reviewflow 3.32.0 → 3.34.0

package/dist/modules/review-execution/interface-adapters/gateways/threadInventory.gitlab.gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"threadInventory.gitlab.gateway.d.ts","sourceRoot":"","sources":["../../../../../src/modules/review-execution/interface-adapters/gateways/threadInventory.gitlab.gateway.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,gFAAgF,CAAA;AAEvF,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAA;AAazD;;;;;GAKG;AACH,qBAAa,4BAA6B,YAAW,sBAAsB;IAC7D,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,eAAe;IAEtD,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,mBAAmB;CAkB9F"}

package/dist/modules/review-execution/interface-adapters/gateways/threadInventory.gitlab.gateway.js

@@ -0,0 +1,31 @@
+const HEADER_BODY_SEPARATOR = '\r\n\r\n';
+function parseTotalPages(headers) {
+    const match = headers.match(/x-total-pages:\s*(\d+)/i);
+    return match ? Number.parseInt(match[1], 10) : 1;
+}
+/**
+ * Authenticated GitLab Threads (discussions) inventory access.
+ *
+ * Issues `glab api -i` so the response carries the `X-Total-Pages` header used by the
+ * resolver to prove pagination completeness (complete-or-empty, fail-closed).
+ */
+export class GitLabThreadInventoryGateway {
+    executor;
+    constructor(executor) {
+        this.executor = executor;
+    }
+    fetchPage(projectPath, mergeRequestNumber, page) {
+        const encodedProject = projectPath.replace(/\//g, '%2F');
+        const raw = this.executor(`glab api -i "projects/${encodedProject}/merge_requests/${mergeRequestNumber}/discussions?page=${page}&per_page=100"`);
+        const separatorIndex = raw.indexOf(HEADER_BODY_SEPARATOR);
+        const headers = separatorIndex === -1 ? '' : raw.slice(0, separatorIndex);
+        const body = separatorIndex === -1 ? raw : raw.slice(separatorIndex + HEADER_BODY_SEPARATOR.length);
+        const discussions = JSON.parse(body);
+        return {
+            page,
+            totalPages: parseTotalPages(headers),
+            threadIds: discussions.map(discussion => discussion.id),
+        };
+    }
+}
+//# sourceMappingURL=threadInventory.gitlab.gateway.js.map

package/dist/modules/review-execution/interface-adapters/gateways/threadInventory.gitlab.gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"threadInventory.gitlab.gateway.js","sourceRoot":"","sources":["../../../../../src/modules/review-execution/interface-adapters/gateways/threadInventory.gitlab.gateway.ts"],"names":[],"mappings":"AAWA,MAAM,qBAAqB,GAAG,UAAU,CAAA;AAExC,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAA;IACtD,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,4BAA4B;IACV;IAA7B,YAA6B,QAAyB;QAAzB,aAAQ,GAAR,QAAQ,CAAiB;IAAG,CAAC;IAE1D,SAAS,CAAC,WAAmB,EAAE,kBAA0B,EAAE,IAAY;QACrE,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CACvB,yBAAyB,cAAc,mBAAmB,kBAAkB,qBAAqB,IAAI,gBAAgB,CACtH,CAAA;QAED,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAA;QACzD,MAAM,OAAO,GAAG,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAA;QACzE,MAAM,IAAI,GAAG,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;QAEnG,MAAM,WAAW,GAAuB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAExD,OAAO;YACL,IAAI;YACJ,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC;YACpC,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;SACxD,CAAA;IACH,CAAC;CACF"}

package/dist/modules/review-execution/services/constrainActionSurface.d.ts

@@ -0,0 +1,19 @@
+import type { ReviewAction } from '../../../modules/review-execution/entities/reviewAction/reviewAction.js';
+import type { Provenance } from '../../../modules/review-execution/entities/actionProvenance/actionProvenance.js';
+export interface ActionSurfaceConstraints {
+    provenance: Provenance;
+    threadInventory: ReadonlySet<string>;
+}
+/**
+ * Bounds the executable write surface derived from LLM output.
+ *
+ * - `POST_COMMENT` is always allowed (the only untrusted write verb).
+ * - `FETCH_THREADS` is allowed only for `trusted` provenance (read-amplification gate).
+ * - `THREAD_RESOLVE` / `THREAD_REPLY` require BOTH `trusted` provenance AND the (trimmed)
+ *   target id being a member of the authenticated MR thread inventory.
+ * - Any other verb is dropped.
+ *
+ * Membership is computed from the passed inventory only, never from token text.
+ */
+export declare function constrainActionSurface(actions: ReviewAction[], constraints: ActionSurfaceConstraints): ReviewAction[];
+//# sourceMappingURL=constrainActionSurface.d.ts.map

package/dist/modules/review-execution/services/constrainActionSurface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constrainActionSurface.d.ts","sourceRoot":"","sources":["../../../../src/modules/review-execution/services/constrainActionSurface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kEAAkE,CAAA;AACpG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0EAA0E,CAAA;AAE1G,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACrC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,YAAY,EAAE,EACvB,WAAW,EAAE,wBAAwB,GACpC,YAAY,EAAE,CAwChB"}

package/dist/modules/review-execution/services/constrainActionSurface.js

@@ -0,0 +1,49 @@
+/**
+ * Bounds the executable write surface derived from LLM output.
+ *
+ * - `POST_COMMENT` is always allowed (the only untrusted write verb).
+ * - `FETCH_THREADS` is allowed only for `trusted` provenance (read-amplification gate).
+ * - `THREAD_RESOLVE` / `THREAD_REPLY` require BOTH `trusted` provenance AND the (trimmed)
+ *   target id being a member of the authenticated MR thread inventory.
+ * - Any other verb is dropped.
+ *
+ * Membership is computed from the passed inventory only, never from token text.
+ */
+export function constrainActionSurface(actions, constraints) {
+    const { provenance, threadInventory } = constraints;
+    const isTrusted = provenance === 'trusted';
+    const constrained = [];
+    for (const action of actions) {
+        switch (action.type) {
+            case 'POST_COMMENT':
+                constrained.push(action);
+                break;
+            case 'FETCH_THREADS':
+                if (isTrusted)
+                    constrained.push(action);
+                break;
+            case 'THREAD_RESOLVE': {
+                if (!isTrusted)
+                    break;
+                const target = action.threadId.trim();
+                if (threadInventory.has(target)) {
+                    constrained.push({ ...action, threadId: target });
+                }
+                break;
+            }
+            case 'THREAD_REPLY': {
+                if (!isTrusted)
+                    break;
+                const target = action.threadId.trim();
+                if (threadInventory.has(target)) {
+                    constrained.push({ ...action, threadId: target });
+                }
+                break;
+            }
+            default:
+                break;
+        }
+    }
+    return constrained;
+}
+//# sourceMappingURL=constrainActionSurface.js.map

