crewly 1.6.4 → 1.7.0

package/dist/backend/backend/src/services/cloud/cloud-event-bridge.service.d.ts

@@ -1,113 +0,0 @@
-/**
- * Cloud Event Inbound Bridge — autonomy_v1.f1
- *
- * Receives `'event'` MessageType inbound from the Cloud Relay (via the
- * existing CloudSyncService poll → `'message'` event-emitter hop) and
- * re-publishes the carried AgentEvent onto the local EventBusService with
- * `source = 'remote'` and `originDeviceId` stamped from the wire envelope.
- *
- * Compose-at-boundary discipline (per Arch verdict 2026-04-28 N1):
- *   - CloudSyncService stays a transport — it polls Cloud, dedupes by
- *     `processedMessageIds`, emits an in-process `'message'` event.
- *   - This service is the AgentEvent translator. It owns the bridge between
- *     the cloud message vocabulary (`MessageType` + `EventMessagePayload`)
- *     and the local event-bus vocabulary (`AgentEvent`). It does NOT touch
- *     the poll loop or the cloud transport.
- *
- * Mirrors the BRIDGE-1 ↔ EventBus separation pattern: CloudSync EMITS,
- * downstream LISTENS. Same shape as PR #347 (BrandOnboarding ⊥
- * OnboardingService) and PR #348 (StatusBadge ⊥ RequestStatusPill) where
- * two parallel modules share a single narrow artifact.
- *
- * Idempotency:
- *   The local LRU at CloudSyncService blocks at-least-once cloud-message-id
- *   re-delivery upstream. The recent-publish suppression in EventBusService
- *   (post-M2 fix: `${type}:${sessionName}:${event.id}`) catches any
- *   duplicate that slips through to the publish boundary. The TriggerEngine
- *   per-trigger dedup `${triggerId}:${event.id}` (Slice 3) is the third
- *   layer at the trigger fire boundary.
- *
- * Unknown peer event types (Arch Q4):
- *   The closed `EVENT_TYPES` enum stays closed. Bridge accepts any string
- *   at the wire boundary via `RemoteEventType = string` and casts to
- *   `EventType` at the local re-publish boundary so the rest of the
- *   pipeline sees a stable type. A debug log names any unrecognised type
- *   so ops can audit drift.
- *
- * @module services/cloud/cloud-event-bridge.service
- */
-import { type ComponentLogger } from '../core/logger.service.js';
-import type { EventBusService } from '../event-bus/event-bus.service.js';
-import { type IncomingMessage } from './cloud-sync.types.js';
-/**
- * Minimum shape this bridge needs from the upstream cloud transport.
- * Defined locally rather than importing the full {@link CloudSyncService}
- * type so the bridge is unit-testable with a tiny mock and isn't coupled
- * to the whole transport surface.
- */
-export interface CloudMessageEmitter {
-    on(eventName: 'message', listener: (msg: IncomingMessage) => void): this;
-    off(eventName: 'message', listener: (msg: IncomingMessage) => void): this;
-}
-/**
- * Constructor dependencies for the inbound bridge.
- */
-export interface CloudEventInboundBridgeDeps {
-    /** Cloud transport that emits 'message' events (CloudSyncService in prod). */
-    cloudSync: CloudMessageEmitter;
-    /** Local event bus the bridge publishes onto. */
-    eventBus: EventBusService;
-    /** Optional logger override (test isolation). */
-    logger?: ComponentLogger;
-}
-/**
- * Bridges inbound cross-machine events from Cloud Relay → local EventBus.
- *
- * @example
- * ```typescript
- * const bridge = new CloudEventInboundBridge({
- *   cloudSync: CloudSyncService.getInstance(),
- *   eventBus: EventBusService.getInstance(),
- * });
- * bridge.start();
- * // ... later
- * bridge.stop();
- * ```
- */
-export declare class CloudEventInboundBridge {
-    private readonly logger;
-    private readonly cloudSync;
-    private readonly eventBus;
-    /**
-     * Bound listener kept so {@link stop} can detach it cleanly. Without
-     * this, repeated start/stop cycles (dev reloads, tests) would leak
-     * additional listeners.
