reviewflow 3.37.0 → 3.38.0

package/dist/tests/acceptance/197-trusted-actor-provenance-gate.acceptance.test.js

@@ -0,0 +1,413 @@
+import { vi } from 'vitest';
+const mockConfig = {
+    server: { port: 3000 },
+    user: { gitlabUsername: 'claude-bot', githubUsername: 'claude-bot' },
+    queue: { maxConcurrent: 1, deduplicationWindowMs: 60000 },
+    repositories: [],
+};
+const mockRepoConfig = {
+    name: 'test-project',
+    platform: 'gitlab',
+    localPath: '/home/user/projects/test-project',
+    remoteUrl: 'https://gitlab.com/test-org/test-project.git',
+    skill: 'review-front',
+    enabled: true,
+};
+vi.mock('@/config/loader.js', () => ({
+    loadConfig: vi.fn(() => mockConfig),
+    findRepositoryByProjectPath: vi.fn(() => mockRepoConfig),
+}));
+vi.mock('@/security/verifier.js', () => ({
+    verifyGitLabSignature: vi.fn(() => ({ valid: true })),
+    getGitLabEventType: vi.fn(() => 'Merge Request Hook'),
+    getGitLabEventUuid: vi.fn(() => undefined),
+}));
+vi.mock('@/frameworks/queue/pQueueAdapter.js', () => ({
+    createJobId: vi.fn(() => 'gitlab-test-org/test-project-42'),
+    enqueueReview: vi.fn(() => Promise.resolve(true)),
+    updateJobProgress: vi.fn(),
+    cancelJob: vi.fn(),
+}));
+vi.mock('@/claude/invoker.js', () => ({
+    invokeClaudeReview: vi.fn(),
+    sendNotification: vi.fn(),
+}));
+vi.mock('@/main/websocket.js', () => ({
+    startWatchingReviewContext: vi.fn(),
+    stopWatchingReviewContext: vi.fn(),
+}));
+vi.mock('@/config/projectConfig.js', () => ({
+    loadProjectConfig: vi.fn(() => null),
+    getProjectAgents: vi.fn(() => null),
+    getProjectAgentsOrFocusDefaults: vi.fn(() => null),
+    getFollowupAgents: vi.fn(() => null),
+    getProjectLanguage: vi.fn(() => 'en'),
+}));
+vi.mock('@/modules/review-execution/interface-adapters/gateways/reviewContext.fileSystem.gateway.js', () => ({
+    ReviewContextFileSystemGateway: vi.fn().mockImplementation(() => ({
+        create: vi.fn(),
+        read: vi.fn(() => null),
+        delete: vi.fn(() => ({ deleted: true })),
+        updateProgress: vi.fn(),
+    })),
+}));
+vi.mock('@/modules/platform-integration/interface-adapters/gateways/threadFetch.gitlab.gateway.js', () => ({
+    GitLabThreadFetchGateway: vi.fn().mockImplementation(() => ({
+        fetchThreads: vi.fn(() => []),
+    })),
+    defaultGitLabExecutor: vi.fn(),
+}));
+vi.mock('@/modules/platform-integration/interface-adapters/gateways/diffMetadataFetch.gitlab.gateway.js', () => ({
+    GitLabDiffMetadataFetchGateway: vi.fn().mockImplementation(() => ({
+        fetchDiffMetadata: vi.fn(() => undefined),
+    })),
+}));
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { enqueueReview } from '../../frameworks/queue/pQueueAdapter.js';
+import { MEMBER_ACCESS_LEVELS } from '../../modules/platform-integration/entities/memberAccess/memberAccess.js';
+import { handleGitLabWebhook } from '../../modules/platform-integration/interface-adapters/controllers/webhook/gitlab.controller.js';
+import { IsTrustedActorUseCase } from '../../modules/platform-integration/usecases/isTrustedActor.usecase.js';
+import { GateClaudeInvocationUseCase } from '../../modules/review-execution/usecases/gateClaudeInvocation.usecase.js';
+import { CheckFollowupNeededUseCase } from '../../modules/tracking/usecases/tracking/checkFollowupNeeded.usecase.js';
+import { HandlePlatformApprovalUseCase } from '../../modules/tracking/usecases/tracking/handlePlatformApproval.usecase.js';
+import { RecordBypassUseCase } from '../../modules/tracking/usecases/tracking/recordBypass.usecase.js';
+import { RecordPushUseCase } from '../../modules/tracking/usecases/tracking/recordPush.usecase.js';
+import { RecordReviewCompletionUseCase } from '../../modules/tracking/usecases/tracking/recordReviewCompletion.usecase.js';
+import { SyncThreadsUseCase } from '../../modules/tracking/usecases/tracking/syncThreads.usecase.js';
+import { TrackAssignmentUseCase } from '../../modules/tracking/usecases/tracking/trackAssignment.usecase.js';
+import { TransitionStateUseCase } from '../../modules/tracking/usecases/tracking/transitionState.usecase.js';
+import { verifyGitLabSignature, getGitLabEventType } from '../../security/verifier.js';
+import { GitLabEventFactory } from '../../tests/factories/gitLabEvent.factory.js';
+import { TrackedMrFactory } from '../../tests/factories/trackedMr.factory.js';
+import { StubApprovalRevocationGateway } from '../../tests/stubs/approvalRevocation.stub.js';
+import { createStubLogger } from '../../tests/stubs/logger.stub.js';
+import { StubMemberAccessGateway } from '../../tests/stubs/memberAccess.stub.js';
+import { StubNoteCommentPostGateway } from '../../tests/stubs/noteCommentPost.stub.js';
+import { StubPendingReviewRequestGateway } from '../../tests/stubs/pendingReviewRequest.stub.js';
+const logger = createStubLogger();
+const TRACKED_MR_ID = 'gitlab-test-org/test-project-42';
+const PROJECT_PATH = 'test-org/test-project';
+function createMockTrackingGateway(initialMr) {
+    return {
+        getById: vi.fn(() => initialMr),
+        getByNumber: vi.fn(() => null),
+        create: vi.fn(),
+        update: vi.fn(),
+        getByState: vi.fn(() => []),
+        getActiveMrs: vi.fn(() => []),
+        remove: vi.fn(() => true),
+        archive: vi.fn(() => true),
+        recordReviewEvent: vi.fn(),
+        recordPush: vi.fn(() => null),
+        loadTracking: vi.fn(() => null),
+        saveTracking: vi.fn(),
+    };
+}
+function createStubContextGateway() {
+    return {
+        create: vi.fn(() => ({ success: true, filePath: '' })),
+        read: vi.fn(() => null),
+        delete: vi.fn(() => ({ success: true, deleted: true })),
+        exists: vi.fn(() => false),
+        getFilePath: vi.fn(() => ''),
+        appendAction: vi.fn(() => ({ success: true })),
+        updateProgress: vi.fn(() => ({ success: true })),
+        setResult: vi.fn(() => ({ success: true })),
+        listAll: vi.fn(() => []),
+    };
+}
+function createAcceptAllEnforceBudget() {
+    return {
+        execute: vi.fn(async () => ({
+            accepted: true,
+            status: {
+                limitUsd: 200,
+                consumedUsd: 0,
+                remainingUsd: 200,
+                percentUsed: 0,
+                exceeded: false,
+                periodStart: '2026-05-01T00:00:00.000Z',
+            },
+        })),
+    };
+}
+function buildBaseDeps(trackingGateway) {
+    const threadFetchGateway = { fetchThreads: vi.fn(() => []) };
+    return {
+        reviewContextGateway: createStubContextGateway(),
+        threadFetchGateway,
+        diffMetadataFetchGateway: {
+            fetchDiffMetadata: vi.fn(() => ({ baseSha: 'abc', headSha: 'def', startSha: 'ghi' })),
+        },
+        diffStatsFetchGateway: { fetchDiffStats: vi.fn(() => null) },
