npm warn Unknown env config "http-proxy". This will stop working in the next major version of npm.

> telegram-task-earning@0.20.1 check
> node scripts/run-quality-checks.js


[phase-20-check] Running lint
npm warn Unknown env config "http-proxy". This will stop working in the next major version of npm.

> telegram-task-earning@0.20.1 lint
> eslint . --max-warnings=0


[phase-20-check] Running format:check
npm warn Unknown env config "http-proxy". This will stop working in the next major version of npm.

> telegram-task-earning@0.20.1 format:check
> prettier . --check

Checking formatting...
All matched files use Prettier code style!

[phase-20-check] Running test
npm warn Unknown env config "http-proxy". This will stop working in the next major version of npm.

> telegram-task-earning@0.20.1 test
> node --test

✔ Admin auth routes are composed behind validation, session, and CSRF gates (128.541108ms)
✔ configured Admin IP policy rejects disallowed networks before authentication (19.20757ms)
✔ Express foundation serves service, liveness, readiness, and safe 404 responses (117.914599ms)
✔ readiness returns 503 without disclosing database errors (15.070651ms)
✔ web bootstrap verifies MySQL, configures HTTP, becomes ready, and shuts down (35.000096ms)
✔ web bootstrap fails closed and releases resources for an unsupported database (3.656401ms)
✔ web bootstrap connects Redis for distributed protection and closes it on shutdown (8.477479ms)
✔ Spaceship web bootstrap selects the database limiter without starting Redis (5.799661ms)
✔ migration dry run validates all files without secrets or a live database (274.881723ms)
✔ seed and rollback dry runs are offline and deterministic (570.763722ms)
✔ unknown database command options fail closed (220.526955ms)
✔ example verification succeeds and redacts sensitive placeholders (211.971015ms)
✔ using the example as a runtime environment fails closed without leaking secrets (185.912638ms)
✔ runtime verification succeeds from deployment environment values (119.199383ms)
✔ wallet and history endpoints require a verified Telegram session (89.587522ms)
✔ wallet API returns string amounts and cursor pagination metadata (25.432178ms)
✔ wallet history rejects excessive limits and unknown query input (18.883443ms)
✔ task APIs require a server-verified Telegram user session (85.081824ms)
✔ task start requires CSRF, an empty body, and an Idempotency-Key (74.549664ms)
✔ claim validates ownership-shaped IDs and returns server reward data (30.944987ms)
✔ Admin task lifecycle routes enforce their exact permission (24.15866ms)
✔ public referral endpoints require a verified Telegram session (115.804382ms)
✔ Admin referral routes enforce distinct view, review, and settings permissions (63.741709ms)
✔ Admin review requires CSRF, review permission, reason, and resource version (16.634167ms)
✔ public Mystery Box endpoints require a verified Telegram session (119.354081ms)
✔ free claim requires CSRF, an empty body, and an Idempotency-Key (61.756637ms)
✔ Admin reads, claims, management, and lifecycle use distinct permissions (40.282855ms)
✔ public method, quote, and withdrawal history endpoints require verified Telegram identity (99.193465ms)
✔ quote and create use strict schemas, CSRF, and a required idempotency key (94.205145ms)
✔ Admin withdrawal reads and decrypted destination details use distinct permissions (26.09153ms)
✔ Admin review checks the submitted decision permission and payout confirmation is separate (26.771913ms)
✔ content endpoints require verified Telegram identity (94.437724ms)
✔ announcement read evidence requires CSRF and an empty strict body (45.878265ms)
✔ Admin banner reading, editing, and publishing use separate permissions (27.374562ms)
✔ Admin settings and feature flags enforce exact permissions and strict versions (25.635398ms)
✔ Notification inbox requires Telegram identity and read mutation requires CSRF (97.963012ms)
✔ Template reads and broadcast approval require their exact Admin permissions (22.769733ms)
✔ Reminder creation validates timezone-shaped schedule inputs before service execution (13.784765ms)
✔ earning history and leaderboard require a Telegram-authenticated user (64.840073ms)
✔ financial analytics require their exact high-sensitivity permission (23.031208ms)
✔ report range and leaderboard pagination are rejected before service execution (14.414874ms)
✔ Mini App shell renders EJS with a narrowly scoped official Telegram SDK CSP (71.406346ms)
✔ Mini App module assets revalidate and private paths remain inaccessible (35.198663ms)
✔ Maintenance allows only the public shell/assets while protected API stays closed (36.653388ms)
✔ Banned sessions can load the shell for an error screen but cannot access API data (9.609218ms)
✔ admin shell and assets are public but contain no account data and deny framing (103.016983ms)
✔ every operational route fails closed without its exact read permission (58.284363ms)
✔ authorized reads validate pagination, return string amounts, and record audit context (29.293992ms)
✔ catalog exposes only allowed screens and hides payment account details from reviewers (8.589766ms)
✔ maintenance preserves shell access and follows configured admin access policy (17.222033ms)
✔ upload size exception requires permission and CSRF and does not enlarge other routes (46.867814ms)
✔ all Phase 19 operations reject anonymous callers even with a valid anonymous CSRF token (146.507097ms)
✔ all Phase 19 operations enforce their exact permissions before invoking the service (57.481463ms)
✔ every authorized operation routes a strict validated body and trusted actor context (73.621181ms)
✔ CSRF, malformed money, stale-body fields and oversized input are rejected without a write (32.803297ms)
✔ public enrollment keeps CSRF protection and strict one-time-token validation (24.202686ms)
✔ Phase 9 user endpoints require a server-attached session (92.312158ms)
✔ profile mutation requires CSRF and rejects unapproved fields (41.485138ms)
✔ admin user inspection requires both admin authentication and users.view (11.802092ms)
✔ maintenance keeps bootstrap, authenticated admins, and configured webhook reachable (12.670772ms)
✔ Telegram auth and webhook routes are composed behind their security gates (100.486011ms)
