@oscharko-dev/keiko 0.2.0-beta.2 → 0.2.0-beta.4

package/node_modules/@oscharko-dev/keiko-server/dist/local-knowledge-handlers.js

@@ -1,12 +1,12 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { statSync } from "node:fs";
 import { basename, dirname } from "node:path";
 import { addSourceToCapsule, composeCapsules, CompositionError, createSqliteAuditSink, createDefaultParserRegistry, createCapsule, deleteCapsule, getCapsule, listCapsuleSets, listCapsuleSources, listCapsules, openKnowledgeStore, removeSourceFromCapsule, resolveKnowledgeStorePath, runIndexingJob, updateCapsuleDetails, updateCapsuleState, } from "@oscharko-dev/keiko-local-knowledge";
 import { KnowledgeNotFoundError, KnowledgeStoreError } from "@oscharko-dev/keiko-local-knowledge";
-import { CAPSULE_SET_MAX_MEMBERS, validateKnowledgeSourceScope, } from "@oscharko-dev/keiko-contracts";
+import { CAPSULE_SET_MAX_MEMBERS, isSafeDisplaySummary, validateCapsuleReindexRequest, validateKnowledgeSourceScope, } from "@oscharko-dev/keiko-contracts";
 import { currentGatewayConfig } from "./deps.js";
 import { errorBody } from "./routes.js";
-import { findConfiguredCapability, requestOpenAIEmbedding, } from "@oscharko-dev/keiko-model-gateway";
+import { findConfiguredCapability, requestOpenAIEmbedding, verifyEmbeddingCapability, } from "@oscharko-dev/keiko-model-gateway";
 import { nodeWorkspaceFs } from "@oscharko-dev/keiko-workspace/internal/fs";
 import { isDenied } from "@oscharko-dev/keiko-workspace";
 import { localKnowledgeIndexingRegistry } from "./local-knowledge-indexing-registry.js";
@@ -15,6 +15,7 @@ const MAX_BODY_BYTES = 32_000;
 // thousands of parser diagnostics / job rows cannot inflate a single JSON response.
 const MAX_DIAGNOSTICS_PER_RESPONSE = 500;
 const MAX_JOBS_PER_RESPONSE = 500;
+const LOCAL_KNOWLEDGE_STORE_UNAVAILABLE_MESSAGE = "Local knowledge storage is unavailable. Check the local runtime state and try again.";
 class InvalidRequest extends Error {
     constructor(message) {
         super(message);
@@ -208,7 +209,12 @@ function configuredEmbeddingProvider(config, modelId) {
     return isConfiguredEmbeddingModel(config, provider.modelId) ? provider : undefined;
 }
 function configuredProviderForCapsule(deps, capsule) {
-    return configuredEmbeddingProvider(currentGatewayConfig(deps), capsule.embeddingModelIdentity.modelId);
+    const provider = configuredEmbeddingProvider(currentGatewayConfig(deps), capsule.embeddingModelIdentity.modelId);
+    if (provider === undefined)
+        return undefined;
+    return storedProviderMatchesConfiguredProvider(capsule.embeddingModelIdentity.provider, provider)
+        ? provider
+        : undefined;
 }
 function embeddingCompatibilityReason(config, capsule) {
     if (config === undefined)
@@ -217,9 +223,13 @@ function embeddingCompatibilityReason(config, capsule) {
     if (!config.providers.some((entry) => entry.modelId === modelId)) {
         return "The configured embedding model no longer matches this capsule.";
     }
-    if (configuredEmbeddingProvider(config, modelId) === undefined) {
+    const provider = configuredEmbeddingProvider(config, modelId);
+    if (provider === undefined) {
         return "The configured model for this capsule cannot serve embeddings.";
     }
+    if (!storedProviderMatchesConfiguredProvider(capsule.embeddingModelIdentity.provider, provider)) {
+        return "The configured embedding gateway no longer matches this capsule.";
+    }
     return undefined;
 }
 function vectorCompatibility(deps, capsule) {
@@ -243,14 +253,15 @@ function vectorCompatibility(deps, capsule) {
 function loadSourceStats(store, capsuleId) {
