reviewflow 3.32.0 → 3.34.0

package/dist/modules/platform-integration/interface-adapters/gateways/memberAccess.gitlab.cli.gateway.d.ts

@@ -0,0 +1,31 @@
+import type { MemberAccessGateway } from '../../../../modules/platform-integration/entities/memberAccess/memberAccess.gateway.js';
+import { type ResolvedAccessLevel } from '../../../../modules/platform-integration/entities/memberAccess/memberAccess.js';
+export type CommandExecutor = (command: string) => string;
+export interface GitLabMemberAccessOptions {
+    ttlMs: number;
+    clock: () => number;
+}
+/**
+ * Cached, fail-closed GitLab membership resolver (SPEC-197).
+ *
+ * Resolves the actor's numeric id via the Users API (`/users?username=`) then the
+ * project membership via the Members API (`/projects/:id/members/all/:user_id`),
+ * both through the injected authenticated glab executor. Results are cached per
+ * username with a TTL. Every failure mode — lookup error, timeout, ambiguous match
+ * (more than one user), unknown username (empty list), non-member, or an
+ * access_level outside the known scale — resolves to `null` (non-trusted). The
+ * cache keys strictly on username, so a trusted result for one actor never widens
+ * trust for another (AC5).
+ */
+export declare class GitLabMemberAccessCliGateway implements MemberAccessGateway {
+    private readonly executor;
+    private readonly cache;
+    private readonly ttlMs;
+    private readonly clock;
+    constructor(executor: CommandExecutor, options?: Partial<GitLabMemberAccessOptions>);
+    resolve(projectPath: string, username: string): Promise<ResolvedAccessLevel>;
+    private lookup;
+    private resolveUserId;
+    private resolveMembership;
+}
+//# sourceMappingURL=memberAccess.gitlab.cli.gateway.d.ts.map

package/dist/modules/platform-integration/interface-adapters/gateways/memberAccess.gitlab.cli.gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memberAccess.gitlab.cli.gateway.d.ts","sourceRoot":"","sources":["../../../../../src/modules/platform-integration/interface-adapters/gateways/memberAccess.gitlab.cli.gateway.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACxH,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,sEAAsE,CAAC;AAE9E,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;AAE1D,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,MAAM,CAAC;CACrB;AAuBD;;;;;;;;;;;GAWG;AACH,qBAAa,4BAA6B,YAAW,mBAAmB;IAMpE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAL3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;gBAGlB,QAAQ,EAAE,eAAe,EAC1C,OAAO,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC;IAMxC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAYlF,OAAO,CAAC,MAAM;IAQd,OAAO,CAAC,aAAa;IAcrB,OAAO,CAAC,iBAAiB;CAe1B"}

package/dist/modules/platform-integration/interface-adapters/gateways/memberAccess.gitlab.cli.gateway.js

@@ -0,0 +1,83 @@
+import { z } from 'zod';
+import { MEMBER_ACCESS_LEVELS, } from '../../../../modules/platform-integration/entities/memberAccess/memberAccess.js';
+const DEFAULT_TTL_MS = 5 * 60 * 1000;
+const gitLabUserSchema = z.object({ id: z.number().int() });
+const gitLabUserListSchema = z.array(gitLabUserSchema);
+const gitLabMemberSchema = z.object({ access_level: z.number().int() });
+const KNOWN_ACCESS_LEVELS = new Set(Object.values(MEMBER_ACCESS_LEVELS));
+function toKnownAccessLevel(value) {
+    if (!KNOWN_ACCESS_LEVELS.has(value)) {
+        return null;
+    }
+    const known = Object.values(MEMBER_ACCESS_LEVELS).find((level) => level === value);
+    return known ?? null;
+}
+/**
+ * Cached, fail-closed GitLab membership resolver (SPEC-197).
+ *
+ * Resolves the actor's numeric id via the Users API (`/users?username=`) then the
+ * project membership via the Members API (`/projects/:id/members/all/:user_id`),
+ * both through the injected authenticated glab executor. Results are cached per
+ * username with a TTL. Every failure mode — lookup error, timeout, ambiguous match
+ * (more than one user), unknown username (empty list), non-member, or an
+ * access_level outside the known scale — resolves to `null` (non-trusted). The
+ * cache keys strictly on username, so a trusted result for one actor never widens
+ * trust for another (AC5).
+ */
+export class GitLabMemberAccessCliGateway {
+    executor;
+    cache = new Map();
+    ttlMs;
+    clock;
+    constructor(executor, options) {
+        this.executor = executor;
+        this.ttlMs = options?.ttlMs ?? DEFAULT_TTL_MS;
+        this.clock = options?.clock ?? (() => Date.now());
+    }
+    async resolve(projectPath, username) {
+        const cacheKey = `${projectPath} ${username}`;
+        const cached = this.cache.get(cacheKey);
+        if (cached && cached.expiresAt > this.clock()) {
+            return cached.accessLevel;
+        }
+        const accessLevel = this.lookup(projectPath, username);
+        this.cache.set(cacheKey, { accessLevel, expiresAt: this.clock() + this.ttlMs });
+        return accessLevel;
+    }
+    lookup(projectPath, username) {
+        const userId = this.resolveUserId(username);
+        if (userId === null) {
+            return null;
+        }
+        return this.resolveMembership(projectPath, userId);
+    }
+    resolveUserId(username) {
+        try {
+            const encodedUsername = encodeURIComponent(username);
+            const response = this.executor(`glab api users?username=${encodedUsername}`);
+            const parsed = gitLabUserListSchema.safeParse(JSON.parse(response));
+            if (!parsed.success || parsed.data.length !== 1) {
+                return null;
+            }
+            return parsed.data[0].id;
+        }
+        catch {
+            return null;
+        }
+    }
+    resolveMembership(projectPath, userId) {
+        try {
+            const encodedProject = projectPath.replace(/\//g, '%2F');
+            const response = this.executor(`glab api projects/${encodedProject}/members/all/${userId}`);
+            const parsed = gitLabMemberSchema.safeParse(JSON.parse(response));
+            if (!parsed.success) {
+                return null;
+            }
+            return toKnownAccessLevel(parsed.data.access_level);
+        }
+        catch {
+            return null;
+        }
+    }
+}
+//# sourceMappingURL=memberAccess.gitlab.cli.gateway.js.map