-     */
-    private listener;
-    /** Whether the bridge is currently subscribed. */
-    private running;
-    /**
-     * Construct the bridge. Subscription does NOT start until
-     * {@link start} is called explicitly so callers control lifecycle.
-     */
-    constructor(deps: CloudEventInboundBridgeDeps);
-    /**
-     * Subscribe to the cloud transport's `'message'` event. Idempotent — a
-     * second `start()` call is a no-op.
-     */
-    start(): void;
-    /**
-     * Detach the cloud transport listener. Safe to call when not running.
-     */
-    stop(): void;
-    /**
-     * Process a single inbound cloud message. Filters on `type === 'event'`,
-     * validates the payload shape, then re-publishes the carried AgentEvent
-     * onto the local EventBus with `source = 'remote'` + `originDeviceId`.
-     *
-     * Public for unit tests only; production code should drive the bridge
-     * via the cloud transport's `'message'` event.
-     */
-    handle(msg: IncomingMessage): void;
-}
-//# sourceMappingURL=cloud-event-bridge.service.d.ts.map

package/dist/backend/backend/src/services/cloud/cloud-event-bridge.service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cloud-event-bridge.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/cloud/cloud-event-bridge.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAOzE,OAAO,EAEN,KAAK,eAAe,EACpB,MAAM,uBAAuB,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,IAAI,GAAG,IAAI,CAAC;IACzE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,IAAI,GAAG,IAAI,CAAC;CAC1E;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC3C,8EAA8E;IAC9E,SAAS,EAAE,mBAAmB,CAAC;IAC/B,iDAAiD;IACjD,QAAQ,EAAE,eAAe,CAAC;IAC1B,iDAAiD;IACjD,MAAM,CAAC,EAAE,eAAe,CAAC;CACzB;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,uBAAuB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAE3C;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAiD;IAEjE,kDAAkD;IAClD,OAAO,CAAC,OAAO,CAAS;IAExB;;;OAGG;gBACS,IAAI,EAAE,2BAA2B;IAQ7C;;;OAGG;IACH,KAAK,IAAI,IAAI;IAoBb;;OAEG;IACH,IAAI,IAAI,IAAI;IAQZ;;;;;;;OAOG;IACI,MAAM,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI;CAwDzC"}

package/dist/backend/backend/src/services/cloud/cloud-event-bridge.service.js

@@ -1,179 +0,0 @@
-/**
- * Cloud Event Inbound Bridge — autonomy_v1.f1
- *
- * Receives `'event'` MessageType inbound from the Cloud Relay (via the
- * existing CloudSyncService poll → `'message'` event-emitter hop) and
- * re-publishes the carried AgentEvent onto the local EventBusService with
- * `source = 'remote'` and `originDeviceId` stamped from the wire envelope.
- *
- * Compose-at-boundary discipline (per Arch verdict 2026-04-28 N1):
- *   - CloudSyncService stays a transport — it polls Cloud, dedupes by
- *     `processedMessageIds`, emits an in-process `'message'` event.
- *   - This service is the AgentEvent translator. It owns the bridge between
- *     the cloud message vocabulary (`MessageType` + `EventMessagePayload`)
- *     and the local event-bus vocabulary (`AgentEvent`). It does NOT touch
- *     the poll loop or the cloud transport.
- *
- * Mirrors the BRIDGE-1 ↔ EventBus separation pattern: CloudSync EMITS,
- * downstream LISTENS. Same shape as PR #347 (BrandOnboarding ⊥
- * OnboardingService) and PR #348 (StatusBadge ⊥ RequestStatusPill) where
- * two parallel modules share a single narrow artifact.
- *
- * Idempotency:
- *   The local LRU at CloudSyncService blocks at-least-once cloud-message-id
- *   re-delivery upstream. The recent-publish suppression in EventBusService
- *   (post-M2 fix: `${type}:${sessionName}:${event.id}`) catches any
- *   duplicate that slips through to the publish boundary. The TriggerEngine
- *   per-trigger dedup `${triggerId}:${event.id}` (Slice 3) is the third
- *   layer at the trigger fire boundary.
- *
- * Unknown peer event types (Arch Q4):
- *   The closed `EVENT_TYPES` enum stays closed. Bridge accepts any string
- *   at the wire boundary via `RemoteEventType = string` and casts to
- *   `EventType` at the local re-publish boundary so the rest of the
- *   pipeline sees a stable type. A debug log names any unrecognised type
- *   so ops can audit drift.