package/dist/modules/review-execution/services/constrainActionSurface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constrainActionSurface.js","sourceRoot":"","sources":["../../../../src/modules/review-execution/services/constrainActionSurface.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAuB,EACvB,WAAqC;IAErC,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,WAAW,CAAA;IACnD,MAAM,SAAS,GAAG,UAAU,KAAK,SAAS,CAAA;IAE1C,MAAM,WAAW,GAAmB,EAAE,CAAA;IAEtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,cAAc;gBACjB,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;gBACxB,MAAK;YAEP,KAAK,eAAe;gBAClB,IAAI,SAAS;oBAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;gBACvC,MAAK;YAEP,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,IAAI,CAAC,SAAS;oBAAE,MAAK;gBACrB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;gBACrC,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChC,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;gBACnD,CAAC;gBACD,MAAK;YACP,CAAC;YAED,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,IAAI,CAAC,SAAS;oBAAE,MAAK;gBACrB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;gBACrC,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChC,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;gBACnD,CAAC;gBACD,MAAK;YACP,CAAC;YAED;gBACE,MAAK;QACT,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAA;AACpB,CAAC"}

package/dist/modules/review-execution/services/contextActionsExecutor.d.ts

@@ -1,6 +1,7 @@
 import type { ReviewContext } from '../../../modules/review-execution/entities/reviewContext/reviewContext.js';
 import type { ReviewAction } from '../../../modules/review-execution/entities/reviewAction/reviewAction.js';
 import type { ExecutionResult, CommandExecutor } from '../../../modules/review-execution/entities/reviewAction/reviewAction.gateway.js';
+import type { NoteCommentPostGateway } from '../../../modules/platform-integration/entities/noteComment/noteCommentPost.gateway.js';
 /**
  * @deprecated Use ReviewContextAction from reviewAction entity instead
  */
@@ -15,5 +16,5 @@ interface Logger {
 /**
  * @deprecated Use GitLabReviewActionCliGateway or GitHubReviewActionCliGateway directly
  */
-export declare function executeActionsFromContext(context: ReviewContext, localPath: string, _logger: Logger, executor: CommandExecutor, baseUrl?: string | null): Promise<ExecutionResult>;
+export declare function executeActionsFromContext(context: ReviewContext, localPath: string, logger: Logger, executor: CommandExecutor, baseUrl?: string | null, postGateway?: NoteCommentPostGateway | null): Promise<ExecutionResult>;
 //# sourceMappingURL=contextActionsExecutor.d.ts.map

package/dist/modules/review-execution/services/contextActionsExecutor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contextActionsExecutor.d.ts","sourceRoot":"","sources":["../../../../src/modules/review-execution/services/contextActionsExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oEAAoE,CAAA;AACvG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kEAAkE,CAAA;AAGpG,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,0EAA0E,CAAA;AAEhI;;GAEG;AACH,YAAY,EAAE,YAAY,IAAI,mBAAmB,EAAE,CAAA;AAEnD,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,CAAA;AAEhD,UAAU,MAAM;IACd,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IACxC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IACxC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IACzC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAC1C;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,aAAa,EACtB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,eAAe,EACzB,OAAO,GAAE,MAAM,GAAG,IAAW,GAC5B,OAAO,CAAC,eAAe,CAAC,CAe1B"}
+{"version":3,"file":"contextActionsExecutor.d.ts","sourceRoot":"","sources":["../../../../src/modules/review-execution/services/contextActionsExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oEAAoE,CAAA;AACvG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kEAAkE,CAAA;AAGpG,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,0EAA0E,CAAA;AAChI,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gFAAgF,CAAA;AAI5H;;GAEG;AACH,YAAY,EAAE,YAAY,IAAI,mBAAmB,EAAE,CAAA;AAEnD,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,CAAA;AAEhD,UAAU,MAAM;IACd,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IACxC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IACxC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IACzC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAC1C;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,aAAa,EACtB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,eAAe,EACzB,OAAO,GAAE,MAAM,GAAG,IAAW,EAC7B,WAAW,GAAE,sBAAsB,GAAG,IAAW,GAChD,OAAO,CAAC,eAAe,CAAC,CA4C1B"}

