@pattern-stack/codegen 0.27.1 → 0.27.2

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.27.2] — 2026-06-08
+
+### Fixed
+
+- **Bridge audit-tier guard no longer emits a false-positive WARN on every
+  audit event (#535).** `BridgeOutboxDrainHook.processEvent` ran its audit-tier
+  guard *before* the trigger lookup, so it fired — and logged a WARN — for every
+  `tier:audit` event, while asserting "a `bridge_trigger` row exists out-of-band"
+  (a registry/runtime-drift claim it never actually checked). Audit-tier
+  lifecycle events (`connection.created`, `connection.field_changed`, …) share
+  the outbox with domain events and carry no triggers, so the warning fired on
+  ordinary, correct operation. Dogfood discovery from swe-brain. Fix: look up
+  triggers first, then branch — `tier:audit` **with** a registered trigger is
+  genuine drift (WARN, now naming the offending trigger id, + `auditBlocked:1`,
+  no fanout); `tier:audit` with **no** trigger is the benign shared-outbox case
+  (returns zeros, silent). The SELECT-level `tier='audit'` filter was rejected:
+  audit events still need the normal drain (`processed_at` stamp + subscriber
+  dispatch); only bridge fanout skips them. Revises the original AUDIT-4
+  top-of-method guard (`ai-docs/specs/issue-242/plan.md` §AUDIT-4 revision note).
+  To make a workflow react to a lifecycle moment, emit a typed domain
+  change-fact — do not make the audit event bridge-eligible (new bridge skill
+  rule).
+
 ## [0.27.1] — 2026-06-07
 
 ### Fixed

package/dist/{chunk-E5FJWOMP.js → chunk-3AM722ZH.js}

@@ -42,16 +42,24 @@ var BridgeOutboxDrainHook = class {
   warnedNullDirection = false;
   warnedAuditTypes = /* @__PURE__ */ new Set();
   async processEvent(event, tx) {
+    const triggers = this.lookupTriggers(event.type);
     if (event.metadata?.["tier"] === "audit") {
-      this.warnAuditBlockedOnce(event);
+      if (triggers.length > 0) {
+        this.warnAuditBlockedOnce(event, triggers);
+        return {
+          delivered: 0,
+          dedupSkips: 0,
+          triggerCount: 0,
+          auditBlocked: 1
+        };
+      }
       return {
         delivered: 0,
         dedupSkips: 0,
         triggerCount: 0,
-        auditBlocked: 1
+        auditBlocked: 0
       };
     }
-    const triggers = this.lookupTriggers(event.type);
     if (triggers.length === 0) {
       return {
         delivered: 0,
@@ -128,11 +136,12 @@ var BridgeOutboxDrainHook = class {
       auditBlocked: 0
     };
   }
-  warnAuditBlockedOnce(event) {
+  warnAuditBlockedOnce(event, triggers) {
     if (this.warnedAuditTypes.has(event.type)) return;
     this.warnedAuditTypes.add(event.type);
+    const triggerIds = triggers.map((t) => t.triggerId).join(", ");
     this.logger.warn(
-      `Bridge guard blocked audit-tier event '${event.type}' (event.id=${event.id}). Registry says this event is not bridge-eligible; a bridge_trigger row exists out-of-band. Investigate registry/runtime drift.`
+      `Bridge guard blocked audit-tier event '${event.type}' (event.id=${event.id}). Audit events are not bridge-eligible, yet the registry has trigger(s) registered against this type [${triggerIds}] \u2014 an out-of-band bridge_trigger row or version skew. Investigate registry/runtime drift.`
     );
   }
   lookupTriggers(eventType) {
@@ -151,4 +160,4 @@ BridgeOutboxDrainHook = __decorateClass([
 export {
   BridgeOutboxDrainHook
 };
-//# sourceMappingURL=chunk-E5FJWOMP.js.map
+//# sourceMappingURL=chunk-3AM722ZH.js.map

