@oscharko-dev/keiko 0.2.0-beta.3 → 0.2.0-beta.4

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/companionStore.d.ts

@@ -17,4 +17,21 @@ export interface ContainedJsonArtifactStoreOptions<T> {
  * a fresh atomic temp and renames over any existing file.
  */
 export declare function createNodeContainedJsonArtifactStore<T>(evidenceDir: string, suffix: string, options: ContainedJsonArtifactStoreOptions<T>): ContainedJsonArtifactStore<T>;
+/**
+ * Idempotently delete ONE QI companion artifact `<runId><suffix>` from the contained `qi/` dir.
+ *
+ * Used by the run-deletion path (`deleteQualityIntelligenceRun`) to clean up companion artifacts
+ * that live alongside the run manifest. EXACT-suffix matching is mandatory: a non-leading `.` is a
+ * legal runId character (`assertValidRunId`), so `run-1` and `run-1.2` can coexist and a prefix
+ * (`startsWith`) sweep would let deleting `run-1` destroy `run-1.2`'s companion. By deriving the
+ * full `${runId}${suffix}` name and resolving it through `assertContainedRealPath`, the delete is
+ * collision-free, realpath-contained, and symlink-refusing (`deleteArtifactFile` lstat-gates
+ * `isFile`, which is false for a symlink). Returns true iff a regular file was removed.
+ *
+ * Intentionally NOT re-exported from the package barrel — it is an internal seam consumed only by
+ * the deletion path, so the published surface stays unchanged.
+ */
+export declare function deleteQualityIntelligenceCompanionArtifact(evidenceDir: string, runId: string, suffix: string, options?: {
+    readonly fs?: WorkspaceFs;
+}): boolean;
 //# sourceMappingURL=companionStore.d.ts.map

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/companionStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"companionStore.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/companionStore.ts"],"names":[],"mappings":"AAuBA,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,+BAA+B,CAAC;AAQvC,MAAM,WAAW,0BAA0B,CAAC,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC;IACrD,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,CAAC,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;CAC9C;AAED,MAAM,WAAW,iCAAiC,CAAC,CAAC;IAClD,QAAQ,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;IACrC,gGAAgG;IAChG,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC,GAAG,SAAS,CAAC;CACnD;AAuFD;;;;GAIG;AACH,wBAAgB,oCAAoC,CAAC,CAAC,EACpD,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iCAAiC,CAAC,CAAC,CAAC,GAC5C,0BAA0B,CAAC,CAAC,CAAC,CAwB/B"}
+{"version":3,"file":"companionStore.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/companionStore.ts"],"names":[],"mappings":"AAuBA,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,+BAA+B,CAAC;AAQvC,MAAM,WAAW,0BAA0B,CAAC,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC;IACrD,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,CAAC,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;CAC9C;AAED,MAAM,WAAW,iCAAiC,CAAC,CAAC;IAClD,QAAQ,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;IACrC,gGAAgG;IAChG,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC,GAAG,SAAS,CAAC;CACnD;AAuFD;;;;GAIG;AACH,wBAAgB,oCAAoC,CAAC,CAAC,EACpD,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iCAAiC,CAAC,CAAC,CAAC,GAC5C,0BAA0B,CAAC,CAAC,CAAC,CAwB/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0CAA0C,CACxD,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,WAAW,CAAA;CAAO,GAC1C,OAAO,CAIT"}

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/companionStore.js

@@ -117,3 +117,22 @@ export function createNodeContainedJsonArtifactStore(evidenceDir, suffix, option
         },
     };
 }
+/**
+ * Idempotently delete ONE QI companion artifact `<runId><suffix>` from the contained `qi/` dir.
+ *
+ * Used by the run-deletion path (`deleteQualityIntelligenceRun`) to clean up companion artifacts
+ * that live alongside the run manifest. EXACT-suffix matching is mandatory: a non-leading `.` is a
+ * legal runId character (`assertValidRunId`), so `run-1` and `run-1.2` can coexist and a prefix
+ * (`startsWith`) sweep would let deleting `run-1` destroy `run-1.2`'s companion. By deriving the
+ * full `${runId}${suffix}` name and resolving it through `assertContainedRealPath`, the delete is
+ * collision-free, realpath-contained, and symlink-refusing (`deleteArtifactFile` lstat-gates
+ * `isFile`, which is false for a symlink). Returns true iff a regular file was removed.
+ *
+ * Intentionally NOT re-exported from the package barrel — it is an internal seam consumed only by
+ * the deletion path, so the published surface stays unchanged.
+ */
+export function deleteQualityIntelligenceCompanionArtifact(evidenceDir, runId, suffix, options = {}) {
+    const baseDir = join(evidenceDir, QI_SUBDIR);
+    const fs = options.fs ?? nodeWorkspaceFs;
+    return deleteArtifactFile(baseDir, fs, suffix, runId);
+}