package/dist/modules/review-execution/services/contextActionsExecutor.js

@@ -1,9 +1,11 @@
 import { GitLabReviewActionCliGateway } from '../../../modules/review-execution/interface-adapters/gateways/cli/reviewAction.gitlab.cli.gateway.js';
 import { GitHubReviewActionCliGateway } from '../../../modules/review-execution/interface-adapters/gateways/cli/reviewAction.github.cli.gateway.js';
+import { executePublicOutput, isPublicOutputAction } from '../../../modules/review-execution/services/publicOutputExecutor.js';
+import { filterAutoExecutorActions } from '../../../modules/platform-integration/services/autoExecutorActionFilter.js';
 /**
  * @deprecated Use GitLabReviewActionCliGateway or GitHubReviewActionCliGateway directly
  */
-export async function executeActionsFromContext(context, localPath, _logger, executor, baseUrl = null) {
+export async function executeActionsFromContext(context, localPath, logger, executor, baseUrl = null, postGateway = null) {
     const gatewayContext = {
         projectPath: context.projectPath,
         mrNumber: context.mergeRequestNumber,
@@ -11,9 +13,25 @@ export async function executeActionsFromContext(context, localPath, _logger, exe
         diffMetadata: context.diffMetadata,
         baseUrl,
     };
+    const { allowed, dropped } = filterAutoExecutorActions(context.actions);
+    if (dropped.length > 0) {
+        logger.warn({ droppedTypes: dropped.map(action => action.type) }, 'Auto executor dropped write-capable actions outside the read+postComment capability set');
+    }
     const gateway = context.platform === 'gitlab'
         ? new GitLabReviewActionCliGateway(executor)
         : new GitHubReviewActionCliGateway(executor);
-    return gateway.execute(context.actions, gatewayContext);
+    if (postGateway === null) {
+        return gateway.execute(allowed, gatewayContext);
+    }
+    const publicOutputActions = allowed.filter(isPublicOutputAction);
+    const remainingActions = allowed.filter(action => !isPublicOutputAction(action));
+    await executePublicOutput(publicOutputActions, { projectPath: context.projectPath, mrNumber: context.mergeRequestNumber }, postGateway);
+    const cliResult = await gateway.execute(remainingActions, gatewayContext);
+    return {
+        total: allowed.length,
+        succeeded: cliResult.succeeded + publicOutputActions.length,
+        failed: cliResult.failed,
+        skipped: cliResult.skipped,
+    };
 }
 //# sourceMappingURL=contextActionsExecutor.js.map

package/dist/modules/review-execution/services/contextActionsExecutor.js.map

@@ -1 +1 @@
-{"version":3,"file":"contextActionsExecutor.js","sourceRoot":"","sources":["../../../../src/modules/review-execution/services/contextActionsExecutor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,4BAA4B,EAAE,MAAM,+FAA+F,CAAA;AAC5I,OAAO,EAAE,4BAA4B,EAAE,MAAM,+FAA+F,CAAA;AAiB5I;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAsB,EACtB,SAAiB,EACjB,OAAe,EACf,QAAyB,EACzB,UAAyB,IAAI;IAE7B,MAAM,cAAc,GAAG;QACrB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,OAAO,CAAC,kBAAkB;QACpC,SAAS;QACT,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,OAAO;KACR,CAAA;IAED,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,IAAI,4BAA4B,CAAC,QAAQ,CAAC;QAC5C,CAAC,CAAC,IAAI,4BAA4B,CAAC,QAAQ,CAAC,CAAA;IAEhD,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAyB,EAAE,cAAc,CAAC,CAAA;AAC3E,CAAC"}
+{"version":3,"file":"contextActionsExecutor.js","sourceRoot":"","sources":["../../../../src/modules/review-execution/services/contextActionsExecutor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,4BAA4B,EAAE,MAAM,+FAA+F,CAAA;AAC5I,OAAO,EAAE,4BAA4B,EAAE,MAAM,+FAA+F,CAAA;AAG5I,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAA;AACvH,OAAO,EAAE,yBAAyB,EAAE,MAAM,qEAAqE,CAAA;AAgB/G;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAsB,EACtB,SAAiB,EACjB,MAAc,EACd,QAAyB,EACzB,UAAyB,IAAI,EAC7B,cAA6C,IAAI;IAEjD,MAAM,cAAc,GAAG;QACrB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,OAAO,CAAC,kBAAkB;QACpC,SAAS;QACT,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,OAAO;KACR,CAAA;IAED,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,yBAAyB,CAAC,OAAO,CAAC,OAAyB,CAAC,CAAA;IAEzF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CACT,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EACpD,yFAAyF,CAC1F,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,IAAI,4BAA4B,CAAC,QAAQ,CAAC;QAC5C,CAAC,CAAC,IAAI,4BAA4B,CAAC,QAAQ,CAAC,CAAA;IAEhD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;IACjD,CAAC;IAED,MAAM,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAChE,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAA;IAEhF,MAAM,mBAAmB,CACvB,mBAAmB,EACnB,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,kBAAkB,EAAE,EAC1E,WAAW,CACZ,CAAA;IAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAA;IAEzE,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,MAAM;QACrB,SAAS,EAAE,SAAS,CAAC,SAAS,GAAG,mBAAmB,CAAC,MAAM;QAC3D,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,OAAO,EAAE,SAAS,CAAC,OAAO;KAC3B,CAAA;AACH,CAAC"}

package/dist/modules/review-execution/services/dispatchConstrainedActions.d.ts

@@ -0,0 +1,30 @@
+import type { ReviewAction } from '../../../modules/review-execution/entities/reviewAction/reviewAction.js';
+import type { Provenance } from '../../../modules/review-execution/entities/actionProvenance/actionProvenance.js';
+import type { ThreadInventoryGateway } from '../../../modules/review-execution/entities/threadInventory/threadInventory.gateway.js';
+import { type ExecutionContext, type ExecutionResult, type CommandExecutor } from '../../../modules/review-execution/services/threadActionsExecutor.js';
+import type { NoteCommentPostGateway } from '../../../modules/platform-integration/entities/noteComment/noteCommentPost.gateway.js';
+interface DispatchLogger {
+    info: (obj: object, message: string) => void;
+    warn: (obj: object, message: string) => void;
+    error: (obj: object, message: string) => void;
+    debug: (obj: object, message: string) => void;
+}
+export interface DispatchOptions {
+    context: ExecutionContext;
+    provenance: Provenance;
+    inventoryGateway: ThreadInventoryGateway;
+    logger: DispatchLogger;
+    executor: CommandExecutor;
+    postGateway?: NoteCommentPostGateway | null;
+}
+/**
+ * Single chokepoint between parsed LLM actions and live write commands.
+ *
+ * Resolves the authenticated MR thread inventory (fail-closed), bounds the action
+ * surface against provenance + that inventory, then dispatches only the surviving
+ * actions to the executor. Forged or out-of-MR thread ids never reach a live write.
+ * Public-output verbs that survive are routed through the scanned post sink.
+ */
+export declare function dispatchConstrainedActions(actions: ReviewAction[], options: DispatchOptions): Promise<ExecutionResult>;
+export {};
+//# sourceMappingURL=dispatchConstrainedActions.d.ts.map