- *
- * @module services/cloud/cloud-event-bridge.service
- */
-import { LoggerService } from '../core/logger.service.js';
-import { formatError } from '../../utils/format-error.js';
-import { EVENT_TYPES } from '../../types/event-bus.types.js';
-import { isEventMessagePayload, } from './cloud-sync.types.js';
-/**
- * Bridges inbound cross-machine events from Cloud Relay → local EventBus.
- *
- * @example
- * ```typescript
- * const bridge = new CloudEventInboundBridge({
- *   cloudSync: CloudSyncService.getInstance(),
- *   eventBus: EventBusService.getInstance(),
- * });
- * bridge.start();
- * // ... later
- * bridge.stop();
- * ```
- */
-export class CloudEventInboundBridge {
-    logger;
-    cloudSync;
-    eventBus;
-    /**
-     * Bound listener kept so {@link stop} can detach it cleanly. Without
-     * this, repeated start/stop cycles (dev reloads, tests) would leak
-     * additional listeners.
-     */
-    listener = null;
-    /** Whether the bridge is currently subscribed. */
-    running = false;
-    /**
-     * Construct the bridge. Subscription does NOT start until
-     * {@link start} is called explicitly so callers control lifecycle.
-     */
-    constructor(deps) {
-        this.cloudSync = deps.cloudSync;
-        this.eventBus = deps.eventBus;
-        this.logger =
-            deps.logger ??
-                LoggerService.getInstance().createComponentLogger('CloudEventInboundBridge');
-    }
-    /**
-     * Subscribe to the cloud transport's `'message'` event. Idempotent — a
-     * second `start()` call is a no-op.
-     */
-    start() {
-        if (this.running)
-            return;
-        this.listener = (msg) => {
-            try {
-                this.handle(msg);
-            }
-            catch (err) {
-                // Defensive — handle() already swallows known failure modes,
-                // but a thrown error here MUST NOT poison other 'message'
-                // listeners on the cloud transport.
-                this.logger.error('CloudEventInboundBridge handler threw', {
-                    error: formatError(err),
-                    messageId: msg?.id,
-                });
-            }
-        };
-        this.cloudSync.on('message', this.listener);
-        this.running = true;
-        this.logger.info('CloudEventInboundBridge started — listening for `event` MessageType');
-    }
-    /**
-     * Detach the cloud transport listener. Safe to call when not running.
-     */
-    stop() {
-        if (this.listener) {
-            this.cloudSync.off('message', this.listener);
-            this.listener = null;
-        }
-        this.running = false;
-    }
-    /**
-     * Process a single inbound cloud message. Filters on `type === 'event'`,
-     * validates the payload shape, then re-publishes the carried AgentEvent
-     * onto the local EventBus with `source = 'remote'` + `originDeviceId`.
-     *
-     * Public for unit tests only; production code should drive the bridge
-     * via the cloud transport's `'message'` event.
-     */
-    handle(msg) {
-        // Wrong type — leave it for the consumer that actually owns it
-        // (CrossMachineMessageRouter, browser command handler, etc).
-        if (msg.type !== 'event') {
-            return;
-        }
-        if (!isEventMessagePayload(msg.payload)) {
-            this.logger.warn('Dropping malformed cross-machine event payload', {
-                messageId: msg.id,
-                from: msg.from,
-            });
-            return;
-        }
-        const { event: wireEvent, originDeviceId, originDeviceName } = msg.payload;
-        const remoteType = wireEvent.type;
-        // Per Arch Q4: log when a peer ships a type we don't know locally.
-        // We still re-publish — closed-enum sync would create a deployment-
-        // ordering constraint we explicitly rejected.
-        if (!isKnownEventType(remoteType)) {
-            this.logger.debug('Cross-machine event with unknown-to-local event type — accepting via RemoteEventType boundary', {
-                messageId: msg.id,
-                eventId: wireEvent.id,
-                unknownType: remoteType,
-                originDeviceId,
-            });
-        }
-        // Build the AgentEvent. Wire payload may carry extra fields the
-        // origin device knew about (e.g. workItemId, missionId, requestId)
-        // — pass them through unchanged. Our bridge only stamps the two
-        // origin-tag fields.