package/dist/modules/platform-integration/interface-adapters/gateways/memberAccess.gitlab.cli.gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memberAccess.gitlab.cli.gateway.js","sourceRoot":"","sources":["../../../../../src/modules/platform-integration/interface-adapters/gateways/memberAccess.gitlab.cli.gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,oBAAoB,GAGrB,MAAM,sEAAsE,CAAC;AAS9E,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAErC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC5D,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACvD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAExE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;AAOjF,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACnF,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,4BAA4B;IAMpB;IALF,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtC,KAAK,CAAS;IACd,KAAK,CAAe;IAErC,YACmB,QAAyB,EAC1C,OAA4C;QAD3B,aAAQ,GAAR,QAAQ,CAAiB;QAG1C,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,cAAc,CAAC;QAC9C,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,QAAgB;QACjD,MAAM,QAAQ,GAAG,GAAG,WAAW,IAAI,QAAQ,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAC9C,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAChF,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,WAAmB,EAAE,QAAgB;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAEO,aAAa,CAAC,QAAgB;QACpC,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,2BAA2B,eAAe,EAAE,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,WAAmB,EAAE,MAAc;QAC3D,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAC5B,qBAAqB,cAAc,gBAAgB,MAAM,EAAE,CAC5D,CAAC;YACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/modules/platform-integration/interface-adapters/gateways/scopedGitLabExecutor.d.ts

@@ -0,0 +1,17 @@
+import { type ExecutorFileWriter, type ScopedExecutorEnv } from '../../../../modules/platform-integration/services/scopedExecutorEnvironment.js';
+import type { CommandExecutor } from '../../../../modules/platform-integration/interface-adapters/gateways/threadFetch.gitlab.gateway.js';
+export type ScopedSpawn = (command: string, env: ScopedExecutorEnv, cwd: string) => string;
+export interface CreateScopedGitLabExecutorInput {
+    parentEnv: Record<string, string | undefined>;
+    isolatedDir: string;
+    fileWriter: ExecutorFileWriter;
+    spawn: ScopedSpawn;
+}
+/**
+ * Builds a CommandExecutor whose GitLab credential is a dedicated service token (AC1,
+ * fail-closed at construction), whose process env is an allowlist with the token never
+ * present (AC2/AC3), and which runs against an isolated HOME/GLAB_CONFIG_DIR holding the
+ * token in its own glab config file (AC4). Never inherits the ambient admin token.
+ */
+export declare function createScopedGitLabExecutor(input: CreateScopedGitLabExecutorInput): CommandExecutor;
+//# sourceMappingURL=scopedGitLabExecutor.d.ts.map

package/dist/modules/platform-integration/interface-adapters/gateways/scopedGitLabExecutor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopedGitLabExecutor.d.ts","sourceRoot":"","sources":["../../../../../src/modules/platform-integration/interface-adapters/gateways/scopedGitLabExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,sEAAsE,CAAA;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0FAA0F,CAAA;AAE/H,MAAM,MAAM,WAAW,GAAG,CACxB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,iBAAiB,EACtB,GAAG,EAAE,MAAM,KACR,MAAM,CAAA;AAEX,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,kBAAkB,CAAA;IAC9B,KAAK,EAAE,WAAW,CAAA;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,+BAA+B,GACrC,eAAe,CAUjB"}

package/dist/modules/platform-integration/interface-adapters/gateways/scopedGitLabExecutor.js

@@ -0,0 +1,17 @@
+import { buildScopedExecutorEnvironment, } from '../../../../modules/platform-integration/services/scopedExecutorEnvironment.js';
+/**
+ * Builds a CommandExecutor whose GitLab credential is a dedicated service token (AC1,
+ * fail-closed at construction), whose process env is an allowlist with the token never
+ * present (AC2/AC3), and which runs against an isolated HOME/GLAB_CONFIG_DIR holding the
+ * token in its own glab config file (AC4). Never inherits the ambient admin token.
+ */
+export function createScopedGitLabExecutor(input) {
+    const { env } = buildScopedExecutorEnvironment({
+        parentEnv: input.parentEnv,
+        isolatedDir: input.isolatedDir,
+        fileWriter: input.fileWriter,
+    });
+    const cwd = env.HOME ?? input.isolatedDir;
+    return (command) => input.spawn(command, env, cwd);
+}
+//# sourceMappingURL=scopedGitLabExecutor.js.map

package/dist/modules/platform-integration/interface-adapters/gateways/scopedGitLabExecutor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopedGitLabExecutor.js","sourceRoot":"","sources":["../../../../../src/modules/platform-integration/interface-adapters/gateways/scopedGitLabExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,GAG/B,MAAM,sEAAsE,CAAA;AAgB7E;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAsC;IAEtC,MAAM,EAAE,GAAG,EAAE,GAAG,8BAA8B,CAAC;QAC7C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC,WAAW,CAAA;IAEzC,OAAO,CAAC,OAAe,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;AACpE,CAAC"}

package/dist/modules/platform-integration/interface-adapters/gateways/threadFetch.gitlab.gateway.d.ts

