WACP3 实现企微审批补偿拉取 POC

server/src/scripts/check-wecom-approval-compensation-poc.js

@@ -0,0 +1,741 @@
+#!/usr/bin/env node
+require("dotenv/config");
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+const { getConfig } = require("../config");
+const {
+  APPROVAL_GET_INFO_ENDPOINT,
+  APPROVAL_POC_TARGETS,
+  fetchWecomApprovalDetail,
+  fetchWecomApprovalInfoList,
+  maskApprovalIdentifier,
+} = require("../services/integrations/wecomApproval");
+const { readCallbackEvidence } = require("../services/integrations/wecomCallbackCrypto");
+
+const DEFAULT_REPORT_ROOT = path.resolve(__dirname, "../../../artifacts/qa-flow");
+const DEFAULT_WINDOW_HOURS = 72;
+const DEFAULT_PAGE_SIZE = 100;
+const DEFAULT_MAX_PAGES = 10;
+
+const REPORT_PRIVACY =
+  "approval counts/status summaries/masked sp_no/template/userid prefixes only; no phone/email/token/secret/full userid/full template_id/full sp_no/form values/attachments/comments/raw payload";
+
+const TEMPLATE_ENV = Object.freeze({
+  leave: "WECOM_APPROVAL_LEAVE_TEMPLATE_ID",
+  missed_punch: "WECOM_APPROVAL_MISSED_PUNCH_TEMPLATE_ID",
+});
+
+function printHelp() {
+  process.stdout.write(`Usage: node src/scripts/check-wecom-approval-compensation-poc.js [options]
+
+QA-only 企业微信审批补偿拉取 POC。
+默认 dry-run 只检查配置和计划；--live 仅做只读 getapprovalinfo/getapprovaldetail，不写 OA/企微数据。
+
+Options:
+  --live                         启用企微 live 只读拉取。
+  --format=text|json             输出格式，默认 text。
+  --report-dir=<path>            报告目录，默认 artifacts/qa-flow/wecom-approval-compensation-poc-<timestamp>。
+  --start-time=<iso|epoch>       窗口开始时间，默认 end-time 前 72 小时。
+  --end-time=<iso|epoch>         窗口结束时间，默认当前时间。
+  --template=leave:<id>          指定请假模板 ID，用于 template_id filter。
+  --template=missed_punch:<id>   指定补卡模板 ID，用于 template_id filter。
+  --size=<1..100>                单页审批单号数量，默认 100。
+  --help                         显示帮助。
+
+Secret 固定规则：
+  审批单号批量查询和审批详情读取：WECOM_AGENT_SECRET。
+  不使用 WECOM_CONTACT_SECRET、WECOM_CHECKIN_SECRET 或 WECOM_HR_ASSISTANT_SECRET 兜底。
+
+隐私边界：
+  报告只输出审批类型、计数、状态摘要、脱敏 sp_no/template/userid 前缀和错误分类。
+  不输出手机号、邮箱、token、secret、完整 userid、完整 template_id、完整 sp_no、表单值、附件、评论或企微原始 payload。
+`);
+}
+
+function timestamp() {
+  return new Date().toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
+}
+
+function toSafeString(value, maxLength = 500) {
+  if (value == null) return "";
+  return String(value).trim().slice(0, maxLength);
+}
+
+function safeMessage(value) {
+  return toSafeString(value, 500)
+    .replace(/access_token=[^&\s]+/gi, "access_token=***")
+    .replace(/[A-Za-z0-9_-]{24,}/g, "***")
+    .slice(0, 240);
+}
+
+function supportedTargetKeys() {
+  return APPROVAL_POC_TARGETS.map((item) => item.key);
+}
+
+function parseTargetPair(value, flagName) {
+  const raw = toSafeString(value, 500);
+  const separatorIndex = raw.indexOf(":");
+  if (separatorIndex <= 0) {
+    throw new Error(`${flagName} requires <target>:<value>`);
+  }
+  const target = raw.slice(0, separatorIndex).trim();
+  const itemValue = raw.slice(separatorIndex + 1).trim();
+  if (!supportedTargetKeys().includes(target)) {
+    throw new Error(`${flagName} unsupported target: ${target}`);
+  }
+  if (!itemValue) {
+    throw new Error(`${flagName} requires non-empty value`);
+  }
+  return { target, value: itemValue };
+}
+
+function parseArgs(argv) {
+  const options = {
+    live: false,
+    format: "text",
+    reportDir: path.join(DEFAULT_REPORT_ROOT, `wecom-approval-compensation-poc-${timestamp()}`),
+    startTime: "",