     const rows = store._internal.db
         .prepare([
-        "SELECT s.id AS source_id, s.display_name, s.scope_kind, s.scope_json,",
+        "SELECT s.id AS source_id, ks.display_name, ks.scope_kind, ks.scope_json,",
         "  SUM(CASE WHEN d.status = 'extracted' THEN 1 ELSE 0 END) AS indexed_count,",
         "  SUM(CASE WHEN d.status = 'failed' THEN 1 ELSE 0 END) AS failed_count,",
         "  SUM(CASE WHEN d.status IN ('skipped', 'unsupported') THEN 1 ELSE 0 END) AS skipped_count",
         "FROM capsule_sources AS s",
+        "JOIN knowledge_sources AS ks ON ks.id = s.id",
         "LEFT JOIN documents AS d ON d.capsule_id = s.capsule_id AND d.source_id = s.id",
         "WHERE s.capsule_id = :c",
-        "GROUP BY s.id, s.display_name, s.scope_kind, s.scope_json",
+        "GROUP BY s.id, ks.display_name, ks.scope_kind, ks.scope_json",
         "ORDER BY s.created_at ASC, s.id ASC",
     ].join(" "))
         .all({ c: capsuleId });
@@ -407,6 +418,7 @@ function buildCapsuleHealth(deps, store, dbPath, capsule) {
     const unsupportedGuidance = unsupportedDocuments > 0 ? loadUnsupportedGuidance(store, capsule.id) : [];
     return {
         capsuleId: capsule.id,
+        sourceIds: capsule.sourceIds,
         lifecycleState: capsule.lifecycleState,
         storageSizeBytes: storageSizeBytes(dbPath),
         documentCount,
@@ -466,9 +478,24 @@ function canonicalizeCapsuleSourceRoots(store, capsule) {
     const now = store._internal.now();
     for (const source of listCapsuleSources(store, capsule.id)) {
         const canonicalScope = canonicalizeScopeRoot(source.scope);
+        // Re-validate the deny-list against the canonical (realpath-resolved) root at index time,
+        // not only at connect time. A folder that was safe when connected can later be moved or
+        // symlink-swapped so its realpath resolves into a denied location (e.g. ~/.ssh); refuse to
+        // index it rather than walking credential files inside it. Runs for every source, including
+        // already-canonical ones, so it must precede the no-op skip below.
+        if (isDenied(connectScopeRootPath(canonicalScope))) {
+            throw new InvalidRequest("Source path is in a denied location and cannot be indexed.");
+        }
         if (JSON.stringify(canonicalScope) === JSON.stringify(source.scope)) {
             continue;
         }
+        store._internal.db
+            .prepare("UPDATE knowledge_sources SET scope_json = :scope_json, updated_at = :updated_at WHERE id = :id")
+            .run({
+            scope_json: scopeToJson(canonicalScope),
+            updated_at: now,
+            id: source.id,
+        });
         store._internal.db
             .prepare("UPDATE capsule_sources SET scope_json = :scope_json, updated_at = :updated_at WHERE capsule_id = :c AND id = :id")
             .run({
@@ -518,60 +545,51 @@ function parseCapsuleId(ctx) {
     }
     return capsuleId;
 }
-function parseReindexMode(body) {
-    const mode = body.mode;
-    if (mode === undefined || mode === "changed-files" || mode === "repair-failed") {
-        return mode;
+function requireSafeDisplayText(field, value) {
+    const trimmed = value.trim();
+    if (trimmed.length === 0 || !isSafeDisplaySummary(trimmed)) {
+        throw new InvalidRequest(`Field "${field}" must be a browser-safe non-empty string.`);
     }
-    throw new InvalidRequest('Field "mode" must be "changed-files" or "repair-failed".');
+    return trimmed;
 }
-// O2-GAP-1 (Epic #189): reindex callers can opt into a forced re-embed. Plumbed
-// through to runIndexingJob so a capsule whose embedding model rotated can be
-// rebuilt without manual store surgery.
