crewly 1.20.132 → 1.20.134

package/dist/backend/backend/src/controllers/bundle/bundle.controller.js

@@ -0,0 +1,122 @@
+/**
+ * Solution bundle controller — REST handlers for `/api/bundles`
+ * (specs/solution-bundles.md).
+ *
+ * Every response is `{ success: true, data }` or
+ * `{ success: false, error, code?, missing?, invalid? }`.
+ *
+ * Owner-only: applying a bundle and reading an apply job refuse a request
+ * that carries `X-Agent-Session` (403), like `/api/harness` and the setup
+ * checklist — an agent must not deploy teams, schedules and channels in the
+ * owner's name. The catalog reads stay open.
+ *
+ * @module controllers/bundle/bundle.controller
+ */
+import { refuseAgent } from '../harness/harness.controller.js';
+import { BundleError } from '../../services/bundle/bundle-apply.service.js';
+import { toBundleDetail, toBundleSummary } from '../../services/bundle/bundle-catalog.js';
+/** HTTP status per engine error code. */
+const ERROR_STATUS = {
+    unknown_bundle: 404,
+    job_not_found: 404,
+    bundle_not_ready: 409,
+    invalid_runtime: 400,
+    invalid_answers: 400,
+};
+/**
+ * Send an error response.
+ *
+ * @param res - Response
+ * @param error - Thrown value
+ */
+export function sendBundleError(res, error) {
+    if (error instanceof BundleError) {
+        res.status(ERROR_STATUS[error.code] ?? 400).json({
+            success: false,
+            error: error.message,
+            code: error.code,
+            ...(error.details ? { missing: error.details.missing, invalid: error.details.invalid } : {}),
+        });
+        return;
+    }
+    res.status(500).json({ success: false, error: error instanceof Error ? error.message : String(error) });
+}
+/**
+ * A route parameter as a string.
+ *
+ * @param req - Request
+ * @param name - Parameter
+ * @returns Value ('' when absent)
+ */
+function param(req, name) {
+    const value = req.params[name];
+    return typeof value === 'string' ? value : '';
+}
+/**
+ * Build the handlers.
+ *
+ * @param deps - Engine and catalog accessors (tests inject fakes)
+ * @returns Handlers
+ */
+export function createBundleController(deps) {
+    return {
+        /** GET / — ready bundles (`?drafts=1` includes drafts) */
+        async list(req, res) {
+            try {
+                const includeDrafts = req.query.drafts === '1' || req.query.drafts === 'true';
+                const bundles = deps.catalog().list({ includeDrafts }).map((b) => toBundleSummary(b.template));
+                res.json({ success: true, data: { bundles } });
+            }
+            catch (error) {
+                sendBundleError(res, error);
+            }
+        },
+        /** GET /:templateId — questions, members, what gets set up, and this machine's deployment */
+        async detail(req, res) {
+            try {
+                const id = param(req, 'templateId');
+                const entry = deps.catalog().get(id);
+                if (!entry)
+                    throw new BundleError('unknown_bundle', `没有找到方案「${id}」`);
+                const deployment = await deps.service().getDeployment(id);
+                res.json({ success: true, data: { bundle: toBundleDetail(entry.template), deployment } });
+            }
+            catch (error) {
+                sendBundleError(res, error);
+            }
+        },
+        /** POST /apply { templateId, answers, runtime?, allowDraft? } — start (or join) an apply job; 202 */
+        async apply(req, res) {
+            if (refuseAgent(req, res, 'deploy a solution bundle'))
+                return;
+            try {
+                const body = (req.body ?? {});
+                const templateId = typeof body.templateId === 'string' ? body.templateId.trim() : '';
+                if (!templateId)
+                    throw new BundleError('unknown_bundle', 'templateId is required');
+                const deployment = await deps.service().start({
+                    templateId,
+                    answers: body.answers,
+                    runtime: typeof body.runtime === 'string' && body.runtime ? body.runtime : undefined,
+                    allowDraft: body.allowDraft === true,
+                });
+                res.status(202).json({ success: true, data: { jobId: deployment.jobId, deployment } });
+            }
+            catch (error) {
+                sendBundleError(res, error);
+            }
+        },
+        /** GET /apply/:jobId — progress of an apply job */
+        async getJob(req, res) {
+            if (refuseAgent(req, res, 'read a bundle deployment'))
+                return;
+            try {
+                res.json({ success: true, data: await deps.service().getJob(param(req, 'jobId')) });
+            }
+            catch (error) {
+                sendBundleError(res, error);
+            }
+        },
+    };
+}
+//# sourceMappingURL=bundle.controller.js.map

