crewly 1.20.303 → 1.20.305

package/dist/backend/backend/src/services/team-move/team-move-runtime.js

@@ -0,0 +1,173 @@
+/**
+ * Composition of the team move for the running backend: builds the exporter,
+ * importer, archiver and driver from the backend's own singletons (storage,
+ * task pool, decision cards, Slack team channels, harness status, device
+ * identity) so a move changes the live stores through their services and not
+ * behind their back.
+ *
+ * Starting and stopping a team goes through this backend's own REST API with
+ * the internal Cloud credential: the owner approved the move in Cloud, and the
+ * regular start/stop routes do the tmux and status bookkeeping.
+ *
+ * @module services/team-move/team-move-runtime
+ */
+import * as path from 'node:path';
+import * as fs from 'node:fs/promises';
+import { safeReadJson, atomicWriteJson } from '../../utils/file-io.utils.js';
+import { collectSecretEnvValues } from '../../utils/secret-env.js';
+import { getLocalApiBaseUrl } from '../../utils/local-api-url.utils.js';
+import { CloudClientService } from '../cloud/cloud-client.service.js';
+import { DeviceIdentityService } from '../cloud/device-identity.service.js';
+import { getCrewlyHomePath } from '../core/crewly-home.utils.js';
+import { internalCredentialHeaders } from '../core/owner-auth.service.js';
+import { DecisionService } from '../decisions/decision.service.js';
+import { getHarnessService } from '../harness/harness.service.js';
+import { collectSettingsSecretValues } from '../security/secret-scrub.service.js';
+import { getSlackTeamChannelService } from '../slack/slack-team-channel.service.js';
+import { TaskPoolService } from '../task-pool/task-pool.service.js';
+import { VersionCheckService } from '../system/version-check.service.js';
+import { TeamMoveArchiver } from './team-move-archive.js';
+import { TeamMoveCloudClient } from './team-move-cloud.client.js';
+import { TeamMoveDriver } from './team-move-driver.service.js';
+import { TeamMoveExporter } from './team-move-exporter.js';
+import { TeamMoveImporter } from './team-move-importer.js';
+import { freeDiskBytes, runPreflight } from './team-move-preflight.js';
+/**
+ * Call a team route of this backend as the owner's Cloud-approved action.
+ *
+ * @param teamId - Team id
+ * @param action - `start` or `stop`
+ * @returns ok/error from the route
+ */
+async function teamRoute(teamId, action) {
+    try {
+        const res = await fetch(`${getLocalApiBaseUrl()}/api/teams/${encodeURIComponent(teamId)}/${action}`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', ...internalCredentialHeaders('cloud') },
+            body: '{}',
+            signal: AbortSignal.timeout(120_000),
+        });
+        const body = (await res.json().catch(() => ({})));
+        return res.ok && body.success !== false ? { ok: true } : { ok: false, error: body.error ?? `HTTP ${res.status}` };
+    }
+    catch (error) {
+        return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}
+/**
+ * Add a Slack channel mapping to the mapping file when the Slack service is
+ * not running (it loads the file when it starts).
+ *
+ * @param home - Crewly home
+ * @param mapping - Mapping to add
+ * @returns True when added
+ */
+async function adoptMappingInFile(home, mapping) {
+    const file = path.join(home, 'slack-team-channels.json');
+    const store = await safeReadJson(file, {});
+    const mappings = Array.isArray(store.mappings) ? store.mappings : [];
+    if (mappings.some((m) => m['teamId'] === mapping['teamId'] || m['slackChannelId'] === mapping['slackChannelId']))
+        return false;
+    await fs.mkdir(home, { recursive: true });
+    await atomicWriteJson(file, { version: 1, autoCreate: store.autoCreate !== false, channelPrefix: store.channelPrefix ?? '', ...store, mappings: [...mappings, mapping] });
+    return true;
+}
+/**
+ * Build the driver for the running backend.