-function parseReindexForce(body) {
-    const force = body.force;
-    if (force === undefined)
-        return false;
-    if (typeof force !== "boolean") {
-        throw new InvalidRequest('Field "force" must be a boolean when provided.');
+function safeOptionalDisplayText(field, value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== "string") {
+        throw new InvalidRequest(`Field "${field}" must be a string when provided.`);
+    }
+    const trimmed = value.trim();
+    if (trimmed.length === 0) {
+        return undefined;
     }
-    return force;
+    if (!isSafeDisplaySummary(trimmed)) {
+        throw new InvalidRequest(`Field "${field}" must be browser-safe when provided.`);
+    }
+    return trimmed;
 }
 function parseCreateCapsuleInput(body) {
-    const displayName = typeof body.displayName === "string" ? body.displayName.trim() : undefined;
-    if (displayName === undefined || displayName.length === 0) {
+    if (typeof body.displayName !== "string") {
         throw new InvalidRequest('Field "displayName" must be a non-empty string.');
     }
-    const descriptionRaw = body.description;
-    if (descriptionRaw === undefined) {
-        return { displayName };
-    }
-    if (typeof descriptionRaw !== "string") {
-        throw new InvalidRequest('Field "description" must be a string when provided.');
-    }
-    const description = descriptionRaw.trim();
-    return description.length === 0 ? { displayName } : { displayName, description };
-}
-// Issue #621: derive native vector dimensions from the embedding model id rather than
-// hardcoding 1536, which is wrong for text-embedding-3-large (native: 3072).
-function derivedVectorDimensions(modelId) {
-    const lower = modelId.toLowerCase();
-    if (lower.includes("text-embedding-3-large"))
-        return 3072;
-    if (lower.includes("text-embedding-3-small"))
-        return 1536;
-    if (lower.includes("text-embedding-ada-002"))
-        return 1536;
-    // Conservative default for unknown embedding models.
-    return 1536;
-}
-function defaultEmbeddingIdentity(modelId) {
-    return {
-        provider: "openai",
-        modelId,
-        vectorDimensions: derivedVectorDimensions(modelId),
-        vectorMetric: "cosine",
-    };
+    const displayName = requireSafeDisplayText("displayName", body.displayName);
+    const description = safeOptionalDisplayText("description", body.description);
+    return description === undefined ? { displayName } : { displayName, description };
+}
+function normalizedEndpointFingerprint(baseUrl) {
+    const normalized = baseUrl.trim().replace(/\/+$/, "");
+    return createHash("sha256").update(normalized).digest("hex").slice(0, 16);
+}
+function embeddingProviderIdentity(provider) {
+    return `openai-compatible:${normalizedEndpointFingerprint(provider.baseUrl)}`;
+}
+function storedProviderMatchesConfiguredProvider(storedProvider, provider) {
+    // Legacy capsules created before #192 audit fixes stored the generic "openai" label.
+    // Keep those usable; new capsules store a non-secret endpoint fingerprint so future
+    // gateway swaps mark them incompatible instead of mixing unrelated vector spaces.
+    if (!storedProvider.startsWith("openai-compatible:"))
+        return true;
+    return storedProvider === embeddingProviderIdentity(provider);
 }
 // Issue #621 / #677: select the first provider whose resolved capability is embedding-capable.
 // Falling back to a chat model creates capsules that can never index successfully.
@@ -584,6 +602,45 @@ export function selectEmbeddingModelId(config) {
 function createCapsuleStorageReference(capsuleId) {
     return `capsules/${capsuleId}`;
 }
+async function verifiedNewCapsuleEmbeddingIdentity(deps, provider) {
+    const adapter = createEmbeddingAdapter(provider, requestEmbeddingImpl(deps));
+    try {
+        const result = await verifyEmbeddingCapability(adapter, {
+            modelId: provider.modelId,
+            provider: embeddingProviderIdentity(provider),
+            vectorMetric: "cosine",
+            timeoutMs: provider.timeoutMs,
+        });
+        if (result.ok) {
+            return { ok: true, identity: result.identity };
+        }
+        return { ok: false, result: conflict(result.safeMessage) };
+    }
+    catch {
+        return {
+            ok: false,
+            result: conflict("embedding capability preflight failed before capsule creation"),
+        };
+    }
+}