-        const agentEvent = {
-            ...wireEvent,
-            // Cast at the boundary per Arch Q4. Closed `EVENT_TYPES` enum
-            // stays closed; downstream consumers see a stable EventType.
-            type: remoteType,
-            source: 'remote',
-            originDeviceId,
-        };
-        this.logger.info('Re-publishing cross-machine event onto local EventBus', {
-            messageId: msg.id,
-            eventId: agentEvent.id,
-            eventType: agentEvent.type,
-            originDeviceId,
-            originDeviceName,
-        });
-        this.eventBus.publish(agentEvent);
-    }
-}
-/**
- * Internal helper — true when the wire event-type matches the closed
- * `EVENT_TYPES` enum. Used only for the debug-log breadcrumb; does NOT
- * gate re-publish (per Arch Q4).
- */
-function isKnownEventType(value) {
-    return EVENT_TYPES.includes(value);
-}
-//# sourceMappingURL=cloud-event-bridge.service.js.map

package/dist/backend/backend/src/services/cloud/cloud-event-bridge.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cloud-event-bridge.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/cloud/cloud-event-bridge.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,aAAa,EAAwB,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAO1D,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EACN,qBAAqB,GAErB,MAAM,uBAAuB,CAAC;AAyB/B;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,uBAAuB;IAClB,MAAM,CAAkB;IACxB,SAAS,CAAsB;IAC/B,QAAQ,CAAkB;IAE3C;;;;OAIG;IACK,QAAQ,GAA4C,IAAI,CAAC;IAEjE,kDAAkD;IAC1C,OAAO,GAAG,KAAK,CAAC;IAExB;;;OAGG;IACH,YAAY,IAAiC;QAC5C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,MAAM;YACV,IAAI,CAAC,MAAM;gBACX,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC/E,CAAC;IAED;;;OAGG;IACH,KAAK;QACJ,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAoB,EAAE,EAAE;YACxC,IAAI,CAAC;gBACJ,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,6DAA6D;gBAC7D,0DAA0D;gBAC1D,oCAAoC;gBACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;oBAC1D,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC;oBACvB,SAAS,EAAE,GAAG,EAAE,EAAE;iBAClB,CAAC,CAAC;YACJ,CAAC;QACF,CAAC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IAED;;OAEG;IACH,IAAI;QACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;IACtB,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,GAAoB;QACjC,+DAA+D;QAC/D,6DAA6D;QAC7D,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1B,OAAO;QACR,CAAC;QAED,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;gBAClE,SAAS,EAAE,GAAG,CAAC,EAAE;gBACjB,IAAI,EAAE,GAAG,CAAC,IAAI;aACd,CAAC,CAAC;YACH,OAAO;QACR,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;QAC3E,MAAM,UAAU,GAAoB,SAAS,CAAC,IAAI,CAAC;QAEnD,mEAAmE;QACnE,oEAAoE;QACpE,8CAA8C;QAC9C,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,+FAA+F,EAC/F;gBACC,SAAS,EAAE,GAAG,CAAC,EAAE;gBACjB,OAAO,EAAE,SAAS,CAAC,EAAE;gBACrB,WAAW,EAAE,UAAU;gBACvB,cAAc;aACd,CACD,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,mEAAmE;QACnE,gEAAgE;QAChE,qBAAqB;QACrB,MAAM,UAAU,GAAe;YAC9B,GAAI,SAAmC;YACvC,8DAA8D;YAC9D,6DAA6D;YAC7D,IAAI,EAAE,UAAuB;YAC7B,MAAM,EAAE,QAAQ;YAChB,cAAc;SACd,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE;YACzE,SAAS,EAAE,GAAG,CAAC,EAAE;YACjB,OAAO,EAAE,UAAU,CAAC,EAAE;YACtB,SAAS,EAAE,UAAU,CAAC,IAAI;YAC1B,cAAc;YACd,gBAAgB;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;CACD;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACtC,OAAQ,WAAiC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC"}

package/dist/backend/backend/src/services/cloud/cloud-event-forwarder.service.d.ts

@@ -1,131 +0,0 @@
-/**
- * Cloud Event Outbound Forwarder — autonomy_v1.f1
- *
- * Closes the bidirectional cross-machine event loop. Subscribes to the
- * local EventBusService for events whose type is on an OPT-IN allow-list
- * (read from `crewly.json` at project root, key `crossMachineEvents`) and
- * forwards each via `cloudSync.sendMessage(broadcast, 'event', payload)`
- * so paired devices receive them at their inbound bridge.