package/dist/backend/backend/src/controllers/bundle/bundle.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.controller.js","sourceRoot":"","sources":["../../../../../../backend/src/controllers/bundle/bundle.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAiD,MAAM,+CAA+C,CAAC;AAC3H,OAAO,EAAE,cAAc,EAAE,eAAe,EAAsB,MAAM,yCAAyC,CAAC;AAE9G,yCAAyC;AACzC,MAAM,YAAY,GAAoC;IACpD,cAAc,EAAE,GAAG;IACnB,aAAa,EAAE,GAAG;IAClB,gBAAgB,EAAE,GAAG;IACrB,eAAe,EAAE,GAAG;IACpB,eAAe,EAAE,GAAG;CACrB,CAAC;AAgBF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAa,EAAE,KAAc;IAC3D,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;YAC/C,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,CAAC,OAAO;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7F,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;;GAMG;AACH,SAAS,KAAK,CAAC,GAAY,EAAE,IAAY;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D,OAAO;QACL,0DAA0D;QAC1D,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG;YACjB,IAAI,CAAC;gBACH,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;gBAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC/F,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,6FAA6F;QAC7F,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG;YACnB,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrC,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;gBACrE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;gBAC1D,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;YAC5F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,qGAAqG;QACrG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG;YAClB,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,0BAA0B,CAAC;gBAAE,OAAO;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;gBACzD,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,IAAI,CAAC,UAAU;oBAAE,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;gBACnF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC;oBAC5C,UAAU;oBACV,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,OAAO,EAAE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;oBACpF,UAAU,EAAE,IAAI,CAAC,UAAU,KAAK,IAAI;iBACrC,CAAC,CAAC;gBACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;YACzF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,mDAAmD;QACnD,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG;YACnB,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,0BAA0B,CAAC;gBAAE,OAAO;YAC9D,IAAI,CAAC;gBACH,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;YACtF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/backend/backend/src/controllers/bundle/bundle.routes.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Solution bundle routes — mounted at `/api/bundles`.
+ *
+ * GET and POST only, so the phone / portal relay can carry them
+ * (`MobileApiRelayService` allowlists `GET /bundles` and `POST /bundles/apply`).
+ *
+ * - GET  /                — ready bundles
+ * - GET  /apply/:jobId    — apply progress (owner-only)
+ * - POST /apply           — deploy { templateId, answers, runtime?, allowDraft? } (owner-only)
+ * - GET  /:templateId     — questions, members, deployment on this machine
+ *
+ * @module controllers/bundle/bundle.routes
+ */
+import { Router } from 'express';
+import type { BundleApplyService } from '../../services/bundle/bundle-apply.service.js';
+import type { BundleCatalog } from '../../services/bundle/bundle-catalog.js';
+/**
+ * Create the bundle router.
+ *
+ * @param getService - Engine accessor (tests inject a fake)
+ * @param getCatalog - Catalog accessor (tests inject a fake)
+ * @returns Express router
+ */
+export declare function createBundleRouter(getService?: () => BundleApplyService, getCatalog?: () => Pick<BundleCatalog, 'list' | 'get'>): Router;
+//# sourceMappingURL=bundle.routes.d.ts.map

package/dist/backend/backend/src/controllers/bundle/bundle.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.routes.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/controllers/bundle/bundle.routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAI7E;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,GAAE,MAAM,kBAA0C,EAC5D,UAAU,GAAE,MAAM,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,KAAK,CAAoB,GACvE,MAAM,CAQR"}