+async function resolveNewCapsuleEmbeddingIdentity(deps) {
+    const config = currentGatewayConfig(deps);
+    const configuredModelId = selectEmbeddingModelId(config);
+    if (configuredModelId === undefined) {
+        return {
+            ok: false,
+            result: conflict("No configured embedding-capable model is available for new capsules. Configure the Model Gateway first."),
+        };
+    }
+    const provider = configuredEmbeddingProvider(config, configuredModelId);
+    if (provider === undefined) {
+        return {
+            ok: false,
+            result: conflict("No configured embedding-capable model is available for new capsules. Configure the Model Gateway first."),
+        };
+    }
+    return verifiedNewCapsuleEmbeddingIdentity(deps, provider);
+}
 function latestRunningJobId(store, capsuleId) {
     const row = store._internal.db
         .prepare([
@@ -607,6 +664,9 @@ function requestRunningJobCancellation(store, capsuleId) {
     localKnowledgeIndexingRegistry.cancel(String(capsuleId));
     return true;
 }
+function emptyCapsuleIndexingConflict() {
+    return conflict("Attach at least one source to this capsule before indexing it.");
+}
 function assertScopeShape(scope) {
     const result = validateKnowledgeSourceScope(scope);
     if (result.ok)
@@ -622,6 +682,13 @@ function disconnectCapsuleSources(store, capsuleId) {
     }
     updateCapsuleState(store, capsuleId, "draft");
 }
+function resolveIndexingSourceSelection(store, capsule, mode) {
+    if (mode !== "repair-failed") {
+        return { shouldRun: true };
+    }
+    const sourceIds = failedSourceIds(store, capsule.id);
+    return sourceIds.length === 0 ? { shouldRun: false } : { shouldRun: true, sourceIds };
+}
 // LK-001 (Epic #189): both the start and refresh handlers map a terminal IndexingTerminal
 // to the same 3-way response — cancelled → 409 cancelled, failed → 409 failed-message,
 // any other (completed or absent) → 200 ok. Extracted so each handler stays under the
@@ -642,13 +709,16 @@ async function runCapsuleIndexingJob(deps, store, capsule, options) {
     }
     canonicalizeCapsuleSourceRoots(store, capsule);
     const adapter = createEmbeddingAdapter(provider, requestEmbeddingImpl(deps));
-    const sourceIds = options.mode === "repair-failed" ? failedSourceIds(store, capsule.id) : undefined;
+    const sourceSelection = resolveIndexingSourceSelection(store, capsule, options.mode);
+    if (!sourceSelection.shouldRun) {
+        return undefined;
+    }
     const controller = localKnowledgeIndexingRegistry.start(String(capsule.id));
     let terminal;
     try {
         for await (const event of runIndexingJob({
             capsuleId: capsule.id,
-            ...(sourceIds !== undefined ? { sourceIds } : {}),
+            ...(sourceSelection.sourceIds !== undefined ? { sourceIds: sourceSelection.sourceIds } : {}),
             parserRegistry: createDefaultParserRegistry(),
             workspaceFs: nodeWorkspaceFs,
             embeddingAdapter: adapter,
@@ -701,7 +771,7 @@ async function runHandler(worker) {
             return notFound(error.message);
         }
         if (error instanceof KnowledgeStoreError) {
-            return serviceUnavailable(error.message);
+            return serviceUnavailable(LOCAL_KNOWLEDGE_STORE_UNAVAILABLE_MESSAGE);
         }
         throw error;
     }
@@ -764,14 +834,12 @@ function parseSetCapsuleIds(raw) {
     return capsuleIds;
 }
 function parseCreateCapsuleSetInput(body) {
-    const displayName = typeof body.displayName === "string" ? body.displayName.trim() : "";
-    if (displayName.length === 0) {
+    if (typeof body.displayName !== "string") {
         throw new InvalidRequest('Field "displayName" must be a non-empty string.');
     }
+    const displayName = requireSafeDisplayText("displayName", body.displayName);
     const capsuleIds = parseSetCapsuleIds(body.capsuleIds);
-    const description = typeof body.description === "string" && body.description.trim().length > 0
-        ? body.description.trim()
-        : undefined;
+    const description = safeOptionalDisplayText("description", body.description);
     return description === undefined
         ? { displayName, capsuleIds }
         : { displayName, description, capsuleIds };
@@ -820,16 +888,20 @@ function parseUpdateCapsuleInput(body) {
     }
     const patch = {};
     if (body.displayName !== undefined) {