+    endTime: "",
+    templates: {},
+    size: DEFAULT_PAGE_SIZE,
+    maxPages: DEFAULT_MAX_PAGES,
+    help: false,
+  };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === "--help" || arg === "-h") {
+      options.help = true;
+    } else if (arg === "--live") {
+      options.live = true;
+    } else if (arg === "--no-live") {
+      options.live = false;
+    } else if (arg === "--format") {
+      options.format = argv[index + 1] || options.format;
+      index += 1;
+    } else if (arg.startsWith("--format=")) {
+      options.format = arg.slice("--format=".length);
+    } else if (arg === "--report-dir") {
+      options.reportDir = argv[index + 1] || options.reportDir;
+      index += 1;
+    } else if (arg.startsWith("--report-dir=")) {
+      options.reportDir = arg.slice("--report-dir=".length);
+    } else if (arg === "--start-time") {
+      options.startTime = argv[index + 1] || "";
+      index += 1;
+    } else if (arg.startsWith("--start-time=")) {
+      options.startTime = arg.slice("--start-time=".length);
+    } else if (arg === "--end-time") {
+      options.endTime = argv[index + 1] || "";
+      index += 1;
+    } else if (arg.startsWith("--end-time=")) {
+      options.endTime = arg.slice("--end-time=".length);
+    } else if (arg === "--template") {
+      const pair = parseTargetPair(argv[index + 1], "--template");
+      options.templates[pair.target] = pair.value;
+      index += 1;
+    } else if (arg.startsWith("--template=")) {
+      const pair = parseTargetPair(arg.slice("--template=".length), "--template");
+      options.templates[pair.target] = pair.value;
+    } else if (arg === "--size") {
+      options.size = Number(argv[index + 1] || options.size);
+      index += 1;
+    } else if (arg.startsWith("--size=")) {
+      options.size = Number(arg.slice("--size=".length));
+    } else {
+      throw new Error(`Unsupported argument: ${arg}`);
+    }
+  }
+
+  if (!["text", "json"].includes(options.format)) {
+    throw new Error(`Unsupported --format: ${options.format}`);
+  }
+  if (!Number.isFinite(options.size) || options.size < 1 || options.size > 100) {
+    throw new Error("--size must be between 1 and 100");
+  }
+  options.size = Math.floor(options.size);
+  return options;
+}
+
+function parseTimeInput(value) {
+  const raw = toSafeString(value, 80);
+  if (!raw) return null;
+  if (/^\d+$/.test(raw)) {
+    const numeric = Number(raw);
+    return numeric > 100000000000 ? Math.floor(numeric / 1000) : numeric;
+  }
+  const parsed = Date.parse(raw);
+  if (!Number.isFinite(parsed)) {
+    throw new Error(`Invalid time value: ${raw}`);
+  }
+  return Math.floor(parsed / 1000);
+}
+
+function buildTimeWindow(options, generatedAt) {
+  const generatedEnd = Math.floor(new Date(generatedAt).getTime() / 1000);
+  const endTime = parseTimeInput(options.endTime) || generatedEnd;
+  const startTime = parseTimeInput(options.startTime) || (endTime - DEFAULT_WINDOW_HOURS * 60 * 60);
+  if (!Number.isFinite(startTime) || !Number.isFinite(endTime) || startTime <= 0 || endTime <= 0 || startTime >= endTime) {
+    throw new Error("Invalid approval compensation time window");
+  }
+  return {
+    startTime,
+    endTime,
+    startIso: new Date(startTime * 1000).toISOString(),
+    endIso: new Date(endTime * 1000).toISOString(),
+    defaultWindowHours: DEFAULT_WINDOW_HOURS,
+  };
+}
+
+function envValue(env, name) {
+  return toSafeString(env[name], 500);
+}
+
+function buildInputs(options, env = process.env) {