package/dist/backend/backend/src/controllers/bundle/bundle.routes.js

@@ -0,0 +1,33 @@
+/**
+ * Solution bundle routes — mounted at `/api/bundles`.
+ *
+ * GET and POST only, so the phone / portal relay can carry them
+ * (`MobileApiRelayService` allowlists `GET /bundles` and `POST /bundles/apply`).
+ *
+ * - GET  /                — ready bundles
+ * - GET  /apply/:jobId    — apply progress (owner-only)
+ * - POST /apply           — deploy { templateId, answers, runtime?, allowDraft? } (owner-only)
+ * - GET  /:templateId     — questions, members, deployment on this machine
+ *
+ * @module controllers/bundle/bundle.routes
+ */
+import { Router } from 'express';
+import { getBundleApplyService, getBundleCatalog } from '../../services/bundle/bundle-apply.factory.js';
+import { createBundleController } from './bundle.controller.js';
+/**
+ * Create the bundle router.
+ *
+ * @param getService - Engine accessor (tests inject a fake)
+ * @param getCatalog - Catalog accessor (tests inject a fake)
+ * @returns Express router
+ */
+export function createBundleRouter(getService = getBundleApplyService, getCatalog = getBundleCatalog) {
+    const router = Router();
+    const controller = createBundleController({ service: getService, catalog: getCatalog });
+    router.get('/', controller.list);
+    router.get('/apply/:jobId', controller.getJob);
+    router.post('/apply', controller.apply);
+    router.get('/:templateId', controller.detail);
+    return router;
+}
+//# sourceMappingURL=bundle.routes.js.map

package/dist/backend/backend/src/controllers/bundle/bundle.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.routes.js","sourceRoot":"","sources":["../../../../../../backend/src/controllers/bundle/bundle.routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AACxG,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,aAAuC,qBAAqB,EAC5D,aAAwD,gBAAgB;IAExE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,UAAU,GAAG,sBAAsB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACxF,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/backend/backend/src/controllers/cloud/cloud-device-pairing.controller.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Cloud device pairing controller — `/api/cloud/device/*` on this backend.
+ *
+ * The web UI (`/setup` Cloud step, Settings → Cloud) and the phone app (over
+ * the relay allowlist) connect this machine to Crewly Cloud without handling
+ * tokens:
+ *
+ * - `POST /api/cloud/device/start`  → `{ state: 'pending', userCode, verificationUrl, expiresAt, … }`
+ *   (starts a pairing with crewly-auth, or returns the pending one).
+ * - `GET  /api/cloud/device/status` → the same shape; `state` moves to
+ *   `connected` once the owner approves and the backend has connected itself.
+ * - `POST /api/cloud/device/cancel` → stop waiting.
+ *
+ * Owner-only: every route refuses a request carrying `X-Agent-Session` (403)
+ * — an agent must not sign the machine in to an account, same rule as
+ * `/api/harness`. Responses never contain the device code or tokens.
+ *
+ * @module controllers/cloud/cloud-device-pairing.controller
+ */
+import type { Request, Response } from 'express';
+import { CloudDevicePairingService } from '../../services/cloud/cloud-device-pairing.service.js';
+/**
+ * The process-wide pairing service, wired to the real Cloud URL, device
+ * identity and connect path.
+ *
+ * @returns CloudDevicePairingService
+ */
+export declare function getCloudDevicePairingService(): CloudDevicePairingService;
+/**
+ * Replace the service (tests).
+ *
+ * @param next - Service to use, or null to rebuild the real one
+ */
+export declare function setCloudDevicePairingServiceForTests(next: CloudDevicePairingService | null): void;
+/**
+ * POST /api/cloud/device/start — begin (or resume) a pairing.
+ *
+ * @param req - Body `{ deviceName? }`
+ * @param res - `{ success, data: CloudDevicePairingStatus }`
+ */
+export declare function startCloudDevicePairing(req: Request, res: Response): Promise<void>;
+/**
+ * GET /api/cloud/device/status — where the pairing stands.
+ *
+ * @param req - Express request
+ * @param res - `{ success, data: CloudDevicePairingStatus }`
+ */
+export declare function getCloudDevicePairingStatus(req: Request, res: Response): void;
+/**
+ * POST /api/cloud/device/cancel — stop waiting for the owner.
+ *
+ * @param req - Express request
+ * @param res - `{ success, data: CloudDevicePairingStatus }`
+ */
+export declare function cancelCloudDevicePairing(req: Request, res: Response): void;
+//# sourceMappingURL=cloud-device-pairing.controller.d.ts.map