✔ Admin authentication and RBAC trust only server-attached identity and permissions (1.477538ms)
✔ Admin IP allowlist supports exact addresses and bounded CIDR ranges (5.508833ms)
✔ database schema enforces the current security and money contract (67.861753ms)
✔ unexpected async errors disclose neither stack traces nor embedded Telegram tokens (45.973616ms)
✔ invalid incoming request IDs are replaced with server-generated identifiers (17.841566ms)
✔ security headers allow Telegram framing only through CSP (49.621805ms)
✔ production responses enable HSTS and HTTPS upgrade policy (35.668511ms)
✔ strict CORS rejects unknown origins and handles approved preflights (15.315852ms)
✔ signed double-submit CSRF flow protects unsafe JSON requests (22.587885ms)
✔ body parsing rejects unsupported, malformed, and oversized payloads safely (18.518675ms)
✔ rate limiting emits standard controls and fails closed when its store fails (18.86812ms)
✔ maintenance gates application traffic but preserve liveness (14.249605ms)
✔ readiness fails safely when the distributed security dependency is unavailable (6.074987ms)
✔ Phase 10 migration makes ledger entries append-only and excludes pending balances (5.278513ms)
✔ ledger repository locks account rows in deterministic database order (1.126881ms)
✔ wallet history keeps cursor values parameterized (0.32584ms)
✔ runtime ledger repository contains no entry update or delete operation (6.740965ms)
✔ Phase 11 migration snapshots attempts and blocks duplicate active attempts and claims (10.84505ms)
✔ public task mapping never exposes destination or internal database identifiers (0.804746ms)
✔ Admin task filters keep hostile input parameterized (0.577541ms)
✔ task completion uses the existing transaction for ledger settlement (24.328491ms)
✔ task routes declare separate permissions for viewing, editing, publishing, and review (3.778587ms)
✔ Phase 12 migration preserves referral evidence and optimistic state transitions (11.583129ms)
✔ Admin referral search keeps hostile input in query parameters (0.715815ms)
✔ Referral reward settings require string minor units and matching versions (3.251874ms)
✔ Task completion invokes referral activation inside its existing transaction (10.235001ms)
✔ Referral API exposes reads only while Admin mutations require exact permissions (1.644434ms)
✔ Referral activation amount comes only from validated server settings (2.251389ms)
✔ Phase 13 migration enforces single-active, free-only, immutable claim evidence (11.902509ms)
✔ claim flow locks user and reward state before atomic ledger settlement (4.304136ms)
✔ client cannot select the box, reward, amount, ticket, or paid access fields (5.007463ms)
✔ Admin claim search keeps hostile values parameterized (0.674254ms)
✔ repository hardcodes zero cost and no purchase on every box insert (0.412899ms)
✔ route permissions separate claim evidence from lifecycle and configuration (2.736184ms)
✔ Phase 14 migration protects immutable quotes, requests, approvals, history, and payouts (20.532154ms)
✔ withdrawal creation locks user, quote, and method before holding funds and consuming the quote (10.023379ms)
✔ client payloads cannot choose fees, net totals, status, approvals, or payout evidence (4.89013ms)
✔ Admin search values remain parameterized and LIKE metacharacters are escaped (0.665462ms)
✔ destination details use authenticated encryption context and a separate hash (2.551832ms)
✔ manual provider is the only enabled payout implementation and rejects automatic mode (0.911954ms)
✔ route permissions separate reads, sensitive details, decisions, payout, methods, and settings (1.242182ms)
✔ Phase 15 migration versions content and protects lifecycle evidence (9.442663ms)
✔ public banner query requires active time window and verified public media (0.644601ms)
✔ public announcement query binds user reads and server-owned visibility windows (1.069847ms)
✔ public tutorial queries expose published rows only with safe cover media (0.295496ms)
✔ content routes separate management, viewing, and publishing permissions (5.874552ms)
✔ configuration routes enforce exact settings, flag, theme, currency, and maintenance permissions (4.378486ms)
✔ raw Admin text is converted to safe HTML and never passed through as body_html (1.871138ms)
✔ public media serving uses verified metadata, containment, size, and hash controls (2.530731ms)
✔ Phase 16 migration protects immutable template and delivery evidence (5.170454ms)
✔ Outbox claim query uses row locks, leases, bounded attempts, and SKIP LOCKED (1.527211ms)
✔ Message routes separate view, edit, approval, cancellation, and reminder permissions (5.100421ms)
✔ Telegram worker has one allowlisted method and never stores raw provider response (1.891068ms)
✔ Broadcast audience excludes deleted and non-writable Telegram accounts (1.060854ms)
✔ Phase 17 migration protects immutable leaderboard and rollup evidence (4.972171ms)
✔ leaderboard materialization snapshots privacy-safe display data (1.75646ms)
✔ earning history is sourced from posted ledger evidence and uses keyset pagination (13.000959ms)
✔ financial totals and operational reports use distinct permissions (1.903156ms)
✔ Telegram re-sync merges profile data instead of erasing privacy preferences (0.955609ms)
✔ Mini App modules use local resolvable imports and do not persist authentication material (32.91011ms)
✔ Mini App shell permits zoom, has safe-area viewport and loads no inline code (2.486066ms)
✔ Mini App CSS retains mobile clearance, keyboard focus and reduced effects (1.830108ms)
✔ media processor decodes pixels, removes appended data and strips metadata (28.67514ms)
✔ media processor rejects disguised SVG, mismatched MIME, truncated data and excess pixels (11.033213ms)
✔ upload accepts only strict filenames, bounded base64 and explicit supported media types (8.463955ms)
✔ upload writes only generated paths and stores a digest matching the served pixels (18.50153ms)
✔ operational searches bind escaped wildcards and reject unknown query models (0.760352ms)
✔ console projections exclude password, session, payload and raw security evidence columns (0.341133ms)
✔ admin user filters keep hostile search and status values out of SQL text (1.2138ms)
✔ admin user repository parameterizes pagination and search values (1.285325ms)