+        trackAssignment: new TrackAssignmentUseCase(trackingGateway),
+        recordCompletion: new RecordReviewCompletionUseCase(trackingGateway),
+        recordPush: new RecordPushUseCase(trackingGateway),
+        transitionState: new TransitionStateUseCase(trackingGateway),
+        checkFollowupNeeded: new CheckFollowupNeededUseCase(trackingGateway),
+        syncThreads: new SyncThreadsUseCase(trackingGateway, threadFetchGateway),
+        enforceBudget: createAcceptAllEnforceBudget(),
+        broadcastBudgetExceeded: vi.fn(),
+        getRepositories: vi.fn(() => []),
+        removeWorktree: vi.fn(async () => ({ status: 'removed' })),
+        recordBypass: new RecordBypassUseCase(trackingGateway),
+        noteCommentPostGateway: new StubNoteCommentPostGateway(),
+        handlePlatformApproval: new HandlePlatformApprovalUseCase(trackingGateway),
+        approvalRevocationGateway: new StubApprovalRevocationGateway(),
+        getQualityThreshold: () => null,
+        now: () => '2026-05-26T12:00:00.000Z',
+    };
+}
+/**
+ * Wires the SPEC-197 chokepoint: a real IsTrustedActorUseCase backed by the recording
+ * StubMemberAccessGateway, and a real full-auto GateClaudeInvocationUseCase whose park
+ * branch saves into the StubPendingReviewRequestGateway. Observable job state is the only
+ * thing asserted — enqueue call count, pending saveCount, and the HTTP reply.
+ */
+function buildGatedDeps(trackingGateway, memberAccess, pendingGateway) {
+    const gateClaudeInvocation = new GateClaudeInvocationUseCase({
+        getTriggerMode: () => 'full-auto',
+        pendingReviewRequestGateway: pendingGateway,
+        enqueue: enqueueReview,
+        broadcastPendingChanged: () => { },
+        logger,
+    });
+    return {
+        ...buildBaseDeps(trackingGateway),
+        gateClaudeInvocation,
+        isTrustedActor: new IsTrustedActorUseCase(memberAccess),
+    };
+}
+function buildFollowupMr() {
+    return TrackedMrFactory.create({
+        id: TRACKED_MR_ID,
+        mrNumber: 42,
+        platform: 'gitlab',
+        project: PROJECT_PATH,
+        state: 'pending-review',
+        openThreads: 3,
+        autoFollowup: true,
+        lastPushAt: '2026-05-26T12:00:00.000Z',
+        lastReviewAt: '2026-05-25T12:00:00.000Z',
+    });
+}
+function buildNoteEvent(note) {
+    return {
+        object_kind: 'note',
+        event_type: 'note',
+        user: { username: 'note-author', name: 'Note Author' },
+        project: {
+            id: 1,
+            name: 'test-project',
+            path_with_namespace: PROJECT_PATH,
+            web_url: 'https://gitlab.com/test-org/test-project',
+            git_http_url: 'https://gitlab.com/test-org/test-project.git',
+        },
+        object_attributes: {
+            id: 7,
+            note,
+            noteable_type: 'MergeRequest',
+            noteable_id: 99,
+        },
+        merge_request: {
+            iid: 42,
+            title: 'Test MR',
+            state: 'opened',
+            source_branch: 'feature/test',
+            target_branch: 'main',
+            url: 'https://gitlab.com/test-org/test-project/-/merge_requests/42',
+        },
+    };
+}
+function asRequest(body) {
+    return { body, headers: {} };
+}
+describe('SPEC-197 trusted-actor trigger provenance gate (acceptance — full chokepoint handleGitLabWebhook)', () => {
+    let mockReply;
+    beforeEach(() => {
+        vi.clearAllMocks();
+        mockReply = {
+            status: vi.fn().mockReturnThis(),
+            send: vi.fn().mockReturnThis(),
+        };
+    });
+    afterEach(() => {
+        vi.resetAllMocks();
+    });
+    describe('AC1 — reviewer-added gate', () => {
+        it('parks a reviewer-added trigger from a Reporter and enqueues one from a Developer', async () => {
+            const reporterTracking = createMockTrackingGateway(null);
+            const reporterMembers = new StubMemberAccessGateway();
+            reporterMembers.setAccess('reporter-actor', MEMBER_ACCESS_LEVELS.reporter);
+            const reporterPending = new StubPendingReviewRequestGateway();
+            const reporterDeps = buildGatedDeps(reporterTracking, reporterMembers, reporterPending);
+            const reporterEvent = GitLabEventFactory.createWithReviewerAdded('claude-bot');
+            reporterEvent.user = { username: 'reporter-actor', name: 'Reporter Actor' };
+            await handleGitLabWebhook(asRequest(reporterEvent), mockReply, logger, reporterTracking, reporterDeps);
+            expect(enqueueReview).not.toHaveBeenCalled();
+            expect(reporterPending.saveCount).toBe(1);
+            const developerTracking = createMockTrackingGateway(null);
+            const developerMembers = new StubMemberAccessGateway();
+            developerMembers.setAccess('dev-actor', MEMBER_ACCESS_LEVELS.developer);
+            const developerPending = new StubPendingReviewRequestGateway();
+            const developerDeps = buildGatedDeps(developerTracking, developerMembers, developerPending);
+            const developerEvent = GitLabEventFactory.createWithReviewerAdded('claude-bot');
+            developerEvent.user = { username: 'dev-actor', name: 'Dev Actor' };
+            await handleGitLabWebhook(asRequest(developerEvent), mockReply, logger, developerTracking, developerDeps);
+            expect(enqueueReview).toHaveBeenCalledTimes(1);
+            expect(developerPending.saveCount).toBe(0);
+        });
+    });
+    describe('AC2 — followup / MR-update gate', () => {
+        it('parks a followup from a Reporter and enqueues one from a Developer (payloads differ only by username)', async () => {
+            const reporterTracking = createMockTrackingGateway(buildFollowupMr());
+            reporterTracking.getByNumber.mockReturnValue(buildFollowupMr());
+            reporterTracking.recordPush.mockReturnValue(buildFollowupMr());
+            const reporterMembers = new StubMemberAccessGateway();
+            reporterMembers.setAccess('reporter-actor', MEMBER_ACCESS_LEVELS.reporter);
+            const reporterPending = new StubPendingReviewRequestGateway();
+            const reporterDeps = buildGatedDeps(reporterTracking, reporterMembers, reporterPending);
+            const reporterEvent = GitLabEventFactory.createMrUpdate();
+            reporterEvent.user = { username: 'reporter-actor', name: 'Reporter Actor' };
+            await handleGitLabWebhook(asRequest(reporterEvent), mockReply, logger, reporterTracking, reporterDeps);
+            expect(enqueueReview).not.toHaveBeenCalled();
+            expect(reporterPending.saveCount).toBe(1);
+            const developerTracking = createMockTrackingGateway(buildFollowupMr());
+            developerTracking.getByNumber.mockReturnValue(buildFollowupMr());
+            developerTracking.recordPush.mockReturnValue(buildFollowupMr());