- *
- * Forwarder discipline (per Arch verdict 2026-04-28):
- *   - **Q1 LOCKED — OPT-IN allow-list.** v1 forwards ONLY events whose
- *     type is explicitly listed in `crewly.json` `crossMachineEvents`.
- *     Reasons: privacy (avoid leaking internal events to peers), payload
- *     bloat, per-paired-device DoS-source containment. Empty allow-list
- *     → forwarder is a no-op.
- *   - **Q5 LOCKED — Loop-prevention fence.** The forwarder MUST short-
- *     circuit on `event.source === 'remote'`. Otherwise the inbound
- *     bridge re-publishes a remote event onto the local EventBus, the
- *     forwarder picks it up, ships it back to cloud, cloud fans it out
- *     again, etc. The fence is locked at the test surface via a
- *     dedicated `it()` (PR #354 N1 fence-at-test-surface pattern).
- *   - **Fail-safe on config.** Malformed `crewly.json`, missing file, or
- *     non-array `crossMachineEvents` → forwarder defaults to no-op (NOT
- *     "forward everything"). Surfaces an error log so ops can spot the
- *     misconfiguration without leaking events accidentally.
- *
- * Compose-at-boundary discipline (Arch N1, mirrors the inbound bridge):
- *   - CloudSyncService stays a transport — the forwarder calls
- *     `sendMessage` and that's the only coupling point.
- *   - This forwarder is a NEW file at the same boundary level as
- *     `cloud-event-bridge.service.ts`. Inbound and outbound bridges are
- *     symmetric.
- *
- * @module services/cloud/cloud-event-forwarder.service
- */
-import { type ComponentLogger } from '../core/logger.service.js';
-import type { EventBusService } from '../event-bus/event-bus.service.js';
-import type { AgentEvent } from '../../types/event-bus.types.js';
-import type { EventMessagePayload } from './cloud-sync.types.js';
-/**
- * Minimum cloud transport surface needed for outbound. Defined locally
- * (mirrors `CloudMessageEmitter` in the inbound bridge) so the test mock
- * is tiny and the forwarder is not coupled to the entire CloudSyncService.
- */
-export interface CloudEventSender {
-    /**
-     * Broadcast an `'event'` MessageType to all paired devices in the same
-     * tenant. Cloud Relay handles the fan-out (web/ ticket).
-     *
-     * For v1 we use a sentinel deviceId `'*broadcast'` per the cloud
-     * contract spec §(c). Future v2 may add per-event subscription
-     * routing, in which case the call site here changes; the contract
-     * field shape is forward-compatible.
-     */
-    sendMessage(toDeviceId: string, type: 'event', payload: EventMessagePayload): Promise<void>;
-}
-/**
- * Constructor dependencies for the outbound forwarder.
- */
-export interface CloudEventForwarderDeps {
-    /** Cloud transport for `sendMessage` (CloudSyncService in prod). */
-    cloudSync: CloudEventSender;
-    /** Local event bus the forwarder subscribes to. */
-    eventBus: EventBusService;
-    /** Origin device identity stamped onto every outbound payload. */
-    originDeviceId: string;
-    /** Optional human-readable origin device name (for log lines on the peer). */
-    originDeviceName?: string;
-    /** Project root used to resolve `crewly.json`. */
-    projectPath: string;
-    /**
-     * Optional override for the allow-list. When provided, the forwarder
-     * uses this instead of reading `crewly.json`. Test injection only.
-     */
-    allowListOverride?: ReadonlyArray<string>;
-    /** Optional logger override (test isolation). */
-    logger?: ComponentLogger;
-}
-/**
- * Forwards local AgentEvents to paired devices via Cloud Relay when their
- * type is on the configured allow-list.