package/dist/chunk-3AM722ZH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../runtime/subsystems/bridge/bridge-outbox-drain-hook.ts"],"sourcesContent":["/**\n * BridgeOutboxDrainHook — drains-time bridge fanout writer (BRIDGE-4,\n * ADR-023 Phase 2).\n *\n * Implements `IBridgeOutboxDrainHook`. Called by `DrizzleEventBus`'s\n * modified `processBatch` once per drained event, INSIDE the per-event\n * transaction. For every trigger registered against the event's type in\n * the codegen-emitted `bridgeRegistry`, writes:\n *\n *   1. `bridge_delivery` ledger row — `INSERT … ON CONFLICT (event_id,\n *      trigger_id) DO NOTHING RETURNING id`. Empty result ⇒ Case B\n *      facade-eager pre-write OR drain-replay collision; skip wrapper\n *      insert for that trigger; sibling triggers still fire.\n *   2. `job_run` wrapper row — `type='@framework/bridge_delivery'`,\n *      `pool='events_<direction>'`, `input={ deliveryId }`,\n *      `trigger_source='event'`, `trigger_ref=event.id`. The wrapper is\n *      what the framework `BridgeDeliveryHandler` (BRIDGE-5) eventually\n *      claims via the worker that polls the corresponding reserved pool.\n *\n * Null `event.metadata.direction` is tolerated: the hook logs a one-line\n * warning per event and returns zeros without writing rows. The drain's\n * `processed_at` stamp + subscriber dispatch still fire normally.\n * Direction is null only for events published via the legacy\n * `IEventBus.publish(...)` path (`TypedEventBus.publish` always sets it);\n * such events are out of scope for bridge fanout.\n *\n * The wrapper insert generates its own `id` via Drizzle's `defaultRandom`\n * — we don't `RETURNING id` because nobody needs it at drain time;\n * `BridgeDeliveryHandler` later looks up the wrapper via the\n * `bridge_delivery.wrapper_run_id` link if needed. This keeps the drain\n * one-round-trip-per-trigger.\n */\nimport { Inject, Injectable, Logger, Optional } from '@nestjs/common';\nimport { randomUUID } from 'node:crypto';\nimport { eq } from 'drizzle-orm';\n\nimport type { DomainEvent, DrizzleTransaction } from '../events/event-bus.protocol';\nimport { bridgeDelivery } from './bridge-delivery.schema';\nimport { jobRuns } from '../jobs/job-orchestration.schema';\n\nimport { BRIDGE_REGISTRY } from './bridge.tokens';\nimport type {\n  BridgeOutboxDrainResult,\n  BridgeRegistry,\n  BridgeTriggerEntry,\n  IBridgeOutboxDrainHook,\n} from './bridge.protocol';\nimport { BRIDGE_DELIVERY_JOB_TYPE } from './bridge-delivery-handler';\nimport type { EventTypeName } from '../events/event-registry';\nimport { JOBS_LISTEN_NOTIFY } from '../jobs/jobs-domain.tokens';\nimport { JOBS_WAKE_CHANNEL, pgNotify } from '../jobs/pg-notify';\n\n/** Reserved pools the wrapper rows route into; ADR-022 / ADR-024. */\nconst POOL_BY_DIRECTION: Record<string, string> = {\n  inbound: 'events_inbound',\n  change: 'events_change',\n  outbound: 'events_outbound',\n};\n\n@Injectable()\nexport class BridgeOutboxDrainHook implements IBridgeOutboxDrainHook {\n  private readonly logger = new Logger(BridgeOutboxDrainHook.name);\n  private warnedNullDirection = false;\n  private readonly warnedAuditTypes = new Set<string>();\n\n  constructor(\n    @Optional()\n    @Inject(BRIDGE_REGISTRY)\n    private readonly registry: BridgeRegistry = {},\n    // LISTEN-NOTIFY-1 — when true, the wrapper `job_run` insert below emits an\n    // in-tx `pg_notify(codegen_jobs_wake, <wrapperPool>)` so the reserved-pool\n    // worker wakes the instant the per-event drain tx commits — otherwise the\n    // bridge hop alone would still cost a full poll interval. `@Optional()`\n    // defaulting false so the hook keeps working when jobs isn't installed\n    // (bridge can drive non-jobs consumers) or in vendored/test wiring.\n    @Optional()\n    @Inject(JOBS_LISTEN_NOTIFY)\n    private readonly listenNotify: boolean = false,\n  ) {}\n\n  async processEvent(\n    event: DomainEvent,\n    tx: DrizzleTransaction,\n  ): Promise<BridgeOutboxDrainResult> {\n    const triggers = this.lookupTriggers(event.type);\n\n    // Audit-tier guard (defense-in-depth — AUDIT-4). Audit events are\n    // bridge-inert by design: the codegen-side validator (AUDIT-2) blocks the\n    // registry from listing them as triggers, so an audit event should never\n    // have a matched trigger. The guard runs AFTER the lookup so it can tell\n    // apart the two cases that share `tier === 'audit'`:\n    //   - triggers present → genuine registry/runtime drift (an out-of-band\n    //     `bridge_trigger` insert, or version skew during deploy). Refuse\n    //     fanout and surface the drift via WARN — now a verified claim, not a\n    //     guess. (Revises the original top-of-method guard, which warned for\n    //     every audit event: audit-tier lifecycle events like\n    //     `connection.created` routinely share the outbox with domain events,\n    //     so the unconditional warning was a false positive. See\n    //     ai-docs/specs/issue-242/plan.md §AUDIT-4 revision note.)\n    //   - no triggers → the common, benign case. Stay silent; auditBlocked: 0.\n    if (event.metadata?.['tier'] === 'audit') {\n      if (triggers.length > 0) {\n        this.warnAuditBlockedOnce(event, triggers);\n        return {\n          delivered: 0,\n          dedupSkips: 0,\n          triggerCount: 0,\n          auditBlocked: 1,\n        };\n      }\n      return {\n        delivered: 0,\n        dedupSkips: 0,\n        triggerCount: 0,\n        auditBlocked: 0,\n      };\n    }\n\n    if (triggers.length === 0) {\n      return {\n        delivered: 0,\n        dedupSkips: 0,\n        triggerCount: 0,\n        auditBlocked: 0,\n      };\n    }\n\n    const direction =\n      (event.metadata?.['direction'] as string | undefined) ?? null;\n    const tenantId =\n      (event.metadata?.['tenantId'] as string | null | undefined) ?? null;\n    const wrapperPool = direction ? POOL_BY_DIRECTION[direction] : undefined;\n\n    if (!wrapperPool) {\n      // Null direction (or an unrecognised one — defensive). Bridge\n      // fanout requires a routed wrapper pool; without one we can't\n      // spawn. Log once per process so misconfiguration surfaces.\n      if (!this.warnedNullDirection) {\n        this.warnedNullDirection = true;\n        this.logger.warn(\n          `Skipping bridge fanout for events with null/unknown direction. ` +\n            `event.id=${event.id} event.type=${event.type} ` +\n            `direction=${String(direction)}. The wrapper pool is derived ` +\n            `from direction (events_<direction>); publishers must use ` +\n            `TypedEventBus.publish() so direction is stamped on the ` +\n            `outbox row.