+            const developerMembers = new StubMemberAccessGateway();
+            developerMembers.setAccess('dev-actor', MEMBER_ACCESS_LEVELS.developer);
+            const developerPending = new StubPendingReviewRequestGateway();
+            const developerDeps = buildGatedDeps(developerTracking, developerMembers, developerPending);
+            const developerEvent = GitLabEventFactory.createMrUpdate();
+            developerEvent.user = { username: 'dev-actor', name: 'Dev Actor' };
+            await handleGitLabWebhook(asRequest(developerEvent), mockReply, logger, developerTracking, developerDeps);
+            expect(enqueueReview).toHaveBeenCalledTimes(1);
+            expect(developerPending.saveCount).toBe(0);
+        });
+    });
+    describe('AC3 — note / comment gate', () => {
+        it('parks a note from a Reporter with 202 untrusted-actor and lets a Developer note proceed', async () => {
+            vi.mocked(getGitLabEventType).mockReturnValue('Note Hook');
+            const reporterTracking = createMockTrackingGateway(TrackedMrFactory.create({
+                id: TRACKED_MR_ID,
+                mrNumber: 42,
+                platform: 'gitlab',
+                project: PROJECT_PATH,
+            }));
+            const reporterMembers = new StubMemberAccessGateway();
+            reporterMembers.setAccess('note-author', MEMBER_ACCESS_LEVELS.reporter);
+            const reporterPending = new StubPendingReviewRequestGateway();
+            const reporterDeps = buildGatedDeps(reporterTracking, reporterMembers, reporterPending);
+            await handleGitLabWebhook(asRequest(buildNoteEvent('/bypass-quality "reason here"')), mockReply, logger, reporterTracking, reporterDeps);
+            expect(mockReply.status).toHaveBeenCalledWith(202);
+            expect(mockReply.send).toHaveBeenCalledWith(expect.objectContaining({ status: 'pending-confirmation', reason: 'untrusted-actor' }));
+            expect(reporterTracking.update).not.toHaveBeenCalled();
+            const developerTracking = createMockTrackingGateway(TrackedMrFactory.create({
+                id: TRACKED_MR_ID,
+                mrNumber: 42,
+                platform: 'gitlab',
+                project: PROJECT_PATH,
+            }));
+            const developerMembers = new StubMemberAccessGateway();
+            developerMembers.setAccess('note-author', MEMBER_ACCESS_LEVELS.developer);
+            const developerPending = new StubPendingReviewRequestGateway();
+            const developerDeps = buildGatedDeps(developerTracking, developerMembers, developerPending);
+            const developerReply = {
+                status: vi.fn().mockReturnThis(),
+                send: vi.fn().mockReturnThis(),
+            };
+            await handleGitLabWebhook(asRequest(buildNoteEvent('/bypass-quality "reason here"')), developerReply, logger, developerTracking, developerDeps);
+            expect(developerReply.status).not.toHaveBeenCalledWith(202);
+            expect(developerReply.send).toHaveBeenCalledWith(expect.objectContaining({ status: 'bypass-recorded' }));
+        });
+    });
+    describe('AC4 — fail-closed membership resolution', () => {
+        it('parks every trigger type when membership resolution throws', async () => {
+            const reviewerTracking = createMockTrackingGateway(null);
+            const reviewerMembers = new StubMemberAccessGateway();
+            reviewerMembers.setShouldFail(true);
+            const reviewerPending = new StubPendingReviewRequestGateway();
+            const reviewerDeps = buildGatedDeps(reviewerTracking, reviewerMembers, reviewerPending);
+            const reviewerEvent = GitLabEventFactory.createWithReviewerAdded('claude-bot');
+            reviewerEvent.user = { username: 'dev-actor', name: 'Dev Actor' };
+            await handleGitLabWebhook(asRequest(reviewerEvent), mockReply, logger, reviewerTracking, reviewerDeps);
+            expect(enqueueReview).not.toHaveBeenCalled();
+            expect(reviewerPending.saveCount).toBe(1);
+            const followupTracking = createMockTrackingGateway(buildFollowupMr());
+            followupTracking.getByNumber.mockReturnValue(buildFollowupMr());
+            followupTracking.recordPush.mockReturnValue(buildFollowupMr());
+            const followupMembers = new StubMemberAccessGateway();
+            followupMembers.setShouldFail(true);
+            const followupPending = new StubPendingReviewRequestGateway();
+            const followupDeps = buildGatedDeps(followupTracking, followupMembers, followupPending);
+            const followupEvent = GitLabEventFactory.createMrUpdate();
+            followupEvent.user = { username: 'dev-actor', name: 'Dev Actor' };
+            await handleGitLabWebhook(asRequest(followupEvent), mockReply, logger, followupTracking, followupDeps);
+            expect(enqueueReview).not.toHaveBeenCalled();
+            expect(followupPending.saveCount).toBe(1);
+            vi.mocked(getGitLabEventType).mockReturnValue('Note Hook');
+            const noteTracking = createMockTrackingGateway(TrackedMrFactory.create({
+                id: TRACKED_MR_ID,
+                mrNumber: 42,
+                platform: 'gitlab',
+                project: PROJECT_PATH,
+            }));
+            const noteMembers = new StubMemberAccessGateway();
+            noteMembers.setShouldFail(true);
+            const notePending = new StubPendingReviewRequestGateway();
+            const noteDeps = buildGatedDeps(noteTracking, noteMembers, notePending);
+            const noteReply = {
+                status: vi.fn().mockReturnThis(),
+                send: vi.fn().mockReturnThis(),
+            };
+            await handleGitLabWebhook(asRequest(buildNoteEvent('/bypass-quality "reason here"')), noteReply, logger, noteTracking, noteDeps);
+            expect(noteReply.status).toHaveBeenCalledWith(202);
+            expect(noteReply.send).toHaveBeenCalledWith(expect.objectContaining({ status: 'pending-confirmation', reason: 'untrusted-actor' }));
+            expect(noteTracking.update).not.toHaveBeenCalled();
+        });
+    });
+    describe('AC5 — cache does not widen trust', () => {
+        it('parks a trigger from an unprimed username even after another username resolved Developer', async () => {
+            const memberAccess = new StubMemberAccessGateway();
+            memberAccess.setAccess('dev-actor', MEMBER_ACCESS_LEVELS.developer);
+            const pendingGateway = new StubPendingReviewRequestGateway();
+            const trustedTracking = createMockTrackingGateway(null);
+            const trustedDeps = buildGatedDeps(trustedTracking, memberAccess, pendingGateway);
+            const trustedEvent = GitLabEventFactory.createWithReviewerAdded('claude-bot');