@@ -1,6 +1,12 @@
 import type { ThreadFetchGateway } from '../../../../modules/platform-integration/entities/threadFetch/threadFetch.gateway.js';
 import type { ReviewContextThread } from '../../../../modules/review-execution/entities/reviewContext/reviewContext.js';
 export type CommandExecutor = (command: string) => string;
+/**
+ * Fail-closed scoped GitLab executor (SPEC-196 AC1-AC4). Built lazily on first use so the
+ * dedicated service token is read at construction time; if absent it throws and no job is
+ * started. The token never enters the child env (AC3); it lives in an isolated glab config
+ * file under a per-process HOME/GLAB_CONFIG_DIR (AC4). Never inherits the ambient admin token.
+ */
 export declare const defaultGitLabExecutor: CommandExecutor;
 export declare class GitLabThreadFetchGateway implements ThreadFetchGateway {
     private readonly executor;

package/dist/modules/platform-integration/interface-adapters/gateways/threadFetch.gitlab.gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"threadFetch.gitlab.gateway.d.ts","sourceRoot":"","sources":["../../../../../src/modules/platform-integration/interface-adapters/gateways/threadFetch.gitlab.gateway.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4EAA4E,CAAA;AACpH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oEAAoE,CAAA;AAE7G,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAA;AAEzD,eAAO,MAAM,qBAAqB,EAAE,eAEnC,CAAA;AAmBD,qBAAa,wBAAyB,YAAW,kBAAkB;IACrD,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,eAAe;IAEtD,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,GAAG,mBAAmB,EAAE;CAwBrF"}
+{"version":3,"file":"threadFetch.gitlab.gateway.d.ts","sourceRoot":"","sources":["../../../../../src/modules/platform-integration/interface-adapters/gateways/threadFetch.gitlab.gateway.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4EAA4E,CAAA;AACpH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oEAAoE,CAAA;AAI7G,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAA;AAczD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,eAWnC,CAAA;AAmBD,qBAAa,wBAAyB,YAAW,kBAAkB;IACrD,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,eAAe;IAEtD,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,GAAG,mBAAmB,EAAE;CAwBrF"}

package/dist/modules/platform-integration/interface-adapters/gateways/threadFetch.gitlab.gateway.js

@@ -1,6 +1,33 @@
 import { execSync } from 'node:child_process';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { tmpdir } from 'node:os';
+import { createScopedGitLabExecutor } from '../../../../modules/platform-integration/interface-adapters/gateways/scopedGitLabExecutor.js';
+const realFileWriter = {
+    write(path, contents) {
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, contents, { mode: 0o600 });
+    },
+};
+const scopedSpawn = (command, env, cwd) => execSync(command, { encoding: 'utf-8', timeout: 30000, env, cwd });
+let scopedExecutor = null;
+/**
+ * Fail-closed scoped GitLab executor (SPEC-196 AC1-AC4). Built lazily on first use so the
+ * dedicated service token is read at construction time; if absent it throws and no job is
+ * started. The token never enters the child env (AC3); it lives in an isolated glab config
+ * file under a per-process HOME/GLAB_CONFIG_DIR (AC4). Never inherits the ambient admin token.
+ */
 export const defaultGitLabExecutor = (command) => {
-    return execSync(command, { encoding: 'utf-8', timeout: 30000 });
+    if (scopedExecutor === null) {
+        const isolatedDir = `${tmpdir()}/reviewflow-executor-${process.pid}`;
+        scopedExecutor = createScopedGitLabExecutor({
+            parentEnv: process.env,
+            isolatedDir,
+            fileWriter: realFileWriter,
+            spawn: scopedSpawn,
+        });
+    }
+    return scopedExecutor(command);
 };
 export class GitLabThreadFetchGateway {
     executor;

package/dist/modules/platform-integration/interface-adapters/gateways/threadFetch.gitlab.gateway.js.map