+ *
+ * @param input - Storage and the relay event source
+ * @returns The driver (not started)
+ */
+export function createTeamMoveDriver(input) {
+    const home = input.home ?? getCrewlyHomePath();
+    const storage = input.storage;
+    const cloud = CloudClientService.getInstance();
+    const identity = async () => {
+        const id = await DeviceIdentityService.getInstance().getOrCreateIdentity();
+        return { instanceId: id.deviceId, deviceName: id.deviceName };
+    };
+    const version = () => VersionCheckService.getInstance().getLocalVersion();
+    const client = new TeamMoveCloudClient({
+        session: { getToken: () => cloud.getToken(), getCloudUrl: () => cloud.getCloudUrl(), tryRefreshToken: () => cloud.tryRefreshToken() },
+        getInstanceId: async () => (await identity()).instanceId,
+    });
+    const knownSecrets = async () => [...collectSecretEnvValues(process.env), ...(await collectSettingsSecretValues(home))];
+    const exporter = new TeamMoveExporter({
+        home,
+        getTeams: () => storage.getTeams(),
+        getProjects: () => storage.getProjects(),
+        crewlyVersion: version(),
+        source: { instanceId: null, deviceName: null },
+        knownSecrets,
+    });
+    const pool = {
+        read: async () => {
+            const svc = TaskPoolService.getInstance();
+            return { workItems: await svc.getAllItems(), claims: (await svc.getActiveClaims()) };
+        },
+        removeWorkItems: (ids) => TaskPoolService.getInstance().removeWorkItemsForMove(ids),
+        addWorkItems: (items) => TaskPoolService.getInstance().importWorkItems(items),
+    };
+    const archiver = new TeamMoveArchiver({
+        home,
+        storage,
+        runtime: {
+            stopTeam: async (teamId) => {
+                await teamRoute(teamId, 'stop');
+            },
+            startTeam: (teamId) => teamRoute(teamId, 'start'),
+        },
+        pool,
+        decisions: {
+            list: async () => ((await DecisionService.getInstance()?.list('all')) ?? []),
+            setStatus: async (id, status) => {
+                await DecisionService.getInstance()?.setMovedStatus([id], status === 'open');
+            },
+        },
+        slack: {
+            unlink: async (teamId) => {
+                const service = getSlackTeamChannelService();
+                const mapping = service?.findByTeamId(teamId) ?? null;
+                if (service && mapping)
+                    await service.unlinkTeam(teamId, { archiveSlackChannel: false });
+                return mapping;
+            },
+            adopt: async (mapping) => {
+                const service = getSlackTeamChannelService();
+                return service ? service.adoptMapping(mapping) : adoptMappingInFile(home, mapping);
+            },
+        },
+    });
+    const runtimeLogins = async () => {
+        const statuses = await getHarnessService().status.listStatuses();
+        return Object.fromEntries(statuses.map((s) => [s.id, s.installed && s.loginState === 'logged_in']));
+    };
+    return new TeamMoveDriver({
+        home,
+        cloud: client,
+        source: input.relay,
+        identity,
+        exporter,
+        archiver,
+        importer: () => new TeamMoveImporter({
+            home,
+            crewlyVersion: version(),
+            storage,
+            addWorkItems: pool.addWorkItems,
+            addDecisions: async (decisions) => (await DecisionService.getInstance()?.importMoved(decisions)) ?? 0,
+            adoptSlackMapping: async (mapping) => {
+                const service = getSlackTeamChannelService();
+                return service ? service.adoptMapping(mapping) : adoptMappingInFile(home, mapping);
+            },
+            startTeam: (teamId) => teamRoute(teamId, 'start'),
+            runtimeLogins,
+            freeDisk: freeDiskBytes,
+        }),
+        preflight: (tools) => runPreflight({ crewlyVersion: version(), diskPath: home, runtimeLogins }, tools),
+        isTeamIdle: async (teamId) => {
+            const team = (await storage.getTeams()).find((t) => t.id === teamId);
+            return !team || team.members.every((m) => m.workingStatus !== 'in_progress');
+        },
+    });
+}
+//# sourceMappingURL=team-move-runtime.js.map