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/figmaSnapshot/schema.d.ts

@@ -7,7 +7,11 @@ export interface FigmaSnapshotImageRef {
     readonly sha256: string;
     readonly byteLength: number;
 }
-export type FigmaSnapshotSkipReason = "render-url-missing" | "render-fetch-failed" | "render-empty" | "render-oversized";
+/** Why a screen was excluded from the snapshot. The `render-fetch-failed:<CODE>` variant carries
+ * the FigmaConnectorErrorCode suffix when the download threw a coded error, letting retention
+ * and metrics distinguish misconfigured egress from an unclassified network flake.
+ */
+export type FigmaSnapshotSkipReason = "render-url-missing" | "render-url-blocked" | "render-fetch-failed" | `render-fetch-failed:${string}` | "render-empty" | "render-oversized";
 export interface FigmaSnapshotSkippedScreenRow {
     readonly screenId: string;
     readonly reason: FigmaSnapshotSkipReason;

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/figmaSnapshot/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/qualityIntelligence/figmaSnapshot/schema.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,6BAA6B,EAAG,CAAU,CAAC;AAExD,8EAA8E;AAC9E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,uBAAuB,GAC/B,oBAAoB,GACpB,qBAAqB,GACrB,cAAc,GACd,kBAAkB,CAAC;AAEvB,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;CAC1C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,8FAA8F;AAC9F,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,0BAA0B,EAAE,OAAO,6BAA6B,CAAC;IAC1E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACpD,QAAQ,CAAC,cAAc,EAAE,SAAS,6BAA6B,EAAE,CAAC;IAClE,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACjD;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,6BAA6B,CAAC;CAC1D;AAcD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAID,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,6BAA6B,CAoBzF"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/qualityIntelligence/figmaSnapshot/schema.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,6BAA6B,EAAG,CAAU,CAAC;AAExD,8EAA8E;AAC9E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAC/B,oBAAoB,GACpB,oBAAoB,GACpB,qBAAqB,GACrB,uBAAuB,MAAM,EAAE,GAC/B,cAAc,GACd,kBAAkB,CAAC;AAEvB,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;CAC1C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,8FAA8F;AAC9F,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,0BAA0B,EAAE,OAAO,6BAA6B,CAAC;IAC1E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACpD,QAAQ,CAAC,cAAc,EAAE,SAAS,6BAA6B,EAAE,CAAC;IAClE,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACjD;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,6BAA6B,CAAC;CAC1D;AAcD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAID,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,6BAA6B,CAoBzF"}

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/figmaSnapshot/store.d.ts

@@ -1,5 +1,5 @@
 import { type WorkspaceFs } from "@oscharko-dev/keiko-workspace";
-import { type FigmaSnapshotLinkRow, type FigmaSnapshotRecord, type FigmaSnapshotSkippedScreenRow } from "./schema.js";
+import { type FigmaSnapshotLinkRow, type FigmaSnapshotRecord } from "./schema.js";
 export interface RecordFigmaSnapshotScreenInput {
     readonly screenId: string;
     readonly irJson: unknown;
@@ -19,7 +19,10 @@ export interface RecordFigmaSnapshotInput {
     };
     readonly integrityHash: string;
     readonly screens: readonly RecordFigmaSnapshotScreenInput[];
-    readonly skippedScreens: readonly FigmaSnapshotSkippedScreenRow[];
+    readonly skippedScreens: readonly {
+        readonly screenId: string;
+        readonly reason: string;
+    }[];
     /** Raw inter-screen transitions for the navigation/flow graph (#811). Optional + additive. */
     readonly links?: readonly FigmaSnapshotLinkRow[];
     /** Deterministic design-tokens artifact (#752), opaque, for design-to-code (#755). Optional. */
@@ -29,14 +32,41 @@ export interface RecordFigmaSnapshotResult {
     readonly recordPath: string;
     readonly sideFileDir: string;
 }
+/** Summary entry returned by {@link FigmaSnapshotStore.listByScope}. */
+export interface FigmaSnapshotScopeEntry {
+    readonly runId: string;
+    readonly fetchedAt: string;
+    readonly integrityHash: string;
+}
 export interface FigmaSnapshotStore {
     readonly record: (input: RecordFigmaSnapshotInput) => RecordFigmaSnapshotResult;
     readonly load: (runId: string) => FigmaSnapshotRecord | undefined;
     readonly location: (runId: string) => string;
+    /**
+     * List all snapshot records for a specific Figma scope, sorted by `fetchedAt` descending
+     * (most-recent first). Reads only the record headers — cheap scan. Unparseable files are
+     * skipped silently. Used by drift work (#735) to find existing snapshots for re-comparison.
+     */
+    readonly listByScope: (fileKey: string, nodeId: string) => readonly FigmaSnapshotScopeEntry[];
 }
 export interface FigmaSnapshotStoreOptions {
     readonly fs?: WorkspaceFs;
     readonly randomSuffix?: () => string;
 }
+export interface FigmaSnapshotRetentionProfile {
+    /** Maximum number of snapshots to keep (newest first by fetchedAt). */
+    readonly maxRecords: number;
+}
+/**
+ * Enforce store-level retention for Figma snapshot records. Deletes the RECORD first, then the
+ * side-file dir, so a partially-retained snapshot is never in a state where the record is gone
+ * but the side-files remain (the side-files are unreachable without the record). A retained
+ * record's side-dir is never touched.
+ *
+ * Wiring: call this alongside `deleteQualityIntelligenceRun` in the QI retention orchestrator
+ * (#274). The profiles are intentionally separate because snapshot retention may differ from
+ * run-manifest retention (snapshots are larger, longer-lived evidence artifacts).
+ */
+export declare function enforceFigmaSnapshotRetention(evidenceDir: string, profile: FigmaSnapshotRetentionProfile): void;
 export declare function createNodeFigmaSnapshotStore(evidenceDir: string, options?: FigmaSnapshotStoreOptions): FigmaSnapshotStore;
 //# sourceMappingURL=store.d.ts.map