✔ profile writes update only allowlisted preference columns (0.792779ms)
✔ Telegram webhook requires the exact secret header without reflecting it (1.835096ms)
✔ approved project directories exist (11.584791ms)
✔ package metadata is private, ESM, exact-pinned, and script-complete (8.140432ms)
✔ runtime policy accepts supported LTS lines and rejects unsupported lines (0.857464ms)
✔ web entry point fails closed when deployment configuration is missing (606.601627ms)
✔ repository does not contain a real environment file (6.189977ms)
✔ password success creates only a staged two-factor challenge (1.99406ms)
✔ unknown and incorrect Admin credentials return the same public failure (0.94266ms)
✔ valid TOTP atomically advances replay state and promotes the challenge (0.613024ms)
✔ invalid TOTP revokes its challenge and commits lockout evidence (0.99668ms)
✔ one-time bootstrap creates an active 2FA Super Admin under a database lock (1.884178ms)
✔ bootstrap command refuses missing one-time inputs before opening MySQL (0.681084ms)
✔ native Argon2id hashes verify correctly and reject malformed resource parameters (140.435149ms)
✔ AES-256-GCM encrypts TOTP secrets with admin-bound authenticated context (1.709701ms)
✔ TOTP matches RFC 6238 vectors and blocks accepted-step replay (1.22059ms)
✔ recovery codes are one-time-hashable, bounded, and never store plaintext (1.149414ms)
✔ admin challenge is opaque, hashed at rest, short-lived, and cookie-separated (2.68522ms)
✔ authenticated admin session loads server-side permissions and rolls idle expiry (1.357873ms)
✔ operational error classes expose stable codes and HTTP statuses (1.318283ms)
✔ AppError rejects invalid status codes and unstable error codes (0.490464ms)
✔ unknown errors normalize to a non-exposed internal failure (0.182249ms)
✔ malformed JSON normalizes to a safe client error (0.235808ms)
✔ configuration modules map validated values and preserve bigint-safe database options (14.676289ms)
✔ complete configuration is deeply frozen (1.48489ms)
✔ diagnostic projection does not expose configuration secrets (1.726886ms)
✔ mysql text: stored JSON scalars and objects decode exactly once through the real pool policy (4.312189ms)
✔ mysql binary: stored JSON scalars and objects decode exactly once through the real pool policy (1.080262ms)
✔ mysql static_text: stored JSON scalars and objects decode exactly once through the real pool policy (0.640745ms)
✔ mysql static_binary: stored JSON scalars and objects decode exactly once through the real pool policy (0.8409ms)
✔ mariadb text: stored JSON scalars and objects decode exactly once through the real pool policy (0.555799ms)
✔ mariadb binary: stored JSON scalars and objects decode exactly once through the real pool policy (0.607265ms)
✔ mariadb static_text: stored JSON scalars and objects decode exactly once through the real pool policy (0.287544ms)
✔ mariadb static_binary: stored JSON scalars and objects decode exactly once through the real pool policy (0.355394ms)
✔ MySQL version policy accepts supported Oracle MySQL and rejects alternatives (1.353675ms)
✔ acquired MySQL connections are initialized with UTC and strict SQL mode (0.295055ms)
✔ query helpers keep values parameterized and identifiers allowlisted (0.673844ms)
✔ pagination helpers clamp limits and calculate stable metadata (0.301515ms)
✔ transaction helper commits success and rolls back failure (0.512185ms)
✔ transaction helper retries only deadlock-class errors (0.251771ms)
✔ example template contains every declared key and validates in template mode (27.037576ms)
✔ valid production values are parsed into typed and frozen environment data (3.624473ms)
✔ runtime parsing rejects placeholders without exposing their values (2.114689ms)
✔ production validation rejects insecure transport, proxy, cache, logging, and cookie choices (1.547773ms)
✔ cross-field validation rejects unsafe TTL and upload directory relationships (1.34935ms)
✔ cross-field validation keeps route limits within the global request budget (1.513091ms)
✔ database configuration requires UTC and TLS for remote production servers (1.306957ms)
✔ path traversal and unknown template keys are rejected (3.54687ms)
✔ duplicate environment keys fail before parsing (1.09867ms)
✔ file loading rejects file typos while ignoring unrelated process variables (17.521174ms)
✔ unrelated process variables are ignored when strict file mode is not requested (1.286918ms)
✔ environment and nested diagnostic redaction hide all sensitive values (0.627405ms)
✔ health-check CLI parses bounded options and rejects unknown input (3.057208ms)
✔ health-check URL defaults locally and rejects embedded credentials (0.412088ms)
✔ health-check client validates the response contract (3.212627ms)
✔ application lifecycle moves through starting, ready, draining, and stopped (1.917828ms)
✔ application lifecycle rejects impossible transitions (0.513898ms)
✔ graceful shutdown stops HTTP before closing the database and is idempotent (5.876105ms)
✔ shutdown deadline force-closes connections and still closes the pool (10.2079ms)
✔ secret redaction handles nested keys, tokens, URL credentials, bigint, and cycles (1.628932ms)
✔ JSON logger applies thresholds, child bindings, and stderr separation (1.104739ms)
✔ hotfix changes only the pending FK action in the exact released MariaDB source (8.149085ms)
✔ repair preserves statement hashes, timestamps and completed migrations, then resumes at broadcasts (3.319134ms)
✔ repair refuses modified prior migration without altering the database history (2.0006ms)
✔ repair refuses incomplete prior migrations without altering the database history (0.574096ms)
✔ repair refuses old completed migration 010 without altering the database history (0.378578ms)
✔ repair refuses missing checkpoint without altering the database history (0.315004ms)
✔ repair refuses changed statement without altering the database history (0.453488ms)
✔ repair refuses unknown checksum without altering the database history (0.419328ms)
✔ repair refuses mixed checksums without altering the database history (0.47452ms)
✔ repair refuses rollback checkpoint without altering the database history (0.51498ms)
✔ repair refuses later progress without altering the database history (1.134503ms)