package/dist/backend/backend/src/services/team-move/team-move-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-move-runtime.js","sourceRoot":"","sources":["../../../../../../backend/src/services/team-move/team-move-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAuB,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AAEpF,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,cAAc,EAA4B,MAAM,+BAA+B,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AASvE;;;;;;GAMG;AACH,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,MAAwB;IAC/D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,kBAAkB,EAAE,cAAc,kBAAkB,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,EAAE;YACnG,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,yBAAyB,CAAC,OAAO,CAAC,EAAE;YACtF,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA0C,CAAC;QAC3F,OAAO,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IACpH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACtF,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,OAAgC;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAgH,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1J,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/H,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,eAAe,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,KAAK,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1K,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA2B;IAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,KAAK,IAAyD,EAAE;QAC/E,MAAM,EAAE,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,CAAC,mBAAmB,EAAE,CAAC;QAC3E,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC;IAChE,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,GAAW,EAAE,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE,CAAC;IAElF,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC;QACrC,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE;QACrI,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC,UAAU;KACzD,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,KAAK,IAA+B,EAAE,CAAC,CAAC,GAAG,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEnJ,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC;QACpC,IAAI;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE;QAClC,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE;QACxC,aAAa,EAAE,OAAO,EAAE;QACxB,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;QAC9C,YAAY;KACb,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,GAAG,GAAG,eAAe,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,MAAM,GAAG,CAAC,eAAe,EAAE,CAAY,EAAE,CAAC;QAClG,CAAC;QACD,eAAe,EAAE,CAAC,GAAa,EAAE,EAAE,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC;QAC7F,YAAY,EAAE,CAAC,KAAwD,EAAE,EAAE,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC;KACjI,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC;QACpC,IAAI;QACJ,OAAO;QACP,OAAO,EAAE;YACP,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACzB,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAClC,CAAC;YACD,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC;SAClD;QACD,IAAI;QACJ,SAAS,EAAE;YACT,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAU;YACrF,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;gBAC9B,MAAM,eAAe,CAAC,WAAW,EAAE,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;YAC/E,CAAC;SACF;QACD,KAAK,EAAE;YACL,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACvB,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;gBAC7C,MAAM,OAAO,GAAG,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;gBACtD,IAAI,OAAO,IAAI,OAAO;oBAAE,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;gBACzF,OAAO,OAAoD,CAAC;YAC9D,CAAC;YACD,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACvB,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;gBAC7C,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,OAA6C,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3H,CAAC;SACF;KACF,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,KAAK,IAAsC,EAAE;QACjE,MAAM,QAAQ,GAAG,MAAM,iBAAiB,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC;IACtG,CAAC,CAAC;IAEF,OAAO,IAAI,cAAc,CAAC;QACxB,IAAI;QACJ,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,KAAK,CAAC,KAAK;QACnB,QAAQ;QACR,QAAQ;QACR,QAAQ;QACR,QAAQ,EAAE,GAAG,EAAE,CACb,IAAI,gBAAgB,CAAC;YACnB,IAAI;YACJ,aAAa,EAAE,OAAO,EAAE;YACxB,OAAO;YACP,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,MAAM,eAAe,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YACrG,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACnC,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;gBAC7C,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,OAA6C,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3H,CAAC;YACD,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC;YACjD,aAAa;YACb,QAAQ,EAAE,aAAa;SACxB,CAAC;QACJ,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,KAAK,CAAC;QACtG,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;YACrE,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,aAAa,CAAC,CAAC;QAC/E,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/backend/backend/src/services/team-move/team-move-secret-scan.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Secret scan of a package before it leaves the machine.
+ *
+ * Runs the same detectors as the session-log redactor (token shapes such as
+ * Slack, OpenAI/Anthropic, GitHub, Google keys, JWTs, bearer headers, private
+ * key blocks, connection strings and `SECRET_NAME=value` assignments) plus the
+ * exact secret values this machine holds in its environment and settings. It
+ * reports file paths and pattern counts only, never a matched value.