package/dist/modules/review-execution/services/dispatchConstrainedActions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatchConstrainedActions.d.ts","sourceRoot":"","sources":["../../../../src/modules/review-execution/services/dispatchConstrainedActions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kEAAkE,CAAA;AACpG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0EAA0E,CAAA;AAC1G,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gFAAgF,CAAA;AAG5H,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACrB,MAAM,8DAA8D,CAAA;AACrE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gFAAgF,CAAA;AAE5H,UAAU,cAAc;IACtB,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC5C,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC5C,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7C,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAC9C;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,gBAAgB,CAAA;IACzB,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,sBAAsB,CAAA;IACxC,MAAM,EAAE,cAAc,CAAA;IACtB,QAAQ,EAAE,eAAe,CAAA;IACzB,WAAW,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAA;CAC5C;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,YAAY,EAAE,EACvB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,eAAe,CAAC,CAc1B"}

package/dist/modules/review-execution/services/dispatchConstrainedActions.js

@@ -0,0 +1,20 @@
+import { constrainActionSurface } from '../../../modules/review-execution/services/constrainActionSurface.js';
+import { resolveThreadInventory } from '../../../modules/review-execution/services/resolveThreadInventory.js';
+import { executeThreadActions, } from '../../../modules/review-execution/services/threadActionsExecutor.js';
+/**
+ * Single chokepoint between parsed LLM actions and live write commands.
+ *
+ * Resolves the authenticated MR thread inventory (fail-closed), bounds the action
+ * surface against provenance + that inventory, then dispatches only the surviving
+ * actions to the executor. Forged or out-of-MR thread ids never reach a live write.
+ * Public-output verbs that survive are routed through the scanned post sink.
+ */
+export async function dispatchConstrainedActions(actions, options) {
+    const { context, provenance, inventoryGateway, logger, executor, postGateway = null } = options;
+    const threadInventory = resolveThreadInventory(inventoryGateway, { projectPath: context.projectPath, mrNumber: context.mrNumber }, logger);
+    const constrained = constrainActionSurface(actions, { provenance, threadInventory });
+    return executeThreadActions(constrained, context, logger, executor, postGateway, {
+        skipAutoCapabilityFilter: true,
+    });
+}
+//# sourceMappingURL=dispatchConstrainedActions.js.map

package/dist/modules/review-execution/services/dispatchConstrainedActions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatchConstrainedActions.js","sourceRoot":"","sources":["../../../../src/modules/review-execution/services/dispatchConstrainedActions.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAA;AACtG,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAA;AACtG,OAAO,EACL,oBAAoB,GAIrB,MAAM,8DAA8D,CAAA;AAmBrE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAuB,EACvB,OAAwB;IAExB,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IAE/F,MAAM,eAAe,GAAG,sBAAsB,CAC5C,gBAAgB,EAChB,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,EAChE,MAAM,CACP,CAAA;IAED,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAA;IAEpF,OAAO,oBAAoB,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE;QAC/E,wBAAwB,EAAE,IAAI;KAC/B,CAAC,CAAA;AACJ,CAAC"}

package/dist/modules/review-execution/services/publicOutputExecutor.d.ts

@@ -0,0 +1,10 @@
+import type { ReviewAction } from '../../../modules/review-execution/entities/reviewAction/reviewAction.js';
+import type { NoteCommentPostGateway } from '../../../modules/platform-integration/entities/noteComment/noteCommentPost.gateway.js';
+export type PublicOutputAction = ReviewAction;
+export interface PublicOutputContext {
+    projectPath: string;
+    mrNumber: number;
+}
+export declare function isPublicOutputAction(action: ReviewAction): boolean;
+export declare function executePublicOutput(actions: PublicOutputAction[], context: PublicOutputContext, postGateway: NoteCommentPostGateway): Promise<void>;
+//# sourceMappingURL=publicOutputExecutor.d.ts.map

package/dist/modules/review-execution/services/publicOutputExecutor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicOutputExecutor.d.ts","sourceRoot":"","sources":["../../../../src/modules/review-execution/services/publicOutputExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kEAAkE,CAAC;AACrG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gFAAgF,CAAC;AAE7H,MAAM,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAE9C,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAaD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAElE;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,mBAAmB,EAC5B,WAAW,EAAE,sBAAsB,GAClC,OAAO,CAAC,IAAI,CAAC,CAYf"}

package/dist/modules/review-execution/services/publicOutputExecutor.js

@@ -0,0 +1,27 @@
+function publicOutputBody(action) {
+    switch (action.type) {
+        case 'POST_COMMENT':
+            return action.body;
+        case 'THREAD_REPLY':
+            return action.message;
+        default:
+            return null;
+    }
+}
+export function isPublicOutputAction(action) {
+    return publicOutputBody(action) !== null;
+}
+export async function executePublicOutput(actions, context, postGateway) {
+    for (const action of actions) {
+        const body = publicOutputBody(action);
+        if (body === null) {
+            continue;
+        }
+        await postGateway.postComment({
+            projectPath: context.projectPath,
+            mrNumber: context.mrNumber,
+            body,
+        });
+    }
+}
+//# sourceMappingURL=publicOutputExecutor.js.map

package/dist/modules/review-execution/services/publicOutputExecutor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicOutputExecutor.js","sourceRoot":"","sources":["../../../../src/modules/review-execution/services/publicOutputExecutor.ts"],"names":[],"mappings":"AAUA,SAAS,gBAAgB,CAAC,MAAoB;IAC5C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,cAAc;YACjB,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,KAAK,cAAc;YACjB,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,OAAO,gBAAgB,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA6B,EAC7B,OAA4B,EAC5B,WAAmC;IAEnC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,WAAW,CAAC,WAAW,CAAC;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,IAAI;SACL,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/modules/review-execution/services/resolveThreadInventory.d.ts