+            trustedEvent.user = { username: 'dev-actor', name: 'Dev Actor' };
+            await handleGitLabWebhook(asRequest(trustedEvent), mockReply, logger, trustedTracking, trustedDeps);
+            expect(enqueueReview).toHaveBeenCalledTimes(1);
+            expect(pendingGateway.saveCount).toBe(0);
+            const malloryTracking = createMockTrackingGateway(null);
+            const malloryDeps = buildGatedDeps(malloryTracking, memberAccess, pendingGateway);
+            const malloryEvent = GitLabEventFactory.createWithReviewerAdded('claude-bot');
+            malloryEvent.user = { username: 'mallory', name: 'Mallory' };
+            await handleGitLabWebhook(asRequest(malloryEvent), mockReply, logger, malloryTracking, malloryDeps);
+            expect(enqueueReview).toHaveBeenCalledTimes(1);
+            expect(pendingGateway.saveCount).toBe(1);
+            expect(memberAccess.calls).toEqual([
+                { projectPath: PROJECT_PATH, username: 'dev-actor' },
+                { projectPath: PROJECT_PATH, username: 'mallory' },
+            ]);
+        });
+    });
+    describe('AC6 — token-boundary ordering', () => {
+        it('rejects an invalid-token trigger with 401 and never queries the membership gateway', async () => {
+            vi.mocked(verifyGitLabSignature).mockReturnValueOnce({ valid: false, error: 'bad-token' });
+            const tracking = createMockTrackingGateway(null);
+            const memberAccess = new StubMemberAccessGateway();
+            memberAccess.setAccess('dev-actor', MEMBER_ACCESS_LEVELS.developer);
+            const pendingGateway = new StubPendingReviewRequestGateway();
+            const deps = buildGatedDeps(tracking, memberAccess, pendingGateway);
+            const event = GitLabEventFactory.createWithReviewerAdded('claude-bot');
+            event.user = { username: 'dev-actor', name: 'Dev Actor' };
+            await handleGitLabWebhook(asRequest(event), mockReply, logger, tracking, deps);
+            expect(mockReply.status).toHaveBeenCalledWith(401);
+            expect(mockReply.send).toHaveBeenCalledWith({ error: 'bad-token' });
+            expect(enqueueReview).not.toHaveBeenCalled();
+            expect(memberAccess.calls.length).toBe(0);
+        });
+    });
+});
+//# sourceMappingURL=197-trusted-actor-provenance-gate.acceptance.test.js.map

package/dist/tests/acceptance/197-trusted-actor-provenance-gate.acceptance.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"197-trusted-actor-provenance-gate.acceptance.test.js","sourceRoot":"","sources":["../../../src/tests/acceptance/197-trusted-actor-provenance-gate.acceptance.test.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAI5B,MAAM,UAAU,GAAG;IACjB,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IACtB,IAAI,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE;IACpE,KAAK,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,qBAAqB,EAAE,KAAK,EAAE;IACzD,YAAY,EAAE,EAAE;CACjB,CAAC;AAEF,MAAM,cAAc,GAAqB;IACvC,IAAI,EAAE,cAAc;IACpB,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,kCAAkC;IAC7C,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,cAAc;IACrB,OAAO,EAAE,IAAI;CACd,CAAC;AAEF,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC;IACnC,2BAA2B,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC;CACzD,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAAC,CAAC;IACvC,qBAAqB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC;IACrD,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;CAC3C,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,qCAAqC,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,iCAAiC,CAAC;IAC3D,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC1B,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE;CACnB,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC3B,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC1B,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,0BAA0B,EAAE,EAAE,CAAC,EAAE,EAAE;IACnC,yBAAyB,EAAE,EAAE,CAAC,EAAE,EAAE;CACnC,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;IACpC,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;IACnC,+BAA+B,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;IAClD,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;IACpC,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;CACtC,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CACL,4FAA4F,EAC5F,GAAG,EAAE,CAAC,CAAC;IACL,8BAA8B,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC;QAChE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;QACf,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QACvB,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;KACxB,CAAC,CAAC;CACJ,CAAC,CACH,CAAC;AAEF,EAAE,CAAC,IAAI,CACL,0FAA0F,EAC1F,GAAG,EAAE,CAAC,CAAC;IACL,wBAAwB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1D,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;KAC9B,CAAC,CAAC;IACH,qBAAqB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC/B,CAAC,CACH,CAAC;AAEF,EAAE,CAAC,IAAI,CACL,gGAAgG,EAChG,GAAG,EAAE,CAAC,CAAC;IACL,8BAA8B,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC;QAChE,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;KAC1C,CAAC,CAAC;CACJ,CAAC,CACH,CAAC;AAEF,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sEAAsE,CAAC;AAC5G,OAAO,EAAE,mBAAmB,EAAE,MAAM,4FAA4F,CAAC;AACjI,OAAO,EAAE,qBAAqB,EAAE,MAAM,mEAAmE,CAAC;AAC1G,OAAO,EAAE,2BAA2B,EAAE,MAAM,qEAAqE,CAAC;AAElH,OAAO,EAAE,0BAA0B,EAAE,MAAM,qEAAqE,CAAC;AACjH,OAAO,EAAE,6BAA6B,EAAE,MAAM,wEAAwE,CAAC;AACvH,OAAO,EAAE,mBAAmB,EAAE,MAAM,8DAA8D,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,4DAA4D,CAAC;AAC/F,OAAO,EAAE,6BAA6B,EAAE,MAAM,wEAAwE,CAAC;AACvH,OAAO,EAAE,kBAAkB,EAAE,MAAM,6DAA6D,CAAC;AACjG,OAAO,EAAE,sBAAsB,EAAE,MAAM,iEAAiE,CAAC;AACzG,OAAO,EAAE,sBAAsB,EAAE,MAAM,iEAAiE,CAAC;AACzG,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAE7F,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;AAElC,MAAM,aAAa,GAAG,iCAAiC,CAAC;AACxD,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAE7C,SAAS,yBAAyB,CAAC,SAA2B;IAC5D,OAAO;QACL,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,GAAqB,EAAE,CAAC,SAAS,CAAC;QACjD,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,GAAqB,EAAE,CAAC,IAAI,CAAC;QAChD,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;QACf,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;QACf,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QAC3B,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QACzB,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE;QAC1B,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAqB,EAAE,CAAC,IAAI,CAAC;QAC/C,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAC/B,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB;IAC/B,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QACvB,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;QAC1B,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