+ *
+ * @module services/team-move/team-move-secret-scan
+ */
+import type { SecretEnvValue } from '../../utils/secret-env.js';
+import type { PackageFileEntry } from './team-move.types.js';
+import type { StagingArea } from './team-move-fs.js';
+/** One file that holds secrets. */
+export interface SecretFinding {
+    /** Package path. */
+    path: string;
+    /** Number of secret matches (values are never returned). */
+    matches: number;
+}
+/** Result of a scan. */
+export interface SecretScanResult {
+    filesScanned: number;
+    findings: SecretFinding[];
+}
+/** Thrown when a package would carry secrets. */
+export declare class TeamMoveSecretScanError extends Error {
+    readonly findings: SecretFinding[];
+    constructor(findings: SecretFinding[]);
+}
+/**
+ * Scan every file of a staging area.
+ *
+ * @param staging - The package being built
+ * @param files - Its files
+ * @param known - Exact secret values (env, settings) to look for
+ * @returns Files scanned and the findings
+ */
+export declare function scanStaging(staging: StagingArea, files: readonly PackageFileEntry[], known?: readonly SecretEnvValue[]): Promise<SecretScanResult>;
+/**
+ * Whether a flagged file may be left out of the package instead of aborting.
+ * Core records (the team config, task pool, decisions, chat records) can never
+ * be skipped; free-form notes and project files can.
+ *
+ * @param packagePath - Package path of the flagged file
+ * @returns True when skipping is allowed
+ */
+export declare function isSkippableFinding(packagePath: string): boolean;
+//# sourceMappingURL=team-move-secret-scan.d.ts.map

package/dist/backend/backend/src/services/team-move/team-move-secret-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-move-secret-scan.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/team-move/team-move-secret-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAOrD,mCAAmC;AACnC,MAAM,WAAW,aAAa;IAC5B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAwB;AACxB,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,iDAAiD;AACjD,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE;gBAAzB,QAAQ,EAAE,aAAa,EAAE;CAO/C;AAiCD;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,gBAAgB,EAAE,EAAE,KAAK,GAAE,SAAS,cAAc,EAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAS5J;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAO/D"}

package/dist/backend/backend/src/services/team-move/team-move-secret-scan.js

@@ -0,0 +1,96 @@
+/**
+ * Secret scan of a package before it leaves the machine.
+ *
+ * Runs the same detectors as the session-log redactor (token shapes such as
+ * Slack, OpenAI/Anthropic, GitHub, Google keys, JWTs, bearer headers, private
+ * key blocks, connection strings and `SECRET_NAME=value` assignments) plus the
+ * exact secret values this machine holds in its environment and settings. It
+ * reports file paths and pattern counts only, never a matched value.
+ *
+ * @module services/team-move/team-move-secret-scan
+ */
+import * as fs from 'node:fs/promises';
+import { redactSecretsWithCount } from '../../utils/secret-redactor.js';
+import { looksLikeText } from './team-move-fs.js';
+/** Window read at a time (text is scanned in overlapping windows). */
+const WINDOW_BYTES = 1024 * 1024;
+/** Overlap between windows so a secret cut by a boundary is still seen. */
+const OVERLAP_BYTES = 1024;
+/** Thrown when a package would carry secrets. */
+export class TeamMoveSecretScanError extends Error {
+    findings;
+    constructor(findings) {
+        super(`The secret scan found credentials in ${findings.length} file${findings.length === 1 ? '' : 's'}; nothing was sent. ` +
+            `Remove them from: ${findings.slice(0, 10).map((f) => f.path).join(', ')}${findings.length > 10 ? ', ...' : ''}`);
+        this.findings = findings;
+        this.name = 'TeamMoveSecretScanError';
+    }
+}
+/**
+ * Count secrets in one file.
+ *
+ * @param abs - Absolute file path
+ * @param known - Exact secret values to look for
+ * @returns Number of matches, 0 for binary files
+ */
+async function scanFile(abs, known) {
+    const handle = await fs.open(abs, 'r');
+    try {
+        const stat = await handle.stat();
+        const head = Buffer.alloc(Math.min(8192, stat.size));
+        await handle.read(head, 0, head.length, 0);
+        if (!looksLikeText(head))
+            return { matches: 0, scanned: false };
+        let matches = 0;
+        let position = 0;
+        const buf = Buffer.alloc(WINDOW_BYTES + OVERLAP_BYTES);
+        // Matches inside the overlap are seen by two windows; counting the first
+        // window's tail once is enough, we only need "any", so double counts are fine.