@@ -1 +1 @@
-{"version":3,"file":"threadFetch.gitlab.gateway.js","sourceRoot":"","sources":["../../../../../src/modules/platform-integration/interface-adapters/gateways/threadFetch.gitlab.gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAM7C,MAAM,CAAC,MAAM,qBAAqB,GAAoB,CAAC,OAAe,EAAE,EAAE;IACxE,OAAO,QAAQ,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;AACjE,CAAC,CAAA;AAmBD,MAAM,OAAO,wBAAwB;IACN;IAA7B,YAA6B,QAAyB;QAAzB,aAAQ,GAAR,QAAQ,CAAiB;IAAG,CAAC;IAE1D,YAAY,CAAC,WAAmB,EAAE,kBAA0B;QAC1D,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAC5B,qBAAqB,cAAc,mBAAmB,kBAAkB,cAAc,CACvF,CAAA;QACD,MAAM,WAAW,GAAuB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAE5D,MAAM,OAAO,GAA0B,EAAE,CAAA;QAEzC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YACrC,IAAI,CAAC,SAAS,EAAE,UAAU;gBAAE,SAAQ;YAEpC,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI;gBAC1C,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI;gBAC1C,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;gBAChD,IAAI,EAAE,SAAS,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;CACF"}
+{"version":3,"file":"threadFetch.gitlab.gateway.js","sourceRoot":"","sources":["../../../../../src/modules/platform-integration/interface-adapters/gateways/threadFetch.gitlab.gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAGhC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oFAAoF,CAAA;AAK/H,MAAM,cAAc,GAAuB;IACzC,KAAK,CAAC,IAAY,EAAE,QAAgB;QAClC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7C,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAChD,CAAC;CACF,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,GAAsB,EAAE,GAAW,EAAU,EAAE,CACnF,QAAQ,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;AAEpE,IAAI,cAAc,GAA2B,IAAI,CAAA;AAEjD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAoB,CAAC,OAAe,EAAU,EAAE;IAChF,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,GAAG,MAAM,EAAE,wBAAwB,OAAO,CAAC,GAAG,EAAE,CAAA;QACpE,cAAc,GAAG,0BAA0B,CAAC;YAC1C,SAAS,EAAE,OAAO,CAAC,GAAG;YACtB,WAAW;YACX,UAAU,EAAE,cAAc;YAC1B,KAAK,EAAE,WAAW;SACnB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,OAAO,CAAC,CAAA;AAChC,CAAC,CAAA;AAmBD,MAAM,OAAO,wBAAwB;IACN;IAA7B,YAA6B,QAAyB;QAAzB,aAAQ,GAAR,QAAQ,CAAiB;IAAG,CAAC;IAE1D,YAAY,CAAC,WAAmB,EAAE,kBAA0B;QAC1D,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAC5B,qBAAqB,cAAc,mBAAmB,kBAAkB,cAAc,CACvF,CAAA;QACD,MAAM,WAAW,GAAuB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAE5D,MAAM,OAAO,GAA0B,EAAE,CAAA;QAEzC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YACrC,IAAI,CAAC,SAAS,EAAE,UAAU;gBAAE,SAAQ;YAEpC,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI;gBAC1C,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI;gBAC1C,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;gBAChD,IAAI,EAAE,SAAS,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;CACF"}

package/dist/modules/platform-integration/interface-adapters/gateways/transport/clientIpResolver.forwardedFor.gateway.d.ts

@@ -0,0 +1,5 @@
+import type { ClientIpResolutionInput, ClientIpResolver } from '../../../../../modules/platform-integration/entities/transport/clientIpResolver.gateway.js';
+export declare class ForwardedForClientIpResolver implements ClientIpResolver {
+    resolve(input: ClientIpResolutionInput): string | null;
+}
+//# sourceMappingURL=clientIpResolver.forwardedFor.gateway.d.ts.map

package/dist/modules/platform-integration/interface-adapters/gateways/transport/clientIpResolver.forwardedFor.gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientIpResolver.forwardedFor.gateway.d.ts","sourceRoot":"","sources":["../../../../../../src/modules/platform-integration/interface-adapters/gateways/transport/clientIpResolver.forwardedFor.gateway.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,gBAAgB,EACjB,MAAM,+EAA+E,CAAC;AAEvF,qBAAa,4BAA6B,YAAW,gBAAgB;IACnE,OAAO,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,GAAG,IAAI;CAgBvD"}

package/dist/modules/platform-integration/interface-adapters/gateways/transport/clientIpResolver.forwardedFor.gateway.js

@@ -0,0 +1,16 @@
+export class ForwardedForClientIpResolver {
+    resolve(input) {
+        if (!input.socketTrusted) {
+            return null;
+        }
+        if (input.forwardedFor === null) {
+            return null;
+        }
+        const leftmost = input.forwardedFor.split(',')[0]?.trim();
+        if (!leftmost) {
+            return null;
+        }
+        return leftmost;
+    }
+}
+//# sourceMappingURL=clientIpResolver.forwardedFor.gateway.js.map

package/dist/modules/platform-integration/interface-adapters/gateways/transport/clientIpResolver.forwardedFor.gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientIpResolver.forwardedFor.gateway.js","sourceRoot":"","sources":["../../../../../../src/modules/platform-integration/interface-adapters/gateways/transport/clientIpResolver.forwardedFor.gateway.ts"],"names":[],"mappings":"AAKA,MAAM,OAAO,4BAA4B;IACvC,OAAO,CAAC,KAA8B;QACpC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/modules/platform-integration/services/autoExecutorActionFilter.d.ts