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/figmaSnapshot/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/qualityIntelligence/figmaSnapshot/store.ts"],"names":[],"mappings":"AA2BA,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,+BAA+B,CAAC;AAOvC,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAExB,KAAK,6BAA6B,EACnC,MAAM,aAAa,CAAC;AAMrB,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;CAChF;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;QACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,SAAS,8BAA8B,EAAE,CAAC;IAC5D,QAAQ,CAAC,cAAc,EAAE,SAAS,6BAA6B,EAAE,CAAC;IAClE,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACjD,gGAAgG;IAChG,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,wBAAwB,KAAK,yBAAyB,CAAC;IAChF,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,mBAAmB,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;CAC9C;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;CACtC;AAgHD,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,yBAA8B,GACtC,kBAAkB,CA6CpB"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/qualityIntelligence/figmaSnapshot/store.ts"],"names":[],"mappings":"AAyCA,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,+BAA+B,CAAC;AAOvC,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGzB,MAAM,aAAa,CAAC;AAMrB,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;CAChF;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;QACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,SAAS,8BAA8B,EAAE,CAAC;IAI5D,QAAQ,CAAC,cAAc,EAAE,SAAS;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC3F,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACjD,gGAAgG;IAChG,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,wEAAwE;AACxE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,wBAAwB,KAAK,yBAAyB,CAAC;IAChF,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,mBAAmB,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS,uBAAuB,EAAE,CAAC;CAC/F;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;CACtC;AAwND,MAAM,WAAW,6BAA6B;IAC5C,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,6BAA6B,GACrC,IAAI,CAkCN;AAiGD,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,yBAA8B,GACtC,kBAAkB,CA2BpB"}

