disk can hold a package of the given size once it is downloaded
+ * and unpacked (ciphertext + unpacked copy + headroom).
+ *
+ * @param freeBytes - Free bytes
+ * @param packageBytes - Ciphertext size
+ * @param unpackedBytes - Uncompressed size from the manifest
+ * @returns True when there is room
+ */
+export function hasRoomFor(freeBytes, packageBytes, unpackedBytes) {
+    return freeBytes >= packageBytes + unpackedBytes + TEAM_MOVE_CONSTANTS.DISK_HEADROOM_BYTES;
+}
+//# sourceMappingURL=team-move-preflight.js.map

package/dist/backend/backend/src/services/team-move/team-move-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-move-preflight.js","sourceRoot":"","sources":["../../../../../../backend/src/services/team-move/team-move-preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAgBvE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YAClC,KAAK,GAAG,MAAM,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,KAAK,GAAG,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACpH,MAAM,UAAU,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1F,OAAO,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,IAAI,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,KAAwB,EAAE,aAA0C,aAAa;IAC1G,MAAM,QAAQ,GAAG,mBAAmB,CAAC,aAAuC,CAAC;IAC7E,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAmB,EAAE,gBAAmC,mBAAmB,CAAC,WAAW;IACxH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,aAAa,EAAE,IAAI,IAAI,CAAC;QACxB,KAAK,EAAE,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC;QACjD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,mBAAmB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;AACjH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB,EAAE,YAAoB,EAAE,aAAqB;IACvF,OAAO,SAAS,IAAI,YAAY,GAAG,aAAa,GAAG,mBAAmB,CAAC,mBAAmB,CAAC;AAC7F,CAAC"}

package/dist/backend/backend/src/services/team-move/team-move-runtime.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Composition of the team move for the running backend: builds the exporter,
+ * importer, archiver and driver from the backend's own singletons (storage,
+ * task pool, decision cards, Slack team channels, harness status, device
+ * identity) so a move changes the live stores through their services and not
+ * behind their back.
+ *
+ * Starting and stopping a team goes through this backend's own REST API with
+ * the internal Cloud credential: the owner approved the move in Cloud, and the
+ * regular start/stop routes do the tmux and status bookkeeping.
+ *
+ * @module services/team-move/team-move-runtime
+ */
+import type { StorageService } from '../core/storage.service.js';
+import { TeamMoveDriver, type TeamMoveRelaySource } from './team-move-driver.service.js';
+/** Inputs of the composition. */
+export interface TeamMoveRuntimeInput {
+    storage: StorageService;
+    relay: TeamMoveRelaySource;
+    home?: string;
+}
+/**
+ * Build the driver for the running backend.
+ *
+ * @param input - Storage and the relay event source
+ * @returns The driver (not started)
+ */
+export declare function createTeamMoveDriver(input: TeamMoveRuntimeInput): TeamMoveDriver;
+//# sourceMappingURL=team-move-runtime.d.ts.map

package/dist/backend/backend/src/services/team-move/team-move-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-move-runtime.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/team-move/team-move-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAWH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAUjE,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAKzF,iCAAiC;AACjC,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,cAAc,CAAC;IACxB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AA0CD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,cAAc,CAkGhF"}

package/dist/backend/backend/src/services/team-move/team-move-runtime.js

@@ -0,0 +1,173 @@
+/**
+ * Composition of the team move for the running backend: builds the exporter,
+ * importer, archiver and driver from the backend's own singletons (storage,
+ * task pool, decision cards, Slack team channels, harness status, device
+ * identity) so a move changes the live stores through their services and not
+ * behind their back.
+ *
+ * Starting and stopping a team goes through this backend's own REST API with
+ * the internal Cloud credential: the owner approved the move in Cloud, and the
+ * regular start/stop routes do the tmux and status bookkeeping.