- */
-export declare class CloudEventForwarder {
-    private readonly logger;
-    private readonly cloudSync;
-    private readonly eventBus;
-    private readonly originDeviceId;
-    private readonly originDeviceName?;
-    private readonly projectPath;
-    private readonly allowListOverride?;
-    /** Resolved allow-list of event types. Empty = forwarder is a no-op. */
-    private allowList;
-    /** Detach functions returned by EventBusService.onInProcess(). */
-    private unsubscribers;
-    /** Whether the forwarder is currently subscribed. */
-    private running;
-    constructor(deps: CloudEventForwarderDeps);
-    /**
-     * Load the allow-list and subscribe to the event bus. Idempotent.
-     *
-     * The forwarder uses {@link EventBusService.onInProcess} per
-     * registered allow-list type so it receives FULL `AgentEvent` payloads
-     * (including the `source` field needed for the loop-prevention fence).
-     * The widened `'event_published'` emit payload would also work but is
-     * stripped of optional fields the wire payload needs (e.g. workItemId,
-     * missionId).
-     */
-    start(): Promise<void>;
-    /**
-     * Detach all event-bus listeners. Safe to call when not running.
-     */
-    stop(): void;
-    /**
-     * Process a single local event — forward to cloud if eligible.
-     *
-     * Public for unit tests only; production drives this via the
-     * EventBusService.onInProcess subscription installed in {@link start}.
-     */
-    handle(event: AgentEvent): Promise<void>;
-    /**
-     * Resolve the allow-list. Order:
-     *   1. `allowListOverride` (test injection).
-     *   2. `<projectPath>/crewly.json` `crossMachineEvents` array.
-     *   3. Empty (no-op forwarder) — fail-safe default.
-     *
-     * Malformed JSON or non-array `crossMachineEvents` → empty + error log.
-     * NEVER defaults to "forward everything" — privacy + DoS containment.
-     */
-    private resolveAllowList;
-}
-//# sourceMappingURL=cloud-event-forwarder.service.d.ts.map

package/dist/backend/backend/src/services/cloud/cloud-event-forwarder.service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cloud-event-forwarder.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/cloud/cloud-event-forwarder.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAIH,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEhF,OAAO,KAAK,EAAE,eAAe,EAAwB,MAAM,mCAAmC,CAAC;AAC/F,OAAO,KAAK,EACX,UAAU,EAEV,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEjE;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAChC;;;;;;;;OAQG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5F;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACvC,oEAAoE;IACpE,SAAS,EAAE,gBAAgB,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,EAAE,eAAe,CAAC;IAC1B,kEAAkE;IAClE,cAAc,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,iDAAiD;IACjD,MAAM,CAAC,EAAE,eAAe,CAAC;CACzB;AAKD;;;GAGG;AACH,qBAAa,mBAAmB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAwB;IAE3D,wEAAwE;IACxE,OAAO,CAAC,SAAS,CAAkC;IAEnD,kEAAkE;IAClE,OAAO,CAAC,aAAa,CAA8B;IAEnD,qDAAqD;IACrD,OAAO,CAAC,OAAO,CAAS;gBAEZ,IAAI,EAAE,uBAAuB;IAYzC;;;;;;;;;OASG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA4B5B;;OAEG;IACH,IAAI,IAAI,IAAI;IAYZ;;;;;OAKG;IACU,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAiDrD;;;;;;;;OAQG;YACW,gBAAgB;CAuC9B"}

package/dist/backend/backend/src/services/cloud/cloud-event-forwarder.service.js

@@ -1,227 +0,0 @@
-/**
- * Cloud Event Outbound Forwarder — autonomy_v1.f1
- *
- * Closes the bidirectional cross-machine event loop. Subscribes to the
- * local EventBusService for events whose type is on an OPT-IN allow-list
- * (read from `crewly.json` at project root, key `crossMachineEvents`) and
- * forwards each via `cloudSync.sendMessage(broadcast, 'event', payload)`
- * so paired devices receive them at their inbound bridge.
- *
- * Forwarder discipline (per Arch verdict 2026-04-28):
- *   - **Q1 LOCKED — OPT-IN allow-list.** v1 forwards ONLY events whose
- *     type is explicitly listed in `crewly.json` `crossMachineEvents`.
- *     Reasons: privacy (avoid leaking internal events to peers), payload
- *     bloat, per-paired-device DoS-source containment. Empty allow-list
- *     → forwarder is a no-op.