✔ repair refuses unrecorded broadcasts table without altering the database history (0.357236ms)
✔ repair refuses missing prefix table without altering the database history (0.335665ms)
✔ repair rolls back a checkpoint count mismatch and releases its schema lock (0.476663ms)
✔ repair refuses MySQL, an unrecognized SQL file, and an unavailable lock (0.333542ms)
✔ diagnostic output masks configured secrets in messages/frames and omits SQL and request data (1.97982ms)
✔ diagnostic redactor handles encryption buffers, tokens, terminal controls and long strings (27.53557ms)
✔ diagnostics reject write, lock, comment, outfile, and multiple-statement SQL before execution (1.912289ms)
✔ probe reports the failing stage, discards successful data and continues when used by the runner (0.814481ms)
✔ real bootstrap dependency services run against read-only queries and report no user data (5.774304ms)
✔ dependency failure is labelled and later checks continue without creating a missing user (2.199353ms)
✔ log scan reads bounded tails, filters request IDs, masks secrets and ignores unstructured lines (19.639818ms)
✔ log scan refuses symlinks, external configured directories, and invalid request IDs (4.662805ms)
✔ ledger validation rejects unbalanced, duplicate-account, and unsafe amount inputs (2.046076ms)
✔ balanced reward posts atomically and rebuilds the user projection (18.702315ms)
✔ a repeated ledger idempotency key returns the committed result without new entries (2.790684ms)
✔ reusing a ledger idempotency key for different data is rejected (1.603495ms)
✔ a debit cannot make a user available account negative (0.728514ms)
✔ reversal appends opposite entries and restores reward and lifetime projections (3.637393ms)
✔ wallet cursor is signed, round-trips, and rejects tampering (3.929264ms)
✔ wallet history validation bounds limit and rejects unknown query fields (3.285324ms)
✔ wallet returns authoritative integer strings and projection health (0.90893ms)
✔ history preserves available and held deltas and emits a signed next cursor (1.00343ms)
✔ projection comparison identifies exact mismatched fields (0.350467ms)
✔ reconciliation repair locks user accounts before replacing the snapshot (1.008327ms)
✔ Admin-created task always uses the server settlement currency and starts as draft (4.538021ms)
✔ publishing a future timer task uses optimistic versioning and scheduled state (1.177427ms)
✔ unsupported verification integrations and stale Admin versions fail closed (0.986915ms)
✔ an early task claim rolls back without creating a ledger reward (16.250761ms)
✔ verified task claim posts ledger and completion in one transaction (2.03414ms)
✔ manual verification claim becomes pending without issuing a reward (0.939886ms)
✔ claim idempotency replay returns the committed completion before task mutation (0.776945ms)
✔ task validation accepts only server-governed task fields and integer minor units (5.190213ms)
✔ eligibility rules fail closed when stored configuration is malformed (0.939235ms)
✔ eligibility evaluates username, geography, progress, and account age server-side (1.396809ms)
✔ completion policy enforces active, global, one-time, daily, and cooldown limits (0.269087ms)
✔ task configuration uses deployment URL policy and rejects unavailable callbacks (0.626604ms)
✔ start and claim idempotency hashes are scoped and compared safely (0.984752ms)
✔ completion period keys make one-time, daily, and repeatable awards deterministic (0.349886ms)
✔ scheduled task activates safely and snapshots all reward-critical fields on start (20.605472ms)
✔ an existing active attempt blocks a second start before any insert (1.80429ms)
✔ start idempotency replay returns the immutable destination snapshot (1.674198ms)
✔ referral policy uses safe defaults for invalid database settings (2.25159ms)
✔ referral activation waits for the server-counted task threshold (1.487133ms)
✔ eligible referral activation posts both server-controlled rewards atomically (1.402999ms)
✔ shared-device risk holds a referral and never posts a reward (0.342635ms)
✔ account restriction is evaluated before age and task progress (0.156982ms)
✔ Admin referral setting update versions history and commits optimistic write (2.605562ms)
✔ stale Admin referral setting version rolls back without writing (1.05119ms)
✔ Admin approval records review then re-runs activation in the same transaction (1.95953ms)
✔ Admin-created boxes persist only server-enforced free access fields (1.581752ms)
✔ stale Admin box updates roll back before a database mutation (1.557086ms)
✔ publish validates the reward pool and performs one optimistic transition (0.707152ms)
✔ reward inventory cannot be reduced below its immutable awarded count (0.401752ms)
✔ daily eligibility uses server task count and timezone period boundaries (21.35751ms)
✔ task requirements are evaluated from authoritative integer counts (0.287424ms)
✔ cooldown eligibility is anchored to the last committed claim (0.453599ms)
✔ weighted selection uses an injected cryptographic ticket boundary (0.474019ms)
✔ exhausted rewards are excluded and fixed mode requires exactly one reward (0.797065ms)
✔ publishing enforces free-only configuration and a valid reward pool (1.116086ms)
✔ Admin payloads cannot introduce payment fields or unsafe money numbers (4.553404ms)
✔ eligible free claim reserves inventory, posts ledger, and stores evidence atomically (16.566807ms)
✔ insufficient verified task progress rolls back before reward or ledger mutation (0.85445ms)
✔ a committed idempotency key returns the original claim without a new transaction (1.500362ms)
✔ earning-restricted users cannot reserve inventory or receive a reward (0.411577ms)
✔ reject atomically refunds the full held gross amount, never only the net amount (8.441927ms)
✔ the first high-value approval remains under review and does not move money (0.443073ms)
✔ the required final approval transitions to approved with immutable approval evidence (0.616879ms)
✔ manual paid confirmation settles held gross into exact net payout and fee credits (2.010344ms)
✔ decrypted destination details are released only after stored hash verification (1.64809ms)
✔ payout confirmation rejects stale versions and non-approved states before settlement (0.80027ms)
✔ global and method rules combine using the stricter financial limits (2.553735ms)