+  return APPROVAL_POC_TARGETS.map((target) => {
+    const cliTemplateId = toSafeString(options.templates[target.key], 500);
+    const envTemplateId = envValue(env, TEMPLATE_ENV[target.key]);
+    const templateId = cliTemplateId || envTemplateId;
+    return {
+      key: target.key,
+      label: target.label,
+      templateId,
+      templateIdPrefix: maskApprovalIdentifier(templateId),
+      templateSource: templateId ? (cliTemplateId ? "cli" : TEMPLATE_ENV[target.key]) : null,
+      templateMissingEnv: templateId ? [] : [TEMPLATE_ENV[target.key]],
+    };
+  });
+}
+
+function buildSecretCheck(config) {
+  const missing = [];
+  if (!config.wecomCorpId) missing.push("WECOM_CORP_ID");
+  if (!config.wecomAgentSecret) missing.push("WECOM_AGENT_SECRET");
+  return {
+    id: "approval_compensation_secret_matrix",
+    source: "WECOM_AGENT_SECRET",
+    endpoints: [
+      `POST ${APPROVAL_GET_INFO_ENDPOINT}`,
+      "POST /cgi-bin/oa/getapprovaldetail",
+    ],
+    status: missing.length ? "BLOCKED" : "OK",
+    missing,
+    noFallback: [
+      "WECOM_CONTACT_SECRET",
+      "WECOM_CHECKIN_SECRET",
+      "WECOM_HR_ASSISTANT_SECRET",
+    ],
+  };
+}
+
+function summarizeApiResponse(response) {
+  if (!response || typeof response !== "object") return null;
+  const summary = {};
+  for (const key of [
+    "errcode",
+    "errmsg",
+    "spNoCount",
+    "spNoPrefixes",
+    "nextCursorPresent",
+    "spStatus",
+    "applyFieldCount",
+    "approvalNodeCount",
+    "notifyerCount",
+    "commentCount",
+  ]) {
+    if (response[key] != null) {
+      summary[key] = key === "errmsg" ? safeMessage(response[key]) : response[key];
+    }
+  }
+  return Object.keys(summary).length ? summary : null;
+}
+
+function statusLabelFromSpStatus(value) {
+  const key = toSafeString(value, 20);
+  return {
+    "1": "审批中",
+    "2": "已通过",
+    "3": "已驳回",
+    "4": "已撤销",
+    "6": "通过后撤销",
+    "7": "已删除",
+    "10": "已支付",
+  }[key] || (key ? `状态${key}` : null);
+}
+
+function summarizeDetailResult(target, spNo, result) {
+  const summary = result?.summary || {};
+  const spStatus = summary.spStatus == null ? null : toSafeString(summary.spStatus, 40);
+  return {
+    target: target.key,
+    label: target.label,
+    status: result?.ok ? "OK" : "BLOCKED",
+    reason: result?.ok ? null : result?.code || "wecom_approval_detail_failed",
+    message: result?.message ? safeMessage(result.message) : null,
+    source: result?.tokenSource || "WECOM_AGENT_SECRET",
+    spNoPrefix: maskApprovalIdentifier(spNo),
+    templateIdPrefix: summary.templateIdPrefix || target.templateIdPrefix,
+    spStatus,
+    statusLabel: statusLabelFromSpStatus(spStatus),
+    applyFieldCount: summary.applyFieldCount,
+    approvalNodeCount: summary.approvalNodeCount,
+    notifyerCount: summary.notifyerCount,
+    commentCount: summary.commentCount,
+    response: summarizeApiResponse(result?.response),
+  };
+}
+
+function buildMissingTemplateCheck(input) {
+  return {
+    id: "approval_compensation_pull",
+    target: input.key,
+    label: input.label,
+    endpoint: `POST ${APPROVAL_GET_INFO_ENDPOINT}`,
+    source: "WECOM_AGENT_SECRET",
+    status: "NEEDS_CONFIG",
+    missingEnv: input.templateMissingEnv,
+    templateIdPrefix: null,
+    pageCount: 0,
+    spNoCount: 0,
+    details: [],
+  };
+}
+
+function buildDryRunTargetCheck(input) {
+  return {
+    id: "approval_compensation_pull",
+    target: input.key,
+    label: input.label,