`,\n        );\n      }\n      return {\n        delivered: 0,\n        dedupSkips: 0,\n        triggerCount: triggers.length,\n        auditBlocked: 0,\n      };\n    }\n\n    let delivered = 0;\n    let dedupSkips = 0;\n    const client = tx as unknown as {\n      insert: (table: unknown) => {\n        values: (v: unknown) => {\n          onConflictDoNothing: (opts: unknown) => {\n            returning: (cols: unknown) => Promise<{ id: string }[]>;\n          };\n        } & {\n          // wrapper insert path — no ON CONFLICT\n          // (typed loosely via the same helper return shape)\n        };\n      };\n    };\n\n    for (const trigger of triggers) {\n      const deliveryId = randomUUID();\n      const wrapperRunId = randomUUID();\n\n      // FK ORDER (BRIDGE / 0.15.2): `bridge_delivery.wrapper_run_id` REFERENCES\n      // `job_run(id)` is a plain (non-deferrable) FK, so the referenced\n      // wrapper `job_run` MUST exist before the delivery row that points at it\n      // is inserted — otherwise Postgres rejects the delivery insert\n      // immediately. (The codegen unit tests mock `tx`, so they never\n      // exercised this ordering against a real FK; package-mode bridge\n      // deliveries are the first to do so.) We therefore insert the wrapper\n      // run FIRST, then the delivery. Idempotency is unchanged: the delivery\n      // keeps its `ON CONFLICT (event_id, trigger_id) DO NOTHING RETURNING`,\n      // and when the delivery conflicts (outbox replay or facade-eager Case B)\n      // we DELETE the just-inserted orphan wrapper run in the same tx, so a\n      // skipped delivery leaves no stray `job_run` for a worker to claim.\n\n      // 1. Wrapper job_run insert. We carry the deliveryId into the wrapper\n      //    input so BridgeDeliveryHandler.run(ctx) can locate the row via\n      //    repo.findDeliveryById(ctx.input.deliveryId).\n      await (tx as unknown as { insert: typeof client.insert })\n        .insert(jobRuns)\n        .values({\n          id: wrapperRunId,\n          jobType: BRIDGE_DELIVERY_JOB_TYPE,\n          jobVersion: 1,\n          rootRunId: wrapperRunId,\n          pool: wrapperPool,\n          status: 'pending',\n          input: { deliveryId },\n          triggerSource: 'event',\n          triggerRef: event.id,\n          tenantId,\n        });\n\n      // 2. bridge_delivery insert with ON CONFLICT DO NOTHING + RETURNING.\n      const inserted = await (tx as unknown as {\n        insert: typeof client.insert;\n      })\n        .insert(bridgeDelivery)\n        .values({\n          id: deliveryId,\n          eventId: event.id,\n          triggerId: trigger.triggerId,\n          wrapperRunId,\n          status: 'pending',\n          tenantId,\n        })\n        .onConflictDoNothing({\n          target: [bridgeDelivery.eventId, bridgeDelivery.triggerId],\n        })\n        .returning({ id: bridgeDelivery.id });\n\n      if (inserted.length === 0) {\n        // Case B (facade pre-wrote `delivered`) or drain replay — the delivery\n        // already exists, so this trigger is a no-op. Remove the orphan wrapper\n        // run we speculatively inserted above so no worker claims it. Sibling\n        // triggers still fire.\n        await (tx as unknown as {\n          delete: (table: unknown) => {\n            where: (cond: unknown) => Promise<unknown>;\n          };\n        })\n          .delete(jobRuns)\n          .where(eq(jobRuns.id, wrapperRunId));\n        dedupSkips++;\n        continue;\n      }\n\n      // LISTEN-NOTIFY-1 — the wrapper run is real and claimable; wake its\n      // reserved-pool worker on commit (D7). Same `tx` as the inserts above, so\n      // delivery is gated on the per-event drain tx committing. Best-effort: a\n      // notify failure is non-fatal (the reserved-pool worker still polls).\n      if (this.listenNotify) {\n        try {\n          await pgNotify(tx, JOBS_WAKE_CHANNEL, wrapperPool);\n        } catch (err) {\n          this.logger.warn(\n            `pg_notify(${JOBS_WAKE_CHANNEL}, ${wrapperPool}) failed for ` +\n              `wrapper run ${wrapperRunId}: ${(err as Error).message} ` +\n              `(non-fatal — the reserved-pool worker still polls).`,\n          );\n        }\n      }\n\n      delivered++;\n    }\n\n    return {\n      delivered,\n      dedupSkips,\n      triggerCount: triggers.length,\n      auditBlocked: 0,\n    };\n  }\n\n  private warnAuditBlockedOnce(\n    event: DomainEvent,\n    triggers: BridgeTriggerEntry[],\n  ): void {\n    if (this.warnedAuditTypes.has(event.type)) return;\n    this.warnedAuditTypes.add(event.type);\n    const triggerIds = triggers.map((t) => t.triggerId).join(', ');\n    this.logger.warn(\n      `Bridge guard blocked audit-tier event '${event.type}' (event.id=${event.id}). ` +\n        `Audit events are not bridge-eligible, yet the registry has trigger(s) ` +\n        `registered against this type [${triggerIds}] — an out-of-band bridge_trigger ` +\n        `row or version skew. Investigate registry/runtime drift.`,\n    );\n  }\n\n  private lookupTriggers(\n    eventType: string,\n  ): BridgeTriggerEntry[] {\n    const candidates = this.registry[eventType as EventTypeName];\n    return (candidates ?? []) as BridgeTriggerEntry[];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,SAAS,QAAQ,YAAY,QAAQ,gBAAgB;AACrD,SAAS,kBAAkB;AAC3B,SAAS,UAAU;AAmBnB,IAAM,oBAA4C;AAAA,EAChD,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,UAAU;AACZ;AAGO,IAAM,wBAAN,MAA8D;AAAA,EAKnE,YAGmB,WAA2B,CAAC,GAS5B,eAAwB,OACzC;AAViB;AASA;AAAA,EAChB;AAAA,EAVgB;AAAA,EASA;AAAA,EAhBF,SAAS,IAAI,OAAO,sBAAsB,IAAI;AAAA,EACvD,sBAAsB;AAAA,EACb,mBAAmB,oBAAI,IAAY;AAAA,EAiBpD,MAAM,aACJ,OACA,IACkC;AAClC,UAAM,WAAW,KAAK,eAAe,MAAM,IAAI;AAgB/C,QAAI,MAAM,WAAW,MAAM,MAAM,SAAS;AACxC,UAAI,SAAS,SAAS,GAAG;AACvB,aAAK,qBAAqB,OAAO,QAAQ;AACzC,eAAO;AAAA,UACL,WAAW;AAAA,UACX,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,QAChB;AAAA,MACF;AACA,aAAO;AAAA,QACL,WAAW;AAAA,QACX,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,cAAc;AAAA,MAChB;AAAA,IACF;AAEA,QAAI,SAAS,WAAW,GAAG;AACzB,aAAO;AAAA,QACL,WAAW;AAAA,QACX,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,cAAc;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,YACH,MAAM,WAAW,WAAW,KAA4B;AAC3D,UAAM,WACH,MAAM,WAAW,UAAU,KAAmC;AACjE,UAAM,cAAc,YAAY,kBAAkB,SAAS,IAAI;AAE/D,QAAI,CAAC,aAAa;AAIhB,UAAI,CAAC,KAAK,qBAAqB;AAC7B,aAAK,sBAAsB;AAC3B,aAAK,OAAO;AAAA,UACV,2EACc,MAAM,EAAE,eAAe,MAAM,IAAI,cAChC,OAAO,SAAS,CAAC;AAAA,QAIlC;AAAA,MACF;AACA,aAAO;AAAA,QACL,WAAW;AAAA,QACX,YAAY;AAAA,QACZ,cAAc,SAAS;AAAA,QACvB,cAAc;AAAA,MAChB;AAAA,IACF;AAEA,QAAI,YAAY;AAChB,QAAI,aAAa;AACjB,UAAM,SAAS;AAaf,eAAW,WAAW,UAAU;AAC9B,YAAM,aAAa,WAAW;AAC9B,YAAM,eAAe,WAAW;AAkBhC,YAAO,GACJ,OAAO,OAAO,EACd,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,OAAO,EAAE,WAAW;AAAA,QACpB,eAAe;AAAA,QACf,YAAY,MAAM;AAAA,QAClB;AAAA,MACF,CAAC;AAGH,YAAM,WAAW,MAAO,GAGrB,OAAO,cAAc,EACrB,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,SAAS,MAAM;AAAA,QACf,WAAW,QAAQ;AAAA,QACnB;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,MACF,CAAC,EACA,oBAAoB;AAAA,QACnB,QAAQ,CAAC,eAAe,SAAS,eAAe,SAAS;AAAA,MAC3D,CAAC,EACA,UAAU,EAAE,IAAI,eAAe,GAAG,CAAC;AAEtC,UAAI,SAAS,WAAW,GAAG;AAKzB,cAAO,GAKJ,OAAO,OAAO,EACd,MAAM,GAAG,QAAQ,IAAI,YAAY,CAAC;AACrC;AACA;AAAA,MACF;AAMA,UAAI,KAAK,cAAc;AACrB,YAAI;AACF,gBAAM,SAAS,IAAI,mBAAmB,WAAW;AAAA,QACnD,SAAS,KAAK;AACZ,eAAK,OAAO;AAAA,YACV,aAAa,iBAAiB,KAAK,WAAW,4BAC7B,YAAY,KAAM,IAAc,OAAO;AAAA,UAE1D;AAAA,QACF;AAAA,MACF;AAEA;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,cAAc,SAAS;AAAA,MACvB,cAAc;AAAA,IAChB;AAAA,EACF;AAAA,EAEQ,qBACN,OACA,UACM;AACN,QAAI,KAAK,iBAAiB,IAAI,MAAM,IAAI,EAAG;AAC3C,SAAK,iBAAiB,IAAI,MAAM,IAAI;AACpC,UAAM,aAAa,SAAS,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,IAAI;AAC7D,SAAK,OAAO;AAAA,MACV,0CAA0C,MAAM,IAAI,eAAe,MAAM,EAAE,0GAExC,UAAU;AAAA,IAE/C;AAAA,EACF;AAAA,EAEQ,eACN,WACsB;AACtB,UAAM,aAAa,KAAK,SAAS,SAA0B;AAC3D,WAAQ,cAAc,CAAC;AAAA,EACzB;AACF;AApOa,wBAAN;AAAA,EADN,WAAW;AAAA,EAOP,4BAAS;AAAA,EACT,0BAAO,eAAe;AAAA,EAQtB,4BAAS;AAAA,EACT,0BAAO,kBAAkB;AAAA,GAhBjB;","names":[]}