-        if (typeof body.displayName !== "string" || body.displayName.trim().length === 0) {
+        if (typeof body.displayName !== "string") {
             throw new InvalidRequest('Field "displayName" must be a non-empty string when provided.');
         }
-        patch.displayName = body.displayName.trim();
+        patch.displayName = requireSafeDisplayText("displayName", body.displayName);
     }
     if (body.description !== undefined) {
         if (typeof body.description !== "string") {
             throw new InvalidRequest('Field "description" must be a string when provided.');
         }
-        patch.description = body.description.trim();
+        const trimmed = body.description.trim();
+        if (!isSafeDisplaySummary(trimmed)) {
+            throw new InvalidRequest('Field "description" must be browser-safe when provided.');
+        }
+        patch.description = trimmed;
     }
     if (patch.displayName === undefined && patch.description === undefined) {
         throw new InvalidRequest("Patch must include displayName or description.");
@@ -858,9 +930,9 @@ export async function handleCreateLocalKnowledgeCapsule(ctx, deps) {
         const input = parseCreateCapsuleInput(await readJsonObject(ctx.req));
         const env = openStoreForDeps(deps);
         try {
-            const configuredModelId = selectEmbeddingModelId(currentGatewayConfig(deps));
-            if (configuredModelId === undefined) {
-                return conflict("No configured embedding-capable model is available for new capsules. Configure the Model Gateway first.");
+            const embeddingIdentity = await resolveNewCapsuleEmbeddingIdentity(deps);
+            if (!embeddingIdentity.ok) {
+                return embeddingIdentity.result;
             }
             const capsuleId = randomUUID();
             const capsule = createCapsule(env.store, {
@@ -871,7 +943,7 @@ export async function handleCreateLocalKnowledgeCapsule(ctx, deps) {
                 retrievalEffort: "default",
                 outputMode: "snippets",
                 answerGroundingPolicy: "require-citations",
-                embeddingModelIdentity: defaultEmbeddingIdentity(configuredModelId),
+                embeddingModelIdentity: embeddingIdentity.identity,
                 lifecycleState: "draft",
                 storageReference: createCapsuleStorageReference(capsuleId),
             }, createSqliteAuditSink(env.store));
@@ -914,6 +986,9 @@ export async function handleStartLocalKnowledgeCapsuleIndexing(ctx, deps) {
             if (capsule === undefined) {
                 return notFound(`Capsule not found: ${capsuleId}`);
             }
+            if (capsule.sourceIds.length === 0) {
+                return emptyCapsuleIndexingConflict();
+            }
             if (configuredProviderForCapsule(deps, capsule) === undefined) {
                 return conflict("No configured embedding-capable model matches this capsule. Update the Model Gateway configuration before indexing it.");
             }
@@ -973,8 +1048,11 @@ function parseConnectSourceInput(body) {
     assertScopeShape(scope);
     const displayNameRaw = body.displayName;
     const displayName = typeof displayNameRaw === "string" && displayNameRaw.trim().length > 0
-        ? displayNameRaw.trim()
+        ? requireSafeDisplayText("displayName", displayNameRaw)
         : basename(connectScopeRootPath(scope));
+    if (!isSafeDisplaySummary(displayName)) {
+        throw new InvalidRequest('Field "displayName" must be browser-safe when provided.');
+    }
     return { scope, displayName };
 }
 // Canonicalize (realpath) then refuse denied locations and non-directory roots BEFORE
@@ -997,6 +1075,36 @@ function guardConnectorSourcePath(scope) {
     }
     return canonical;
 }
+// Stable identity for connect-time dedup. Field-by-field (not JSON.stringify of the raw
+// object) so the request body's key order cannot defeat the comparison, and built on the
+// canonicalized scope so trailing-slash and symlink-alias spellings of the same folder fold
+// together. Scopes that differ in globs, recursion, or file lists stay distinct sources.
+//
+// files scope: the array order has no logical meaning (unlike includeGlobs/excludeGlobs on
+// folder/repository scopes where first-match-wins makes order semantically significant), so
+// we sort before serializing. This ensures [a,b] and [b,a] map to the same identity and the
+// idempotency check fires correctly on permuted re-connects.