@@ -0,0 +1,9 @@
+import type { ReviewAction } from '../../../modules/review-execution/entities/reviewAction/reviewAction.js';
+export type ActionCapability = 'readMr' | 'postComment' | 'threadResolve' | 'revoke' | 'addLabel';
+export declare function capabilityForAction(action: ReviewAction): ActionCapability;
+export interface AutoExecutorActionFilterResult {
+    allowed: ReviewAction[];
+    dropped: ReviewAction[];
+}
+export declare function filterAutoExecutorActions(actions: ReviewAction[]): AutoExecutorActionFilterResult;
+//# sourceMappingURL=autoExecutorActionFilter.d.ts.map

package/dist/modules/platform-integration/services/autoExecutorActionFilter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"autoExecutorActionFilter.d.ts","sourceRoot":"","sources":["../../../../src/modules/platform-integration/services/autoExecutorActionFilter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kEAAkE,CAAA;AAGpG,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,aAAa,GAAG,eAAe,GAAG,QAAQ,GAAG,UAAU,CAAA;AAEjG,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,gBAAgB,CAa1E;AAED,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,OAAO,EAAE,YAAY,EAAE,CAAA;CACxB;AASD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,8BAA8B,CAajG"}

package/dist/modules/platform-integration/services/autoExecutorActionFilter.js

@@ -0,0 +1,33 @@
+import { AUTO_EXECUTOR_CAPABILITIES } from '../../../modules/platform-integration/entities/executorToken/executorCapability.js';
+export function capabilityForAction(action) {
+    switch (action.type) {
+        case 'FETCH_THREADS':
+            return 'readMr';
+        case 'POST_COMMENT':
+        case 'THREAD_REPLY':
+        case 'POST_INLINE_COMMENT':
+            return 'postComment';
+        case 'THREAD_RESOLVE':
+            return 'threadResolve';
+        case 'ADD_LABEL':
+            return 'addLabel';
+    }
+}
+function isAutoCapability(capability) {
+    return ((capability === 'readMr' || capability === 'postComment') &&
+        AUTO_EXECUTOR_CAPABILITIES.has(capability));
+}
+export function filterAutoExecutorActions(actions) {
+    const allowed = [];
+    const dropped = [];
+    for (const action of actions) {
+        if (isAutoCapability(capabilityForAction(action))) {
+            allowed.push(action);
+        }
+        else {
+            dropped.push(action);
+        }
+    }
+    return { allowed, dropped };
+}
+//# sourceMappingURL=autoExecutorActionFilter.js.map

package/dist/modules/platform-integration/services/autoExecutorActionFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"autoExecutorActionFilter.js","sourceRoot":"","sources":["../../../../src/modules/platform-integration/services/autoExecutorActionFilter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,6EAA6E,CAAA;AAIxH,MAAM,UAAU,mBAAmB,CAAC,MAAoB;IACtD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,eAAe;YAClB,OAAO,QAAQ,CAAA;QACjB,KAAK,cAAc,CAAC;QACpB,KAAK,cAAc,CAAC;QACpB,KAAK,qBAAqB;YACxB,OAAO,aAAa,CAAA;QACtB,KAAK,gBAAgB;YACnB,OAAO,eAAe,CAAA;QACxB,KAAK,WAAW;YACd,OAAO,UAAU,CAAA;IACrB,CAAC;AACH,CAAC;AAOD,SAAS,gBAAgB,CAAC,UAA4B;IACpD,OAAO,CACL,CAAC,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,aAAa,CAAC;QACzD,0BAA0B,CAAC,GAAG,CAAC,UAAU,CAAC,CAC3C,CAAA;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAuB;IAC/D,MAAM,OAAO,GAAmB,EAAE,CAAA;IAClC,MAAM,OAAO,GAAmB,EAAE,CAAA;IAElC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AAC7B,CAAC"}

package/dist/modules/platform-integration/services/pinnedThreadFetchTarget.d.ts

@@ -0,0 +1,23 @@
+export interface PinnedThreadFetchTarget {
+    projectPath: string;
+    mrNumber: number;
+}
+interface ResolvedRepository {
+    projectPath: string;
+}
+export interface ResolvePinnedThreadFetchTargetInput {
+    payloadProjectPath: string;
+    payloadMrNumber: number;
+    findRepository: (projectPath: string) => ResolvedRepository | null | undefined;
+    gatedMrNumber: number | null;
+}
+/**
+ * Anchors the (projectPath, mrNumber) pair driving fetchThreads to a server-validated
+ * source (AC9). The forgeable webhook payload is never used as-is to widen scope:
+ * - projectPath MUST resolve to a configured repository.
+ * - mrNumber MUST equal the merge-request that passed the upstream trusted-actor gate.
+ * If either cannot be established, the action surface is empty (null, fail-closed).
+ */
+export declare function resolvePinnedThreadFetchTarget(input: ResolvePinnedThreadFetchTargetInput): PinnedThreadFetchTarget | null;
+export {};
+//# sourceMappingURL=pinnedThreadFetchTarget.d.ts.map

package/dist/modules/platform-integration/services/pinnedThreadFetchTarget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinnedThreadFetchTarget.d.ts","sourceRoot":"","sources":["../../../../src/modules/platform-integration/services/pinnedThreadFetchTarget.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,UAAU,kBAAkB;IAC1B,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,mCAAmC;IAClD,kBAAkB,EAAE,MAAM,CAAA;IAC1B,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,kBAAkB,GAAG,IAAI,GAAG,SAAS,CAAA;IAC9E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,mCAAmC,GACzC,uBAAuB,GAAG,IAAI,CAchC"}