✔ percentage fees round upward and all amounts stay decimal strings (0.879477ms)
✔ eligibility is derived from server account, task, referral, wallet, day, and cooldown state (1.405252ms)
✔ restricted and too-new accounts fail closed (0.264159ms)
✔ dynamic destination fields reject unknown values and produce a safe display mask (1.521343ms)
✔ dual approval is required only at or above the configured high-value threshold (0.206655ms)
✔ withdrawal payload schemas reject client-controlled totals and unsafe numeric amounts (3.979247ms)
✔ Admin method and setting schemas enforce consistent fees and optimistic versions (12.586208ms)
✔ invalid stored setting values fall back to conservative defaults (0.406309ms)
✔ quote derives fee and expiry on the server without posting ledger entries (24.600001ms)
✔ request atomically encrypts details, holds the gross amount, consumes quote, and records history (5.622089ms)
✔ a concurrent quote-consumption conflict rolls back the complete request transaction (1.96719ms)
✔ idempotent request replays must match the original canonical input fingerprint (1.093943ms)
✔ managed setting policy preserves the free-only Mystery Box boundary (1.296161ms)
✔ managed setting policy bounds pagination and normalizes allowlisted URLs (0.335084ms)
✔ theme payload accepts the closed token contract and rejects CSS injection (4.206803ms)
✔ feature flag mutation permits rollout only and rejects targeting objects (1.495876ms)
✔ currency input canonicalizes ISO-style codes and caps decimal precision (3.529514ms)
✔ maintenance windows require strictly ordered timestamps (1.560531ms)
✔ setting updates write an immutable next-version record in one transaction (2.454429ms)
✔ setting updates reject null when it violates the stored value type (1.041956ms)
✔ settlement currency precision cannot change after ledger setup (1.001536ms)
✔ publishing a theme retires the former active theme inside the transaction (0.852397ms)
✔ plain content is encoded into inert server-generated HTML (1.509715ms)
✔ banner validation requires verified-media identity and paired actions (3.983584ms)
✔ announcement targeting schema is strict and date ordered (2.508348ms)
✔ tutorial validation rejects client lifecycle and malformed slugs (1.324793ms)
✔ announcement targeting fails closed for missing or mismatched user attributes (0.229658ms)
✔ disabled banner feature avoids every content database read (1.076066ms)
✔ banner creation rejects media that is not verified and public (1.262932ms)
✔ future announcement publishing selects scheduled state on the server clock (1.399373ms)
✔ tutorial creation rejects a URL outside the deployment allowlist (2.618882ms)
✔ media resolution blocks storage paths that escape the public root (0.614976ms)
✔ Telegram templates preserve allowlisted markup and escape every variable (2.364687ms)
✔ Template buttons are HTTPS-only and expose one closed Telegram keyboard shape (1.13935ms)
✔ Internal Telegram payload contract rejects arbitrary methods, chats, and oversized text (4.203128ms)
✔ Outbox claims use leases and exponential retry is bounded and honors Telegram retry-after (1.073492ms)
✔ Outbox worker completes successes and records failures without logging payloads (0.707383ms)
✔ Telegram job rejects malformed success responses instead of recording a false delivery (0.580335ms)
✔ Reminder next-run calculation follows IANA local time and ISO weekdays (67.513375ms)
✔ Broadcast creator cannot approve their own draft (0.785739ms)
✔ Transactional amount placeholders format integer minor units without floating point (0.419598ms)
✔ analytics periods use closed UTC dates and ISO calendar boundaries (3.156755ms)
✔ earning-history cursors are scoped, signed, and reject tampering (1.898279ms)
✔ earning history emits only signed server ledger deltas and an opaque next cursor (0.889681ms)
✔ earning summary keeps integer minor units and reports reversals separately (0.844365ms)
✔ public leaderboard uses snapshots and never requests Telegram identifiers (0.856863ms)
✔ rollup is idempotent per closed date and builds every allowlisted snapshot (1.472611ms)
✔ Admin financial reports keep monetary values behind a separate service method (2.264799ms)
✔ profile contract accepts explicit leaderboard privacy without accepting identity fields (2.302605ms)
✔ miniapp money formatting preserves every BIGINT minor unit including negative fractions (23.564685ms)
✔ miniapp amount entry never uses floating point or accepts exponent notation (0.461941ms)
✔ miniapp navigation normalizes hashes and rejects malformed or traversal routes (1.5933ms)
✔ miniapp rejects credential-bearing and executable URLs (0.335395ms)
✔ withdrawal field validation mirrors allowed format and option contracts (1.570816ms)
✔ miniapp API rejects non-local paths before sending credentials (2.425646ms)
✔ miniapp shares CSRF retrieval and coalesces concurrent identical mutations (7.238943ms)
✔ failed CSRF requests can be retried and do not send a mutation (3.728097ms)
✔ uncertain financial mutations reuse the same key on deliberate retry (1.447925ms)
✔ API failures retain safe request references and distinguish timeout (1.008787ms)
✔ authentication never invents a development identity outside Telegram (0.45441ms)
✔ theme tokens reject CSS injection and reset stale per-theme overrides (1.743791ms)
✔ admin client rejects external and traversal destinations before sending credentials (2.088689ms)
✔ admin mutations coalesce and use the admin CSRF token without persisting credentials (3.882415ms)
✔ failed mutations are never automatically retried and preserve error context (0.593645ms)
✔ session invalidation discards late responses and does not send an awaiting mutation (0.448051ms)
✔ 401 invalidates authentication while 403 keeps an actionable permission error (1.101945ms)
✔ catalog hides ungranted resources and exact withdrawal decision controls (0.470443ms)
✔ minor units remain decimal strings and numeric configuration rejects unsafe integers (0.358088ms)
✔ forms preserve optional omission, explicit null, booleans and nested reward values (127.825258ms)
✔ create task form submits only supported server fields and keeps rewards precise (24.202705ms)
✔ editing plain content round-trips server HTML without double encoding (13.281343ms)