+function scopeIdentity(scope) {
+    const canonical = canonicalizeScopeRoot(scope);
+    if (canonical.kind === "folder") {
+        return JSON.stringify([
+            "folder",
+            canonical.rootPath,
+            canonical.recursive,
+            canonical.includeGlobs ?? null,
+            canonical.excludeGlobs ?? null,
+        ]);
+    }
+    if (canonical.kind === "repository") {
+        return JSON.stringify([
+            "repository",
+            canonical.repositoryRoot,
+            canonical.includeGlobs ?? null,
+            canonical.excludeGlobs ?? null,
+        ]);
+    }
+    return JSON.stringify(["files", canonical.rootPath, [...canonical.files].sort()]);
+}
 export async function handleConnectLocalKnowledgeCapsule(ctx, deps) {
     return runHandler(async () => {
         const capsuleId = parseCapsuleId(ctx);
@@ -1008,6 +1116,17 @@ export async function handleConnectLocalKnowledgeCapsule(ctx, deps) {
             if (capsule === undefined) {
                 return notFound(`Capsule not found: ${capsuleId}`);
             }
+            // Idempotent connect: re-connecting an identical scope (double-click, trailing-slash or
+            // symlink-alias spelling of the same folder) must not create a second source row — a
+            // duplicate would double-index every document and double every grounded citation.
+            const targetIdentity = scopeIdentity(guarded);
+            const alreadyConnected = listCapsuleSources(env.store, capsule.id).some((source) => scopeIdentity(source.scope) === targetIdentity);
+            if (alreadyConnected) {
+                return {
+                    status: 200,
+                    body: buildCapsuleResponseBody(deps, env.store, env.dbPath, capsule),
+                };
+            }
             addSourceToCapsule(env.store, capsule.id, {
                 id: randomUUID(),
                 displayName,
@@ -1061,14 +1180,21 @@ export async function handleReindexLocalKnowledgeCapsule(ctx, deps) {
     return runHandler(async () => {
         const capsuleId = parseCapsuleId(ctx);
         const body = await readJsonObject(ctx.req);
-        const mode = parseReindexMode(body);
-        const force = parseReindexForce(body);
+        const reindexRequest = validateCapsuleReindexRequest({ ...body, capsuleId });
+        if (!reindexRequest.ok) {
+            throw new InvalidRequest(reindexRequest.errors.join(" "));
+        }
+        const mode = reindexRequest.value.mode;
+        const force = reindexRequest.value.force ?? false;
         const env = openStoreForDeps(deps);
         try {
             const capsule = getCapsule(env.store, capsuleId);
             if (capsule === undefined) {
                 return notFound(`Capsule not found: ${capsuleId}`);
             }
+            if (capsule.sourceIds.length === 0) {
+                return emptyCapsuleIndexingConflict();
+            }
             if (configuredProviderForCapsule(deps, capsule) === undefined) {
                 return conflict("No configured embedding-capable model matches this capsule. Update the Model Gateway configuration before refreshing it.");
             }

package/node_modules/@oscharko-dev/keiko-server/dist/memory-handlers.d.ts

@@ -13,5 +13,5 @@ export declare function handleDeleteMemory(ctx: RouteContext, deps: UiHandlerDep
 export declare function handleCorrectMemory(ctx: RouteContext, deps: UiHandlerDeps): Promise<RouteResult>;
 export declare function handleAcceptMemoryProposal(ctx: RouteContext, deps: UiHandlerDeps): RouteResult;
 export declare function handleRejectMemoryProposal(ctx: RouteContext, deps: UiHandlerDeps): Promise<RouteResult>;
-export declare function createBffMemoryVault(redactString: (s: string) => string, onMemoryEvent?: (event: import("@oscharko-dev/keiko-memory-vault").MemoryEvent) => void): MemoryVaultStore;
+export declare function createBffMemoryVault(redactString: (s: string) => string, onMemoryEvent?: (event: import("@oscharko-dev/keiko-memory-vault").MemoryEvent) => void, env?: Readonly<Record<string, string | undefined>>): MemoryVaultStore;
 //# sourceMappingURL=memory-handlers.d.ts.map