- *   - **Q5 LOCKED — Loop-prevention fence.** The forwarder MUST short-
- *     circuit on `event.source === 'remote'`. Otherwise the inbound
- *     bridge re-publishes a remote event onto the local EventBus, the
- *     forwarder picks it up, ships it back to cloud, cloud fans it out
- *     again, etc. The fence is locked at the test surface via a
- *     dedicated `it()` (PR #354 N1 fence-at-test-surface pattern).
- *   - **Fail-safe on config.** Malformed `crewly.json`, missing file, or
- *     non-array `crossMachineEvents` → forwarder defaults to no-op (NOT
- *     "forward everything"). Surfaces an error log so ops can spot the
- *     misconfiguration without leaking events accidentally.
- *
- * Compose-at-boundary discipline (Arch N1, mirrors the inbound bridge):
- *   - CloudSyncService stays a transport — the forwarder calls
- *     `sendMessage` and that's the only coupling point.
- *   - This forwarder is a NEW file at the same boundary level as
- *     `cloud-event-bridge.service.ts`. Inbound and outbound bridges are
- *     symmetric.
- *
- * @module services/cloud/cloud-event-forwarder.service
- */
-import * as fs from 'fs/promises';
-import * as path from 'path';
-import { LoggerService } from '../core/logger.service.js';
-import { formatError } from '../../utils/format-error.js';
-/** Sentinel for "fan out to every paired device in the tenant". */
-const BROADCAST_TARGET = '*broadcast';
-/**
- * Forwards local AgentEvents to paired devices via Cloud Relay when their
- * type is on the configured allow-list.
- */
-export class CloudEventForwarder {
-    logger;
-    cloudSync;
-    eventBus;
-    originDeviceId;
-    originDeviceName;
-    projectPath;
-    allowListOverride;
-    /** Resolved allow-list of event types. Empty = forwarder is a no-op. */
-    allowList = new Set();
-    /** Detach functions returned by EventBusService.onInProcess(). */
-    unsubscribers = [];
-    /** Whether the forwarder is currently subscribed. */
-    running = false;
-    constructor(deps) {
-        this.cloudSync = deps.cloudSync;
-        this.eventBus = deps.eventBus;
-        this.originDeviceId = deps.originDeviceId;
-        this.originDeviceName = deps.originDeviceName;
-        this.projectPath = deps.projectPath;
-        this.allowListOverride = deps.allowListOverride;
-        this.logger =
-            deps.logger ??
-                LoggerService.getInstance().createComponentLogger('CloudEventForwarder');
-    }
-    /**
-     * Load the allow-list and subscribe to the event bus. Idempotent.
-     *
-     * The forwarder uses {@link EventBusService.onInProcess} per
-     * registered allow-list type so it receives FULL `AgentEvent` payloads
-     * (including the `source` field needed for the loop-prevention fence).
-     * The widened `'event_published'` emit payload would also work but is
-     * stripped of optional fields the wire payload needs (e.g. workItemId,
-     * missionId).
-     */
-    async start() {
-        if (this.running)
-            return;
-        this.allowList = await this.resolveAllowList();
-        if (this.allowList.size === 0) {
-            this.logger.info('CloudEventForwarder allow-list is empty — forwarder will be a no-op until configured', { projectPath: this.projectPath });
-            this.running = true;
-            return;
-        }
-        for (const eventType of this.allowList) {
-            const unsub = this.eventBus.onInProcess([eventType], (event) => this.handle(event));
-            this.unsubscribers.push(unsub);
-        }
-        this.running = true;
-        this.logger.info('CloudEventForwarder started', {
-            allowList: Array.from(this.allowList),
-            originDeviceId: this.originDeviceId,
-        });
-    }
-    /**
-     * Detach all event-bus listeners. Safe to call when not running.
-     */
-    stop() {
-        for (const unsub of this.unsubscribers) {
-            try {
-                unsub();
-            }
-            catch (err) {
-                this.logger.warn('CloudEventForwarder unsubscribe threw', { error: formatError(err) });
-            }
-        }
-        this.unsubscribers = [];
-        this.running = false;
-    }
-    /**
-     * Process a single local event — forward to cloud if eligible.
-     *
-     * Public for unit tests only; production drives this via the
-     * EventBusService.onInProcess subscription installed in {@link start}.