+    endpoint: `POST ${APPROVAL_GET_INFO_ENDPOINT}`,
+    source: "WECOM_AGENT_SECRET",
+    status: "DRY_RUN_READY",
+    templateIdPrefix: input.templateIdPrefix,
+    configuredFrom: input.templateSource,
+    pageCount: 0,
+    spNoCount: 0,
+    details: [],
+  };
+}
+
+async function runLiveTarget({
+  config,
+  input,
+  timeWindow,
+  options,
+  fetchApprovalInfoListImpl,
+  fetchApprovalDetailImpl,
+}) {
+  const pages = [];
+  const spNos = [];
+  let cursor = "";
+  let pageIndex = 0;
+  let blocked = null;
+
+  do {
+    pageIndex += 1;
+    const result = await fetchApprovalInfoListImpl({
+      config,
+      startTime: timeWindow.startTime,
+      endTime: timeWindow.endTime,
+      size: options.size,
+      nextCursor: cursor,
+      filters: [{ key: "template_id", value: input.templateId }],
+    });
+    pages.push({
+      page: pageIndex,
+      status: result.ok ? "OK" : "BLOCKED",
+      reason: result.ok ? null : result.code,
+      message: result.message ? safeMessage(result.message) : null,
+      source: result.tokenSource || "WECOM_AGENT_SECRET",
+      response: summarizeApiResponse(result.response),
+      spNoCount: result.spNos?.length || 0,
+      spNoPrefixes: (result.spNos || []).map(maskApprovalIdentifier),
+      nextCursorPresent: Boolean(result.nextCursor),
+    });
+    if (!result.ok) {
+      blocked = result;
+      break;
+    }
+    spNos.push(...(result.spNos || []));
+    const nextCursor = toSafeString(result.nextCursor, 160);
+    cursor = nextCursor && nextCursor !== cursor ? nextCursor : "";
+  } while (cursor && pageIndex < options.maxPages);
+
+  if (blocked) {
+    return {
+      id: "approval_compensation_pull",
+      target: input.key,
+      label: input.label,
+      endpoint: `POST ${APPROVAL_GET_INFO_ENDPOINT}`,
+      source: blocked.tokenSource || "WECOM_AGENT_SECRET",
+      status: "BLOCKED",
+      reason: blocked.code,
+      message: blocked.message ? safeMessage(blocked.message) : null,
+      templateIdPrefix: input.templateIdPrefix,
+      configuredFrom: input.templateSource,
+      pageCount: pages.length,
+      spNoCount: 0,
+      pages,
+      details: [],
+    };
+  }
+
+  const uniqueSpNos = Array.from(new Set(spNos));
+  const details = [];
+  for (const spNo of uniqueSpNos) {
+    const detailResult = await fetchApprovalDetailImpl({ config, spNo });
+    details.push(summarizeDetailResult(input, spNo, detailResult));
+  }
+
+  const detailBlocked = details.find((item) => item.status === "BLOCKED");
+  return {
+    id: "approval_compensation_pull",
+    target: input.key,
+    label: input.label,
+    endpoint: `POST ${APPROVAL_GET_INFO_ENDPOINT}`,
+    source: "WECOM_AGENT_SECRET",
+    status: detailBlocked ? "BLOCKED" : "OK",
+    reason: detailBlocked ? detailBlocked.reason : null,
+    templateIdPrefix: input.templateIdPrefix,
+    configuredFrom: input.templateSource,
+    pageCount: pages.length,
+    spNoCount: uniqueSpNos.length,
+    pages,
+    details,
+    findings: cursor ? [{ id: "approval_compensation_pagination_truncated", status: "FINDING" }] : [],
+  };
+}
+
+async function runTargetChecks({
+  config,
+  inputs,
+  timeWindow,
+  options,
+  fetchApprovalInfoListImpl,
+  fetchApprovalDetailImpl,
+}) {
+  const targetChecks = [];
+  for (const input of inputs) {
+    if (!input.templateId) {
+      targetChecks.push(buildMissingTemplateCheck(input));
+    } else if (!options.live) {
+      targetChecks.push(buildDryRunTargetCheck(input));
+    } else {