package/node_modules/@oscharko-dev/keiko-server/dist/memory-handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory-handlers.d.ts","sourceRoot":"","sources":["../src/memory-handlers.ts"],"names":[],"mappings":"AAkBA,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,kCAAkC,CAAC;AAsB1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,EAAY,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuQvE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CA8BtF;AAID,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAqB5F;AAID,wBAAgB,eAAe,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAqBnF;AAwDD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CA+BtB;AAID,wBAAgB,eAAe,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CA6BnF;AAID,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CA6BrF;AAID,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAsCtB;AA0DD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CA6BtB;AAKD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CA6BtF;AA0CD,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAiCtB;AAID,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CA+B9F;AAyBD,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAgCtB;AAOD,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,EACnC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,kCAAkC,EAAE,WAAW,KAAK,IAAI,GACtF,gBAAgB,CAQlB"}
+{"version":3,"file":"memory-handlers.d.ts","sourceRoot":"","sources":["../src/memory-handlers.ts"],"names":[],"mappings":"AAkBA,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,kCAAkC,CAAC;AAsB1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,EAAY,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuQvE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CA8BtF;AAID,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAqB5F;AAID,wBAAgB,eAAe,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAqBnF;AAwDD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CA+BtB;AAID,wBAAgB,eAAe,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CA6BnF;AAID,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CA6BrF;AAID,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAsCtB;AA0DD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CA6BtB;AAKD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CA6BtF;AA0CD,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAiCtB;AAID,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CA+B9F;AAyBD,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAgCtB;AAOD,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,EACnC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,kCAAkC,EAAE,WAAW,KAAK,IAAI,EACvF,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GACjD,gBAAgB,CASlB"}

package/node_modules/@oscharko-dev/keiko-server/dist/memory-handlers.js

@@ -712,12 +712,13 @@ export async function handleRejectMemoryProposal(ctx, deps) {
 // Exported so deps.ts can wire it without importing the vault directly. The `redactString`
 // is the same closure used by the audit redactor; re-using it here keeps redaction in one
 // place (D9).
-export function createBffMemoryVault(redactString, onMemoryEvent) {
+export function createBffMemoryVault(redactString, onMemoryEvent, env) {
     // Optional onMemoryEvent (#214) wires every successful vault mutation into the audit
     // ledger. When undefined, the vault still fires its internal NOOP sink, so the absence
     // of an audit hook is fully backward-compatible with the pre-#214 BFF wiring.
-    if (onMemoryEvent === undefined) {
-        return createMemoryVault({ redactString });
-    }
-    return createMemoryVault({ redactString, onMemoryEvent });
+    return createMemoryVault({
+        redactString,
+        ...(onMemoryEvent === undefined ? {} : { onMemoryEvent }),
+        ...(env === undefined ? {} : { env }),
+    });
 }

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figma/figmaConnectorErrors.d.ts

@@ -1,4 +1,4 @@
-export type FigmaConnectorErrorCode = "FIGMA_MALFORMED_URL" | "FIGMA_TOKEN_MISSING" | "FIGMA_CONSENT_REQUIRED" | "FIGMA_TOKEN_INVALID" | "FIGMA_TOKEN_EXPIRED" | "FIGMA_TOKEN_REVOKED" | "FIGMA_NOT_FOUND" | "FIGMA_INSUFFICIENT_SCOPE" | "FIGMA_RENDER_FAILED" | "FIGMA_PROXY_EGRESS_FAILED" | "FIGMA_PROXY_UNREACHABLE" | "FIGMA_TLS_CA_FAILURE" | "FIGMA_OVERSIZED_SCOPE" | "FIGMA_RATE_LIMITED" | "FIGMA_UPSTREAM_UNAVAILABLE" | "FIGMA_INTERNAL";
+export type FigmaConnectorErrorCode = "FIGMA_MALFORMED_URL" | "FIGMA_TOKEN_MISSING" | "FIGMA_CONSENT_REQUIRED" | "FIGMA_TOKEN_INVALID" | "FIGMA_TOKEN_EXPIRED" | "FIGMA_TOKEN_REVOKED" | "FIGMA_NOT_FOUND" | "FIGMA_INSUFFICIENT_SCOPE" | "FIGMA_RENDER_FAILED" | "FIGMA_PROXY_EGRESS_FAILED" | "FIGMA_PROXY_UNREACHABLE" | "FIGMA_PROXY_AUTH_REQUIRED" | "FIGMA_PROXY_BLOCKED_BY_POLICY" | "FIGMA_TLS_CA_FAILURE" | "FIGMA_OVERSIZED_SCOPE" | "FIGMA_RESPONSE_TOO_LARGE" | "FIGMA_RATE_LIMITED" | "FIGMA_UPSTREAM_UNAVAILABLE" | "FIGMA_NETWORK_UNREACHABLE" | "FIGMA_EGRESS_TIMEOUT" | "FIGMA_EGRESS_FAILED" | "FIGMA_BUILD_TIMEOUT" | "FIGMA_INTERNAL";
 export interface FigmaConnectorErrorBody {
     readonly error: {
         readonly code: FigmaConnectorErrorCode;
@@ -13,7 +13,15 @@ export declare class FigmaConnectorError extends Error {
 /**
  * Classify a transport-level throw from `fetch` or the body read into a stable
  * {@link FigmaConnectorErrorCode}. Side-effect-free and total — any non-Error
- * throwable (string, undefined) maps to `FIGMA_PROXY_EGRESS_FAILED`.
