v0.10.2 build rules update

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jama-backend",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "TeamChat backend server",
   "main": "src/index.js",
   "scripts": {

backend/src/models/db.js

@@ -14,7 +14,18 @@ const fs   = require('fs');
 const path = require('path');
 const bcrypt = require('bcryptjs');
 
-const APP_TYPE = process.env.APP_TYPE || 'selfhost';
+// APP_TYPE validation — host mode requires HOST_DOMAIN and HOST_ADMIN_KEY.
+// If either is missing, fall back to selfhost and warn rather than silently
+// exposing a broken or insecure host control plane.
+let APP_TYPE = (process.env.APP_TYPE || 'selfhost').toLowerCase().trim();
+if (APP_TYPE === 'host') {
+  if (!process.env.HOST_DOMAIN || !process.env.HOST_ADMIN_KEY) {
+    console.warn('[DB] WARNING: APP_TYPE=host requires HOST_DOMAIN and HOST_ADMIN_KEY to be set.');
+    console.warn('[DB] WARNING: Falling back to APP_TYPE=selfhost for safety.');
+    APP_TYPE = 'selfhost';
+  }
+}
+if (APP_TYPE !== 'host') APP_TYPE = 'selfhost'; // only two valid values
 
 // ── Connection pool ───────────────────────────────────────────────────────────