+        while (position < stat.size) {
+            const { bytesRead } = await handle.read(buf, 0, buf.length, position);
+            if (bytesRead === 0)
+                break;
+            matches += redactSecretsWithCount(buf.subarray(0, bytesRead).toString('utf8'), known).count;
+            position += WINDOW_BYTES;
+        }
+        return { matches, scanned: true };
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * Scan every file of a staging area.
+ *
+ * @param staging - The package being built
+ * @param files - Its files
+ * @param known - Exact secret values (env, settings) to look for
+ * @returns Files scanned and the findings
+ */
+export async function scanStaging(staging, files, known = []) {
+    const findings = [];
+    let filesScanned = 0;
+    for (const f of files) {
+        const { matches, scanned } = await scanFile(staging.abs(f.path), known);
+        if (scanned)
+            filesScanned += 1;
+        if (matches > 0)
+            findings.push({ path: f.path, matches });
+    }
+    return { filesScanned, findings };
+}
+/**
+ * Whether a flagged file may be left out of the package instead of aborting.
+ * Core records (the team config, task pool, decisions, chat records) can never
+ * be skipped; free-form notes and project files can.
+ *
+ * @param packagePath - Package path of the flagged file
+ * @returns True when skipping is allowed
+ */
+export function isSkippableFinding(packagePath) {
+    return (packagePath.startsWith('projects/') ||
+        packagePath.startsWith('handover/') ||
+        /^agents\/[^/]+\/sessions\//.test(packagePath) ||
+        /^team\/(wiki|norms|sops)\//.test(packagePath));
+}
+//# sourceMappingURL=team-move-secret-scan.js.map

package/dist/backend/backend/src/services/team-move/team-move-secret-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-move-secret-scan.js","sourceRoot":"","sources":["../../../../../../backend/src/services/team-move/team-move-secret-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIlD,sEAAsE;AACtE,MAAM,YAAY,GAAG,IAAI,GAAG,IAAI,CAAC;AACjC,2EAA2E;AAC3E,MAAM,aAAa,GAAG,IAAI,CAAC;AAgB3B,iDAAiD;AACjD,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAC3B;IAArB,YAAqB,QAAyB;QAC5C,KAAK,CACH,wCAAwC,QAAQ,CAAC,MAAM,QAAQ,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,sBAAsB;YACnH,qBAAqB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACnH,CAAC;QAJiB,aAAQ,GAAR,QAAQ,CAAiB;QAK5C,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;;;GAMG;AACH,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,KAAgC;IACnE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAChE,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,aAAa,CAAC,CAAC;QACvD,yEAAyE;QACzE,+EAA+E;QAC/E,OAAO,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACtE,IAAI,SAAS,KAAK,CAAC;gBAAE,MAAM;YAC3B,OAAO,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC;YAC5F,QAAQ,IAAI,YAAY,CAAC;QAC3B,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAoB,EAAE,KAAkC,EAAE,QAAmC,EAAE;IAC/H,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACxE,IAAI,OAAO;YAAE,YAAY,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,OAAO,CACL,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC;QACnC,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC;QACnC,4BAA4B,CAAC,IAAI,CAAC,WAAW,CAAC;QAC9C,4BAA4B,CAAC,IAAI,CAAC,WAAW,CAAC,CAC/C,CAAC;AACJ,CAAC"}

package/dist/backend/backend/src/services/team-move/team-move-select.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Which records of the global stores belong to a team. Pure functions: the
+ * exporter (source) selects with them, the archiver removes with them.
+ *
+ * @module services/team-move/team-move-select
+ */
+import type { Team } from '../../types/index.js';
+import type { ScheduledMessage } from '../../types/index.js';
+import type { WorkItem } from '../../types/v2/work-item.types.js';
+import type { TaskClaim } from '../../types/v2/claim.types.js';
+/** What identifies a team's records in the global stores. */
+export interface TeamIdentity {
+    teamId: string;
+    teamName: string;
+    /** Member session names. */
+    sessions: ReadonlySet<string>;
+    /** Member ids. */
+    memberIds: ReadonlySet<string>;
+}
+/**
+ * Identity of a team.