QAC5B,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B;IACnC,OAAO;QACL,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAC1B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE;gBACN,QAAQ,EAAE,GAAG;gBACb,WAAW,EAAE,CAAC;gBACd,YAAY,EAAE,GAAG;gBACjB,WAAW,EAAE,CAAC;gBACd,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE,0BAA0B;aACxC;SACF,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,eAA6D;IAClF,MAAM,kBAAkB,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7D,OAAO;QACL,oBAAoB,EAAE,wBAAwB,EAAE;QAChD,kBAAkB;QAClB,wBAAwB,EAAE;YACxB,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;SACtF;QACD,qBAAqB,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE;QAC5D,eAAe,EAAE,IAAI,sBAAsB,CAAC,eAAe,CAAC;QAC5D,gBAAgB,EAAE,IAAI,6BAA6B,CAAC,eAAe,CAAC;QACpE,UAAU,EAAE,IAAI,iBAAiB,CAAC,eAAe,CAAC;QAClD,eAAe,EAAE,IAAI,sBAAsB,CAAC,eAAe,CAAC;QAC5D,mBAAmB,EAAE,IAAI,0BAA0B,CAAC,eAAe,CAAC;QACpE,WAAW,EAAE,IAAI,kBAAkB,CAAC,eAAe,EAAE,kBAAkB,CAAC;QACxE,aAAa,EAAE,4BAA4B,EAAE;QAC7C,uBAAuB,EAAE,EAAE,CAAC,EAAE,EAAE;QAChC,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QAChC,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC,CAAC;QACnE,YAAY,EAAE,IAAI,mBAAmB,CAAC,eAAe,CAAC;QACtD,sBAAsB,EAAE,IAAI,0BAA0B,EAAE;QACxD,sBAAsB,EAAE,IAAI,6BAA6B,CAAC,eAAe,CAAC;QAC1E,yBAAyB,EAAE,IAAI,6BAA6B,EAAE;QAC9D,mBAAmB,EAAE,GAAkB,EAAE,CAAC,IAAI;QAC9C,GAAG,EAAE,GAAW,EAAE,CAAC,0BAA0B;KAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CACrB,eAA6D,EAC7D,YAAqC,EACrC,cAA+C;IAE/C,MAAM,oBAAoB,GAAG,IAAI,2BAA2B,CAAC;QAC3D,cAAc,EAAE,GAAG,EAAE,CAAC,WAAW;QACjC,2BAA2B,EAAE,cAAc;QAC3C,OAAO,EAAE,aAAa;QACtB,uBAAuB,EAAE,GAAG,EAAE,GAAE,CAAC;QACjC,MAAM;KACP,CAAC,CAAC;IACH,OAAO;QACL,GAAG,aAAa,CAAC,eAAe,CAAC;QACjC,oBAAoB;QACpB,cAAc,EAAE,IAAI,qBAAqB,CAAC,YAAY,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,gBAAgB,CAAC,MAAM,CAAC;QAC7B,EAAE,EAAE,aAAa;QACjB,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,YAAY;QACrB,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,0BAA0B;QACtC,YAAY,EAAE,0BAA0B;KACzC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO;QACL,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,MAAM;QAClB,IAAI,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE;QACtD,OAAO,EAAE;YACP,EAAE,EAAE,CAAC;YACL,IAAI,EAAE,cAAc;YACpB,mBAAmB,EAAE,YAAY;YACjC,OAAO,EAAE,0CAA0C;YACnD,YAAY,EAAE,8CAA8C;SAC7D;QACD,iBAAiB,EAAE;YACjB,EAAE,EAAE,CAAC;YACL,IAAI;YACJ,aAAa,EAAE,cAAc;YAC7B,WAAW,EAAE,EAAE;SAChB;QACD,aAAa,EAAE;YACb,GAAG,EAAE,EAAE;YACP,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,QAAQ;YACf,aAAa,EAAE,cAAc;YAC7B,aAAa,EAAE,MAAM;YACrB,GAAG,EAAE,8DAA8D;SACpE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAA+B,CAAC;AAC5D,CAAC;AAED,QAAQ,CAAC,mGAAmG,EAAE,GAAG,EAAE;IACjH,IAAI,SAAuB,CAAC;IAE5B,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,SAAS,GAAG;YACV,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE;YAChC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE;SACJ,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;YAChG,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,eAAe,GAAG,IAAI,uBAAuB,EAAE,CAAC;YACtD,eAAe,CAAC,SAAS,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAC3E,MAAM,eAAe,GAAG,IAAI,+BAA+B,EAAE,CAAC;YAC9D,MAAM,YAAY,GAAG,cAAc,CAAC,gBAAgB,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;YAExF,MAAM,aAAa,GAAG,kBAAkB,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;YAC/E,aAAa,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;YAE5E,MAAM,mBAAmB,CACvB,SAAS,CAAC,aAAa,CAAC,EACxB,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,YAAY,CACb,CAAC;YAEF,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAC7C,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE1C,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,gBAAgB,GAAG,IAAI,uBAAuB,EAAE,CAAC;YACvD,gBAAgB,CAAC,SAAS,CAAC,WAAW,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;YACxE,MAAM,gBAAgB,GAAG,IAAI,+BAA+B,EAAE,CAAC;YAC/D,MAAM,aAAa,GAAG,cAAc,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;YAE5F,MAAM,cAAc,GAAG,kBAAkB,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;YAChF,cAAc,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAEnE,MAAM,mBAAmB,CACvB,SAAS,CAAC,cAAc,CAAC,EACzB,SAAS,EACT,MAAM,EACN,iBAAiB,EACjB,aAAa,CACd,CAAC;YAEF,MAAM,CAAC,aAAa,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC/C,EAAE,CAAC,uGAAuG,EAAE,KAAK,IAAI,EAAE;YACrH,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,eAAe,EAAE,CAAC,CAAC;YACtE,gBAAgB,CAAC,WAAW,CAAC,eAAe,CAAC,eAAe,EAAE,CAAC,CAAC;YAChE,gBAAgB,CAAC,UAAU,CAAC,eAAe,CAAC,eAAe,EAAE,CAAC,CAAC;YAC/D,MAAM,eAAe,GAAG,IAAI,uBAAuB,EAAE,CAAC;YACtD,eAAe,CAAC,SAAS,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAC3E,MAAM,eAAe,GAAG,IAAI,+BAA+B,EAAE,CAAC;YAC9D,MAAM,YAAY,GAAG,cAAc,CAAC,gBAAgB,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;YAExF,MAAM,aAAa,GAAG,kBAAkB,CAAC,cAAc,EAAE,CAAC;YAC1D,aAAa,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;YAE5E,MAAM,mBAAmB,CACvB,SAAS,CAAC,aAAa,CAAC,EACxB,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,YAAY,CACb,CAAC;YAEF,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAC7C,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE1C,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,eAAe,EAAE,CAAC,CAAC;YACvE,iBAAiB,CAAC,WAAW,CAAC,eAAe,CAAC,eAAe,EAAE,CAAC,CAAC;YACjE,iBAAiB,CAAC,UAAU,CAAC,eAAe,CAAC,eAAe,EAAE,CAAC,CAAC;YAChE,MAAM,gBAAgB,GAAG,IAAI,uBAAuB,EAAE,CAAC;YACvD,gBAAgB,CAAC,SAAS,CAAC,WAAW,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;YACxE,MAAM,gBAAgB,GAAG,IAAI,+BAA+B,EAAE,CAAC;YAC/D,MAAM,aAAa,GAAG,cAAc,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;YAE5F,MAAM,cAAc,GAAG,kBAAkB,CAAC,cAAc,EAAE,CAAC;YAC3D,cAAc,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAEnE,MAAM,mBAAmB,CACvB,SAAS,CAAC,cAAc,CAAC,EACzB,SAAS,EACT,MAAM,EACN,iBAAiB,EACjB,aAAa,CACd,CAAC;YAEF,MAAM,CAAC,aAAa,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;YACvG,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;YAE3D,MAAM,gBAAgB,GAAG,yBAAyB,CAChD,gBAAgB,CAAC,MAAM,CAAC;gBACtB,EAAE,EAAE,aAAa;gBACjB,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,YAAY;aACtB,CAAC,CACH,CAAC;YACF,MAAM,eAAe,GAAG,IAAI,uBAAuB,EAAE,CAAC;YACtD,eAAe,CAAC,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YACxE,MAAM,eAAe,GAAG,IAAI,+BAA+B,EAAE,CAAC;YAC9D,MAAM,YAAY,GAAG,cAAc,CAAC,gBAAgB,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;YAExF,MAAM,mBAAmB,CACvB,SAAS,CAAC,cAAc,CAAC,+BAA+B,CAAC,CAAC,EAC1D,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,YAAY,CACb,CAAC;YAEF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;YACnD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACzC,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CACvF,CAAC;YACF,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAEvD,MAAM,iBAAiB,GAAG,yBAAyB,CACjD,gBAAgB,CAAC,MAAM,CAAC;gBACtB,EAAE,EAAE,aAAa;gBACjB,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,YAAY;aACtB,CAAC,CACH,CAAC;YACF,MAAM,gBAAgB,GAAG,IAAI,uBAAuB,EAAE,CAAC;YACvD,gBAAgB,CAAC,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;YAC1E,MAAM,gBAAgB,GAAG,IAAI,+BAA+B,EAAE,CAAC;YAC/D,MAAM,aAAa,GAAG,cAAc,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;YAC5F,MAAM,cAAc,GAAG;gBACrB,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE;gBAChC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE;aACJ,CAAC;YAE7B,MAAM,mBAAmB,CACvB,SAAS,CAAC,cAAc,CAAC,+BAA+B,CAAC,CAAC,EAC1D,cAAc,EACd,MAAM,EACN,iBAAiB,EACjB,aAAa,CACd,CAAC;YAEF,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC5D,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAC9C,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CACvD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACvD,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;YAC1E,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,eAAe,GAAG,IAAI,uBAAuB,EAAE,CAAC;YACtD,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,eAAe,GAAG,IAAI,+BAA+B,EAAE,CAAC;YAC9D,MAAM,YAAY,GAAG,cAAc,CAAC,gBAAgB,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;YAExF,MAAM,aAAa,GAAG,kBAAkB,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;YAC/E,aAAa,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAElE,MAAM,mBAAmB,CACvB,SAAS,CAAC,aAAa,CAAC,EACxB,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,YAAY,CACb,CAAC;YAEF,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAC7C,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE1C,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,eAAe,EAAE,CAAC,CAAC;YACtE,gBAAgB,CAAC,WAAW,CAAC,eAAe,CAAC,eAAe,EAAE,CAAC,CAAC;YAChE,gBAAgB,CAAC,UAAU,CAAC,eAAe,CAAC,eAAe,EAAE,CAAC,CAAC;YAC/D,MAAM,eAAe,GAAG,IAAI,uBAAuB,EAAE,CAAC;YACtD,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,eAAe,GAAG,IAAI,+BAA+B,EAAE,CAAC;YAC9D,MAAM,YAAY,GAAG,cAAc,CAAC,gBAAgB,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;YAExF,MAAM,aAAa,GAAG,kBAAkB,CAAC,cAAc,EAAE,CAAC;YAC1D,aAAa,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAElE,MAAM,mBAAmB,CACvB,SAAS,CAAC,aAAa,CAAC,EACxB,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,YAAY,CACb,CAAC;YAEF,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAC7C,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE1C,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;YAC3D,MAAM,YAAY,GAAG,yBAAyB,CAC5C,gBAAgB,CAAC,MAAM,CAAC;gBACtB,EAAE,EAAE,aAAa;gBACjB,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,YAAY;aACtB,CAAC,CACH,CAAC;YACF,MAAM,WAAW,GAAG,IAAI,uBAAuB,EAAE,CAAC;YAClD,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,WAAW,GAAG,IAAI,+BAA+B,EAAE,CAAC;YAC1D,MAAM,QAAQ,GAAG,cAAc,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;YACxE,MAAM,SAAS,GAAG;gBAChB,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE;gBAChC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE;aACJ,CAAC;YAE7B,MAAM,mBAAmB,CACvB,SAAS,CAAC,cAAc,CAAC,+BAA+B,CAAC,CAAC,EAC1D,SAAS,EACT,MAAM,EACN,YAAY,EACZ,QAAQ,CACT,CAAC;YAEF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;YACnD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACzC,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CACvF,CAAC;YACF,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAChD,EAAE,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;YACxG,MAAM,YAAY,GAAG,IAAI,uBAAuB,EAAE,CAAC;YACnD,YAAY,CAAC,SAAS,CAAC,WAAW,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;YACpE,MAAM,cAAc,GAAG,IAAI,+BAA+B,EAAE,CAAC;YAE7D,MAAM,eAAe,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,WAAW,GAAG,cAAc,CAAC,eAAe,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;YAClF,MAAM,YAAY,GAAG,kBAAkB,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;YAC9E,YAAY,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAEjE,MAAM,mBAAmB,CACvB,SAAS,CAAC,YAAY,CAAC,EACvB,SAAS,EACT,MAAM,EACN,eAAe,EACf,WAAW,CACZ,CAAC;YAEF,MAAM,CAAC,aAAa,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAEzC,MAAM,eAAe,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,WAAW,GAAG,cAAc,CAAC,eAAe,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;YAClF,MAAM,YAAY,GAAG,kBAAkB,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;YAC9E,YAAY,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAE7D,MAAM,mBAAmB,CACvB,SAAS,CAAC,YAAY,CAAC,EACvB,SAAS,EACT,MAAM,EACN,eAAe,EACf,WAAW,CACZ,CAAC;YAEF,MAAM,CAAC,aAAa,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;gBACjC,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE;gBACpD,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE;aACnD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;QAC7C,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;YAClG,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC3F,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,IAAI,uBAAuB,EAAE,CAAC;YACnD,YAAY,CAAC,SAAS,CAAC,WAAW,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;YACpE,MAAM,cAAc,GAAG,IAAI,+BAA+B,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;YAEpE,MAAM,KAAK,GAAG,kBAAkB,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;YACvE,KAAK,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAE1D,MAAM,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAE/E,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;YACnD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACpE,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAC7C,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/acceptance/199-review-output-egress-scan.acceptance.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=199-review-output-egress-scan.acceptance.test.d.ts.map

package/dist/tests/acceptance/199-review-output-egress-scan.acceptance.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"199-review-output-egress-scan.acceptance.test.d.ts","sourceRoot":"","sources":["../../../src/tests/acceptance/199-review-output-egress-scan.acceptance.test.ts"],"names":[],"mappings":""}

package/dist/tests/acceptance/199-review-output-egress-scan.acceptance.test.js

@@ -0,0 +1,159 @@
+import { describe, it, expect } from 'vitest';
+import { buildRecoveryExecuteActions } from '../../main/server.js';
+import { defaultEgressScanConfig } from '../../modules/platform-integration/entities/egressScan/egressScan.defaults.js';
+import { createEgressScanner } from '../../modules/platform-integration/entities/egressScan/egressScan.scanner.js';
+import { EgressBlockedError, EgressScannedNoteCommentPostGateway, } from '../../modules/platform-integration/interface-adapters/gateways/egressScanned.noteCommentPost.gateway.js';
+import { executeActionsFromContext } from '../../modules/review-execution/services/contextActionsExecutor.js';
+import { executeThreadActions, } from '../../modules/review-execution/services/threadActionsExecutor.js';
+import { StubEgressScanGateway, StubEgressTraceGateway } from '../../tests/stubs/egressScan.stub.js';
+import { StubNoteCommentPostGateway } from '../../tests/stubs/noteCommentPost.stub.js';