package/dist/modules/platform-integration/services/pinnedThreadFetchTarget.js

@@ -0,0 +1,21 @@
+/**
+ * Anchors the (projectPath, mrNumber) pair driving fetchThreads to a server-validated
+ * source (AC9). The forgeable webhook payload is never used as-is to widen scope:
+ * - projectPath MUST resolve to a configured repository.
+ * - mrNumber MUST equal the merge-request that passed the upstream trusted-actor gate.
+ * If either cannot be established, the action surface is empty (null, fail-closed).
+ */
+export function resolvePinnedThreadFetchTarget(input) {
+    const repository = input.findRepository(input.payloadProjectPath);
+    if (!repository) {
+        return null;
+    }
+    if (input.gatedMrNumber === null || input.payloadMrNumber !== input.gatedMrNumber) {
+        return null;
+    }
+    return {
+        projectPath: repository.projectPath,
+        mrNumber: input.gatedMrNumber,
+    };
+}
+//# sourceMappingURL=pinnedThreadFetchTarget.js.map

package/dist/modules/platform-integration/services/pinnedThreadFetchTarget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinnedThreadFetchTarget.js","sourceRoot":"","sources":["../../../../src/modules/platform-integration/services/pinnedThreadFetchTarget.ts"],"names":[],"mappings":"AAgBA;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAA0C;IAE1C,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;IACjE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,IAAI,KAAK,CAAC,eAAe,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QAClF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO;QACL,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,QAAQ,EAAE,KAAK,CAAC,aAAa;KAC9B,CAAA;AACH,CAAC"}

package/dist/modules/platform-integration/services/scopedExecutorEnvironment.d.ts

@@ -0,0 +1,21 @@
+export declare const EXECUTOR_TOKEN_ENV_KEY = "REVIEWFLOW_EXECUTOR_TOKEN";
+export declare const ENV_ALLOWLIST: readonly ["PATH", "HOME", "GLAB_CONFIG_DIR", "LANG"];
+export type AllowlistedEnvKey = (typeof ENV_ALLOWLIST)[number];
+export type ScopedExecutorEnv = Partial<Record<AllowlistedEnvKey, string>>;
+export declare class MissingExecutorTokenError extends Error {
+    constructor();
+}
+export interface ExecutorFileWriter {
+    write(path: string, contents: string): void;
+}
+export interface BuildScopedExecutorEnvironmentInput {
+    parentEnv: Record<string, string | undefined>;
+    isolatedDir: string;
+    fileWriter: ExecutorFileWriter;
+}
+export interface ScopedExecutorEnvironment {
+    env: ScopedExecutorEnv;
+    configFilePath: string;
+}
+export declare function buildScopedExecutorEnvironment(input: BuildScopedExecutorEnvironmentInput): ScopedExecutorEnvironment;
+//# sourceMappingURL=scopedExecutorEnvironment.d.ts.map

package/dist/modules/platform-integration/services/scopedExecutorEnvironment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopedExecutorEnvironment.d.ts","sourceRoot":"","sources":["../../../../src/modules/platform-integration/services/scopedExecutorEnvironment.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,8BAA8B,CAAA;AAEjE,eAAO,MAAM,aAAa,sDAAuD,CAAA;AAEjF,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAA;AAE9D,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAA;AAE1E,qBAAa,yBAA0B,SAAQ,KAAK;;CAOnD;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5C;AAED,MAAM,WAAW,mCAAmC;IAClD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,kBAAkB,CAAA;CAC/B;AAED,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,iBAAiB,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;CACvB;AAYD,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,mCAAmC,GACzC,yBAAyB,CAwB3B"}

package/dist/modules/platform-integration/services/scopedExecutorEnvironment.js

@@ -0,0 +1,39 @@
+export const EXECUTOR_TOKEN_ENV_KEY = 'REVIEWFLOW_EXECUTOR_TOKEN';
+export const ENV_ALLOWLIST = ['PATH', 'HOME', 'GLAB_CONFIG_DIR', 'LANG'];
+export class MissingExecutorTokenError extends Error {
+    constructor() {
+        super(`Executor service token (${EXECUTOR_TOKEN_ENV_KEY}) is absent or empty; refusing to start with the ambient token.`);
+        this.name = 'MissingExecutorTokenError';
+    }
+}
+function renderGlabConfig(token) {
+    return [
+        'hosts:',
+        '  gitlab.com:',
+        `    token: ${token}`,
+        '    api_protocol: https',
+        '',
+    ].join('\n');
+}
+export function buildScopedExecutorEnvironment(input) {
+    const token = input.parentEnv[EXECUTOR_TOKEN_ENV_KEY]?.trim();
+    if (!token) {
+        throw new MissingExecutorTokenError();
+    }
+    const home = `${input.isolatedDir}/home`;
+    const glabConfigDir = `${input.isolatedDir}/glab-config`;
+    const env = {
+        HOME: home,
+        GLAB_CONFIG_DIR: glabConfigDir,
+    };
+    const path = input.parentEnv.PATH;
+    if (path)
+        env.PATH = path;
+    const lang = input.parentEnv.LANG;
+    if (lang)
+        env.LANG = lang;
+    const configFilePath = `${glabConfigDir}/glab-cli/config.yml`;
+    input.fileWriter.write(configFilePath, renderGlabConfig(token));
+    return { env, configFilePath };
+}
+//# sourceMappingURL=scopedExecutorEnvironment.js.map