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/figmaSnapshot/store.js

@@ -13,8 +13,21 @@
 // Redaction: the whole record (including the design-content IR) is passed through
 // `redactQualityIntelligenceEvidence` before write. The token is never present by construction
 // (the server builder never places it on the in-memory snapshot); redaction is defense-in-depth.
-import { randomUUID } from "node:crypto";
-import { chmodSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+//
+// Integrity: load() recomputes the snapshot integrity hash and rejects a record whose persisted
+// `integrityHash` disagrees — tampered or truncated records are rejected at the read boundary.
+// NOTE: the PNG side-files are NOT re-hashed on load (they are served separately); the per-screen
+// `sha256` stored in the record serves as the tamper-evidence for each image.
+//
+// Retention: `enforceFigmaSnapshotRetention` deletes snapshot records + their side-file dirs in
+// lock-step with the provided policy. Wiring: call it where the other QI retention enforcement
+// runs (the orchestrator that calls `deleteQualityIntelligenceRun` for each expired run).
+//
+// Orphan cleanup: `sweepOrphanedFigmaSnapshotSideDirs` removes side-file dirs (and stray *.tmp
+// files) that have no matching record. It is lazy/once — the store calls it on first use so stale
+// dirs from a previously interrupted record() are cleaned up without a separate boot step.
+import { createHash, randomUUID } from "node:crypto";
+import { chmodSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { join } from "node:path";
 import { assertContainedRealPath, resolveWithinWorkspace, } from "@oscharko-dev/keiko-workspace";
 import { nodeWorkspaceFs } from "@oscharko-dev/keiko-workspace/internal/fs";
@@ -27,6 +40,38 @@ import { FIGMA_SNAPSHOT_SCHEMA_VERSION, validateFigmaSnapshotRecord, } from "./s
 const QI_DIR_MODE = 0o700;
 const SNAPSHOT_SUFFIX = ".figma-snapshot.json";
 const SIDE_FILE_SUBDIR = "figma-snapshots";
+// ─── Integrity hash (mirrors figmaSnapshotHash.ts — inlined so keiko-evidence does not depend
+//     on the private keiko-server package). MUST stay bit-identical with the server builder. ────
+const sha256Hex = (input) => createHash("sha256").update(input, "utf8").digest("hex");
+// Stable stringify: keys emitted in sorted order at every depth (mirrors canonical() in hash.ts).
+function canonical(value) {
+    if (value === undefined)
+        return "null";
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    const record = value;
+    const entries = Object.keys(record)
+        .sort()
+        .map((key) => `${JSON.stringify(key)}:${canonical(record[key])}`);
+    return `{${entries.join(",")}}`;
+}
+// Recompute the snapshot-level integrity hash from a loaded record.
+// This exactly mirrors hashSnapshot() in figmaSnapshotHash.ts:
+//   sha256( canonical({ screens: sorted [{integrityHash,screenId}], snapshotSchemaVersion, version }) )
+// fetchedAt and links/tokens are excluded by design (non-identity metadata).
+function recomputeSnapshotIntegrityHash(record) {
+    const screens = [...record.screens]
+        .sort((a, b) => (a.screenId < b.screenId ? -1 : a.screenId > b.screenId ? 1 : 0))
+        .map((s) => ({ integrityHash: s.integrityHash, screenId: s.screenId }));
+    return sha256Hex(canonical({
+        screens,
+        snapshotSchemaVersion: record.figmaSnapshotSchemaVersion,
+        version: record.provenance.version ?? null,
+    }));
+}
+// ─── Helpers ─────────────────────────────────────────────────────────────────────────────────
 function realBaseForWrite(baseDir, fs) {
     try {
         mkdirSync(baseDir, { recursive: true, mode: QI_DIR_MODE });
@@ -121,47 +166,221 @@ function assembleRecord(input, screenRows) {
     const { redacted, summary } = redactQualityIntelligenceEvidence(draft);
     return { ...redacted, redactionSummary: summary };
 }
-export function createNodeFigmaSnapshotStore(evidenceDir, options = {}) {
+// Parse one raw JSON string from a snapshot record file into a scope entry, or null when the
+// file does not belong to the requested scope or cannot be parsed.
+function parseScopeEntry(filePath, fileKey, nodeId) {
+    try {
+        const parsed = JSON.parse(readFileSync(filePath, "utf8"));
+        const prov = parsed.provenance;
+        if (!prov?.fileKey || prov.fileKey !== fileKey || prov.nodeId !== nodeId)
+            return null;
+        const runId = typeof parsed.runId === "string" ? parsed.runId : undefined;
+        if (runId === undefined)
+            return null;
+        const fetchedAt = typeof prov.fetchedAt === "string" ? prov.fetchedAt : "";
+        const integrityHash = typeof parsed.integrityHash === "string" ? parsed.integrityHash : "";
+        return { runId, fetchedAt, integrityHash };
+    }
+    catch {
+        return null;
+    }
+}
+// ─── Orphan sweep ─────────────────────────────────────────────────────────────────────────────
+// Removes side-file dirs and stray *.tmp files under sideFileBase that have no matching record