package/dist/{chunk-DKKFTHHI.js → chunk-CZQUOIDY.js}

@@ -1,6 +1,3 @@
-import {
-  NoopAnalyticsBackend
-} from "./chunk-J37YWU7Y.js";
 import {
   CubeAnalyticsBackend
 } from "./chunk-7B3RYX45.js";
@@ -9,6 +6,9 @@ import {
   CUBE_API_SECRET,
   CUBE_API_URL
 } from "./chunk-6I7ULIN6.js";
+import {
+  NoopAnalyticsBackend
+} from "./chunk-J37YWU7Y.js";
 import {
   __decorateClass
 } from "./chunk-2E224ZSN.js";
@@ -50,4 +50,4 @@ AnalyticsModule = __decorateClass([
 export {
   AnalyticsModule
 };
-//# sourceMappingURL=chunk-DKKFTHHI.js.map
+//# sourceMappingURL=chunk-CZQUOIDY.js.map

package/dist/{chunk-Z7YFYK6H.js → chunk-EGXFEZ2N.js}

@@ -1,9 +1,9 @@
-import {
-  JobsDomainModule
-} from "./chunk-KS4BZHIA.js";
 import {
   JobWorker
 } from "./chunk-7B7MMDOJ.js";
+import {
+  JobsDomainModule
+} from "./chunk-XW4XKN3F.js";
 import {
   BootValidationError,
   ReservedPoolViolationError
@@ -295,4 +295,4 @@ export {
   JobWorkerOrchestrator,
   JobWorkerModule
 };
-//# sourceMappingURL=chunk-Z7YFYK6H.js.map
+//# sourceMappingURL=chunk-EGXFEZ2N.js.map

package/dist/{chunk-KS4BZHIA.js → chunk-XW4XKN3F.js}

@@ -1,6 +1,3 @@
-import {
-  MemoryJobRunService
-} from "./chunk-BHZP6LOV.js";
 import {
   DrizzleJobStepService
 } from "./chunk-DV4RV2DC.js";
@@ -13,12 +10,15 @@ import {
 import {
   MemoryJobStepService
 } from "./chunk-PNZSGAB2.js";
-import {
-  MemoryJobStore
-} from "./chunk-SNQ3TOWP.js";
 import {
   DrizzleJobRunService
 } from "./chunk-VNBC3VXM.js";
+import {
+  MemoryJobRunService
+} from "./chunk-BHZP6LOV.js";
+import {
+  MemoryJobStore
+} from "./chunk-SNQ3TOWP.js";
 import {
   BULLMQ_CONNECTION,
   BULLMQ_RESOLVED_CONFIG,
@@ -114,4 +114,4 @@ JobsDomainModule = __decorateClass([
 export {
   JobsDomainModule
 };
-//# sourceMappingURL=chunk-KS4BZHIA.js.map
+//# sourceMappingURL=chunk-XW4XKN3F.js.map

package/dist/{chunk-36NRG2EP.js → chunk-YQA5PMOD.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-5A432NZJ.js";
 import {
   BridgeOutboxDrainHook
-} from "./chunk-E5FJWOMP.js";
+} from "./chunk-3AM722ZH.js";
 import {
   EventFlowService
 } from "./chunk-7OVCARTQ.js";
@@ -24,7 +24,7 @@ import {
 } from "./chunk-NXXDZ6ZF.js";
 import {
   JOB_WORKER_MODULE_OPTIONS
-} from "./chunk-Z7YFYK6H.js";
+} from "./chunk-EGXFEZ2N.js";
 import {
   BRIDGE_DELIVERY_REPO,
   BRIDGE_MODULE_OPTIONS,
@@ -119,4 +119,4 @@ BridgeModule = __decorateClass([
 export {
   BridgeModule
 };
-//# sourceMappingURL=chunk-36NRG2EP.js.map
+//# sourceMappingURL=chunk-YQA5PMOD.js.map