package/dist/backend/backend/src/controllers/cloud/cloud-device-pairing.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-device-pairing.controller.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/controllers/cloud/cloud-device-pairing.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAIjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AAcjG;;;;;GAKG;AACH,wBAAgB,4BAA4B,IAAI,yBAAyB,CAUxE;AAED;;;;GAIG;AACH,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,yBAAyB,GAAG,IAAI,GAAG,IAAI,CAEjG;AAeD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAaxF;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,CAI7E;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,CAG1E"}

package/dist/backend/backend/src/controllers/cloud/cloud-device-pairing.controller.js

@@ -0,0 +1,114 @@
+/**
+ * Cloud device pairing controller — `/api/cloud/device/*` on this backend.
+ *
+ * The web UI (`/setup` Cloud step, Settings → Cloud) and the phone app (over
+ * the relay allowlist) connect this machine to Crewly Cloud without handling
+ * tokens:
+ *
+ * - `POST /api/cloud/device/start`  → `{ state: 'pending', userCode, verificationUrl, expiresAt, … }`
+ *   (starts a pairing with crewly-auth, or returns the pending one).
+ * - `GET  /api/cloud/device/status` → the same shape; `state` moves to
+ *   `connected` once the owner approves and the backend has connected itself.
+ * - `POST /api/cloud/device/cancel` → stop waiting.
+ *
+ * Owner-only: every route refuses a request carrying `X-Agent-Session` (403)
+ * — an agent must not sign the machine in to an account, same rule as
+ * `/api/harness`. Responses never contain the device code or tokens.
+ *
+ * @module controllers/cloud/cloud-device-pairing.controller
+ */
+import { readAgentSessionHeader } from '../../utils/agent-caller.utils.js';
+import { CLOUD_CONSTANTS } from '../../constants.js';
+import { DeviceIdentityService } from '../../services/cloud/device-identity.service.js';
+import { CloudDevicePairingService } from '../../services/cloud/cloud-device-pairing.service.js';
+import { performCloudConnect } from './cloud.controller.js';
+/** HTTP 403. */
+const HTTP_FORBIDDEN = 403;
+/** HTTP 502 — crewly-auth refused or was unreachable. */
+const HTTP_BAD_GATEWAY = 502;
+/** Longest device name accepted from the UI. */
+const MAX_DEVICE_NAME_LENGTH = 80;
+let service = null;
+/**
+ * The process-wide pairing service, wired to the real Cloud URL, device
+ * identity and connect path.
+ *
+ * @returns CloudDevicePairingService
+ */
+export function getCloudDevicePairingService() {
+    if (!service) {
+        service = new CloudDevicePairingService({
+            cloudUrl: () => CLOUD_CONSTANTS.DEFAULT_CLOUD_URL,
+            identity: () => DeviceIdentityService.getInstance().getOrCreateIdentity(),
+            connect: (credentials) => performCloudConnect({ token: credentials.token, refreshToken: credentials.refreshToken }),
+        });
+    }
+    return service;
+}
+/**
+ * Replace the service (tests).
+ *
+ * @param next - Service to use, or null to rebuild the real one
+ */
+export function setCloudDevicePairingServiceForTests(next) {
+    service = next;
+}
+/**
+ * Refuse a request made by an agent session.
+ *
+ * @param req - Express request
+ * @param res - Express response
+ * @returns True when refused (response sent)
+ */
+function refuseAgent(req, res) {
+    if (!readAgentSessionHeader(req))
+        return false;
+    res.status(HTTP_FORBIDDEN).json({ success: false, error: 'Only the owner can connect this machine to Crewly Cloud' });
+    return true;
+}
+/**
+ * POST /api/cloud/device/start — begin (or resume) a pairing.
+ *
+ * @param req - Body `{ deviceName? }`
+ * @param res - `{ success, data: CloudDevicePairingStatus }`
+ */
+export async function startCloudDevicePairing(req, res) {
+    if (refuseAgent(req, res))
+        return;
+    const raw = req.body?.deviceName;
+    const deviceName = typeof raw === 'string' ? raw.slice(0, MAX_DEVICE_NAME_LENGTH) : undefined;
+    try {
+        const status = await getCloudDevicePairingService().start({ deviceName });
+        res.json({ success: true, data: status });
+    }
+    catch (error) {
+        res.status(HTTP_BAD_GATEWAY).json({
+            success: false,
+            error: error instanceof Error ? error.message : 'Could not reach Crewly Cloud',
+        });
+    }
+}
+/**
+ * GET /api/cloud/device/status — where the pairing stands.
+ *
+ * @param req - Express request
+ * @param res - `{ success, data: CloudDevicePairingStatus }`
+ */
+export function getCloudDevicePairingStatus(req, res) {
+    if (refuseAgent(req, res))
+        return;
+    res.setHeader('Cache-Control', 'no-store');
+    res.json({ success: true, data: getCloudDevicePairingService().getStatus() });
+}
+/**
+ * POST /api/cloud/device/cancel — stop waiting for the owner.
+ *
+ * @param req - Express request
+ * @param res - `{ success, data: CloudDevicePairingStatus }`
+ */
+export function cancelCloudDevicePairing(req, res) {
+    if (refuseAgent(req, res))
+        return;
+    res.json({ success: true, data: getCloudDevicePairingService().cancel() });
+}
+//# sourceMappingURL=cloud-device-pairing.controller.js.map