+      targetChecks.push(await runLiveTarget({
+        config,
+        input,
+        timeWindow,
+        options,
+        fetchApprovalInfoListImpl,
+        fetchApprovalDetailImpl,
+      }));
+    }
+  }
+  return targetChecks;
+}
+
+function sanitizeEvidenceEvent(event) {
+  return {
+    callbackKind: toSafeString(event.callbackKind, 80),
+    approvalType: toSafeString(event.approvalType, 80),
+    spStatus: event.spStatus == null ? null : toSafeString(event.spStatus, 40),
+    statusLabel: toSafeString(event.statusLabel, 80) || null,
+    spNoPrefix: toSafeString(event.spNoPrefix, 80) || null,
+    templateIdPrefix: toSafeString(event.templateIdPrefix, 80) || null,
+    recordedAt: toSafeString(event.recordedAt, 80) || null,
+  };
+}
+
+async function buildEvidenceCheck({ config, readCallbackEvidenceImpl = readCallbackEvidence }) {
+  const events = await readCallbackEvidenceImpl({
+    evidenceFile: config.wecomApprovalCallbackEvidenceFile,
+  });
+  const approvalEvents = (events || [])
+    .filter((item) => item?.callbackKind === "approval_status_change")
+    .map(sanitizeEvidenceEvent);
+  const bySpNoPrefix = {};
+  for (const event of approvalEvents) {
+    if (!event.spNoPrefix) continue;
+    bySpNoPrefix[event.spNoPrefix] = bySpNoPrefix[event.spNoPrefix] || [];
+    bySpNoPrefix[event.spNoPrefix].push(event);
+  }
+  return {
+    id: "callback_event_evidence",
+    status: approvalEvents.length ? "OK" : "PENDING",
+    eventCount: approvalEvents.length,
+    latestEvent: approvalEvents[approvalEvents.length - 1] || null,
+    bySpNoPrefix,
+  };
+}
+
+function collectPulledDetails(targetChecks) {
+  return targetChecks.flatMap((target) => (
+    Array.isArray(target.details)
+      ? target.details.filter((item) => item.status === "OK")
+      : []
+  ));
+}
+
+function compareCallbackEvidence(targetChecks, evidenceCheck) {
+  const findings = [];
+  const pulledDetails = collectPulledDetails(targetChecks);
+  const evidenceBySpNo = evidenceCheck.bySpNoPrefix || {};
+  const pulledPrefixes = new Set();
+
+  for (const detail of pulledDetails) {
+    if (!detail.spNoPrefix) continue;
+    pulledPrefixes.add(detail.spNoPrefix);
+    const events = evidenceBySpNo[detail.spNoPrefix] || [];
+    if (!events.length) {
+      findings.push({
+        id: "callback_missing_for_pulled_detail",
+        target: detail.target,
+        spNoPrefix: detail.spNoPrefix,
+        status: "FINDING",
+      });
+      continue;
+    }
+    if (events.length > 1) {
+      findings.push({
+        id: "callback_duplicate_for_pulled_detail",
+        target: detail.target,
+        spNoPrefix: detail.spNoPrefix,
+        count: events.length,
+        status: "FINDING",
+      });
+    }
+    const hasStatusMatch = events.some((event) => (
+      (event.spStatus && detail.spStatus && event.spStatus === detail.spStatus)
+      || (event.statusLabel && detail.statusLabel && event.statusLabel === detail.statusLabel)
+    ));
+    if (!hasStatusMatch) {
+      findings.push({
+        id: "callback_status_mismatch",
+        target: detail.target,
+        spNoPrefix: detail.spNoPrefix,
+        pulledStatus: detail.statusLabel || detail.spStatus,
+        callbackStatus: events[0]?.statusLabel || events[0]?.spStatus || null,
+        status: "FINDING",
+      });
+    }
+  }
+
+  for (const [spNoPrefix, events] of Object.entries(evidenceBySpNo)) {
+    if (!pulledPrefixes.has(spNoPrefix)) {
+      findings.push({
+        id: "callback_not_in_compensation_window",