package/dist/modules/platform-integration/services/scopedExecutorEnvironment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopedExecutorEnvironment.js","sourceRoot":"","sources":["../../../../src/modules/platform-integration/services/scopedExecutorEnvironment.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAA;AAEjE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,CAAU,CAAA;AAMjF,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD;QACE,KAAK,CACH,2BAA2B,sBAAsB,iEAAiE,CACnH,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AAiBD,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO;QACL,QAAQ;QACR,eAAe;QACf,cAAc,KAAK,EAAE;QACrB,yBAAyB;QACzB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,KAA0C;IAE1C,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAA;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,yBAAyB,EAAE,CAAA;IACvC,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,OAAO,CAAA;IACxC,MAAM,aAAa,GAAG,GAAG,KAAK,CAAC,WAAW,cAAc,CAAA;IAExD,MAAM,GAAG,GAAsB;QAC7B,IAAI,EAAE,IAAI;QACV,eAAe,EAAE,aAAa;KAC/B,CAAA;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAA;IACjC,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;IAEzB,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAA;IACjC,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;IAEzB,MAAM,cAAc,GAAG,GAAG,aAAa,sBAAsB,CAAA;IAC7D,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAA;IAE/D,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,CAAA;AAChC,CAAC"}

package/dist/modules/platform-integration/usecases/isTrustedActor.usecase.d.ts

@@ -0,0 +1,17 @@
+import type { MemberAccessGateway } from '../../../modules/platform-integration/entities/memberAccess/memberAccess.gateway.js';
+export interface IsTrustedActorInput {
+    username: string;
+    projectPath: string;
+}
+/**
+ * Decides whether the trigger actor is a trusted (Developer+) member of the target
+ * project (SPEC-197). Consumes the fail-closed MemberAccessGateway: any resolution
+ * failure or sub-Developer level collapses to non-trusted, so a thrown lookup never
+ * widens trust.
+ */
+export declare class IsTrustedActorUseCase {
+    private readonly memberAccessGateway;
+    constructor(memberAccessGateway: MemberAccessGateway);
+    execute(input: IsTrustedActorInput): Promise<boolean>;
+}
+//# sourceMappingURL=isTrustedActor.usecase.d.ts.map

package/dist/modules/platform-integration/usecases/isTrustedActor.usecase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isTrustedActor.usecase.d.ts","sourceRoot":"","sources":["../../../../src/modules/platform-integration/usecases/isTrustedActor.usecase.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AAGxH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,qBAAa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;gBAAnB,mBAAmB,EAAE,mBAAmB;IAE/D,OAAO,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;CAQ5D"}

package/dist/modules/platform-integration/usecases/isTrustedActor.usecase.js

@@ -0,0 +1,23 @@
+import { isDeveloperOrAbove } from '../../../modules/platform-integration/entities/memberAccess/memberAccess.js';
+/**
+ * Decides whether the trigger actor is a trusted (Developer+) member of the target
+ * project (SPEC-197). Consumes the fail-closed MemberAccessGateway: any resolution
+ * failure or sub-Developer level collapses to non-trusted, so a thrown lookup never
+ * widens trust.
+ */
+export class IsTrustedActorUseCase {
+    memberAccessGateway;
+    constructor(memberAccessGateway) {
+        this.memberAccessGateway = memberAccessGateway;
+    }
+    async execute(input) {
+        try {
+            const accessLevel = await this.memberAccessGateway.resolve(input.projectPath, input.username);
+            return isDeveloperOrAbove(accessLevel);
+        }
+        catch {
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=isTrustedActor.usecase.js.map

package/dist/modules/platform-integration/usecases/isTrustedActor.usecase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isTrustedActor.usecase.js","sourceRoot":"","sources":["../../../../src/modules/platform-integration/usecases/isTrustedActor.usecase.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sEAAsE,CAAC;AAO1G;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IACH;IAA7B,YAA6B,mBAAwC;QAAxC,wBAAmB,GAAnB,mBAAmB,CAAqB;IAAG,CAAC;IAEzE,KAAK,CAAC,OAAO,CAAC,KAA0B;QACtC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC9F,OAAO,kBAAkB,CAAC,WAAW,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/modules/platform-integration/usecases/transport/evaluateTransport.usecase.d.ts

@@ -0,0 +1,3 @@
+import type { TransportContext, TransportDecision } from '../../../../modules/platform-integration/entities/transport/transportContext.js';
+export declare function evaluateTransport(context: TransportContext): TransportDecision;
+//# sourceMappingURL=evaluateTransport.usecase.d.ts.map

package/dist/modules/platform-integration/usecases/transport/evaluateTransport.usecase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluateTransport.usecase.d.ts","sourceRoot":"","sources":["../../../../../src/modules/platform-integration/usecases/transport/evaluateTransport.usecase.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,uEAAuE,CAAC;AAK/E,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,GAAG,iBAAiB,CAmB9E"}

package/dist/modules/platform-integration/usecases/transport/evaluateTransport.usecase.js