package/dist/backend/backend/src/controllers/cloud/cloud-device-pairing.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-device-pairing.controller.js","sourceRoot":"","sources":["../../../../../../backend/src/controllers/cloud/cloud-device-pairing.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,gBAAgB;AAChB,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,yDAAyD;AACzD,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,gDAAgD;AAChD,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC,IAAI,OAAO,GAAqC,IAAI,CAAC;AAErD;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,IAAI,yBAAyB,CAAC;YACtC,QAAQ,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,iBAAiB;YACjD,QAAQ,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,WAAW,EAAE,CAAC,mBAAmB,EAAE;YACzE,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CACvB,mBAAmB,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;SAC5F,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAAC,IAAsC;IACzF,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,GAAY,EAAE,GAAa;IAC9C,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,yDAAyD,EAAE,CAAC,CAAC;IACtH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,GAAY,EAAE,GAAa;IACvE,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAO;IAClC,MAAM,GAAG,GAAI,GAAG,CAAC,IAA6C,EAAE,UAAU,CAAC;IAC3E,MAAM,UAAU,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,4BAA4B,EAAE,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1E,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC;YAChC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;SAC/E,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAY,EAAE,GAAa;IACrE,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAO;IAClC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAY,EAAE,GAAa;IAClE,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAO;IAClC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC"}

package/dist/backend/backend/src/controllers/cloud/cloud.controller.d.ts

@@ -26,6 +26,31 @@ export interface CloudHandshakePayload {
     /** ISO timestamp of this handshake */
     timestamp: string;
 }
+/** Input for {@link performCloudConnect}. */
+export interface CloudConnectInput {
+    /** Cloud API base URL (defaults to CLOUD_CONSTANTS.DEFAULT_CLOUD_URL) */
+    cloudUrl?: string;
+    /** Cloud access token (JWT) */
+    token: string;
+    /** Cloud refresh token, for auto-renewal */
+    refreshToken?: string;
+}
+/**
+ * Connect this instance to CrewlyAI Cloud with a token pair.
+ *
+ * The single connect path shared by `POST /api/cloud/connect` (CLI, pasted
+ * token, Google redirect) and the device-code pairing that completes in the
+ * background ({@link CloudDevicePairingService}): verify the token, persist
+ * the credentials, send the handshake, and start Cloud Sync, the message
+ * router and the Slack config sync.
+ *
+ * @param input - Cloud URL and token pair
+ * @returns The subscription tier
+ * @throws Error when the Cloud rejects the token (message contains "authentication failed")
+ */
+export declare function performCloudConnect(input: CloudConnectInput): Promise<{
+    tier: string;
+}>;
 /**
  * POST /api/cloud/connect
  *