+        spNoPrefix,
+        count: events.length,
+        status: "FINDING",
+      });
+    }
+  }
+
+  return {
+    id: "callback_compensation_compare",
+    status: findings.length ? "FINDINGS" : "OK",
+    pulledDetailCount: pulledDetails.length,
+    callbackEventCount: evidenceCheck.eventCount,
+    findings,
+  };
+}
+
+function collectConfigGaps(targetChecks, verificationGaps, evidenceCheck, compareCheck) {
+  const gaps = [];
+  for (const check of targetChecks) {
+    if (check.status === "NEEDS_CONFIG") {
+      gaps.push({
+        id: check.id,
+        target: check.target,
+        status: "NEEDS_CONFIG",
+        missingEnv: check.missingEnv || [],
+      });
+    }
+  }
+  for (const gap of verificationGaps) {
+    gaps.push(gap);
+  }
+  const pulledCount = compareCheck?.pulledDetailCount || 0;
+  const hasTemplateConfigGap = targetChecks.some((item) => item.status === "NEEDS_CONFIG");
+  if (pulledCount === 0
+    && !verificationGaps.length
+    && !hasTemplateConfigGap
+    && !targetChecks.some((item) => item.status === "BLOCKED")) {
+    gaps.push({
+      id: "approval_compensation_window_empty",
+      status: "NEEDS_CONFIG",
+      reason: "no_existing_oa_poc_approval_in_window",
+    });
+  }
+  if (!verificationGaps.length && pulledCount > 0 && evidenceCheck.status !== "OK") {
+    gaps.push({
+      id: "callback_evidence_missing",
+      status: "NEEDS_CONFIG",
+      reason: "no_wcbk1_callback_evidence_available_for_compare",
+    });
+  }
+  return gaps;
+}
+
+function collectMainBlockers(secretCheck, targetChecks) {
+  const blockers = [];
+  if (secretCheck.status === "BLOCKED") {
+    blockers.push({
+      id: secretCheck.id,
+      reason: "missing_required_wecom_approval_config",
+      missing: secretCheck.missing,
+    });
+  }
+  for (const check of targetChecks) {
+    if (check.status === "BLOCKED") {
+      blockers.push({
+        id: check.id,
+        target: check.target,
+        reason: check.reason || "wecom_approval_compensation_api_blocked",
+      });
+    }
+  }
+  return blockers;
+}
+
+function evaluateConclusion({ mainBlockers, configGaps, compareCheck }) {
+  if (mainBlockers.length) {
+    return { status: "SKIP", conclusion: "BLOCKED_BY_EXTERNAL_CONFIG" };
+  }
+  if (configGaps.length) {
+    return {
+      status: "PARTIAL_COMPENSATION_NEEDS_CONFIG",
+      conclusion: "PARTIAL_COMPENSATION_NEEDS_CONFIG",
+    };
+  }
+  if (compareCheck?.findings?.length) {
+    return { status: "PASS_WITH_FINDINGS", conclusion: "PASS_WITH_FINDINGS" };
+  }
+  return { status: "PASS_COMPENSATION_POC", conclusion: "PASS_COMPENSATION_POC" };
+}
+
+async function executeCompensationPoc(options, deps = {}) {
+  const env = deps.env || process.env;
+  const generatedAt = deps.generatedAt || new Date().toISOString();
+  const config = deps.config || getConfig();
+  const timeWindow = buildTimeWindow(options, generatedAt);
+  const inputs = buildInputs(options, env);
+  const secretCheck = buildSecretCheck(config);
+  const targetChecks = await runTargetChecks({
+    config,
+    inputs,
+    timeWindow,
+    options,
+    fetchApprovalInfoListImpl: deps.fetchApprovalInfoListImpl || fetchWecomApprovalInfoList,
+    fetchApprovalDetailImpl: deps.fetchApprovalDetailImpl || fetchWecomApprovalDetail,
+  });
+  const evidenceCheck = await buildEvidenceCheck({
+    config,
+    readCallbackEvidenceImpl: deps.readCallbackEvidenceImpl,
+  });
+  const compareCheck = compareCallbackEvidence(targetChecks, evidenceCheck);