@@ -0,0 +1,18 @@
+import { isIpInCidr } from '../../../../modules/platform-integration/entities/transport/cidr.js';
+const REJECT_STATUS = 403;
+export function evaluateTransport(context) {
+    if (context.directSocketAddress !== context.trustedHopAddress) {
+        return { kind: 'reject', status: REJECT_STATUS, reason: 'untrusted-socket' };
+    }
+    if (context.forwardedProto !== 'https') {
+        return { kind: 'reject', status: REJECT_STATUS, reason: 'non-https' };
+    }
+    const clientIp = context.resolvedClientIp;
+    const allowed = clientIp !== null &&
+        context.allowedCidrRanges.some((range) => isIpInCidr(clientIp, range));
+    if (!allowed) {
+        return { kind: 'reject', status: REJECT_STATUS, reason: 'off-allowlist' };
+    }
+    return { kind: 'accept' };
+}
+//# sourceMappingURL=evaluateTransport.usecase.js.map

package/dist/modules/platform-integration/usecases/transport/evaluateTransport.usecase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluateTransport.usecase.js","sourceRoot":"","sources":["../../../../../src/modules/platform-integration/usecases/transport/evaluateTransport.usecase.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AAEvF,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,UAAU,iBAAiB,CAAC,OAAyB;IACzD,IAAI,OAAO,CAAC,mBAAmB,KAAK,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC/E,CAAC;IAED,IAAI,OAAO,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACxE,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAC1C,MAAM,OAAO,GACX,QAAQ,KAAK,IAAI;QACjB,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAEzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC5E,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC"}

package/dist/modules/review-execution/entities/actionProvenance/actionProvenance.d.ts

@@ -0,0 +1,9 @@
+export type Provenance = 'trusted' | 'untrusted';
+/**
+ * Fail-closed provenance resolver.
+ * Only the exact canonical token resolves to `trusted`; every other value
+ * (including casing, padding, non-string types, null/undefined) is `untrusted`.
+ * `trusted` is NEVER derived from a payload field.
+ */
+export declare function resolveProvenance(value: unknown): Provenance;
+//# sourceMappingURL=actionProvenance.d.ts.map

package/dist/modules/review-execution/entities/actionProvenance/actionProvenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionProvenance.d.ts","sourceRoot":"","sources":["../../../../../src/modules/review-execution/entities/actionProvenance/actionProvenance.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,WAAW,CAAA;AAIhD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAE5D"}

package/dist/modules/review-execution/entities/actionProvenance/actionProvenance.js

@@ -0,0 +1,11 @@
+const CANONICAL_TRUSTED = 'trusted';
+/**
+ * Fail-closed provenance resolver.
+ * Only the exact canonical token resolves to `trusted`; every other value
+ * (including casing, padding, non-string types, null/undefined) is `untrusted`.
+ * `trusted` is NEVER derived from a payload field.
+ */
+export function resolveProvenance(value) {
+    return value === CANONICAL_TRUSTED ? 'trusted' : 'untrusted';
+}
+//# sourceMappingURL=actionProvenance.js.map

package/dist/modules/review-execution/entities/actionProvenance/actionProvenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionProvenance.js","sourceRoot":"","sources":["../../../../../src/modules/review-execution/entities/actionProvenance/actionProvenance.ts"],"names":[],"mappings":"AAEA,MAAM,iBAAiB,GAAG,SAAS,CAAA;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,KAAK,KAAK,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAA;AAC9D,CAAC"}

package/dist/modules/review-execution/entities/threadInventory/threadInventory.gateway.d.ts

@@ -0,0 +1,13 @@
+export interface ThreadInventoryPage {
+    page: number;
+    totalPages: number;
+    threadIds: string[];
+}
+/**
+ * Authenticated, page-by-page access to the current MR's thread inventory.
+ * Each page carries its own `totalPages` so the resolver can prove completeness.
+ */
+export interface ThreadInventoryGateway {
+    fetchPage(projectPath: string, mergeRequestNumber: number, page: number): ThreadInventoryPage;
+}
+//# sourceMappingURL=threadInventory.gateway.d.ts.map

package/dist/modules/review-execution/entities/threadInventory/threadInventory.gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"threadInventory.gateway.d.ts","sourceRoot":"","sources":["../../../../../src/modules/review-execution/entities/threadInventory/threadInventory.gateway.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAAA;CAC9F"}

package/dist/modules/review-execution/entities/threadInventory/threadInventory.gateway.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=threadInventory.gateway.js.map

package/dist/modules/review-execution/entities/threadInventory/threadInventory.gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"threadInventory.gateway.js","sourceRoot":"","sources":["../../../../../src/modules/review-execution/entities/threadInventory/threadInventory.gateway.ts"],"names":[],"mappings":""}

package/dist/modules/review-execution/interface-adapters/gateways/threadInventory.gitlab.gateway.d.ts

@@ -0,0 +1,14 @@
+import type { ThreadInventoryGateway, ThreadInventoryPage } from '../../../../modules/review-execution/entities/threadInventory/threadInventory.gateway.js';
+export type CommandExecutor = (command: string) => string;
+/**
+ * Authenticated GitLab Threads (discussions) inventory access.
+ *
+ * Issues `glab api -i` so the response carries the `X-Total-Pages` header used by the
+ * resolver to prove pagination completeness (complete-or-empty, fail-closed).
+ */
+export declare class GitLabThreadInventoryGateway implements ThreadInventoryGateway {
+    private readonly executor;
+    constructor(executor: CommandExecutor);
+    fetchPage(projectPath: string, mergeRequestNumber: number, page: number): ThreadInventoryPage;
+}
+//# sourceMappingURL=threadInventory.gitlab.gateway.d.ts.map