+// in qiDir. Called lazily once per store instance to clean up dirs left by an interrupted
+// record() call (side-files written, JSON write failed).
+function sweepOrphanedSideDirs(qiDir, sideFileBase) {
+    const sideBaseStat = lstatSync(sideFileBase, { throwIfNoEntry: false });
+    if (!sideBaseStat?.isDirectory())
+        return;
+    let entries;
+    try {
+        entries = readdirSync(sideFileBase);
+    }
+    catch {
+        return; // non-fatal: best-effort sweep
+    }
+    for (const name of entries) {
+        // Remove stray temp files at the top level of sideFileBase.
+        if (name.endsWith(".tmp")) {
+            rmSync(join(sideFileBase, name), { force: true });
+            continue;
+        }
+        // Each subdirectory name should equal a runId that has a matching record.
+        const recordPath = join(qiDir, `${name}${SNAPSHOT_SUFFIX}`);
+        const hasRecord = lstatSync(recordPath, { throwIfNoEntry: false })?.isFile() === true;
+        if (!hasRecord) {
+            const runDir = join(sideFileBase, name);
+            const stat = lstatSync(runDir, { throwIfNoEntry: false });
+            if (stat?.isDirectory() === true) {
+                rmSync(runDir, { recursive: true, force: true });
+            }
+        }
+    }
+}
+// Read the fetchedAt timestamp from one snapshot file, or undefined when unparseable.
+function readFetchedAt(filePath) {
+    try {
+        const parsed = JSON.parse(readFileSync(filePath, "utf8"));
+        const prov = parsed.provenance;
+        return typeof prov?.fetchedAt === "string" ? prov.fetchedAt : "";
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Enforce store-level retention for Figma snapshot records. Deletes the RECORD first, then the
+ * side-file dir, so a partially-retained snapshot is never in a state where the record is gone
+ * but the side-files remain (the side-files are unreachable without the record). A retained
+ * record's side-dir is never touched.
+ *
+ * Wiring: call this alongside `deleteQualityIntelligenceRun` in the QI retention orchestrator
+ * (#274). The profiles are intentionally separate because snapshot retention may differ from
+ * run-manifest retention (snapshots are larger, longer-lived evidence artifacts).
+ */
+export function enforceFigmaSnapshotRetention(evidenceDir, profile) {
     const qiDir = join(evidenceDir, QI_SUBDIR);
     const sideFileBase = join(qiDir, SIDE_FILE_SUBDIR);
-    const fs = options.fs ?? nodeWorkspaceFs;
-    const randomSuffix = options.randomSuffix ?? randomUUID;
-    const record = (input) => {
-        assertValidRunId(input.runId);
-        const realBase = realBaseForWrite(qiDir, fs);
-        const recordPath = containedRecordPath(input.runId, realBase, fs);
-        // Write-once pre-check BEFORE any side-file is written, so a rejected re-record leaves no
-        // partial render bytes behind. `atomicWriteOnce` re-checks via O_EXCL to close the TOCTOU gap.
-        assertSnapshotAbsent(recordPath);
-        const rows = writeScreenSideFiles(sideFileBase, input.runId, input.screens, fs, randomSuffix);
-        atomicWriteOnce(recordPath, JSON.stringify(assembleRecord(input, rows)), randomSuffix);
-        return { recordPath, sideFileDir: join(sideFileBase, input.runId) };
-    };
-    const load = (runId) => {
-        assertValidRunId(runId);
-        const realBase = realBaseForRead(qiDir, fs);
-        if (realBase === undefined)
-            return undefined;
-        const target = join(realBase, `${runId}${SNAPSHOT_SUFFIX}`);
-        if (lstatSync(target, { throwIfNoEntry: false })?.isFile() !== true)
-            return undefined;
-        let parsed;
-        try {
-            parsed = JSON.parse(readFileSync(target, "utf8"));
-        }
-        catch (error) {
-            throw new EvidenceReadError(`Figma snapshot is not valid JSON: ${error instanceof Error ? error.message : "unknown"}`);
+    const dirStat = lstatSync(qiDir, { throwIfNoEntry: false });
+    if (!dirStat?.isDirectory())
+        return;
+    // Scan for snapshot records and sort by fetchedAt ascending so we remove the oldest first.
+    let entries;
+    try {
+        entries = readdirSync(qiDir);
+    }
+    catch {
+        return;
+    }
+    const records = [];
+    for (const name of entries) {
+        if (!name.endsWith(SNAPSHOT_SUFFIX))
+            continue;
+        const runId = name.slice(0, -SNAPSHOT_SUFFIX.length);
+        const fetchedAt = readFetchedAt(join(qiDir, name));
+        // Unparseable records are skipped — do not evict conservatively.
+        if (fetchedAt !== undefined)
+            records.push({ runId, fetchedAt });
+    }
+    // Sort oldest first (ascending fetchedAt) so we evict the oldest beyond the cap.
+    records.sort((a, b) => (a.fetchedAt < b.fetchedAt ? -1 : a.fetchedAt > b.fetchedAt ? 1 : 0));
+    const toEvict = records.slice(0, Math.max(0, records.length - profile.maxRecords));
+    for (const { runId } of toEvict) {
+        // Delete record first — after this the side-dir is unreachable by any normal path.
+        rmSync(join(qiDir, `${runId}${SNAPSHOT_SUFFIX}`), { force: true });