+const SECRET = 'glpat-abcdefghij1234567890';
+const redactConfig = {
+    secretShapeMode: 'redact',
+    lengthMode: 'redact',
+    outOfScopeMode: 'redact',
+    maxBodyLength: 10000,
+    redactionMarker: '[REDACTED]',
+    truncationMarker: '…[TRUNCATED]',
+};
+const blockConfig = {
+    ...redactConfig,
+    secretShapeMode: 'block',
+};
+const silentLogger = {
+    info: () => { },
+    warn: () => { },
+    error: () => { },
+    debug: () => { },
+};
+class RecordingExecutor {
+    calls = [];
+    run = (_command, args) => {
+        this.calls.push(args);
+    };
+    secretBearingArgs() {
+        return this.calls.filter((args) => args.some((arg) => arg.includes(SECRET)));
+    }
+}
+function buildDecoratedSink(config = redactConfig) {
+    const sink = new StubNoteCommentPostGateway();
+    const trace = new StubEgressTraceGateway();
+    const scanner = createEgressScanner(config);
+    const gateway = new EgressScannedNoteCommentPostGateway(sink, scanner, trace);
+    return { sink, trace, gateway };
+}
+const gitlabExecutionContext = {
+    platform: 'gitlab',
+    projectPath: 'group/app',
+    mrNumber: 7,
+    localPath: '/tmp/repo',
+};
+const baseContext = {
+    version: '1.0',
+    mergeRequestId: 'gitlab-group/app-7',
+    platform: 'gitlab',
+    projectPath: 'group/app',
+    mergeRequestNumber: 7,
+    createdAt: '2026-02-02T10:00:00Z',
+    threads: [],
+    actions: [],
+    progress: { phase: 'completed', currentStep: null },
+};
+const publicOutputVerbs = [
+    { name: 'POST_COMMENT', action: { type: 'POST_COMMENT', body: `## Review\ntoken ${SECRET}` } },
+    {
+        name: 'THREAD_REPLY',
+        action: { type: 'THREAD_REPLY', threadId: 'abc', message: `fixed ${SECRET}` },
+    },
+];
+describe('SPEC-199 review output egress scan (acceptance — shared chokepoint across all callers)', () => {
+    describe('AC9 — every auto-path public-output verb is scanned before reaching the sink', () => {
+        for (const { name, action } of publicOutputVerbs) {
+            it(`scans a ${name} body driven through executeThreadActions, never the raw note primitive`, async () => {
+                const { sink, trace, gateway } = buildDecoratedSink();
+                const executor = new RecordingExecutor();
+                await executeThreadActions([action], gitlabExecutionContext, silentLogger, executor.run, gateway);
+                expect(sink.calls).toHaveLength(1);
+                expect(sink.calls[0].body).toContain('[REDACTED]');
+                expect(sink.calls[0].body).not.toContain(SECRET);
+                expect(executor.secretBearingArgs()).toHaveLength(0);
+                expect(trace.traces).toHaveLength(1);
+            });
+            it(`scans a ${name} body persisted in a ReviewContext through executeActionsFromContext`, async () => {
+                const { sink, trace, gateway } = buildDecoratedSink();
+                const executor = new RecordingExecutor();
+                const context = { ...baseContext, actions: [action] };
+                await executeActionsFromContext(context, '/tmp/repo', silentLogger, executor.run, null, gateway);
+                expect(sink.calls).toHaveLength(1);
+                expect(sink.calls[0].body).toContain('[REDACTED]');
+                expect(sink.calls[0].body).not.toContain(SECRET);
+                expect(executor.secretBearingArgs()).toHaveLength(0);
+                expect(trace.traces).toHaveLength(1);
+            });
+        }
+    });
+    describe('AC2 / AC5 — block and fail-closed end-to-end', () => {
+        it('raises EgressBlockedError and never reaches the sink for a secret body in block mode', async () => {
+            const { sink, gateway } = buildDecoratedSink(blockConfig);
+            const executor = new RecordingExecutor();
+            await expect(executeThreadActions([{ type: 'POST_COMMENT', body: `summary ${SECRET}` }], gitlabExecutionContext, silentLogger, executor.run, gateway)).rejects.toBeInstanceOf(EgressBlockedError);
+            expect(sink.calls).toHaveLength(0);
+            expect(executor.secretBearingArgs()).toHaveLength(0);
+        });
+        it('fails closed when the scanner throws — no post, error raised', async () => {
+            const sink = new StubNoteCommentPostGateway();
+            const trace = new StubEgressTraceGateway();
+            const scanner = new StubEgressScanGateway();
+            scanner.setShouldFail(true);
+            const gateway = new EgressScannedNoteCommentPostGateway(sink, scanner, trace);
+            const executor = new RecordingExecutor();
+            await expect(executeThreadActions([{ type: 'POST_COMMENT', body: `summary ${SECRET}` }], gitlabExecutionContext, silentLogger, executor.run, gateway)).rejects.toThrow();
+            expect(sink.calls).toHaveLength(0);
+        });
+    });
+    describe('AC9 — the boot-time recovery path is scanned (GAP-1 close-loop)', () => {
+        it('scans a recovered POST_COMMENT so the secret never reaches the raw CLI note primitive', async () => {
+            const cliCalls = [];
+            const noteCommands = [];
+            const trace = new StubEgressTraceGateway();
+            const recoveredContext = {
+                ...baseContext,
+                actions: [{ type: 'POST_COMMENT', body: `## Recovered review\ntoken ${SECRET}` }],
+            };
+            const executeActions = buildRecoveryExecuteActions(silentLogger, trace, {
+                cliExecutor: (_command, args) => {
+                    cliCalls.push(args);
+                },
+                gitLabNoteExecutor: (command) => {
+                    noteCommands.push(command);
+                    return '';
+                },
+            });
+            await executeActions(recoveredContext, '/tmp/repo');
+            expect(noteCommands).toHaveLength(1);
+            expect(noteCommands[0]).toContain('[redacted]');
+            expect(noteCommands[0]).not.toContain(SECRET);
+            expect(cliCalls.some((args) => args.some((arg) => arg.includes(SECRET)))).toBe(false);
+            expect(trace.traces).toHaveLength(1);
+        });
+    });
+    describe('AC8 — out-of-scope-by-design: no auto revoke whose comment could egress (SPEC-196 unwire)', () => {
+        it('drops THREAD_RESOLVE / ADD_LABEL from the auto path, recording zero CLI writes for them', async () => {
+            const { sink, gateway } = buildDecoratedSink();
+            const executor = new RecordingExecutor();
+            const context = {
+                ...baseContext,
+                actions: [
+                    { type: 'POST_COMMENT', body: 'clean summary' },
+                    { type: 'THREAD_RESOLVE', threadId: 't1' },
+                    { type: 'ADD_LABEL', label: 'approved' },