+ *
+ * @module services/team-move/team-move-runtime
+ */
+import * as path from 'node:path';
+import * as fs from 'node:fs/promises';
+import { safeReadJson, atomicWriteJson } from '../../utils/file-io.utils.js';
+import { collectSecretEnvValues } from '../../utils/secret-env.js';
+import { getLocalApiBaseUrl } from '../../utils/local-api-url.utils.js';
+import { CloudClientService } from '../cloud/cloud-client.service.js';
+import { DeviceIdentityService } from '../cloud/device-identity.service.js';
+import { getCrewlyHomePath } from '../core/crewly-home.utils.js';
+import { internalCredentialHeaders } from '../core/owner-auth.service.js';
+import { DecisionService } from '../decisions/decision.service.js';
+import { getHarnessService } from '../harness/harness.service.js';
+import { collectSettingsSecretValues } from '../security/secret-scrub.service.js';
+import { getSlackTeamChannelService } from '../slack/slack-team-channel.service.js';
+import { TaskPoolService } from '../task-pool/task-pool.service.js';
+import { VersionCheckService } from '../system/version-check.service.js';
+import { TeamMoveArchiver } from './team-move-archive.js';
+import { TeamMoveCloudClient } from './team-move-cloud.client.js';
+import { TeamMoveDriver } from './team-move-driver.service.js';
+import { TeamMoveExporter } from './team-move-exporter.js';
+import { TeamMoveImporter } from './team-move-importer.js';
+import { freeDiskBytes, runPreflight } from './team-move-preflight.js';
+/**
+ * Call a team route of this backend as the owner's Cloud-approved action.
+ *
+ * @param teamId - Team id
+ * @param action - `start` or `stop`
+ * @returns ok/error from the route
+ */
+async function teamRoute(teamId, action) {
+    try {
+        const res = await fetch(`${getLocalApiBaseUrl()}/api/teams/${encodeURIComponent(teamId)}/${action}`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', ...internalCredentialHeaders('cloud') },
+            body: '{}',
+            signal: AbortSignal.timeout(120_000),
+        });
+        const body = (await res.json().catch(() => ({})));
+        return res.ok && body.success !== false ? { ok: true } : { ok: false, error: body.error ?? `HTTP ${res.status}` };
+    }
+    catch (error) {
+        return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}
+/**
+ * Add a Slack channel mapping to the mapping file when the Slack service is
+ * not running (it loads the file when it starts).
+ *
+ * @param home - Crewly home
+ * @param mapping - Mapping to add
+ * @returns True when added
+ */
+async function adoptMappingInFile(home, mapping) {
+    const file = path.join(home, 'slack-team-channels.json');
+    const store = await safeReadJson(file, {});
+    const mappings = Array.isArray(store.mappings) ? store.mappings : [];
+    if (mappings.some((m) => m['teamId'] === mapping['teamId'] || m['slackChannelId'] === mapping['slackChannelId']))
+        return false;
+    await fs.mkdir(home, { recursive: true });
+    await atomicWriteJson(file, { version: 1, autoCreate: store.autoCreate !== false, channelPrefix: store.channelPrefix ?? '', ...store, mappings: [...mappings, mapping] });
+    return true;
+}
+/**
+ * Build the driver for the running backend.
+ *
+ * @param input - Storage and the relay event source
+ * @returns The driver (not started)
+ */
+export function createTeamMoveDriver(input) {
+    const home = input.home ?? getCrewlyHomePath();
+    const storage = input.storage;
+    const cloud = CloudClientService.getInstance();
+    const identity = async () => {
+        const id = await DeviceIdentityService.getInstance().getOrCreateIdentity();
+        return { instanceId: id.deviceId, deviceName: id.deviceName };
+    };
+    const version = () => VersionCheckService.getInstance().getLocalVersion();
+    const client = new TeamMoveCloudClient({
+        session: { getToken: () => cloud.getToken(), getCloudUrl: () => cloud.getCloudUrl(), tryRefreshToken: () => cloud.tryRefreshToken() },
+        getInstanceId: async () => (await identity()).instanceId,
+    });
+    const knownSecrets = async () => [...collectSecretEnvValues(process.env), ...(await collectSettingsSecretValues(home))];
+    const exporter = new TeamMoveExporter({
+        home,
+        getTeams: () => storage.getTeams(),
+        getProjects: () => storage.getProjects(),
+        crewlyVersion: version(),
+        source: { instanceId: null, deviceName: null },
+        knownSecrets,
+    });
+    const pool = {
+        read: async () => {
+            const svc = TaskPoolService.getInstance();
+            return { workItems: await svc.getAllItems(), claims: (await svc.getActiveClaims()) };
+        },
+        removeWorkItems: (ids) => TaskPoolService.getInstance().removeWorkItemsForMove(ids),
+        addWorkItems: (items) => TaskPoolService.getInstance().importWorkItems(items),
+    };
+    const archiver = new TeamMoveArchiver({