package/dist/runtime/base-classes/index.js

@@ -1,8 +1,3 @@
-import {
-  JunctionIntegrationRepository,
-  buildCompositeExternalId,
-  parseCompositeExternalId
-} from "../../chunk-2FTZLDBP.js";
 import {
   KnowledgeEntityRepository
 } from "../../chunk-NN7XZEGF.js";
@@ -18,9 +13,6 @@ import {
 import {
   WithAnalytics
 } from "../../chunk-IBGER4YK.js";
-import {
-  ActivityEntityService
-} from "../../chunk-SJGEBMJT.js";
 import {
   BaseFindByIdUseCase,
   BaseListUseCase
@@ -32,15 +24,10 @@ import {
   IntegratedEntityService
 } from "../../chunk-5AAA4LTE.js";
 import {
-  BaseService
-} from "../../chunk-BPYZCEHS.js";
-import {
-  buildChangeEvents,
-  buildLifecycleEvent,
-  diffSnapshots,
-  emitSafely,
-  entitySnapshot
-} from "../../chunk-DAHWN63L.js";
+  JunctionIntegrationRepository,
+  buildCompositeExternalId,
+  parseCompositeExternalId
+} from "../../chunk-2FTZLDBP.js";
 import {
   ActivityEntityRepository
 } from "../../chunk-MKWQKKK7.js";
@@ -56,6 +43,19 @@ import {
   withSuperuserScope,
   withUserScope
 } from "../../chunk-ZUKFQL6E.js";
+import {
+  ActivityEntityService
+} from "../../chunk-SJGEBMJT.js";
+import {
+  BaseService
+} from "../../chunk-BPYZCEHS.js";
+import {
+  buildChangeEvents,
+  buildLifecycleEvent,
+  diffSnapshots,
+  emitSafely,
+  entitySnapshot
+} from "../../chunk-DAHWN63L.js";
 import "../../chunk-2E224ZSN.js";
 export {
   ActivityEntityRepository,

package/dist/runtime/subsystems/analytics/analytics.module.js

@@ -1,9 +1,9 @@
 import {
   AnalyticsModule
-} from "../../../chunk-DKKFTHHI.js";
-import "../../../chunk-J37YWU7Y.js";
+} from "../../../chunk-CZQUOIDY.js";
 import "../../../chunk-7B3RYX45.js";
 import "../../../chunk-6I7ULIN6.js";
+import "../../../chunk-J37YWU7Y.js";
 import "../../../chunk-GYGNEQSC.js";
 import "../../../chunk-2E224ZSN.js";
 export {

package/dist/runtime/subsystems/analytics/index.js

@@ -1,9 +1,6 @@
 import {
   AnalyticsModule
-} from "../../../chunk-DKKFTHHI.js";
-import {
-  NoopAnalyticsBackend
-} from "../../../chunk-J37YWU7Y.js";
+} from "../../../chunk-CZQUOIDY.js";
 import {
   CubeAnalyticsBackend
 } from "../../../chunk-7B3RYX45.js";
@@ -12,6 +9,9 @@ import {
   CUBE_API_SECRET,
   CUBE_API_URL
 } from "../../../chunk-6I7ULIN6.js";
+import {
+  NoopAnalyticsBackend
+} from "../../../chunk-J37YWU7Y.js";
 import "../../../chunk-GYGNEQSC.js";
 import "../../../chunk-2E224ZSN.js";
 export {

package/dist/runtime/subsystems/auth/auth.module.js

@@ -6,8 +6,8 @@ import "../../../chunk-N5OTOWTP.js";
 import "../../../chunk-QLTJSCE6.js";
 import "../../../chunk-BPARRK6F.js";
 import "../../../chunk-SZVPIHWE.js";
-import "../../../chunk-NPFPZ2HO.js";
 import "../../../chunk-6XY6ZMMD.js";
+import "../../../chunk-NPFPZ2HO.js";
 import "../../../chunk-GYGNEQSC.js";
 import "../../../chunk-U64T4YZE.js";
 import "../../../chunk-2E224ZSN.js";

package/dist/runtime/subsystems/auth/index.js

@@ -35,9 +35,6 @@ import {
 import {
   AuthController
 } from "../../../chunk-SZVPIHWE.js";
-import {
-  authOAuthState
-} from "../../../chunk-NPFPZ2HO.js";
 import {
   AUTH_CONNECTION_GRANT_SINK,
   AUTH_CONNECTION_READER,
@@ -48,6 +45,9 @@ import {
   OAUTH_STATE_STORE,
   STRATEGY_REGISTRY
 } from "../../../chunk-6XY6ZMMD.js";
+import {
+  authOAuthState
+} from "../../../chunk-NPFPZ2HO.js";
 import "../../../chunk-GYGNEQSC.js";
 import "../../../chunk-U64T4YZE.js";
 import "../../../chunk-ZUKFQL6E.js";

package/dist/runtime/subsystems/bridge/bridge-outbox-drain-hook.js

@@ -1,6 +1,6 @@
 import {
   BridgeOutboxDrainHook
-} from "../../../chunk-E5FJWOMP.js";
+} from "../../../chunk-3AM722ZH.js";
 import "../../../chunk-R6F6KFIL.js";
 import "../../../chunk-6DWFJNIK.js";
 import "../../../chunk-BORNCTH3.js";

package/dist/runtime/subsystems/bridge/bridge.module.js

@@ -1,8 +1,8 @@
 import {
   BridgeModule
-} from "../../../chunk-36NRG2EP.js";
+} from "../../../chunk-YQA5PMOD.js";
 import "../../../chunk-5A432NZJ.js";
-import "../../../chunk-E5FJWOMP.js";
+import "../../../chunk-3AM722ZH.js";
 import "../../../chunk-7OVCARTQ.js";
 import "../../../chunk-EDKJU5BO.js";
 import "../../../chunk-R6F6KFIL.js";
@@ -11,16 +11,16 @@ import "../../../chunk-6DWFJNIK.js";
 import "../../../chunk-4DOJBQTP.js";
 import "../../../chunk-BORNCTH3.js";
 import "../../../chunk-NXXDZ6ZF.js";
-import "../../../chunk-Z7YFYK6H.js";
-import "../../../chunk-KS4BZHIA.js";
-import "../../../chunk-BHZP6LOV.js";
-import "../../../chunk-DV4RV2DC.js";
+import "../../../chunk-EGXFEZ2N.js";
 import "../../../chunk-7B7MMDOJ.js";
+import "../../../chunk-XW4XKN3F.js";
+import "../../../chunk-DV4RV2DC.js";
 import "../../../chunk-E6PLM6QG.js";
 import "../../../chunk-VQOAATIG.js";
 import "../../../chunk-PNZSGAB2.js";
-import "../../../chunk-SNQ3TOWP.js";
 import "../../../chunk-VNBC3VXM.js";
+import "../../../chunk-BHZP6LOV.js";
+import "../../../chunk-SNQ3TOWP.js";
 import "../../../chunk-T4BIIU5E.js";
 import "../../../chunk-L3LZWWSX.js";
 import "../../../chunk-I6MVCB5A.js";

package/dist/runtime/subsystems/bridge/bridge.protocol.d.ts

@@ -266,14 +266,16 @@ type BridgeRegistry = {
  * `triggerCount`: total triggers matched in the registry for this event;
  * `triggerCount === delivered + dedupSkips`.
  *
- * `auditBlocked`: number of events the dispatcher refused to fan out
- * because their `metadata.tier === 'audit'`. Audit-tier events are not
- * bridge-eligible; codegen errors block the registry from listing them
- * as triggers, so a non-zero value here indicates registry/runtime drift
- * (an out-of-band `bridge_trigger` insert, version skew during deploy).
- * Per-event: `0` when the guard does not fire, `1` when it does. Add it
- * to per-batch logging if your drain caller aggregates results. See
- * ai-docs/specs/issue-242/plan.md §AUDIT-4.
+ * `auditBlocked`: number of audit-tier events the dispatcher refused to fan
+ * out *because they had a trigger registered against them*. Audit-tier events
+ * are not bridge-eligible; codegen errors block the registry from listing them
+ * as triggers, so a non-zero value here indicates genuine registry/runtime
+ * drift (an out-of-band `bridge_trigger` insert, version skew during deploy).
+ * A benign audit-tier event — one with no matched trigger, the common case for
+ * lifecycle events sharing the outbox — returns `0` and produces no log.
+ * Per-event: `0` when the guard does not fire (including benign audit events),
+ * `1` when it fires on drift. Add it to per-batch logging if your drain caller
+ * aggregates results. See ai-docs/specs/issue-242/plan.md §AUDIT-4.
  */
 interface BridgeOutboxDrainResult {
     delivered: number;
@@ -307,13 +309,17 @@ interface IBridgeOutboxDrainHook {
      * job_run` row pairs for every matched trigger via the supplied `tx`.
      *
      * Behaviour:
-     *   0. **Audit-tier guard (defense-in-depth).** If
-     *      `event.metadata.tier === 'audit'`, returns
+     *   0. **Audit-tier guard (defense-in-depth).** Runs *after* the registry
+     *      lookup (step 1). If `event.metadata.tier === 'audit'` AND a trigger
+     *      is registered against the type (genuine drift — AUDIT-2 should have
+     *      prevented it), returns
      *      `{ delivered: 0, dedupSkips: 0, triggerCount: 0, auditBlocked: 1 }`
-     *      immediately and logs a per-`(event_type, process)` WARN. The
-     *      codegen-side validator (AUDIT-2) is the primary enforcement;
-     *      this guard catches out-of-band `bridge_trigger` inserts and
-     *      version skew during deploy. See
+     *      and logs a per-`(event_type, process)` WARN naming the offending
+     *      trigger id(s). If the audit event has *no* matched trigger (the
+     *      common, benign case — lifecycle events sharing the outbox), returns
+     *      all zeros (`auditBlocked: 0`) silently. The codegen-side validator
+     *      (AUDIT-2) is the primary enforcement; this guard catches out-of-band
+     *      `bridge_trigger` inserts and version skew. See
      *      ai-docs/specs/issue-242/plan.md §AUDIT-4.
      *   1. Looks up `bridgeRegistry[event.type]`. No matches → returns
      *      `{ delivered: 0, dedupSkips: 0, triggerCount: 0, auditBlocked: 0 }`;