+        // Best-effort: remove the side-file dir; failure is non-fatal (it is orphaned, not
+        // linked to a live record, and will be removed by the next sweepOrphanedSideDirs pass).
+        const runDir = join(sideFileBase, runId);
+        const stat = lstatSync(runDir, { throwIfNoEntry: false });
+        if (stat?.isDirectory() === true) {
+            rmSync(runDir, { recursive: true, force: true });
         }
-        if (!validateFigmaSnapshotRecord(parsed).ok)
-            return undefined;
-        return parsed;
+    }
+}
+function recordOp(ctx, input) {
+    assertValidRunId(input.runId);
+    ctx.ensureSwept();
+    const realBase = realBaseForWrite(ctx.qiDir, ctx.fs);
+    const recordPath = containedRecordPath(input.runId, realBase, ctx.fs);
+    // Write-once pre-check BEFORE any side-file is written so a rejected re-record leaves no
+    // partial render bytes behind. `atomicWriteOnce` re-checks via O_EXCL to close the TOCTOU gap.
+    assertSnapshotAbsent(recordPath);
+    let rows;
+    try {
+        rows = writeScreenSideFiles(ctx.sideFileBase, input.runId, input.screens, ctx.fs, ctx.randomSuffix);
+    }
+    catch (error) {
+        // Side-file write failed: best-effort remove the run's side-dir so it is not orphaned.
+        rmSync(join(ctx.sideFileBase, input.runId), { recursive: true, force: true });
+        throw error;
+    }
+    try {
+        atomicWriteOnce(recordPath, JSON.stringify(assembleRecord(input, rows)), ctx.randomSuffix);
+    }
+    catch (error) {
+        // Record write failed after side-files succeeded: remove side-dir to avoid orphaning.
+        rmSync(join(ctx.sideFileBase, input.runId), { recursive: true, force: true });
+        throw error;
+    }
+    return { recordPath, sideFileDir: join(ctx.sideFileBase, input.runId) };
+}
+function loadOp(ctx, runId) {
+    assertValidRunId(runId);
+    ctx.ensureSwept();
+    const realBase = realBaseForRead(ctx.qiDir, ctx.fs);
+    if (realBase === undefined)
+        return undefined;
+    const target = join(realBase, `${runId}${SNAPSHOT_SUFFIX}`);
+    if (lstatSync(target, { throwIfNoEntry: false })?.isFile() !== true)
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(target, "utf8"));
+    }
+    catch (error) {
+        throw new EvidenceReadError(`Figma snapshot is not valid JSON: ${error instanceof Error ? error.message : "unknown"}`);
+    }
+    if (!validateFigmaSnapshotRecord(parsed).ok)
+        return undefined;
+    const rec = parsed;
+    // Integrity check: recompute and reject on mismatch. The PNG side-files are NOT re-hashed
+    // on load — each screen's `sha256` field is the tamper evidence for the image bytes.
+    const expected = recomputeSnapshotIntegrityHash(rec);
+    if (rec.integrityHash !== expected) {
+        throw new EvidenceReadError(`Figma snapshot integrity check failed for run ${runId}: hash mismatch`);
+    }
+    return rec;
+}
+function listByScopeOp(ctx, fileKey, nodeId) {
+    const realBase = realBaseForRead(ctx.qiDir, ctx.fs);
+    if (realBase === undefined)
+        return [];
+    let entries;
+    try {
+        entries = readdirSync(realBase);
+    }
+    catch {
+        return [];
+    }
+    const results = [];
+    for (const name of entries) {
+        if (!name.endsWith(SNAPSHOT_SUFFIX))
+            continue;
+        const entry = parseScopeEntry(join(realBase, name), fileKey, nodeId);
+        if (entry !== null)
+            results.push(entry);
+    }
+    results.sort((a, b) => (a.fetchedAt > b.fetchedAt ? -1 : a.fetchedAt < b.fetchedAt ? 1 : 0));
+    return results;
+}
+// ─── Store factory ────────────────────────────────────────────────────────────────────────────
+export function createNodeFigmaSnapshotStore(evidenceDir, options = {}) {
+    const qiDir = join(evidenceDir, QI_SUBDIR);
+    const sideFileBase = join(qiDir, SIDE_FILE_SUBDIR);
+    let swept = false;
+    const ctx = {
+        qiDir,
+        sideFileBase,
+        fs: options.fs ?? nodeWorkspaceFs,
+        randomSuffix: options.randomSuffix ?? randomUUID,
+        ensureSwept() {
+            if (swept)
+                return;
+            swept = true;
+            sweepOrphanedSideDirs(qiDir, sideFileBase);
+        },
     };
-    const location = (runId) => {
-        assertValidRunId(runId);
-        const realBase = realBaseForRead(qiDir, fs);
-        return realBase === undefined
-            ? join(qiDir, `${runId}${SNAPSHOT_SUFFIX}`)
-            : containedRecordPath(runId, realBase, fs);
+    return {
+        record: (input) => recordOp(ctx, input),
+        load: (runId) => loadOp(ctx, runId),
+        location: (runId) => {
+            assertValidRunId(runId);
+            const realBase = realBaseForRead(qiDir, ctx.fs);
+            return realBase === undefined
+                ? join(qiDir, `${runId}${SNAPSHOT_SUFFIX}`)
+                : containedRecordPath(runId, realBase, ctx.fs);
+        },
+        listByScope: (fileKey, nodeId) => listByScopeOp(ctx, fileKey, nodeId),
     };
-    return { record, load, location };
 }