+ *
+ * @param team - The team
+ * @returns Ids and session names to match records by
+ */
+export declare function identityOf(team: Pick<Team, 'id' | 'name' | 'members'>): TeamIdentity;
+/**
+ * Whether a free-form target string names the team or one of its members.
+ *
+ * @param target - A `target`/`targetTeam`/session field value
+ * @param id - Team identity
+ * @returns True on a match
+ */
+export declare function targetsTeam(target: unknown, id: TeamIdentity): boolean;
+/**
+ * Whether a work item is still open.
+ *
+ * @param wi - Work item
+ * @returns True when it is neither terminal nor failed/rejected
+ */
+export declare function isOpenWorkItem(wi: Pick<WorkItem, 'status'>): boolean;
+/** The slice of the pool a team owns. */
+export interface TeamPoolSlice {
+    workItems: WorkItem[];
+    /** Active claims by team members on selected items (not moved; counted for the report). */
+    activeClaims: number;
+}
+/**
+ * Open task-pool items of a team: those aimed at the team or a member, those
+ * a member is working on, and their open children.
+ *
+ * @param pool - The pool file content
+ * @param pool.workItems - All work items
+ * @param pool.claims - All claims
+ * @param id - Team identity
+ * @returns Selected items
+ */
+export declare function selectPoolItems(pool: {
+    workItems?: WorkItem[];
+    claims?: TaskClaim[];
+}, id: TeamIdentity): TeamPoolSlice;
+/**
+ * Make a work item safe to start over on the target: nothing is running there
+ * yet, so an item that was being worked on goes back to the queue.
+ *
+ * @param wi - Work item as exported
+ * @returns Copy for the target
+ */
+export declare function resetWorkItemForTarget(wi: WorkItem): WorkItem;
+/**
+ * Scheduled messages (legacy owner-created reminders) that address a team.
+ *
+ * @param messages - All scheduled messages
+ * @param id - Team identity
+ * @returns Those whose `targetTeam` names the team or one of its members
+ */
+export declare function selectScheduledMessages(messages: readonly ScheduledMessage[], id: TeamIdentity): ScheduledMessage[];
+/** The decision fields the selector reads. */
+export interface DecisionLike {
+    id: string;
+    status: string;
+    teamId?: string;
+    asker?: string;
+    requestedBy?: string;
+}
+/**
+ * Open decisions/requests to the owner that belong to a team.
+ *
+ * @param decisions - All decisions
+ * @param id - Team identity
+ * @returns Pending ones asked by the team or one of its members
+ */
+export declare function selectDecisions<T extends DecisionLike>(decisions: readonly T[], id: TeamIdentity): T[];
+//# sourceMappingURL=team-move-select.d.ts.map

package/dist/backend/backend/src/services/team-move/team-move-select.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-move-select.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/team-move/team-move-select.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAG/D,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,kBAAkB;IAClB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,YAAY,CAOpF;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,GAAG,OAAO,CAGtE;AAKD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,OAAO,CAEpE;AAED,yCAAyC;AACzC,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,2FAA2F;IAC3F,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAA;CAAE,EAAE,EAAE,EAAE,YAAY,GAAG,aAAa,CAwBvH;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,QAAQ,GAAG,QAAQ,CAQ7D;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,EAAE,EAAE,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEnH;AAED,8CAA8C;AAC9C,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAKD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,YAAY,GAAG,CAAC,EAAE,CAMtG"}

package/dist/backend/backend/src/services/team-move/team-move-select.js

@@ -0,0 +1,124 @@
+/**
+ * Which records of the global stores belong to a team. Pure functions: the
+ * exporter (source) selects with them, the archiver removes with them.
+ *
+ * @module services/team-move/team-move-select
+ */
+import { TERMINAL_WORK_ITEM_STATUSES } from '../../types/v2/work-item.types.js';
+/**
+ * Identity of a team.