-     */
-    async handle(event) {
-        // Q5 LOCKED — loop-prevention fence. NEVER forward an event that
-        // itself arrived from cloud. Without this, the inbound bridge ↔
-        // forwarder pair would form an infinite ping-pong loop.
-        if (event.source === 'remote') {
-            return;
-        }
-        // Allow-list gate (Q1 LOCKED).
-        if (!this.allowList.has(event.type)) {
-            return;
-        }
-        const payload = {
-            event: {
-                id: event.id,
-                type: event.type,
-                sessionName: event.sessionName,
-                timestamp: event.timestamp,
-                // Pass through the rest of the AgentEvent so the inbound
-                // bridge on the peer device sees the full picture (workItemId,
-                // missionId, requestId, etc.). `source` and `originDeviceId`
-                // are NOT included — the receiving bridge stamps those from
-                // the message envelope so the contract stays symmetric.
-                ...stripCrossMachineFields(event),
-            },
-            originDeviceId: this.originDeviceId,
-            originDeviceName: this.originDeviceName,
-        };
-        try {
-            await this.cloudSync.sendMessage(BROADCAST_TARGET, 'event', payload);
-            this.logger.debug('CloudEventForwarder broadcast', {
-                eventId: event.id,
-                eventType: event.type,
-            });
-        }
-        catch (err) {
-            // Failure is non-fatal — local processing already happened. We
-            // log + drop. A future enhancement could buffer + retry, but v1
-            // trusts the cloud queue's TTL semantics (see decomp §(c)
-            // errors table).
-            this.logger.warn('CloudEventForwarder broadcast failed', {
-                eventId: event.id,
-                eventType: event.type,
-                error: formatError(err),
-            });
-        }
-    }
-    /**
-     * Resolve the allow-list. Order:
-     *   1. `allowListOverride` (test injection).
-     *   2. `<projectPath>/crewly.json` `crossMachineEvents` array.
-     *   3. Empty (no-op forwarder) — fail-safe default.
-     *
-     * Malformed JSON or non-array `crossMachineEvents` → empty + error log.
-     * NEVER defaults to "forward everything" — privacy + DoS containment.
-     */
-    async resolveAllowList() {
-        if (this.allowListOverride) {
-            return new Set(this.allowListOverride);
-        }
-        const configPath = path.join(this.projectPath, 'crewly.json');
-        try {
-            const raw = await fs.readFile(configPath, 'utf-8');
-            const parsed = JSON.parse(raw);
-            const value = parsed.crossMachineEvents;
-            if (value === undefined || value === null)
-                return new Set();
-            if (!Array.isArray(value)) {
-                this.logger.error('crewly.json `crossMachineEvents` must be an array — falling back to empty allow-list (no events will forward)', { configPath, actualType: typeof value });
-                return new Set();
-            }
-            const cleaned = value.filter((v) => typeof v === 'string' && v.length > 0);
-            if (cleaned.length !== value.length) {
-                this.logger.warn('crewly.json `crossMachineEvents` contains non-string entries — dropped', { configPath, kept: cleaned, droppedCount: value.length - cleaned.length });
-            }
-            return new Set(cleaned);
-        }
-        catch (err) {
-            const code = err.code;
-            if (code === 'ENOENT') {
-                // File simply doesn't exist — silent default to empty.
-                return new Set();
-            }
-            this.logger.error('Failed to read crewly.json — falling back to empty allow-list (no events will forward)', { configPath, error: formatError(err) });
-            return new Set();
-        }
-    }
-}
-/**
- * Strip the cross-machine origin fields off an event before serialising
- * onto the wire. The receiving bridge stamps `source` + `originDeviceId`
- * from the message envelope — including them in the payload would let
- * the wire mutate them mid-flight.
- */
-function stripCrossMachineFields(event) {
-    // Shallow copy + drop the two fields. `id`, `type`, `sessionName`,
-    // `timestamp` are added back explicitly by the caller (above) so we
-    // don't double-spread them.
-    const out = { ...event };
-    delete out.source;
-    delete out.originDeviceId;
-    delete out.id;
-    delete out.type;
-    delete out.sessionName;
-    delete out.timestamp;
-    return out;
-}
-//# sourceMappingURL=cloud-event-forwarder.service.js.map