✔ reminder form reconstructs template keys and keeps nested audience rules (18.72582ms)
✔ template editor sends all strict fields and represents nullable button config (16.442714ms)
✔ settings editor fixes free-only protection and preserves server versions (20.0621ms)
✔ resource query only includes route-supported fields and identities are encoded (0.490383ms)
✔ login completes password challenge and TOTP without persisting a password (26.483137ms)
✔ withdrawal confirmation requires review and duplicate clicks share one request (20.41519ms)
✔ conflict keeps the draft visible and prevents immediate resubmission (27.643128ms)
✔ resource UI renders hostile text inert and ignores a disposed response (18.17658ms)
✔ dashboard renders daily chart and table from real response values and isolates financial reports (15.174804ms)
✔ search phrases with spaces and encoded URL punctuation stay on the local admin endpoint (0.66485ms)
✔ admin entry restores an authenticated shell and logout clears its private data (21.181371ms)
✔ administrator form loads named roles, reviews the request and displays a one-time invitation safely (165.307423ms)
✔ wallet correction editor creates a stable hidden idempotency key per draft (11.416513ms)
✔ resolved fraud records offer no further review action (38.743144ms)
✔ enrollment accepts own password then verifies TOTP without retaining invitation or password fields (25.546717ms)
✔ closing enrollment while a response is pending cannot restore its secret (25.938414ms)
✔ enrollment API obtains anonymous admin CSRF and never exempts its mutations (1.346385ms)
✔ mobile authenticator app switching hides the setup key but permits returning with a code (19.382558ms)
✔ retry risk acknowledgement requires a deliberate checked choice (20.395491ms)
✔ administrative changes recheck active session and fresh permission before writing (6.3685ms)
✔ identity management cannot be delegated by assigning only a manage permission (1.66191ms)
✔ invitation stores only a token digest and does not provision active credentials (3.119789ms)
✔ self access changes and stale administrator versions cannot revoke the last operator (1.86545ms)
✔ administrator role/status change and session revocation commit together (2.795081ms)
✔ a cancelled, unenrolled administrator cannot be enabled through access editing (1.064259ms)
✔ built-in roles cannot be edited, while custom grants revoke assigned sessions (1.854014ms)
✔ account ban revokes sessions without leaving a permanent banned status after expiry (3.121393ms)
✔ unban removes only the selected scope and requires its separate permission (1.190926ms)
✔ competing fraud decisions have one winner and persist the review reason (1.632407ms)
✔ wallet correction preparation is idempotent and cannot change money (1.675911ms)
✔ wallet adjustment rejects self approval and posts exactly once under competing reviews (11.204781ms)
✔ insufficient debit rolls back review and ledger; rejection never changes money (1.05176ms)
✔ money and control inputs reject floats, forged actor fields and missing risk acknowledgement (2.522209ms)
✔ manual retry refuses sent, cancelled, unlinked, stale and permanent recipient failures (0.630971ms)
✔ manual retry retains attempt number/payload and only schedules one additional attempt (1.866532ms)
✔ retry rechecks delivery consent and cannot revive an ineligible campaign (0.372389ms)
✔ invitation enrollment consumes both tokens, encrypts TOTP, and returns recovery codes only once (5.267557ms)
✔ failed enrollment attempts commit their counter and stop verification after five codes (3.643812ms)
✔ outbox terminal failure records its linked job in the same executor and never writes for a lost lease (0.755153ms)
✔ administrative repositories bind arbitrary text and refuse arbitrary table names (0.478025ms)
✔ fraud evidence reveal redacts nested credentials and sensitive identity evidence (0.957291ms)
✔ release schema check is read-only and verifies the complete release (33.689927ms)
✔ release refuses missing schema history (20.447528ms)
✔ release refuses changed schema history (16.064335ms)
✔ release refuses missingSeed schema history (21.210178ms)
✔ release refuses partial schema history (12.125532ms)
✔ Redis fails immediately while offline and bounds queued commands (0.465176ms)
✔ production rejects unsafe DATABASE_QUEUE_LIMIT=0 (9.308625ms)
✔ production rejects unsafe REDIS_URL=redis://default:valid-pass@remote.internal:6379 (1.218367ms)
✔ production rejects unsafe REDIS_URL=redis://127.0.0.1:6379 (1.048666ms)
✔ live acceptance cannot select a production database or an unconfirmed target (0.445937ms)
✔ backup roundtrip preserves binary bytes and private output permissions (23.721125ms)
✔ backup rejects wrong-key and removes unauthenticated plaintext (12.167745ms)
✔ backup rejects ciphertext and removes unauthenticated plaintext (5.98862ms)
✔ backup rejects tag and removes unauthenticated plaintext (8.631221ms)
✔ backup rejects header and removes unauthenticated plaintext (10.605427ms)
✔ backup rejects truncated and removes unauthenticated plaintext (8.896737ms)
✔ backup rejects size-limit and removes unauthenticated plaintext (5.840131ms)
✔ backup and restore never overwrite an existing output (7.921078ms)
✔ backup key rejects malformed, ambiguous or short key material (0.552835ms)
✔ completed polling intervals release abort listeners over repeated cycles (34.607466ms)
✔ readiness times out even when the database connection queue never resolves (17.412463ms)
✔ mysql backup CLI publishes only a successful dump (failure=false) (134.551556ms)
✔ mysql backup CLI publishes only a successful dump (failure=true) (82.609857ms)
✔ mariadb backup CLI publishes only a successful dump (failure=false) (103.867234ms)
✔ mariadb backup CLI publishes only a successful dump (failure=true) (92.879028ms)
✔ admin user list schema caps page sizes and rejects deleted pseudo-filter (4.647632ms)
✔ admin user mappings preserve large numeric values as strings (1.265956ms)
✔ admin user list uses normalized pagination and parallel repository reads (0.838096ms)
✔ admin user detail combines profile, restrictions, wallets, and metrics (0.77989ms)
✔ cache returns a valid hit without invoking the loader (1.951267ms)
✔ cache fails open on malformed reads and write failures (0.391427ms)