+        home,
+        storage,
+        runtime: {
+            stopTeam: async (teamId) => {
+                await teamRoute(teamId, 'stop');
+            },
+            startTeam: (teamId) => teamRoute(teamId, 'start'),
+        },
+        pool,
+        decisions: {
+            list: async () => ((await DecisionService.getInstance()?.list('all')) ?? []),
+            setStatus: async (id, status) => {
+                await DecisionService.getInstance()?.setMovedStatus([id], status === 'open');
+            },
+        },
+        slack: {
+            unlink: async (teamId) => {
+                const service = getSlackTeamChannelService();
+                const mapping = service?.findByTeamId(teamId) ?? null;
+                if (service && mapping)
+                    await service.unlinkTeam(teamId, { archiveSlackChannel: false });
+                return mapping;
+            },
+            adopt: async (mapping) => {
+                const service = getSlackTeamChannelService();
+                return service ? service.adoptMapping(mapping) : adoptMappingInFile(home, mapping);
+            },
+        },
+    });
+    const runtimeLogins = async () => {
+        const statuses = await getHarnessService().status.listStatuses();
+        return Object.fromEntries(statuses.map((s) => [s.id, s.installed && s.loginState === 'logged_in']));
+    };
+    return new TeamMoveDriver({
+        home,
+        cloud: client,
+        source: input.relay,
+        identity,
+        exporter,
+        archiver,
+        importer: () => new TeamMoveImporter({
+            home,
+            crewlyVersion: version(),
+            storage,
+            addWorkItems: pool.addWorkItems,
+            addDecisions: async (decisions) => (await DecisionService.getInstance()?.importMoved(decisions)) ?? 0,
+            adoptSlackMapping: async (mapping) => {
+                const service = getSlackTeamChannelService();
+                return service ? service.adoptMapping(mapping) : adoptMappingInFile(home, mapping);
+            },
+            startTeam: (teamId) => teamRoute(teamId, 'start'),
+            runtimeLogins,
+            freeDisk: freeDiskBytes,
+        }),
+        preflight: (tools) => runPreflight({ crewlyVersion: version(), diskPath: home, runtimeLogins }, tools),
+        isTeamIdle: async (teamId) => {
+            const team = (await storage.getTeams()).find((t) => t.id === teamId);
+            return !team || team.members.every((m) => m.workingStatus !== 'in_progress');
+        },
+    });
+}
+//# sourceMappingURL=team-move-runtime.js.map

package/dist/backend/backend/src/services/team-move/team-move-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-move-runtime.js","sourceRoot":"","sources":["../../../../../../backend/src/services/team-move/team-move-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAuB,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AAEpF,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,cAAc,EAA4B,MAAM,+BAA+B,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AASvE;;;;;;GAMG;AACH,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,MAAwB;IAC/D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,kBAAkB,EAAE,cAAc,kBAAkB,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,EAAE;YACnG,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,yBAAyB,CAAC,OAAO,CAAC,EAAE;YACtF,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA0C,CAAC;QAC3F,OAAO,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IACpH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACtF,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,OAAgC;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAgH,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1J,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/H,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,eAAe,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,KAAK,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1K,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA2B;IAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,KAAK,IAAyD,EAAE;QAC/E,MAAM,EAAE,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,CAAC,mBAAmB,EAAE,CAAC;QAC3E,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC;IAChE,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,GAAW,EAAE,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE,CAAC;IAElF,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC;QACrC,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE;QACrI,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC,UAAU;KACzD,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,KAAK,IAA+B,EAAE,CAAC,CAAC,GAAG,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEnJ,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC;QACpC,IAAI;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE;QAClC,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE;QACxC,aAAa,EAAE,OAAO,EAAE;QACxB,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;QAC9C,YAAY;KACb,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,GAAG,GAAG,eAAe,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,MAAM,GAAG,CAAC,eAAe,EAAE,CAAY,EAAE,CAAC;QAClG,CAAC;QACD,eAAe,EAAE,CAAC,GAAa,EAAE,EAAE,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC;QAC7F,YAAY,EAAE,CAAC,KAAwD,EAAE,EAAE,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC;KACjI,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC;QACpC,IAAI;QACJ,OAAO;QACP,OAAO,EAAE;YACP,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACzB,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAClC,CAAC;YACD,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC;SAClD;QACD,IAAI;QACJ,SAAS,EAAE;YACT,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAU;YACrF,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;gBAC9B,MAAM,eAAe,CAAC,WAAW,EAAE,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;YAC/E,CAAC;SACF;QACD,KAAK,EAAE;YACL,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACvB,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;gBAC7C,MAAM,OAAO,GAAG,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;gBACtD,IAAI,OAAO,IAAI,OAAO;oBAAE,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;gBACzF,OAAO,OAAoD,CAAC;YAC9D,CAAC;YACD,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACvB,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;gBAC7C,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,OAA6C,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3H,CAAC;SACF;KACF,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,KAAK,IAAsC,EAAE;QACjE,MAAM,QAAQ,GAAG,MAAM,iBAAiB,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC;IACtG,CAAC,CAAC;IAEF,OAAO,IAAI,cAAc,CAAC;QACxB,IAAI;QACJ,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,KAAK,CAAC,KAAK;QACnB,QAAQ;QACR,QAAQ;QACR,QAAQ;QACR,QAAQ,EAAE,GAAG,EAAE,CACb,IAAI,gBAAgB,CAAC;YACnB,IAAI;YACJ,aAAa,EAAE,OAAO,EAAE;YACxB,OAAO;YACP,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,MAAM,eAAe,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YACrG,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACnC,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;gBAC7C,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,OAA6C,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3H,CAAC;YACD,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC;YACjD,aAAa;YACb,QAAQ,EAAE,aAAa;SACxB,CAAC;QACJ,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,KAAK,CAAC;QACtG,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;YACrE,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,aAAa,CAAC,CAAC;QAC/E,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/backend/backend/src/services/team-move/team-move-secret-scan.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Secret scan of a package before it leaves the machine.
+ *
+ * Runs the same detectors as the session-log redactor (token shapes such as
+ * Slack, OpenAI/Anthropic, GitHub, Google keys, JWTs, bearer headers, private
+ * key blocks, connection strings and `SECRET_NAME=value` assignments) plus the
+ * exact secret values this machine holds in its environment and settings. It
+ * reports file paths and pattern counts only, never a matched value.
+ *
+ * @module services/team-move/team-move-secret-scan
+ */
+import type { SecretEnvValue } from '../../utils/secret-env.js';
+import type { PackageFileEntry } from './team-move.types.js';
+import type { StagingArea } from './team-move-fs.js';
+/** One file that holds secrets. */
+export interface SecretFinding {
+    /** Package path. */
+    path: string;
+    /** Number of secret matches (values are never returned). */
+    matches: number;
+}
+/** Result of a scan. */
+export interface SecretScanResult {
+    filesScanned: number;
+    findings: SecretFinding[];
+}
+/** Thrown when a package would carry secrets. */
+export declare class TeamMoveSecretScanError extends Error {
+    readonly findings: SecretFinding[];
+    constructor(findings: SecretFinding[]);
+}
+/**
+ * Scan every file of a staging area.
+ *
+ * @param staging - The package being built
+ * @param files - Its files
+ * @param known - Exact secret values (env, settings) to look for
+ * @returns Files scanned and the findings
+ */
+export declare function scanStaging(staging: StagingArea, files: readonly PackageFileEntry[], known?: readonly SecretEnvValue[]): Promise<SecretScanResult>;
+/**
+ * Whether a flagged file may be left out of the package instead of aborting.
+ * Core records (the team config, task pool, decisions, chat records) can never
+ * be skipped; free-form notes and project files can.
+ *
+ * @param packagePath - Package path of the flagged file
+ * @returns True when skipping is allowed
+ */
+export declare function isSkippableFinding(packagePath: string): boolean;
+//# sourceMappingURL=team-move-secret-scan.d.ts.map