+                ],
+            };
+            await executeActionsFromContext(context, '/tmp/repo', silentLogger, executor.run, null, gateway);
+            expect(sink.calls).toHaveLength(1);
+            expect(executor.calls.some((args) => args.includes('resolved=true'))).toBe(false);
+            expect(defaultEgressScanConfig.secretShapeMode).toBe('redact');
+        });
+    });
+});
+//# sourceMappingURL=199-review-output-egress-scan.acceptance.test.js.map

package/dist/tests/acceptance/199-review-output-egress-scan.acceptance.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"199-review-output-egress-scan.acceptance.test.js","sourceRoot":"","sources":["../../../src/tests/acceptance/199-review-output-egress-scan.acceptance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,2EAA2E,CAAC;AACpH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0EAA0E,CAAC;AAE/G,OAAO,EACL,kBAAkB,EAClB,mCAAmC,GACpC,MAAM,qGAAqG,CAAC;AAG7G,OAAO,EAAE,yBAAyB,EAAE,MAAM,+DAA+D,CAAC;AAC1G,OAAO,EACL,oBAAoB,GAErB,MAAM,8DAA8D,CAAC;AAEtE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AACjG,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAEnF,MAAM,MAAM,GAAG,4BAA4B,CAAC;AAE5C,MAAM,YAAY,GAAqB;IACrC,eAAe,EAAE,QAAQ;IACzB,UAAU,EAAE,QAAQ;IACpB,cAAc,EAAE,QAAQ;IACxB,aAAa,EAAE,KAAK;IACpB,eAAe,EAAE,YAAY;IAC7B,gBAAgB,EAAE,cAAc;CACjC,CAAC;AAEF,MAAM,WAAW,GAAqB;IACpC,GAAG,YAAY;IACf,eAAe,EAAE,OAAO;CACzB,CAAC;AAEF,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;IACf,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;CAChB,CAAC;AAEF,MAAM,iBAAiB;IACZ,KAAK,GAAe,EAAE,CAAC;IAChC,GAAG,GAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE;QACxC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC,CAAC;IAEF,iBAAiB;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,SAA2B,YAAY;IACjE,MAAM,IAAI,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,mCAAmC,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9E,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,sBAAsB,GAAqB;IAC/C,QAAQ,EAAE,QAAQ;IAClB,WAAW,EAAE,WAAW;IACxB,QAAQ,EAAE,CAAC;IACX,SAAS,EAAE,WAAW;CACvB,CAAC;AAEF,MAAM,WAAW,GAAkB;IACjC,OAAO,EAAE,KAAK;IACd,cAAc,EAAE,oBAAoB;IACpC,QAAQ,EAAE,QAAQ;IAClB,WAAW,EAAE,WAAW;IACxB,kBAAkB,EAAE,CAAC;IACrB,SAAS,EAAE,sBAAsB;IACjC,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,EAAE;IACX,QAAQ,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE;CACpD,CAAC;AAEF,MAAM,iBAAiB,GAAkD;IACvE,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,oBAAoB,MAAM,EAAE,EAAE,EAAE;IAC9F;QACE,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE;KAC9E;CACF,CAAC;AAEF,QAAQ,CAAC,wFAAwF,EAAE,GAAG,EAAE;IACtG,QAAQ,CAAC,8EAA8E,EAAE,GAAG,EAAE;QAC5F,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;YACjD,EAAE,CAAC,WAAW,IAAI,yEAAyE,EAAE,KAAK,IAAI,EAAE;gBACtG,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,kBAAkB,EAAE,CAAC;gBACtD,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;gBAEzC,MAAM,oBAAoB,CACxB,CAAC,MAAM,CAAC,EACR,sBAAsB,EACtB,YAAY,EACZ,QAAQ,CAAC,GAAG,EACZ,OAAO,CACR,CAAC;gBAEF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;gBACnD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACjD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBACrD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,WAAW,IAAI,sEAAsE,EAAE,KAAK,IAAI,EAAE;gBACnG,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,kBAAkB,EAAE,CAAC;gBACtD,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;gBACzC,MAAM,OAAO,GAAkB,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;gBAErE,MAAM,yBAAyB,CAC7B,OAAO,EACP,WAAW,EACX,YAAY,EACZ,QAAQ,CAAC,GAAG,EACZ,IAAI,EACJ,OAAO,CACR,CAAC;gBAEF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;gBACnD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACjD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBACrD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;QAC5D,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;YACpG,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;YAEzC,MAAM,MAAM,CACV,oBAAoB,CAClB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,MAAM,EAAE,EAAE,CAAC,EACrD,sBAAsB,EACtB,YAAY,EACZ,QAAQ,CAAC,GAAG,EACZ,OAAO,CACR,CACF,CAAC,OAAO,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;YAE7C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;YAC5E,MAAM,IAAI,GAAG,IAAI,0BAA0B,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,sBAAsB,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,qBAAqB,EAAE,CAAC;YAC5C,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,mCAAmC,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YAC9E,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;YAEzC,MAAM,MAAM,CACV,oBAAoB,CAClB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,MAAM,EAAE,EAAE,CAAC,EACrD,sBAAsB,EACtB,YAAY,EACZ,QAAQ,CAAC,GAAG,EACZ,OAAO,CACR,CACF,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAEpB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAC/E,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;YACrG,MAAM,QAAQ,GAAe,EAAE,CAAC;YAChC,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,sBAAsB,EAAE,CAAC;YAC3C,MAAM,gBAAgB,GAAkB;gBACtC,GAAG,WAAW;gBACd,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,8BAA8B,MAAM,EAAE,EAAE,CAAC;aAClF,CAAC;YAEF,MAAM,cAAc,GAAG,2BAA2B,CAAC,YAAY,EAAE,KAAK,EAAE;gBACtE,WAAW,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE;oBAC9B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC;gBACD,kBAAkB,EAAE,CAAC,OAAO,EAAE,EAAE;oBAC9B,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAC3B,OAAO,EAAE,CAAC;gBACZ,CAAC;aACF,CAAC,CAAC;YACH,MAAM,cAAc,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;YAEpD,MAAM,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YAChD,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,2FAA2F,EAAE,GAAG,EAAE;QACzG,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;YACvG,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,kBAAkB,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;YACzC,MAAM,OAAO,GAAkB;gBAC7B,GAAG,WAAW;gBACd,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE;oBAC/C,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAC1C,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE;iBACzC;aACF,CAAC;YAEF,MAAM,yBAAyB,CAC7B,OAAO,EACP,WAAW,EACX,YAAY,EACZ,QAAQ,CAAC,GAAG,EACZ,IAAI,EACJ,OAAO,CACR,CAAC;YAEF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClF,MAAM,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/acceptance/201-transport-provenance-hardening.acceptance.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=201-transport-provenance-hardening.acceptance.test.d.ts.map

package/dist/tests/acceptance/201-transport-provenance-hardening.acceptance.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"201-transport-provenance-hardening.acceptance.test.d.ts","sourceRoot":"","sources":["../../../src/tests/acceptance/201-transport-provenance-hardening.acceptance.test.ts"],"names":[],"mappings":""}