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/retention.d.ts

@@ -22,17 +22,20 @@ export type QualityIntelligenceDeletionStatus = "deleted" | "absent";
 export interface QualityIntelligenceDeletionReceipt {
     readonly runId: string;
     readonly status: QualityIntelligenceDeletionStatus;
+    readonly removedCompanionSuffixes: readonly string[];
     readonly auditEvent: QualityIntelligenceRunDeletedEvent;
 }
 export interface QualityIntelligenceRunDeletedEvent {
     readonly type: "qi:run:deleted";
     readonly runId: string;
     readonly status: QualityIntelligenceDeletionStatus;
+    readonly removedCompanionSuffixes: readonly string[];
     readonly at: string;
 }
 export interface QualityIntelligenceDeleteOptions extends QualityIntelligenceLoadOptions {
     readonly now?: (() => number) | undefined;
     readonly sideFileRoot?: string | undefined;
+    readonly companionSuffixes?: readonly string[] | undefined;
 }
 export declare function deleteQualityIntelligenceRun(runId: string, options?: QualityIntelligenceDeleteOptions): QualityIntelligenceDeletionReceipt;
 export interface QualityIntelligenceQuarantineOptions {

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/retention.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/retention.ts"],"names":[],"mappings":"AAmBA,OAAO,EAGL,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EACnC,MAAM,YAAY,CAAC;AAIpB,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAGvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,yCAAyC;IACxD,QAAQ,CAAC,QAAQ,EAAE,SAAS,mCAAmC,EAAE,CAAC;IAElE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,gBAAgB,CAAC;CACpD;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,SAAS,oCAAoC,EAAE,CAAC;CACrE;AAoED,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,yCAAyC,GAC/C,kCAAkC,CAapC;AAID,MAAM,MAAM,iCAAiC,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErE,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,kCAAkC,CAAC;CACzD;AAKD,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IAEnD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gCAAiC,SAAQ,8BAA8B;IAEtF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;IAM1C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C;AAkCD,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,gCAAqC,GAC7C,kCAAkC,CAcpC;AAaD,MAAM,WAAW,oCAAoC;IAEnD,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,QAAQ,CAAC;CAC3C;AAED,wBAAgB,4CAA4C,CAC1D,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,oCAAyC,GACjD,oCAAoC,CAYtC;AAUD,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,wBAAgB,0CAA0C,CACxD,KAAK,EAAE,6BAA6B,GACnC,mCAAmC,CAYrC"}
+{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/retention.ts"],"names":[],"mappings":"AAuBA,OAAO,EAGL,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EACnC,MAAM,YAAY,CAAC;AAcpB,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAGvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,yCAAyC;IACxD,QAAQ,CAAC,QAAQ,EAAE,SAAS,mCAAmC,EAAE,CAAC;IAElE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,gBAAgB,CAAC;CACpD;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,SAAS,oCAAoC,EAAE,CAAC;CACrE;AAoED,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,yCAAyC,GAC/C,kCAAkC,CAapC;AAID,MAAM,MAAM,iCAAiC,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErE,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IAGnD,QAAQ,CAAC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,kCAAkC,CAAC;CACzD;AAKD,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IAGnD,QAAQ,CAAC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;IAErD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gCAAiC,SAAQ,8BAA8B;IAEtF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;IAM1C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAO3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC5D;AA+DD,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,gCAAqC,GAC7C,kCAAkC,CAqBpC;AAaD,MAAM,WAAW,oCAAoC;IAEnD,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,QAAQ,CAAC;CAC3C;AAED,wBAAgB,4CAA4C,CAC1D,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,oCAAyC,GACjD,oCAAoC,CAYtC;AAUD,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,wBAAgB,0CAA0C,CACxD,KAAK,EAAE,6BAA6B,GACnC,mCAAmC,CAYrC"}