package/dist/runtime/subsystems/bridge/index.js

@@ -1,10 +1,10 @@
 import {
   BridgeModule
-} from "../../../chunk-36NRG2EP.js";
+} from "../../../chunk-YQA5PMOD.js";
 import "../../../chunk-5A432NZJ.js";
 import {
   BridgeOutboxDrainHook
-} from "../../../chunk-E5FJWOMP.js";
+} from "../../../chunk-3AM722ZH.js";
 import {
   EventFlowService
 } from "../../../chunk-7OVCARTQ.js";
@@ -33,16 +33,16 @@ import {
   MissingTenantIdError,
   UniqueConstraintError
 } from "../../../chunk-NXXDZ6ZF.js";
-import "../../../chunk-Z7YFYK6H.js";
-import "../../../chunk-KS4BZHIA.js";
-import "../../../chunk-BHZP6LOV.js";
-import "../../../chunk-DV4RV2DC.js";
+import "../../../chunk-EGXFEZ2N.js";
 import "../../../chunk-7B7MMDOJ.js";
+import "../../../chunk-XW4XKN3F.js";
+import "../../../chunk-DV4RV2DC.js";
 import "../../../chunk-E6PLM6QG.js";
 import "../../../chunk-VQOAATIG.js";
 import "../../../chunk-PNZSGAB2.js";
-import "../../../chunk-SNQ3TOWP.js";
 import "../../../chunk-VNBC3VXM.js";
+import "../../../chunk-BHZP6LOV.js";
+import "../../../chunk-SNQ3TOWP.js";
 import "../../../chunk-T4BIIU5E.js";
 import "../../../chunk-L3LZWWSX.js";
 import "../../../chunk-I6MVCB5A.js";

package/dist/runtime/subsystems/index.js

@@ -12,6 +12,7 @@ import {
   MemoryStorageBackend
 } from "../../chunk-3SZFUTXE.js";
 import "../../chunk-J6MN42LG.js";
+import "../../chunk-W4HOHZVF.js";
 import "../../chunk-FI34KYZ5.js";
 import "../../chunk-L4SDDEEU.js";
 import {
@@ -26,7 +27,6 @@ import {
 import {
   ObservabilityError
 } from "../../chunk-EWYCWP4H.js";
-import "../../chunk-W4HOHZVF.js";
 import "../../chunk-SYVZ4MD2.js";
 import {
   EventsModule
@@ -50,16 +50,16 @@ import {
   DrizzleEventBus
 } from "../../chunk-Y6UZMYGX.js";
 import "../../chunk-UQ5EHOH2.js";
-import "../../chunk-Z7YFYK6H.js";
-import "../../chunk-KS4BZHIA.js";
-import "../../chunk-BHZP6LOV.js";
-import "../../chunk-DV4RV2DC.js";
+import "../../chunk-EGXFEZ2N.js";
 import "../../chunk-7B7MMDOJ.js";
+import "../../chunk-XW4XKN3F.js";
+import "../../chunk-DV4RV2DC.js";
 import "../../chunk-E6PLM6QG.js";
 import "../../chunk-VQOAATIG.js";
 import "../../chunk-PNZSGAB2.js";
-import "../../chunk-SNQ3TOWP.js";
 import "../../chunk-VNBC3VXM.js";
+import "../../chunk-BHZP6LOV.js";
+import "../../chunk-SNQ3TOWP.js";
 import "../../chunk-T4BIIU5E.js";
 import "../../chunk-L3LZWWSX.js";
 import "../../chunk-I6MVCB5A.js";
@@ -72,6 +72,21 @@ import "../../chunk-FASRXRX5.js";
 import {
   CACHE
 } from "../../chunk-L6FTY45T.js";
+import "../../chunk-7C3FOSDI.js";
+import {
+  withAuthRetry
+} from "../../chunk-WL67FZGF.js";
+import {
+  OAuth2RefreshStrategy
+} from "../../chunk-M6QLSLPO.js";
+import {
+  ConnectionBrokenError
+} from "../../chunk-2N4UG4VD.js";
+import {
+  SessionExpiredError,
+  isSessionExpiredError
+} from "../../chunk-7RELQJIN.js";
+import "../../chunk-OSQRXVG2.js";
 import "../../chunk-7P5ODGLA.js";
 import "../../chunk-ZPL74UQN.js";
 import {
@@ -93,21 +108,6 @@ import {
   waitKindEnum
 } from "../../chunk-OKXZ63IA.js";
 import "../../chunk-E2BRT5IB.js";
-import "../../chunk-7C3FOSDI.js";
-import {
-  withAuthRetry
-} from "../../chunk-WL67FZGF.js";
-import {
-  OAuth2RefreshStrategy
-} from "../../chunk-M6QLSLPO.js";
-import {
-  ConnectionBrokenError
-} from "../../chunk-2N4UG4VD.js";
-import {
-  SessionExpiredError,
-  isSessionExpiredError
-} from "../../chunk-7RELQJIN.js";
-import "../../chunk-OSQRXVG2.js";
 import {
   AuthModule
 } from "../../chunk-7LKAMLV4.js";
@@ -126,9 +126,6 @@ import {
 import {
   AuthController
 } from "../../chunk-SZVPIHWE.js";
-import {
-  authOAuthState
-} from "../../chunk-NPFPZ2HO.js";
 import {
   AUTH_CONNECTION_GRANT_SINK,
   AUTH_CONNECTION_READER,
@@ -139,6 +136,9 @@ import {
   OAUTH_STATE_STORE,
   STRATEGY_REGISTRY
 } from "../../chunk-6XY6ZMMD.js";
+import {
+  authOAuthState
+} from "../../chunk-NPFPZ2HO.js";
 import "../../chunk-GYGNEQSC.js";
 import "../../chunk-KVOWSC5S.js";
 import "../../chunk-VCXOPBYY.js";

package/dist/runtime/subsystems/jobs/index.js

@@ -2,16 +2,7 @@ import "../../../chunk-W4HOHZVF.js";
 import {
   JobWorkerModule,
   JobWorkerOrchestrator
-} from "../../../chunk-Z7YFYK6H.js";
-import {
-  JobsDomainModule
-} from "../../../chunk-KS4BZHIA.js";
-import {
-  MemoryJobRunService
-} from "../../../chunk-BHZP6LOV.js";
-import {
-  DrizzleJobStepService
-} from "../../../chunk-DV4RV2DC.js";
+} from "../../../chunk-EGXFEZ2N.js";
 import {
   JOB_WORKER_OPTIONS,
   JobWorker,
@@ -20,6 +11,12 @@ import {
   classifyError,
   computeBackoff
 } from "../../../chunk-7B7MMDOJ.js";
+import {
+  JobsDomainModule
+} from "../../../chunk-XW4XKN3F.js";
+import {
+  DrizzleJobStepService
+} from "../../../chunk-DV4RV2DC.js";
 import {
   DrizzleJobOrchestrator
 } from "../../../chunk-E6PLM6QG.js";
@@ -29,12 +26,15 @@ import {
 import {
   MemoryJobStepService
 } from "../../../chunk-PNZSGAB2.js";
-import {
-  MemoryJobStore
-} from "../../../chunk-SNQ3TOWP.js";
 import {
   DrizzleJobRunService
 } from "../../../chunk-VNBC3VXM.js";
+import {
+  MemoryJobRunService
+} from "../../../chunk-BHZP6LOV.js";
+import {
+  MemoryJobStore
+} from "../../../chunk-SNQ3TOWP.js";
 import {
   BootValidationError,
   JobCollisionError,