+ *
+ * @param team - The team
+ * @returns Ids and session names to match records by
+ */
+export function identityOf(team) {
+    return {
+        teamId: team.id,
+        teamName: team.name,
+        sessions: new Set(team.members.map((m) => m.sessionName).filter((s) => typeof s === 'string' && s.length > 0)),
+        memberIds: new Set(team.members.map((m) => m.id)),
+    };
+}
+/**
+ * Whether a free-form target string names the team or one of its members.
+ *
+ * @param target - A `target`/`targetTeam`/session field value
+ * @param id - Team identity
+ * @returns True on a match
+ */
+export function targetsTeam(target, id) {
+    if (typeof target !== 'string' || target.length === 0)
+        return false;
+    return target === id.teamId || target === id.teamName || id.sessions.has(target) || id.memberIds.has(target);
+}
+/** Work-item statuses that are still open (not finished, cancelled or verified). */
+const OPEN_EXCLUDED = new Set([...TERMINAL_WORK_ITEM_STATUSES, 'failed', 'rejected']);
+/**
+ * Whether a work item is still open.
+ *
+ * @param wi - Work item
+ * @returns True when it is neither terminal nor failed/rejected
+ */
+export function isOpenWorkItem(wi) {
+    return !OPEN_EXCLUDED.has(wi.status);
+}
+/**
+ * Open task-pool items of a team: those aimed at the team or a member, those
+ * a member is working on, and their open children.
+ *
+ * @param pool - The pool file content
+ * @param pool.workItems - All work items
+ * @param pool.claims - All claims
+ * @param id - Team identity
+ * @returns Selected items
+ */
+export function selectPoolItems(pool, id) {
+    const items = Array.isArray(pool.workItems) ? pool.workItems : [];
+    const claims = Array.isArray(pool.claims) ? pool.claims : [];
+    const activeByItem = new Map();
+    for (const c of claims)
+        if (c.status === 'active' && id.sessions.has(c.agentId))
+            activeByItem.set(c.workItemId, c);
+    const picked = new Map();
+    for (const wi of items) {
+        if (!isOpenWorkItem(wi))
+            continue;
+        if (targetsTeam(wi.target, id) || activeByItem.has(wi.id))
+            picked.set(wi.id, wi);
+    }
+    // Open children of picked items follow their parent.
+    let grew = true;
+    while (grew) {
+        grew = false;
+        for (const wi of items) {
+            if (picked.has(wi.id) || !isOpenWorkItem(wi))
+                continue;
+            if (wi.parentWorkItemId && picked.has(wi.parentWorkItemId)) {
+                picked.set(wi.id, wi);
+                grew = true;
+            }
+        }
+    }
+    const activeClaims = [...picked.keys()].filter((k) => activeByItem.has(k)).length;
+    return { workItems: [...picked.values()], activeClaims };
+}
+/**
+ * Make a work item safe to start over on the target: nothing is running there
+ * yet, so an item that was being worked on goes back to the queue.
+ *
+ * @param wi - Work item as exported
+ * @returns Copy for the target
+ */
+export function resetWorkItemForTarget(wi) {
+    const next = { ...wi };
+    if (next.status === 'running' || next.status === 'accepted') {
+        next.status = 'queued';
+        delete next.startedAt;
+        next.metadata = { ...(next.metadata ?? {}), movedFromRunning: true };
+    }
+    return next;
+}
+/**
+ * Scheduled messages (legacy owner-created reminders) that address a team.
+ *
+ * @param messages - All scheduled messages
+ * @param id - Team identity
+ * @returns Those whose `targetTeam` names the team or one of its members
+ */
+export function selectScheduledMessages(messages, id) {
+    return messages.filter((m) => targetsTeam(m.targetTeam, id));
+}
+/** Decision statuses that still wait for the owner. */
+const PENDING_DECISION_STATUSES = new Set(['open', 'parked']);
+/**
+ * Open decisions/requests to the owner that belong to a team.