@@ -0,0 +1,19 @@
+import type { ThreadInventoryGateway } from '../../../modules/review-execution/entities/threadInventory/threadInventory.gateway.js';
+export interface PinnedMergeRequest {
+    projectPath: string;
+    mrNumber: number;
+}
+interface InventoryLogger {
+    error: (obj: object, message: string) => void;
+}
+/**
+ * Resolves the authenticated MR thread inventory, fail-closed.
+ *
+ * The inventory is built ONLY from the authenticated gateway, never from the
+ * inbound webhook payload. It is either provably complete (every advertised page
+ * followed) or provably empty. Any failure — fetch error, page-count mismatch,
+ * undelivered page — resolves to the empty set with no payload/partial fallback.
+ */
+export declare function resolveThreadInventory(gateway: ThreadInventoryGateway, pinned: PinnedMergeRequest, logger: InventoryLogger): ReadonlySet<string>;
+export {};
+//# sourceMappingURL=resolveThreadInventory.d.ts.map

package/dist/modules/review-execution/services/resolveThreadInventory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveThreadInventory.d.ts","sourceRoot":"","sources":["../../../../src/modules/review-execution/services/resolveThreadInventory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gFAAgF,CAAA;AAE5H,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,UAAU,eAAe;IACvB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAC9C;AAID;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,sBAAsB,EAC/B,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,eAAe,GACtB,WAAW,CAAC,MAAM,CAAC,CAsCrB"}

package/dist/modules/review-execution/services/resolveThreadInventory.js

@@ -0,0 +1,39 @@
+const MAX_PAGES = 100;
+/**
+ * Resolves the authenticated MR thread inventory, fail-closed.
+ *
+ * The inventory is built ONLY from the authenticated gateway, never from the
+ * inbound webhook payload. It is either provably complete (every advertised page
+ * followed) or provably empty. Any failure — fetch error, page-count mismatch,
+ * undelivered page — resolves to the empty set with no payload/partial fallback.
+ */
+export function resolveThreadInventory(gateway, pinned, logger) {
+    try {
+        const first = gateway.fetchPage(pinned.projectPath, pinned.mrNumber, 1);
+        const totalPages = first.totalPages;
+        const ids = new Set(first.threadIds);
+        if (totalPages < 1 || totalPages > MAX_PAGES) {
+            logger.error({ projectPath: pinned.projectPath, mrNumber: pinned.mrNumber, totalPages }, 'thread inventory: implausible page count, failing closed to empty inventory');
+            return new Set();
+        }
+        for (let page = 2; page <= totalPages; page++) {
+            const next = gateway.fetchPage(pinned.projectPath, pinned.mrNumber, page);
+            if (next.totalPages !== totalPages) {
+                logger.error({ projectPath: pinned.projectPath, mrNumber: pinned.mrNumber, page }, 'thread inventory: page-count mismatch, failing closed to empty inventory');
+                return new Set();
+            }
+            for (const id of next.threadIds)
+                ids.add(id);
+        }
+        return ids;
+    }
+    catch (error) {
+        logger.error({
+            projectPath: pinned.projectPath,
+            mrNumber: pinned.mrNumber,
+            error: error instanceof Error ? error.message : String(error),
+        }, 'thread inventory: fetch failed, failing closed to empty inventory');
+        return new Set();
+    }
+}
+//# sourceMappingURL=resolveThreadInventory.js.map

package/dist/modules/review-execution/services/resolveThreadInventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveThreadInventory.js","sourceRoot":"","sources":["../../../../src/modules/review-execution/services/resolveThreadInventory.ts"],"names":[],"mappings":"AAWA,MAAM,SAAS,GAAG,GAAG,CAAA;AAErB;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA+B,EAC/B,MAA0B,EAC1B,MAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QACvE,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAA;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,SAAS,CAAC,CAAA;QAE5C,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,SAAS,EAAE,CAAC;YAC7C,MAAM,CAAC,KAAK,CACV,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,EAC1E,6EAA6E,CAC9E,CAAA;YACD,OAAO,IAAI,GAAG,EAAU,CAAA;QAC1B,CAAC;QAED,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YACzE,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACnC,MAAM,CAAC,KAAK,CACV,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EACpE,0EAA0E,CAC3E,CAAA;gBACD,OAAO,IAAI,GAAG,EAAU,CAAA;YAC1B,CAAC;YACD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC9C,CAAC;QAED,OAAO,GAAG,CAAA;IACZ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV;YACE,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,EACD,mEAAmE,CACpE,CAAA;QACD,OAAO,IAAI,GAAG,EAAU,CAAA;IAC1B,CAAC;AACH,CAAC"}

package/dist/modules/review-execution/services/threadActionsExecutor.d.ts

@@ -1,5 +1,6 @@
 import type { ReviewAction } from '../../../modules/review-execution/entities/reviewAction/reviewAction.js';
 import type { ExecutionResult, CommandExecutor } from '../../../modules/review-execution/entities/reviewAction/reviewAction.gateway.js';
+import type { NoteCommentPostGateway } from '../../../modules/platform-integration/entities/noteComment/noteCommentPost.gateway.js';
 /**
  * @deprecated Use ReviewAction instead
  */
@@ -12,6 +13,15 @@ export interface ExecutionContext {
     diffMetadata?: import('../../../modules/review-execution/entities/reviewContext/reviewContext.js').DiffMetadata;
 }
 export type { ExecutionResult, CommandExecutor };
+export interface ExecuteThreadActionsOptions {
+    /**
+     * Skip the auto-path capability filter (SPEC-196). Set by the constrained
+     * dispatch chokepoint (SPEC-198), where provenance + authenticated-inventory
+     * validation has already bounded the surface and must NOT be re-narrowed by
+     * the auto-path read+postComment gate.
+     */
+    skipAutoCapabilityFilter?: boolean;
+}
 interface Logger {
     info: (obj: object, msg: string) => void;
     warn: (obj: object, msg: string) => void;
@@ -21,6 +31,6 @@ interface Logger {
 /**
  * @deprecated Use GitLabReviewActionCliGateway or GitHubReviewActionCliGateway directly
  */
-export declare function executeThreadActions(actions: ThreadAction[], context: ExecutionContext, _logger: Logger, executor: CommandExecutor): Promise<ExecutionResult>;
+export declare function executeThreadActions(actions: ThreadAction[], context: ExecutionContext, logger: Logger, executor: CommandExecutor, postGateway?: NoteCommentPostGateway | null, options?: ExecuteThreadActionsOptions): Promise<ExecutionResult>;
 export declare const defaultCommandExecutor: CommandExecutor;
 //# sourceMappingURL=threadActionsExecutor.d.ts.map