package/dist/runtime/subsystems/jobs/job-worker.module.js

@@ -2,16 +2,16 @@ import {
   JOB_WORKER_MODULE_OPTIONS,
   JobWorkerModule,
   JobWorkerOrchestrator
-} from "../../../chunk-Z7YFYK6H.js";
-import "../../../chunk-KS4BZHIA.js";
-import "../../../chunk-BHZP6LOV.js";
-import "../../../chunk-DV4RV2DC.js";
+} from "../../../chunk-EGXFEZ2N.js";
 import "../../../chunk-7B7MMDOJ.js";
+import "../../../chunk-XW4XKN3F.js";
+import "../../../chunk-DV4RV2DC.js";
 import "../../../chunk-E6PLM6QG.js";
 import "../../../chunk-VQOAATIG.js";
 import "../../../chunk-PNZSGAB2.js";
-import "../../../chunk-SNQ3TOWP.js";
 import "../../../chunk-VNBC3VXM.js";
+import "../../../chunk-BHZP6LOV.js";
+import "../../../chunk-SNQ3TOWP.js";
 import "../../../chunk-T4BIIU5E.js";
 import "../../../chunk-L3LZWWSX.js";
 import "../../../chunk-I6MVCB5A.js";

package/dist/runtime/subsystems/jobs/jobs-domain.module.js

@@ -1,13 +1,13 @@
 import {
   JobsDomainModule
-} from "../../../chunk-KS4BZHIA.js";
-import "../../../chunk-BHZP6LOV.js";
+} from "../../../chunk-XW4XKN3F.js";
 import "../../../chunk-DV4RV2DC.js";
 import "../../../chunk-E6PLM6QG.js";
 import "../../../chunk-VQOAATIG.js";
 import "../../../chunk-PNZSGAB2.js";
-import "../../../chunk-SNQ3TOWP.js";
 import "../../../chunk-VNBC3VXM.js";
+import "../../../chunk-BHZP6LOV.js";
+import "../../../chunk-SNQ3TOWP.js";
 import "../../../chunk-T4BIIU5E.js";
 import "../../../chunk-L3LZWWSX.js";
 import "../../../chunk-I6MVCB5A.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pattern-stack/codegen",
-  "version": "0.27.1",
+  "version": "0.27.2",
   "description": "Entity-driven code generation for full-stack TypeScript applications",
   "license": "MIT",
   "type": "module",

package/runtime/subsystems/bridge/bridge-outbox-drain-hook.ts

@@ -82,22 +82,40 @@ export class BridgeOutboxDrainHook implements IBridgeOutboxDrainHook {
     event: DomainEvent,
     tx: DrizzleTransaction,
   ): Promise<BridgeOutboxDrainResult> {
-    // Audit-tier guard (defense-in-depth — AUDIT-4). Audit events are not
-    // bridge-eligible: the codegen-side validator (AUDIT-2) blocks the
-    // registry from listing them as triggers. Reaching this branch means
-    // registry/runtime drift — an out-of-band `bridge_trigger` insert, or
-    // version skew during deploy. Refuse fanout, surface drift via WARN.
+    const triggers = this.lookupTriggers(event.type);
+
+    // Audit-tier guard (defense-in-depth — AUDIT-4). Audit events are
+    // bridge-inert by design: the codegen-side validator (AUDIT-2) blocks the
+    // registry from listing them as triggers, so an audit event should never
+    // have a matched trigger. The guard runs AFTER the lookup so it can tell
+    // apart the two cases that share `tier === 'audit'`:
+    //   - triggers present → genuine registry/runtime drift (an out-of-band
+    //     `bridge_trigger` insert, or version skew during deploy). Refuse
+    //     fanout and surface the drift via WARN — now a verified claim, not a
+    //     guess. (Revises the original top-of-method guard, which warned for
+    //     every audit event: audit-tier lifecycle events like
+    //     `connection.created` routinely share the outbox with domain events,
+    //     so the unconditional warning was a false positive. See
+    //     ai-docs/specs/issue-242/plan.md §AUDIT-4 revision note.)
+    //   - no triggers → the common, benign case. Stay silent; auditBlocked: 0.
     if (event.metadata?.['tier'] === 'audit') {
-      this.warnAuditBlockedOnce(event);
+      if (triggers.length > 0) {
+        this.warnAuditBlockedOnce(event, triggers);
+        return {
+          delivered: 0,
+          dedupSkips: 0,
+          triggerCount: 0,
+          auditBlocked: 1,
+        };
+      }
       return {
         delivered: 0,
         dedupSkips: 0,
         triggerCount: 0,
-        auditBlocked: 1,
+        auditBlocked: 0,
       };
     }
 
-    const triggers = this.lookupTriggers(event.type);
     if (triggers.length === 0) {
       return {
         delivered: 0,
@@ -247,13 +265,18 @@ export class BridgeOutboxDrainHook implements IBridgeOutboxDrainHook {
     };
   }
 
-  private warnAuditBlockedOnce(event: DomainEvent): void {
+  private warnAuditBlockedOnce(
+    event: DomainEvent,
+    triggers: BridgeTriggerEntry[],
+  ): void {
     if (this.warnedAuditTypes.has(event.type)) return;
     this.warnedAuditTypes.add(event.type);
+    const triggerIds = triggers.map((t) => t.triggerId).join(', ');
     this.logger.warn(
       `Bridge guard blocked audit-tier event '${event.type}' (event.id=${event.id}). ` +
-        `Registry says this event is not bridge-eligible; a bridge_trigger row exists ` +
-        `out-of-band. Investigate registry/runtime drift.`,
+        `Audit events are not bridge-eligible, yet the registry has trigger(s) ` +
+        `registered against this type [${triggerIds}] — an out-of-band bridge_trigger ` +
+        `row or version skew. Investigate registry/runtime drift.`,
     );
   }
 

package/runtime/subsystems/bridge/bridge.protocol.ts

@@ -334,14 +334,16 @@ export type BridgeRegistry = {
  * `triggerCount`: total triggers matched in the registry for this event;
  * `triggerCount === delivered + dedupSkips`.
  *
- * `auditBlocked`: number of events the dispatcher refused to fan out
- * because their `metadata.tier === 'audit'`. Audit-tier events are not
- * bridge-eligible; codegen errors block the registry from listing them
- * as triggers, so a non-zero value here indicates registry/runtime drift
- * (an out-of-band `bridge_trigger` insert, version skew during deploy).
- * Per-event: `0` when the guard does not fire, `1` when it does. Add it
- * to per-batch logging if your drain caller aggregates results. See
- * ai-docs/specs/issue-242/plan.md §AUDIT-4.
+ * `auditBlocked`: number of audit-tier events the dispatcher refused to fan
+ * out *because they had a trigger registered against them*. Audit-tier events
+ * are not bridge-eligible; codegen errors block the registry from listing them
+ * as triggers, so a non-zero value here indicates genuine registry/runtime
+ * drift (an out-of-band `bridge_trigger` insert, version skew during deploy).
+ * A benign audit-tier event — one with no matched trigger, the common case for
+ * lifecycle events sharing the outbox — returns `0` and produces no log.
+ * Per-event: `0` when the guard does not fire (including benign audit events),
+ * `1` when it fires on drift. Add it to per-batch logging if your drain caller
+ * aggregates results. See ai-docs/specs/issue-242/plan.md §AUDIT-4.
  */
 export interface BridgeOutboxDrainResult {
   delivered: number;
@@ -376,13 +378,17 @@ export interface IBridgeOutboxDrainHook {
    * job_run` row pairs for every matched trigger via the supplied `tx`.
    *
    * Behaviour:
-   *   0. **Audit-tier guard (defense-in-depth).** If
-   *      `event.metadata.tier === 'audit'`, returns
+   *   0. **Audit-tier guard (defense-in-depth).** Runs *after* the registry
+   *      lookup (step 1). If `event.metadata.tier === 'audit'` AND a trigger
+   *      is registered against the type (genuine drift — AUDIT-2 should have
+   *      prevented it), returns
    *      `{ delivered: 0, dedupSkips: 0, triggerCount: 0, auditBlocked: 1 }`
-   *      immediately and logs a per-`(event_type, process)` WARN. The
-   *      codegen-side validator (AUDIT-2) is the primary enforcement;
-   *      this guard catches out-of-band `bridge_trigger` inserts and
-   *      version skew during deploy. See
+   *      and logs a per-`(event_type, process)` WARN naming the offending
+   *      trigger id(s). If the audit event has *no* matched trigger (the
+   *      common, benign case — lifecycle events sharing the outbox), returns
+   *      all zeros (`auditBlocked: 0`) silently. The codegen-side validator
+   *      (AUDIT-2) is the primary enforcement; this guard catches out-of-band
+   *      `bridge_trigger` inserts and version skew. See
    *      ai-docs/specs/issue-242/plan.md §AUDIT-4.
    *   1. Looks up `bridgeRegistry[event.type]`. No matches → returns
    *      `{ delivered: 0, dedupSkips: 0, triggerCount: 0, auditBlocked: 0 }`;