package/dist/backend/backend/src/controllers/cloud/cloud.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud.controller.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/controllers/cloud/cloud.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAyB/D,oEAAoE;AACpE,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,KAAK,EAAE,KAAK,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC,CAAC;IACH,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;CACnB;AA+ED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+EnG;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBxG;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBnG;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBlG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA4DvG;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBhG;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAmDtG;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBtG;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA2CrG;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA4CxG;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0ChG"}
+{"version":3,"file":"cloud.controller.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/controllers/cloud/cloud.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAyB/D,oEAAoE;AACpE,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,KAAK,EAAE,KAAK,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC,CAAC;IACH,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;CACnB;AA+ED,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CA8D7F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBnG;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBxG;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBnG;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBlG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA4DvG;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBhG;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAmDtG;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBtG;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA2CrG;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA4CxG;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0ChG"}

package/dist/backend/backend/src/controllers/cloud/cloud.controller.js

@@ -98,6 +98,78 @@ async function sendCloudHandshake(cloudUrl, token) {
         });
     }
 }
+/**
+ * Connect this instance to CrewlyAI Cloud with a token pair.
+ *
+ * The single connect path shared by `POST /api/cloud/connect` (CLI, pasted
+ * token, Google redirect) and the device-code pairing that completes in the
+ * background ({@link CloudDevicePairingService}): verify the token, persist
+ * the credentials, send the handshake, and start Cloud Sync, the message
+ * router and the Slack config sync.
+ *
+ * @param input - Cloud URL and token pair
+ * @returns The subscription tier
+ * @throws Error when the Cloud rejects the token (message contains "authentication failed")
+ */
+export async function performCloudConnect(input) {
+    const { cloudUrl, token, refreshToken } = input;
+    const resolvedUrl = cloudUrl || CLOUD_CONSTANTS.DEFAULT_CLOUD_URL;
+    const client = CloudClientService.getInstance();
+    // Try local JWT verification first — this works when OSS and Cloud share
+    // the same JWT secret (CREWLY_JWT_SECRET), or when the token was issued
+    // by this same instance (e.g. local Google OAuth flow).
+    const localPayload = verifyJwt(token);
+    let result;
+    if (localPayload) {
+        // JWT verified locally — connect without calling cloud API
+        const tier = localPayload.plan || 'free';
+        client.connectLocal(resolvedUrl, token, tier, refreshToken);
+        result = { success: true, tier };
+        logger.info('Connected to CrewlyAI Cloud (local JWT verification)', { tier });
+    }
+    else {
+        // Local verification failed (different JWT secret) — call cloud API
+        result = await client.connect(resolvedUrl, token, refreshToken);
+        logger.info('Connected to CrewlyAI Cloud (remote verification)', { tier: result.tier });
+    }
+    // Safety net: ensure refreshToken is persisted even if connect/connectLocal
+    // did not receive it (e.g. race condition or future refactor).
+    // Both connect() and connectLocal() already store refreshToken, but
+    // setRefreshToken() also re-persists config to disk as an extra guarantee.
+    if (refreshToken) {
+        client.setRefreshToken(refreshToken);
+    }
+    // Send device metadata + active teams to Cloud (best-effort, non-blocking)
+    sendCloudHandshake(resolvedUrl, token).catch(() => { });