package/dist/modules/review-execution/services/threadActionsExecutor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"threadActionsExecutor.d.ts","sourceRoot":"","sources":["../../../../src/modules/review-execution/services/threadActionsExecutor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kEAAkE,CAAA;AAGpG,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAA+C,MAAM,0EAA0E,CAAA;AAI7K;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,YAAY,CAAA;AAEvC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,OAAO,oEAAoE,EAAE,YAAY,CAAA;CACzG;AAED,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,CAAA;AAEhD,UAAU,MAAM;IACd,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IACxC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IACxC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IACzC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAC1C;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,YAAY,EAAE,EACvB,OAAO,EAAE,gBAAgB,EACzB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,eAAe,CAAC,CAe1B;AAED,eAAO,MAAM,sBAAsB,EAAE,eAUpC,CAAA"}
+{"version":3,"file":"threadActionsExecutor.d.ts","sourceRoot":"","sources":["../../../../src/modules/review-execution/services/threadActionsExecutor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kEAAkE,CAAA;AAGpG,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAA+C,MAAM,0EAA0E,CAAA;AAC7K,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gFAAgF,CAAA;AAM5H;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,YAAY,CAAA;AAEvC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,OAAO,oEAAoE,EAAE,YAAY,CAAA;CACzG;AAED,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,CAAA;AAEhD,MAAM,WAAW,2BAA2B;IAC1C;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;CACnC;AAED,UAAU,MAAM;IACd,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IACxC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IACxC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IACzC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAC1C;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,YAAY,EAAE,EACvB,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,eAAe,EACzB,WAAW,GAAE,sBAAsB,GAAG,IAAW,EACjD,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,eAAe,CAAC,CA+C1B;AAED,eAAO,MAAM,sBAAsB,EAAE,eAUpC,CAAA"}

package/dist/modules/review-execution/services/threadActionsExecutor.js

@@ -1,11 +1,13 @@
 import { execSync } from 'node:child_process';
 import { GitLabReviewActionCliGateway } from '../../../modules/review-execution/interface-adapters/gateways/cli/reviewAction.gitlab.cli.gateway.js';
 import { GitHubReviewActionCliGateway } from '../../../modules/review-execution/interface-adapters/gateways/cli/reviewAction.github.cli.gateway.js';
+import { executePublicOutput, isPublicOutputAction } from '../../../modules/review-execution/services/publicOutputExecutor.js';
+import { filterAutoExecutorActions } from '../../../modules/platform-integration/services/autoExecutorActionFilter.js';
 const COMMAND_TIMEOUT_MS = 30000;
 /**
  * @deprecated Use GitLabReviewActionCliGateway or GitHubReviewActionCliGateway directly
  */
-export async function executeThreadActions(actions, context, _logger, executor) {
+export async function executeThreadActions(actions, context, logger, executor, postGateway = null, options = {}) {
     const gatewayContext = {
         projectPath: context.projectPath,
         mrNumber: context.mrNumber,
@@ -13,10 +15,30 @@ export async function executeThreadActions(actions, context, _logger, executor)
         diffMetadata: context.diffMetadata,
         baseUrl: null,
     };
+    let effectiveActions = actions;
+    if (!options.skipAutoCapabilityFilter) {
+        const { allowed, dropped } = filterAutoExecutorActions(actions);
+        if (dropped.length > 0) {
+            logger.warn({ droppedTypes: dropped.map(action => action.type) }, 'Auto executor dropped write-capable actions outside the read+postComment capability set');
+        }
+        effectiveActions = allowed;
+    }
     const gateway = context.platform === 'gitlab'
         ? new GitLabReviewActionCliGateway(executor)
         : new GitHubReviewActionCliGateway(executor);
-    return gateway.execute(actions, gatewayContext);
+    if (postGateway === null) {
+        return gateway.execute(effectiveActions, gatewayContext);
+    }
+    const publicOutputActions = effectiveActions.filter(isPublicOutputAction);
+    const remainingActions = effectiveActions.filter(action => !isPublicOutputAction(action));
+    await executePublicOutput(publicOutputActions, { projectPath: context.projectPath, mrNumber: context.mrNumber }, postGateway);
+    const cliResult = await gateway.execute(remainingActions, gatewayContext);
+    return {
+        total: effectiveActions.length,
+        succeeded: cliResult.succeeded + publicOutputActions.length,
+        failed: cliResult.failed,
+        skipped: cliResult.skipped,
+    };
 }
 export const defaultCommandExecutor = (command, args, cwd) => {
     execSync(`${command} ${args.map(a => `'${a.replace(/'/g, "'\\''")}'`).join(' ')}`, {