+ * throwable (string, undefined) maps to `FIGMA_EGRESS_FAILED`.
+ *
+ * Precedence:
+ *   (a) OutboundHttpEgressError (or plain Error with outbound code, for cross-package resilience)
+ *       → proxy/TLS-via-proxy codes. FIGMA_PROXY_* codes are ONLY reachable via this branch.
+ *   (b) TLS trust codes / messages → FIGMA_TLS_CA_FAILURE.
+ *   (c) Timeout / abort names (DOMException AbortError, Node TimeoutError) → FIGMA_EGRESS_TIMEOUT.
+ *   (d) Direct connectivity codes / messages → FIGMA_NETWORK_UNREACHABLE.
+ *   (e) Default → FIGMA_EGRESS_FAILED.
  *
  * Inspects `err.code`, `err.cause.code`, and `err.message` in that order of
  * precedence so Node.js `TypeError: fetch failed` wrappers (undici wraps the

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figma/figmaConnectorErrors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"figmaConnectorErrors.d.ts","sourceRoot":"","sources":["../../../src/qualityIntelligence/figma/figmaConnectorErrors.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,uBAAuB,GAC/B,qBAAqB,GACrB,qBAAqB,GACrB,wBAAwB,GACxB,qBAAqB,GACrB,qBAAqB,GACrB,qBAAqB,GACrB,iBAAiB,GACjB,0BAA0B,GAC1B,qBAAqB,GACrB,2BAA2B,GAC3B,yBAAyB,GACzB,sBAAsB,GACtB,uBAAuB,GACvB,oBAAoB,GACpB,4BAA4B,GAC5B,gBAAgB,CAAC;AAmCrB,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACtF;AAED,eAAO,MAAM,uBAAuB,GAClC,MAAM,uBAAuB,KAC5B,uBAED,CAAC;AAEH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;gBAE3B,IAAI,EAAE,uBAAuB;CAK1C;AA6DD;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,GAAI,KAAK,OAAO,KAAG,uBAa1D,CAAC"}
+{"version":3,"file":"figmaConnectorErrors.d.ts","sourceRoot":"","sources":["../../../src/qualityIntelligence/figma/figmaConnectorErrors.ts"],"names":[],"mappings":"AAkCA,MAAM,MAAM,uBAAuB,GAC/B,qBAAqB,GACrB,qBAAqB,GACrB,wBAAwB,GACxB,qBAAqB,GACrB,qBAAqB,GACrB,qBAAqB,GACrB,iBAAiB,GACjB,0BAA0B,GAC1B,qBAAqB,GACrB,2BAA2B,GAC3B,yBAAyB,GACzB,2BAA2B,GAC3B,+BAA+B,GAC/B,sBAAsB,GACtB,uBAAuB,GACvB,0BAA0B,GAC1B,oBAAoB,GACpB,4BAA4B,GAC5B,2BAA2B,GAC3B,sBAAsB,GACtB,qBAAqB,GACrB,qBAAqB,GACrB,gBAAgB,CAAC;AAgDrB,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACtF;AAED,eAAO,MAAM,uBAAuB,GAClC,MAAM,uBAAuB,KAC5B,uBAED,CAAC;AAEH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;gBAE3B,IAAI,EAAE,uBAAuB;CAK1C;AA0JD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,2BAA2B,GAAI,KAAK,OAAO,KAAG,uBAa1D,CAAC"}