package/dist/chunk-E5FJWOMP.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../runtime/subsystems/bridge/bridge-outbox-drain-hook.ts"],"sourcesContent":["/**\n * BridgeOutboxDrainHook — drains-time bridge fanout writer (BRIDGE-4,\n * ADR-023 Phase 2).\n *\n * Implements `IBridgeOutboxDrainHook`. Called by `DrizzleEventBus`'s\n * modified `processBatch` once per drained event, INSIDE the per-event\n * transaction. For every trigger registered against the event's type in\n * the codegen-emitted `bridgeRegistry`, writes:\n *\n *   1. `bridge_delivery` ledger row — `INSERT … ON CONFLICT (event_id,\n *      trigger_id) DO NOTHING RETURNING id`. Empty result ⇒ Case B\n *      facade-eager pre-write OR drain-replay collision; skip wrapper\n *      insert for that trigger; sibling triggers still fire.\n *   2. `job_run` wrapper row — `type='@framework/bridge_delivery'`,\n *      `pool='events_<direction>'`, `input={ deliveryId }`,\n *      `trigger_source='event'`, `trigger_ref=event.id`. The wrapper is\n *      what the framework `BridgeDeliveryHandler` (BRIDGE-5) eventually\n *      claims via the worker that polls the corresponding reserved pool.\n *\n * Null `event.metadata.direction` is tolerated: the hook logs a one-line\n * warning per event and returns zeros without writing rows. The drain's\n * `processed_at` stamp + subscriber dispatch still fire normally.\n * Direction is null only for events published via the legacy\n * `IEventBus.publish(...)` path (`TypedEventBus.publish` always sets it);\n * such events are out of scope for bridge fanout.\n *\n * The wrapper insert generates its own `id` via Drizzle's `defaultRandom`\n * — we don't `RETURNING id` because nobody needs it at drain time;\n * `BridgeDeliveryHandler` later looks up the wrapper via the\n * `bridge_delivery.wrapper_run_id` link if needed. This keeps the drain\n * one-round-trip-per-trigger.\n */\nimport { Inject, Injectable, Logger, Optional } from '@nestjs/common';\nimport { randomUUID } from 'node:crypto';\nimport { eq } from 'drizzle-orm';\n\nimport type { DomainEvent, DrizzleTransaction } from '../events/event-bus.protocol';\nimport { bridgeDelivery } from './bridge-delivery.schema';\nimport { jobRuns } from '../jobs/job-orchestration.schema';\n\nimport { BRIDGE_REGISTRY } from './bridge.tokens';\nimport type {\n  BridgeOutboxDrainResult,\n  BridgeRegistry,\n  BridgeTriggerEntry,\n  IBridgeOutboxDrainHook,\n} from './bridge.protocol';\nimport { BRIDGE_DELIVERY_JOB_TYPE } from './bridge-delivery-handler';\nimport type { EventTypeName } from '../events/event-registry';\nimport { JOBS_LISTEN_NOTIFY } from '../jobs/jobs-domain.tokens';\nimport { JOBS_WAKE_CHANNEL, pgNotify } from '../jobs/pg-notify';\n\n/** Reserved pools the wrapper rows route into; ADR-022 / ADR-024. */\nconst POOL_BY_DIRECTION: Record<string, string> = {\n  inbound: 'events_inbound',\n  change: 'events_change',\n  outbound: 'events_outbound',\n};\n\n@Injectable()\nexport class BridgeOutboxDrainHook implements IBridgeOutboxDrainHook {\n  private readonly logger = new Logger(BridgeOutboxDrainHook.name);\n  private warnedNullDirection = false;\n  private readonly warnedAuditTypes = new Set<string>();\n\n  constructor(\n    @Optional()\n    @Inject(BRIDGE_REGISTRY)\n    private readonly registry: BridgeRegistry = {},\n    // LISTEN-NOTIFY-1 — when true, the wrapper `job_run` insert below emits an\n    // in-tx `pg_notify(codegen_jobs_wake, <wrapperPool>)` so the reserved-pool\n    // worker wakes the instant the per-event drain tx commits — otherwise the\n    // bridge hop alone would still cost a full poll interval. `@Optional()`\n    // defaulting false so the hook keeps working when jobs isn't installed\n    // (bridge can drive non-jobs consumers) or in vendored/test wiring.\n    @Optional()\n    @Inject(JOBS_LISTEN_NOTIFY)\n    private readonly listenNotify: boolean = false,\n  ) {}\n\n  async processEvent(\n    event: DomainEvent,\n    tx: DrizzleTransaction,\n  ): Promise<BridgeOutboxDrainResult> {\n    // Audit-tier guard (defense-in-depth — AUDIT-4). Audit events are not\n    // bridge-eligible: the codegen-side validator (AUDIT-2) blocks the\n    // registry from listing them as triggers. Reaching this branch means\n    // registry/runtime drift — an out-of-band `bridge_trigger` insert, or\n    // version skew during deploy. Refuse fanout, surface drift via WARN.\n    if (event.metadata?.['tier'] === 'audit') {\n      this.warnAuditBlockedOnce(event);\n      return {\n        delivered: 0,\n        dedupSkips: 0,\n        triggerCount: 0,\n        auditBlocked: 1,\n      };\n    }\n\n    const triggers = this.lookupTriggers(event.type);\n    if (triggers.length === 0) {\n      return {\n        delivered: 0,\n        dedupSkips: 0,\n        triggerCount: 0,\n        auditBlocked: 0,\n      };\n    }\n\n    const direction =\n      (event.metadata?.['direction'] as string | undefined) ?? null;\n    const tenantId =\n      (event.metadata?.['tenantId'] as string | null | undefined) ?? null;\n    const wrapperPool = direction ? POOL_BY_DIRECTION[direction] : undefined;\n\n    if (!wrapperPool) {\n      // Null direction (or an unrecognised one — defensive). Bridge\n      // fanout requires a routed wrapper pool; without one we can't\n      // spawn. Log once per process so misconfiguration surfaces.\n      if (!this.warnedNullDirection) {\n        this.warnedNullDirection = true;\n        this.logger.warn(\n          `Skipping bridge fanout for events with null/unknown direction. ` +\n            `event.id=${event.id} event.type=${event.type} ` +\n            `direction=${String(direction)}. The wrapper pool is derived ` +\n            `from direction (events_<direction>); publishers must use ` +\n            `TypedEventBus.publish() so direction is stamped on the ` +\n            `outbox row.`,\n        );\n      }\n      return {\n        delivered: 0,\n        dedupSkips: 0,\n        triggerCount: triggers.length,\n        auditBlocked: 0,\n      };\n    }\n\n    let delivered = 0;\n    let dedupSkips = 0;\n    const client = tx as unknown as {\n      insert: (table: unknown) => {\n        values: (v: unknown) => {\n          onConflictDoNothing: (opts: unknown) => {\n            returning: (cols: unknown) => Promise<{ id: string }[]>;\n          };\n        } & {\n          // wrapper insert path — no ON CONFLICT\n          // (typed loosely via the same helper return shape)\n        };\n      };\n    };\n\n    for (const trigger of triggers) {\n      const deliveryId = randomUUID();\n      const wrapperRunId = randomUUID();\n\n      // FK ORDER (BRIDGE / 0.15.2): `bridge_delivery.wrapper_run_id` REFERENCES\n      // `job_run(id)` is a plain (non-deferrable) FK, so the referenced\n      // wrapper `job_run` MUST exist before the delivery row that points at it\n      // is inserted — otherwise Postgres rejects the delivery insert\n      // immediately. (The codegen unit tests mock `tx`, so they never\n      // exercised this ordering against a real FK; package-mode bridge\n      // deliveries are the first to do so.) We therefore insert the wrapper\n      // run FIRST, then the delivery. Idempotency is unchanged: the delivery\n      // keeps its `ON CONFLICT (event_id, trigger_id) DO NOTHING RETURNING`,\n      // and when the delivery conflicts (outbox replay or facade-eager Case B)\n      // we DELETE the just-inserted orphan wrapper run in the same tx, so a\n      // skipped delivery leaves no stray `job_run` for a worker to claim.\n\n      // 1. Wrapper job_run insert. We carry the deliveryId into the wrapper\n      //    input so BridgeDeliveryHandler.run(ctx) can locate the row via\n      //    repo.findDeliveryById(ctx.input.deliveryId).\n      await (tx as unknown as { insert: typeof client.insert })\n        .insert(jobRuns)\n        .values({\n          id: wrapperRunId,\n          jobType: BRIDGE_DELIVERY_JOB_TYPE,\n          jobVersion: 1,\n          rootRunId: wrapperRunId,\n          pool: wrapperPool,\n          status: 'pending',\n          input: { deliveryId },\n          triggerSource: 'event',\n          triggerRef: event.id,\n          tenantId,\n        });\n\n      // 2. bridge_delivery insert with ON CONFLICT DO NOTHING + RETURNING.\n      const inserted = await (tx as unknown as {\n        insert: typeof client.insert;\n      })\n        .insert(bridgeDelivery)\n        .values({\n          id: deliveryId,\n          eventId: event.id,\n          triggerId: trigger.triggerId,\n          wrapperRunId,\n          status: 'pending',\n          tenantId,\n        })\n        .onConflictDoNothing({\n          target: [bridgeDelivery.eventId, bridgeDelivery.triggerId],\n        })\n        .returning({ id: bridgeDelivery.id });\n\n      if (inserted.length === 0) {\n        // Case B (facade pre-wrote `delivered`) or drain replay — the delivery\n        // already exists, so this trigger is a no-op. Remove the orphan wrapper\n        // run we speculatively inserted above so no worker claims it. Sibling\n        // triggers still fire.\n        await (tx as unknown as {\n          delete: (table: unknown) => {\n            where: (cond: unknown) => Promise<unknown>;\n          };\n        })\n          .delete(jobRuns)\n          .where(eq(jobRuns.id, wrapperRunId));\n        dedupSkips++;\n        continue;\n      }\n\n      // LISTEN-NOTIFY-1 — the wrapper run is real and claimable; wake its\n      // reserved-pool worker on commit (D7). Same `tx` as the inserts above, so\n      // delivery is gated on the per-event drain tx committing. Best-effort: a\n      // notify failure is non-fatal (the reserved-pool worker still polls).\n      if (this.listenNotify) {\n        try {\n          await pgNotify(tx, JOBS_WAKE_CHANNEL, wrapperPool);\n        } catch (err) {\n          this.logger.warn(\n            `pg_notify(${JOBS_WAKE_CHANNEL}, ${wrapperPool}) failed for ` +\n              `wrapper run ${wrapperRunId}: ${(err as Error).message} ` +\n              `(non-fatal — the reserved-pool worker still polls).`,\n          );\n        }\n      }\n\n      delivered++;\n    }\n\n    return {\n      delivered,\n      dedupSkips,\n      triggerCount: triggers.length,\n      auditBlocked: 0,\n    };\n  }\n\n  private warnAuditBlockedOnce(event: DomainEvent): void {\n    if (this.warnedAuditTypes.has(event.type)) return;\n    this.warnedAuditTypes.add(event.type);\n    this.logger.warn(\n      `Bridge guard blocked audit-tier event '${event.type}' (event.id=${event.id}). ` +\n        `Registry says this event is not bridge-eligible; a bridge_trigger row exists ` +\n        `out-of-band. Investigate registry/runtime drift.`,\n    );\n  }\n\n  private lookupTriggers(\n    eventType: string,\n  ): BridgeTriggerEntry[] {\n    const candidates = this.registry[eventType as EventTypeName];\n    return (candidates ?? []) as BridgeTriggerEntry[];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,SAAS,QAAQ,YAAY,QAAQ,gBAAgB;AACrD,SAAS,kBAAkB;AAC3B,SAAS,UAAU;AAmBnB,IAAM,oBAA4C;AAAA,EAChD,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,UAAU;AACZ;AAGO,IAAM,wBAAN,MAA8D;AAAA,EAKnE,YAGmB,WAA2B,CAAC,GAS5B,eAAwB,OACzC;AAViB;AASA;AAAA,EAChB;AAAA,EAVgB;AAAA,EASA;AAAA,EAhBF,SAAS,IAAI,OAAO,sBAAsB,IAAI;AAAA,EACvD,sBAAsB;AAAA,EACb,mBAAmB,oBAAI,IAAY;AAAA,EAiBpD,MAAM,aACJ,OACA,IACkC;AAMlC,QAAI,MAAM,WAAW,MAAM,MAAM,SAAS;AACxC,WAAK,qBAAqB,KAAK;AAC/B,aAAO;AAAA,QACL,WAAW;AAAA,QACX,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,cAAc;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,WAAW,KAAK,eAAe,MAAM,IAAI;AAC/C,QAAI,SAAS,WAAW,GAAG;AACzB,aAAO;AAAA,QACL,WAAW;AAAA,QACX,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,cAAc;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,YACH,MAAM,WAAW,WAAW,KAA4B;AAC3D,UAAM,WACH,MAAM,WAAW,UAAU,KAAmC;AACjE,UAAM,cAAc,YAAY,kBAAkB,SAAS,IAAI;AAE/D,QAAI,CAAC,aAAa;AAIhB,UAAI,CAAC,KAAK,qBAAqB;AAC7B,aAAK,sBAAsB;AAC3B,aAAK,OAAO;AAAA,UACV,2EACc,MAAM,EAAE,eAAe,MAAM,IAAI,cAChC,OAAO,SAAS,CAAC;AAAA,QAIlC;AAAA,MACF;AACA,aAAO;AAAA,QACL,WAAW;AAAA,QACX,YAAY;AAAA,QACZ,cAAc,SAAS;AAAA,QACvB,cAAc;AAAA,MAChB;AAAA,IACF;AAEA,QAAI,YAAY;AAChB,QAAI,aAAa;AACjB,UAAM,SAAS;AAaf,eAAW,WAAW,UAAU;AAC9B,YAAM,aAAa,WAAW;AAC9B,YAAM,eAAe,WAAW;AAkBhC,YAAO,GACJ,OAAO,OAAO,EACd,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,OAAO,EAAE,WAAW;AAAA,QACpB,eAAe;AAAA,QACf,YAAY,MAAM;AAAA,QAClB;AAAA,MACF,CAAC;AAGH,YAAM,WAAW,MAAO,GAGrB,OAAO,cAAc,EACrB,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,SAAS,MAAM;AAAA,QACf,WAAW,QAAQ;AAAA,QACnB;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,MACF,CAAC,EACA,oBAAoB;AAAA,QACnB,QAAQ,CAAC,eAAe,SAAS,eAAe,SAAS;AAAA,MAC3D,CAAC,EACA,UAAU,EAAE,IAAI,eAAe,GAAG,CAAC;AAEtC,UAAI,SAAS,WAAW,GAAG;AAKzB,cAAO,GAKJ,OAAO,OAAO,EACd,MAAM,GAAG,QAAQ,IAAI,YAAY,CAAC;AACrC;AACA;AAAA,MACF;AAMA,UAAI,KAAK,cAAc;AACrB,YAAI;AACF,gBAAM,SAAS,IAAI,mBAAmB,WAAW;AAAA,QACnD,SAAS,KAAK;AACZ,eAAK,OAAO;AAAA,YACV,aAAa,iBAAiB,KAAK,WAAW,4BAC7B,YAAY,KAAM,IAAc,OAAO;AAAA,UAE1D;AAAA,QACF;AAAA,MACF;AAEA;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,cAAc,SAAS;AAAA,MACvB,cAAc;AAAA,IAChB;AAAA,EACF;AAAA,EAEQ,qBAAqB,OAA0B;AACrD,QAAI,KAAK,iBAAiB,IAAI,MAAM,IAAI,EAAG;AAC3C,SAAK,iBAAiB,IAAI,MAAM,IAAI;AACpC,SAAK,OAAO;AAAA,MACV,0CAA0C,MAAM,IAAI,eAAe,MAAM,EAAE;AAAA,IAG7E;AAAA,EACF;AAAA,EAEQ,eACN,WACsB;AACtB,UAAM,aAAa,KAAK,SAAS,SAA0B;AAC3D,WAAQ,cAAc,CAAC;AAAA,EACzB;AACF;AA7Ma,wBAAN;AAAA,EADN,WAAW;AAAA,EAOP,4BAAS;AAAA,EACT,0BAAO,eAAe;AAAA,EAQtB,4BAAS;AAAA,EACT,0BAAO,kBAAkB;AAAA,GAhBjB;","names":[]}