✔ cache does not persist oversized responses (0.819018ms)
✔ local day and week boundaries are converted to UTC for Dhaka (17.697764ms)
✔ day boundaries respect daylight-saving transitions (0.69212ms)
✔ database and offset datetimes normalize to the same UTC representation (0.380071ms)
✔ theme tokens accept a closed safe schema and reject CSS injection (1.218397ms)
✔ setting guards accept only usable locale lists and IANA timezones (19.004236ms)
✔ bootstrap combines safe public configuration with user-scoped state (1.174812ms)
✔ dashboard returns decimal-safe strings and never exposes task destination URLs (3.525588ms)
✔ feature gates prevent disabled task and free-reward database reads (1.910937ms)
✔ database numeric guards reject unsafe representations (0.527558ms)
✔ free reward eligibility is display-only and honors frequency boundaries (0.252953ms)
✔ profile schema rejects Telegram-owned and financial fields (3.572037ms)
✔ profile reads expose Telegram IDs as strings and only public fields (1.057028ms)
✔ profile update validates flags/settings before opening a transaction (23.525006ms)
✔ disabled profile editing fails before a database transaction begins (1.140943ms)
✔ unsupported language and invalid timezone are rejected server-side (0.678881ms)
✔ memory rate-limit store increments and resets fixed windows (1.694318ms)
✔ Redis rate-limit store uses one atomic script and namespaced keys (0.573415ms)
✔ Redis client factory applies TLS verification and bounded reconnects (0.335194ms)
✔ Redis connection, readiness cache, and close lifecycle are bounded (0.616559ms)
✔ database readiness is cached and concurrent checks share one query (1.648491ms)
✔ database readiness fails closed without throwing dependency details (1.287929ms)
✔ migration runner applies each immutable migration once under a schema lock (6.300139ms)
✔ migration runner resumes after a partial DDL failure without replaying recorded statements (5.619266ms)
✔ migration runner rejects a changed file after it has been applied (0.56352ms)
✔ seeds require all migrations, run once, and rollback invalidates seed history (3.985707ms)
✔ validation middleware stores only schema-approved data and returns safe issues (9.651261ms)
✔ maintenance and ban gates use trusted server-side providers (0.862732ms)
✔ idempotency middleware hashes accepted keys and rejects duplicates (1.293477ms)
✔ audit middleware records completed mutations without delaying responses (5.369908ms)
✔ HMAC signatures are deterministic and reject modified input (1.864109ms)
✔ CSRF tokens are signed, session-bound, and time-limited (0.727172ms)
✔ secure random and idempotency helpers enforce bounded keys (0.450434ms)
✔ managed URL allowlist requires approved schemes, domains, and credential-free URLs (0.525635ms)
✔ HTML and plain-text helpers encode markup and remove unsafe controls (0.432377ms)
✔ Spaceship accepts the supplied MariaDB release and rejects other engine/version families (1.507142ms)
✔ Spaceship production configuration keeps database rate limiting without Redis (10.151758ms)
✔ Spaceship refuses unsafe profile override RATE_LIMIT_STORE=memory (0.827801ms)
✔ Spaceship refuses unsafe profile override DATABASE_DIALECT=mysql (0.565423ms)
✔ Spaceship refuses unsafe profile override REDIS_ENABLED=true (0.573916ms)
✔ Spaceship refuses unsafe profile override QUEUE_BATCH_SIZE=20 (0.503052ms)
✔ Spaceship refuses unsafe profile override DATABASE_CONNECTION_LIMIT=1 (2.972924ms)
✔ Spaceship refuses unsafe profile override DATABASE_CONNECTION_LIMIT=10 (0.540687ms)
✔ Spaceship refuses unsafe profile override DATABASE_QUEUE_LIMIT=0 (0.49499ms)
✔ the Spaceship template includes and validates every environment key (13.272574ms)
✔ MariaDB requires the configured engine, its collation alias and enabled CHECK constraints (1.184096ms)
✔ MariaDB permits only the reviewed broadcast FK difference and refuses MySQL history (50.072829ms)
✔ persistent workers are rejected before opening any connection on Spaceship (2.627553ms)
✔ database rate limit uses a transaction and database clock without storing the client key (0.564833ms)
✔ database limiter outage denies the request with 503 (0.482271ms)
✔ cron already_running does not execute work (0.775574ms)
✔ cron interval_not_elapsed does not execute work (0.161438ms)
✔ cron reports failures without private payloads and releases its connection lock (0.378939ms)
✔ cron defers further batches when its work budget expires (0.275977ms)
✔ cron stops work when the owning database lock is lost (0.250669ms)
✔ SQL splitter preserves quoted semicolons and removes comments (1.609864ms)
✔ migration parser requires both sections and rejects session control (1.325394ms)
✔ seed parser accepts one section and checksum is deterministic (0.882241ms)
✔ all migration and seed files load in contiguous order (45.801601ms)
✔ Telegram exchange creates one user, first-touch referral, and opaque session atomically (2.411546ms)
✔ existing Telegram users retain their internal database ID during profile sync (0.451856ms)
✔ simultaneous first login recovers from a unique-user insert race (0.839769ms)
✔ Telegram API client sends JSON webhook settings and exposes no token on failure (3.019361ms)
✔ bot command routing is private-chat only and preserves a bounded referral payload (0.491165ms)
✔ Mini App keyboards require HTTPS and Telegram HTML is escaped (0.300463ms)
✔ webhook service acknowledges duplicates and retries failed processing safely (0.293632ms)
✔ failed webhook retries cannot replace the payload for an existing update ID (1.423539ms)
✔ Telegram initData validates HMAC, freshness, and bigint-safe identity strings (4.154586ms)
✔ Telegram initData rejects tampering, expiry, future dates, and duplicate protected fields (2.555823ms)
✔ Telegram initData rejects bot users and unsafe numeric identities (1.180761ms)
✔ user sessions store only a hash and emit an HttpOnly secure cookie (2.906545ms)
✔ cookie and IP parsing fail safely on malformed values (9.29159ms)
✔ session authentication maps public identity and rolls idle expiry server-side (0.608837ms)
✔ public IDs are 26-character sortable Crockford identifiers (0.404747ms)
ℹ tests 491
ℹ suites 0
ℹ pass 491
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 4075.426754