package/dist/modules/review-execution/services/threadActionsExecutor.js.map

@@ -1 +1 @@
-{"version":3,"file":"threadActionsExecutor.js","sourceRoot":"","sources":["../../../../src/modules/review-execution/services/threadActionsExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAE7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,+FAA+F,CAAA;AAC5I,OAAO,EAAE,4BAA4B,EAAE,MAAM,+FAA+F,CAAA;AAG5I,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAwBhC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAuB,EACvB,OAAyB,EACzB,OAAe,EACf,QAAyB;IAEzB,MAAM,cAAc,GAA4B;QAC9C,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,OAAO,EAAE,IAAI;KACd,CAAA;IAED,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,IAAI,4BAA4B,CAAC,QAAQ,CAAC;QAC5C,CAAC,CAAC,IAAI,4BAA4B,CAAC,QAAQ,CAAC,CAAA;IAEhD,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;AACjD,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAoB,CACrD,OAAe,EACf,IAAc,EACd,GAAW,EACL,EAAE;IACR,QAAQ,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE;QACjF,GAAG;QACH,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAA;AACJ,CAAC,CAAA"}
+{"version":3,"file":"threadActionsExecutor.js","sourceRoot":"","sources":["../../../../src/modules/review-execution/services/threadActionsExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAE7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,+FAA+F,CAAA;AAC5I,OAAO,EAAE,4BAA4B,EAAE,MAAM,+FAA+F,CAAA;AAG5I,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAA;AACvH,OAAO,EAAE,yBAAyB,EAAE,MAAM,qEAAqE,CAAA;AAE/G,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAkChC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAuB,EACvB,OAAyB,EACzB,MAAc,EACd,QAAyB,EACzB,cAA6C,IAAI,EACjD,UAAuC,EAAE;IAEzC,MAAM,cAAc,GAA4B;QAC9C,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,OAAO,EAAE,IAAI;KACd,CAAA;IAED,IAAI,gBAAgB,GAAG,OAAO,CAAA;IAC9B,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC;QACtC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAA;QAC/D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CACT,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EACpD,yFAAyF,CAC1F,CAAA;QACH,CAAC;QACD,gBAAgB,GAAG,OAAO,CAAA;IAC5B,CAAC;IAED,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,IAAI,4BAA4B,CAAC,QAAQ,CAAC;QAC5C,CAAC,CAAC,IAAI,4BAA4B,CAAC,QAAQ,CAAC,CAAA;IAEhD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAA;IAC1D,CAAC;IAED,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;IACzE,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAA;IAEzF,MAAM,mBAAmB,CACvB,mBAAmB,EACnB,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,EAChE,WAAW,CACZ,CAAA;IAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAA;IAEzE,OAAO;QACL,KAAK,EAAE,gBAAgB,CAAC,MAAM;QAC9B,SAAS,EAAE,SAAS,CAAC,SAAS,GAAG,mBAAmB,CAAC,MAAM;QAC3D,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,OAAO,EAAE,SAAS,CAAC,OAAO;KAC3B,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAoB,CACrD,OAAe,EACf,IAAc,EACd,GAAW,EACL,EAAE;IACR,QAAQ,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE;QACjF,GAAG;QACH,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/modules/review-execution/usecases/gateClaudeInvocation.usecase.d.ts

@@ -17,6 +17,12 @@ export interface GateClaudeInvocationInput {
     job: ReviewJob;
     triggerSource: TriggerSource;
     processor: GateClaudeInvocationProcessor;
+    /**
+     * Trigger-actor provenance verdict (SPEC-197). When explicitly `false` the job
+     * is parked pending regardless of triggerMode: a non-trusted actor never
+     * auto-runs. `undefined`/`true` preserves the existing triggerMode behaviour.
+     */
+    actorTrusted?: boolean;
 }
 export type GateClaudeInvocationResult = {
     status: 'enqueued';

package/dist/modules/review-execution/usecases/gateClaudeInvocation.usecase.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateClaudeInvocation.usecase.d.ts","sourceRoot":"","sources":["../../../../src/modules/review-execution/usecases/gateClaudeInvocation.usecase.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAErE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,KAAK,EACV,oBAAoB,EACpB,aAAa,EACd,MAAM,yFAAyF,CAAC;AAEjG,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;AAEpD,MAAM,MAAM,6BAA6B,GAAG,CAC1C,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,WAAW,KAChB,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,MAAM,MAAM,qBAAqB,GAAG,CAClC,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,6BAA6B,KACrC,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,MAAM,WAAW,gCAAgC;IAC/C,WAAW,EAAE,WAAW,CAAC;IACzB,2BAA2B,EAAE,2BAA2B,CAAC;IACzD,OAAO,EAAE,qBAAqB,CAAC;IAC/B,uBAAuB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,IAAI,CAAC;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,SAAS,CAAC;IACf,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,6BAA6B,CAAC;CAC1C;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAM3C,qBAAa,2BAA2B;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,gCAAgC;IAE7D,OAAO,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC;CAgCrF"}
+{"version":3,"file":"gateClaudeInvocation.usecase.d.ts","sourceRoot":"","sources":["../../../../src/modules/review-execution/usecases/gateClaudeInvocation.usecase.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAErE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,KAAK,EACV,oBAAoB,EACpB,aAAa,EACd,MAAM,yFAAyF,CAAC;AAEjG,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;AAEpD,MAAM,MAAM,6BAA6B,GAAG,CAC1C,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,WAAW,KAChB,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,MAAM,MAAM,qBAAqB,GAAG,CAClC,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,6BAA6B,KACrC,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,MAAM,WAAW,gCAAgC;IAC/C,WAAW,EAAE,WAAW,CAAC;IACzB,2BAA2B,EAAE,2BAA2B,CAAC;IACzD,OAAO,EAAE,qBAAqB,CAAC;IAC/B,uBAAuB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,IAAI,CAAC;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,SAAS,CAAC;IACf,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,6BAA6B,CAAC;IACzC;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAM3C,qBAAa,2BAA2B;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,gCAAgC;IAE7D,OAAO,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC;CAkCrF"}

package/dist/modules/review-execution/usecases/gateClaudeInvocation.usecase.js

@@ -9,7 +9,8 @@ export class GateClaudeInvocationUseCase {
     }
     async execute(input) {
         const { triggerMode, pendingReviewRequestGateway, enqueue, broadcastPendingChanged, logger } = this.deps;
-        if (triggerMode === 'full-auto') {
+        const actorParks = input.actorTrusted === false;
+        if (triggerMode === 'full-auto' && !actorParks) {
             const enqueued = await enqueue(input.job, input.processor);
             if (!enqueued) {
                 logger.info({ jobId: input.job.id }, 'Job rejected by queue (deduplicated or already active)');