+  const verificationGaps = options.live ? [] : [{
+    id: "live_read",
+    status: "DRY_RUN",
+    reason: "run_with_--live_for_public_readonly_gate",
+  }];
+  const mainBlockers = collectMainBlockers(secretCheck, targetChecks);
+  const configGaps = collectConfigGaps(targetChecks, verificationGaps, evidenceCheck, compareCheck);
+  const conclusion = evaluateConclusion({ mainBlockers, configGaps, compareCheck });
+
+  return {
+    mode: "qa_only",
+    generatedAt,
+    status: conclusion.status,
+    conclusion: conclusion.conclusion,
+    privacy: REPORT_PRIVACY,
+    scope: {
+      issue: "WACP3",
+      targets: APPROVAL_POC_TARGETS.map((item) => item.key),
+      writeBehavior: "read-only only; no OA writes, no WeCom writes, no template creation, no approval submission",
+      liveRead: Boolean(options.live),
+      deepMirror: "not_started",
+      nextStage: "WREAD1",
+    },
+    timeWindow,
+    inputs: {
+      templates: Object.fromEntries(inputs.map((item) => [item.key, {
+        configured: Boolean(item.templateId),
+        configuredFrom: item.templateSource,
+        templateIdPrefix: item.templateIdPrefix,
+      }])),
+      pageSize: options.size,
+      maxPages: options.maxPages,
+    },
+    checks: {
+      secretMatrix: secretCheck,
+      targets: targetChecks,
+      callbackEvidence: {
+        ...evidenceCheck,
+        bySpNoPrefix: undefined,
+      },
+      callbackCompare: compareCheck,
+    },
+    configGaps,
+    mainBlockers,
+  };
+}
+
+function ensureReportDir(reportDir) {
+  fs.mkdirSync(reportDir, { recursive: true });
+}
+
+function writeReport(reportDir, report) {
+  ensureReportDir(reportDir);
+  const filePath = path.join(reportDir, "summary.json");
+  fs.writeFileSync(filePath, `${JSON.stringify(report, null, 2)}\n`, "utf8");
+  return filePath;
+}
+
+function printText(report, reportPath) {
+  process.stdout.write(`[wecom-approval-compensation-poc] status=${report.status} conclusion=${report.conclusion}\n`);
+  process.stdout.write(`[wecom-approval-compensation-poc] report=${reportPath}\n`);
+  process.stdout.write(`[wecom-approval-compensation-poc] privacy=${report.privacy}\n`);
+  process.stdout.write(`[wecom-approval-compensation-poc] liveRead=${report.scope.liveRead} targets=${report.scope.targets.join(",")}\n`);
+  if (report.configGaps?.length) {
+    process.stdout.write(`[wecom-approval-compensation-poc] configGaps=${JSON.stringify(report.configGaps)}\n`);
+  }
+  if (report.mainBlockers?.length) {
+    process.stdout.write(`[wecom-approval-compensation-poc] mainBlockers=${JSON.stringify(report.mainBlockers)}\n`);
+  }
+}
+
+async function main() {
+  const options = parseArgs(process.argv.slice(2));
+  if (options.help) {
+    printHelp();
+    return;
+  }
+  const report = await executeCompensationPoc(options);
+  const reportPath = writeReport(options.reportDir, report);
+  if (options.format === "json") {
+    process.stdout.write(`${JSON.stringify({ ...report, reportPath }, null, 2)}\n`);
+  } else {
+    printText(report, reportPath);
+  }
+}
+
+if (require.main === module) {
+  main().catch((error) => {
+    process.stderr.write(`[wecom-approval-compensation-poc][FAIL] ${safeMessage(error?.message || error)}\n`);
+    process.exitCode = 1;
+  });
+}
+
+module.exports = {
+  buildInputs,
+  buildSecretCheck,
+  buildTimeWindow,
+  compareCallbackEvidence,
+  evaluateConclusion,
+  executeCompensationPoc,
+  parseArgs,
+  statusLabelFromSpStatus,
+};