+ *
+ * @param decisions - All decisions
+ * @param id - Team identity
+ * @returns Pending ones asked by the team or one of its members
+ */
+export function selectDecisions(decisions, id) {
+    return decisions.filter((d) => PENDING_DECISION_STATUSES.has(d.status) &&
+        (d.teamId === id.teamId || (typeof d.asker === 'string' && id.sessions.has(d.asker)) || (typeof d.requestedBy === 'string' && id.sessions.has(d.requestedBy))));
+}
+//# sourceMappingURL=team-move-select.js.map

package/dist/backend/backend/src/services/team-move/team-move-select.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-move-select.js","sourceRoot":"","sources":["../../../../../../backend/src/services/team-move/team-move-select.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAYhF;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAA2C;IACpE,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,QAAQ,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3H,SAAS,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;KAClD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,MAAe,EAAE,EAAgB;IAC3D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,OAAO,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,MAAM,KAAK,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC/G,CAAC;AAED,oFAAoF;AACpF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,2BAA2B,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAE9F;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,EAA4B;IACzD,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AASD;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,IAAsD,EAAE,EAAgB;IACtG,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAqB,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACnH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAAE,SAAS;QAClC,IAAI,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,qDAAqD;IACrD,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,GAAG,KAAK,CAAC;QACb,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;gBAAE,SAAS;YACvD,IAAI,EAAE,CAAC,gBAAgB,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC3D,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBACtB,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAClF,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAY;IACjD,MAAM,IAAI,GAAa,EAAE,GAAG,EAAE,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC5D,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAqC,EAAE,EAAgB;IAC7F,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC;AAWD,uDAAuD;AACvD,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAyB,SAAuB,EAAE,EAAgB;IAC/F,OAAO,SAAS,CAAC,MAAM,CACrB,CAAC,CAAC,EAAE,EAAE,CACJ,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CACjK,CAAC;AACJ,CAAC"}

package/dist/backend/backend/src/services/team-move/team-move.fixture.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Test fixture of the team move: builds a throwaway Crewly home with one team
+ * (plus a decoy team that must not travel), its agents' memory, handover notes,
+ * a project with `.crewly` data and a git repository, task-pool items,
+ * decisions, chat channels and a Slack channel mapping.
+ *
+ * @module services/team-move/team-move.fixture
+ */
+/** Ids of the fixture. */
+export declare const FIXTURE: {
+    readonly teamId: "11111111-1111-4111-8111-111111111111";
+    readonly decoyTeamId: "22222222-2222-4222-8222-222222222222";
+    readonly projectId: "33333333-3333-4333-8333-333333333333";
+    readonly leadId: "aaaaaaaa-0000-4000-8000-000000000001";
+    readonly devId: "aaaaaaaa-0000-4000-8000-000000000002";
+    readonly leadSession: "movers-lena-aaaaaaaa";
+    readonly devSession: "movers-dev-bbbbbbbb";
+    readonly decoySession: "decoy-dan-cccccccc";
+    readonly channelId: "chan-0001-team-channel";
+    readonly dmId: "chan-0002-lena-dm";
+};
+/** A built fixture. */
+export interface Fixture {
+    root: string;
+    home: string;
+    projectDir: string;
+    remoteDir: string;
+    cleanup(): Promise<void>;
+}
+/**
+ * Build the source machine.
+ *
+ * @returns Paths and a cleanup function
+ */
+export declare function buildSourceFixture(): Promise<Fixture>;
+/**
+ * An empty target machine.
+ *
+ * @param root - Fixture root
+ * @returns Target home and projects root
+ */
+export declare function buildTargetPaths(root: string): Promise<{
+    home: string;
+    projectsRoot: string;
+}>;
+//# sourceMappingURL=team-move.fixture.d.ts.map

package/dist/backend/backend/src/services/team-move/team-move.fixture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-move.fixture.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/team-move/team-move.fixture.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,0BAA0B;AAC1B,eAAO,MAAM,OAAO;;;;;;;;;;;CAWV,CAAC;AAEX,uBAAuB;AACvB,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AA2BD;;;;GAIG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CAiJ3D;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAMpG"}