package/dist/modules/review-execution/usecases/gateClaudeInvocation.usecase.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateClaudeInvocation.usecase.js","sourceRoot":"","sources":["../../../../src/modules/review-execution/usecases/gateClaudeInvocation.usecase.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAuCnE,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,WAAW,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,OAAO,2BAA2B;IACT;IAA7B,YAA6B,IAAsC;QAAtC,SAAI,GAAJ,IAAI,CAAkC;IAAG,CAAC;IAEvE,KAAK,CAAC,OAAO,CAAC,KAAgC;QAC5C,MAAM,EAAE,WAAW,EAAE,2BAA2B,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAEzG,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,wDAAwD,CAAC,CAAC;gBAC/F,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;YAClG,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACrD,CAAC;QAED,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1E,MAAM,OAAO,GAAyB;YACpC,sBAAsB,EAAE,SAAS;YACjC,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,QAAQ;YACtC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;YAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS;SACV,CAAC;QAEF,MAAM,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,EACtE,+DAA+D,CAChE,CAAC;QAEF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;CACF"}
+{"version":3,"file":"gateClaudeInvocation.usecase.js","sourceRoot":"","sources":["../../../../src/modules/review-execution/usecases/gateClaudeInvocation.usecase.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AA6CnE,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,WAAW,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,OAAO,2BAA2B;IACT;IAA7B,YAA6B,IAAsC;QAAtC,SAAI,GAAJ,IAAI,CAAkC;IAAG,CAAC;IAEvE,KAAK,CAAC,OAAO,CAAC,KAAgC;QAC5C,MAAM,EAAE,WAAW,EAAE,2BAA2B,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAEzG,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC;QAEhD,IAAI,WAAW,KAAK,WAAW,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,wDAAwD,CAAC,CAAC;gBAC/F,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;YAClG,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACrD,CAAC;QAED,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1E,MAAM,OAAO,GAAyB;YACpC,sBAAsB,EAAE,SAAS;YACjC,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,QAAQ;YACtC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;YAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS;SACV,CAAC;QAEF,MAAM,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,EACtE,+DAA+D,CAChE,CAAC;QAEF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;CACF"}

package/dist/modules/statistics-insights/entities/insight/aiInsightsSession.gateway.d.ts

@@ -0,0 +1,13 @@
+export type AiInsightsSessionResult = {
+    status: 'completed';
+    answer: string;
+} | {
+    status: 'unavailable';
+    reason: string;
+} | {
+    status: 'timed-out';
+};
+export interface AiInsightsSessionGateway {
+    run(prompt: string): Promise<AiInsightsSessionResult>;
+}
+//# sourceMappingURL=aiInsightsSession.gateway.d.ts.map

package/dist/modules/statistics-insights/entities/insight/aiInsightsSession.gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aiInsightsSession.gateway.d.ts","sourceRoot":"","sources":["../../../../../src/modules/statistics-insights/entities/insight/aiInsightsSession.gateway.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,uBAAuB,GAC/B;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC;AAE5B,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACvD"}

package/dist/modules/statistics-insights/entities/insight/aiInsightsSession.gateway.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=aiInsightsSession.gateway.js.map

package/dist/modules/statistics-insights/entities/insight/aiInsightsSession.gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aiInsightsSession.gateway.js","sourceRoot":"","sources":["../../../../../src/modules/statistics-insights/entities/insight/aiInsightsSession.gateway.ts"],"names":[],"mappings":""}

package/dist/modules/statistics-insights/interface-adapters/controllers/http/insights.routes.d.ts

@@ -5,14 +5,16 @@ import type { InsightsGateway } from '../../../../../modules/statistics-insights
 import type { ReviewFileGateway } from '../../../../../modules/review-execution/entities/review/reviewFile.gateway.js';
 import type { ReviewRequestTrackingGateway } from '../../../../../modules/tracking/entities/tracking/reviewRequestTracking.gateway.js';
 import type { Language } from '../../../../../modules/shared-kernel/entities/language/language.schema.js';
-import { type ClaudeInvoker } from '../../../../../modules/statistics-insights/usecases/insights/generateAiInsights.usecase.js';
+import type { EnvironmentGateway } from '../../../../../modules/claude-invocation/entities/billingState/environment.gateway.js';
+import type { AiInsightsSessionGateway } from '../../../../../modules/statistics-insights/entities/insight/aiInsightsSession.gateway.js';
 interface InsightsRoutesOptions {
     statsGateway: StatsGateway;
     insightsGateway: InsightsGateway;
     reviewFileGateway: ReviewFileGateway;
     reviewRequestTrackingGateway: ReviewRequestTrackingGateway;
     logger: Logger;
-    claudeInvoker: ClaudeInvoker;
+    session: AiInsightsSessionGateway;
+    environment: EnvironmentGateway;
     language: Language;
 }
 export declare const insightsRoutes: FastifyPluginAsync<InsightsRoutesOptions>;

package/dist/modules/statistics-insights/interface-adapters/controllers/http/insights.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"insights.routes.d.ts","sourceRoot":"","sources":["../../../../../../src/modules/statistics-insights/interface-adapters/controllers/http/insights.routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+DAA+D,CAAC;AAClG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oEAAoE,CAAC;AAC1G,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kEAAkE,CAAC;AAC1G,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uEAAuE,CAAC;AAC1H,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAA+C,KAAK,aAAa,EAAE,MAAM,+EAA+E,CAAC;AAIhK,UAAU,qBAAqB;IAC7B,YAAY,EAAE,YAAY,CAAC;IAC3B,eAAe,EAAE,eAAe,CAAC;IACjC,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,4BAA4B,EAAE,4BAA4B,CAAC;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAQD,eAAO,MAAM,cAAc,EAAE,kBAAkB,CAAC,qBAAqB,CAmFpE,CAAC"}
+{"version":3,"file":"insights.routes.d.ts","sourceRoot":"","sources":["../../../../../../src/modules/statistics-insights/interface-adapters/controllers/http/insights.routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+DAA+D,CAAC;AAClG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oEAAoE,CAAC;AAC1G,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kEAAkE,CAAC;AAC1G,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uEAAuE,CAAC;AAC1H,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0EAA0E,CAAC;AACnH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6EAA6E,CAAC;AAM5H,UAAU,qBAAqB;IAC7B,YAAY,EAAE,YAAY,CAAC;IAC3B,eAAe,EAAE,eAAe,CAAC;IACjC,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,4BAA4B,EAAE,4BAA4B,CAAC;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,wBAAwB,CAAC;IAClC,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAQD,eAAO,MAAM,cAAc,EAAE,kBAAkB,CAAC,qBAAqB,CAqFpE,CAAC"}