[phase-20-check] Running verify:environment:example
npm warn Unknown env config "http-proxy". This will stop working in the next major version of npm.

> telegram-task-earning@0.20.1 verify:environment:example
> node bin/verify-environment.js --example

Telegram Task Earning — Phase 20 environment verification
Mode: example-template
Source: .env.example (found)
Node.js: v24.19.0 (supported)
Keys: 89/89 recognized
Placeholders: 13
Environment verification passed.

[phase-20-check] Running verify:database-schema
npm warn Unknown env config "http-proxy". This will stop working in the next major version of npm.

> telegram-task-earning@0.20.1 verify:database-schema
> node scripts/verify-database-schema.js

Database schema verified: 23 migrations, 6 seeds, 77 tables, 259 named constraints, 202 up statements, 178 down statements, 19 seed statements.

[phase-20-check] Running verify:spaceship
npm warn Unknown env config "http-proxy". This will stop working in the next major version of npm.

> telegram-task-earning@0.20.1 verify:spaceship
> node scripts/verify-spaceship.js

{"passed":true,"scope":"static-only","migrations":24,"seeds":6,"liveMariaDb":"pending"}

[phase-20-check] Running build:css
npm warn Unknown env config "http-proxy". This will stop working in the next major version of npm.

> telegram-task-earning@0.20.1 build:css
> node scripts/build-css.js

npm warn Unknown env config "http-proxy". This will stop working in the next major version of npm.

> telegram-task-earning@0.20.1 build:css:miniapp
> postcss resources/css/miniapp.css --output public/miniapp/css/app.min.css --env production

npm warn Unknown env config "http-proxy". This will stop working in the next major version of npm.

> telegram-task-earning@0.20.1 build:css:admin
> postcss resources/css/admin.css --output public/admin/css/admin.min.css --env production

CSS bundles built successfully.

[phase-20-check] Running verify:project
npm warn Unknown env config "http-proxy". This will stop working in the next major version of npm.

> telegram-task-earning@0.20.1 verify:project
> node scripts/verify-project.js

Phase 20 project verification passed: 81 directories, 521 required files, and 40 npm scripts.

Phase 20 quality gate passed.