+    // Start Cloud Sync for device discovery and message polling (best-effort)
+    try {
+        const identityService = DeviceIdentityService.getInstance();
+        const identity = await identityService.getOrCreateIdentity();
+        CloudSyncService.getInstance().start({
+            cloudUrl: resolvedUrl,
+            token,
+            deviceId: identity.deviceId,
+            deviceName: identity.deviceName,
+        });
+        logger.info('CloudSyncService started after cloud connect', { deviceId: identity.deviceId });
+        // Start MessageRouterService for cross-device agent communication
+        try {
+            const { startMessageRouter, startSlackCloudSync } = await import('../../services/cloud/cloud-initializer.js');
+            startMessageRouter();
+            // Slack v3: fetch the Cloud-owned Slack config right after login
+            startSlackCloudSync();
+        }
+        catch {
+            logger.debug('MessageRouterService start deferred (non-fatal)');
+        }
+    }
+    catch (syncErr) {
+        logger.warn('CloudSyncService start failed (non-fatal)', {
+            error: syncErr instanceof Error ? syncErr.message : String(syncErr),
+        });
+    }
+    return { tier: result.tier };
+}
 /**
  * POST /api/cloud/connect
  *
@@ -116,61 +188,7 @@ export async function connectToCloud(req, res, next) {
             res.status(400).json({ success: false, error: 'Missing required parameter: token' });
             return;
         }
-        const resolvedUrl = cloudUrl || CLOUD_CONSTANTS.DEFAULT_CLOUD_URL;
-        const client = CloudClientService.getInstance();
-        // Try local JWT verification first — this works when OSS and Cloud share
-        // the same JWT secret (CREWLY_JWT_SECRET), or when the token was issued
-        // by this same instance (e.g. local Google OAuth flow).
-        const localPayload = verifyJwt(token);
-        let result;
-        if (localPayload) {
-            // JWT verified locally — connect without calling cloud API
-            const tier = localPayload.plan || 'free';
-            client.connectLocal(resolvedUrl, token, tier, refreshToken);
-            result = { success: true, tier };
-            logger.info('Connected to CrewlyAI Cloud (local JWT verification)', { tier });
-        }
-        else {
-            // Local verification failed (different JWT secret) — call cloud API
-            result = await client.connect(resolvedUrl, token, refreshToken);
-            logger.info('Connected to CrewlyAI Cloud (remote verification)', { tier: result.tier });
-        }
-        // Safety net: ensure refreshToken is persisted even if connect/connectLocal
-        // did not receive it (e.g. race condition or future refactor).
-        // Both connect() and connectLocal() already store refreshToken, but
-        // setRefreshToken() also re-persists config to disk as an extra guarantee.
-        if (refreshToken) {
-            client.setRefreshToken(refreshToken);
-        }
-        // Send device metadata + active teams to Cloud (best-effort, non-blocking)
-        sendCloudHandshake(resolvedUrl, token).catch(() => { });
-        // Start Cloud Sync for device discovery and message polling (best-effort)
-        try {
-            const identityService = DeviceIdentityService.getInstance();
-            const identity = await identityService.getOrCreateIdentity();
-            CloudSyncService.getInstance().start({
-                cloudUrl: resolvedUrl,
-                token,
-                deviceId: identity.deviceId,
-                deviceName: identity.deviceName,
-            });
-            logger.info('CloudSyncService started after cloud connect', { deviceId: identity.deviceId });
-            // Start MessageRouterService for cross-device agent communication
-            try {
-                const { startMessageRouter, startSlackCloudSync } = await import('../../services/cloud/cloud-initializer.js');
-                startMessageRouter();
-                // Slack v3: fetch the Cloud-owned Slack config right after login
-                startSlackCloudSync();
-            }
-            catch {
-                logger.debug('MessageRouterService start deferred (non-fatal)');
-            }
-        }
-        catch (syncErr) {
-            logger.warn('CloudSyncService start failed (non-fatal)', {
-                error: syncErr instanceof Error ? syncErr.message : String(syncErr),
-            });
-        }
+        const result = await performCloudConnect({ cloudUrl, token, refreshToken });
         res.json({ success: true, data: { tier: result.tier } });
     }
     catch (error) {