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/retention.js

@@ -2,18 +2,31 @@
 //
 // Pure decision function (`applyQualityIntelligenceRetention`) consumed by the orchestrator with
 // the current store snapshot; the orchestrator does the side effects. Idempotent deletion
-// (`deleteQualityIntelligenceRun`) removes the manifest and emits a typed deletion-receipt
-// audit event without throwing on a missing run.
+// (`deleteQualityIntelligenceRun`) removes the manifest AND its companion artifacts
+// (`.candidates.json` plus any caller-supplied server-owned suffixes) so a deleted run leaves no
+// orphaned customer-derived content, and emits a typed deletion-receipt audit event without
+// throwing on a missing run.
 //
 // Restart recovery is enforced at the WRITE seam: every persist is atomic O_EXCL temp + rename,
 // so an unclean shutdown leaves at most one `.tmp` (or nothing). The list/load surfaces filter on
 // the `.qi.json` suffix, so a half-written run is never surfaced. There is no recovery procedure
 // to call — recovery IS the absence of a code path that surfaces partials.
 import { lstatSync, renameSync, rmSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve, sep } from "node:path";
 import { assertValidRunId } from "@oscharko-dev/keiko-security";
+import { CANDIDATES_SUFFIX } from "./candidatesArtifact.js";
+import { deleteQualityIntelligenceCompanionArtifact } from "./companionStore.js";
 import { getQualityIntelligenceRetentionProfile, } from "./retentionPolicy.js";
 import { createNodeQualityIntelligenceLocalStore, QI_SUBDIR, } from "./store.js";
+// Companion artifacts that `keiko-evidence` OWNS and writes alongside the run manifest under
+// `qi/`, keyed by `<runId>`. They are swept by default on deletion so a "deleted" run never leaves
+// customer-derived generated content (`.candidates.json`) orphaned on disk (Issue #274 AC4).
+// Higher layers that own their own companions (e.g. keiko-server's `.review.json`, the figma
+// route companions) pass their suffixes via `QualityIntelligenceDeleteOptions.companionSuffixes`;
+// keiko-evidence MUST NOT hard-code suffixes it does not own (layering). The figma-snapshot
+// companion + its `figma-snapshots/<runId>/` side-files are deliberately EXCLUDED here — they have
+// their own retention seam (`enforceFigmaSnapshotRetention`) and are cleaned by that subsystem.
+const QI_EVIDENCE_OWNED_COMPANION_SUFFIXES = Object.freeze([CANDIDATES_SUFFIX]);
 const MS_PER_DAY = 24 * 60 * 60 * 1000;
 function profileForEntry(entry) {
     return { entry, profile: getQualityIntelligenceRetentionProfile(entry.retentionPolicyId) };
@@ -93,7 +106,16 @@ function resolveDeleteStore(options) {
 // A symlink at the run-dir path is refused (defence against a planted symlink redirecting the
 // rm into an unrelated tree).
 function removeSideFileDirIfPresent(runId, sideFileRoot) {
-    const runDir = join(sideFileRoot, runId);
+    const root = resolve(sideFileRoot);
+    const runDir = join(root, runId);
+    // Defence-in-depth: runId is already `assertValidRunId`-checked (no separators, no `..`, no
+    // leading dot) before this is reached, so `runDir` cannot escape `root`. Assert it lexically so
+    // a future refactor that relaxes the validation order fails loudly here instead of `rm`-ing an
+    // unrelated tree — the one #274 FS op that did not previously route through the containment
+    // discipline used by the manifest/companion stores.
+    if (!runDir.startsWith(root + sep)) {
+        throw new Error(`QI side-file dir escapes the side-file root, refusing to delete: ${runDir}`);
+    }
     const stat = lstatSync(runDir, { throwIfNoEntry: false });
     if (stat === undefined) {
         return;
@@ -103,6 +125,21 @@ function removeSideFileDirIfPresent(runId, sideFileRoot) {
     }
     rmSync(runDir, { recursive: true, force: true });
 }
+// Sweep the run's companion artifacts (evidence-owned + caller-supplied) from the contained `qi/`
+// dir. Exact-suffix, idempotent: a companion that does not exist is skipped. Returns the suffixes
+// that were actually removed so the deletion receipt/audit event can attest completeness.
+function removeRunCompanions(evidenceDir, runId, extraSuffixes) {
+    const suffixes = [
+        ...new Set([...QI_EVIDENCE_OWNED_COMPANION_SUFFIXES, ...(extraSuffixes ?? [])]),
+    ];
+    const removed = [];
+    for (const suffix of suffixes) {
+        if (deleteQualityIntelligenceCompanionArtifact(evidenceDir, runId, suffix)) {
+            removed.push(suffix);
+        }
+    }
+    return removed.sort();
+}
 // Idempotent removal of a single QI run's local state. Returns a structured receipt rather than
 // throwing on a missing run — callers (UI, retention orchestrator) need to distinguish "deleted"
 // from "absent" without try/catch noise. When options.sideFileRoot is set, also removes
@@ -112,6 +149,11 @@ export function deleteQualityIntelligenceRun(runId, options = {}) {
     assertValidRunId(runId);
     const store = resolveDeleteStore(options);
     const removed = store.delete(runId);
+    // Sweep companion artifacts so a deleted run leaves no orphaned customer-derived content on disk
+    // (Issue #274 AC4). On-disk only — skipped when just an in-memory store is supplied.
+    const removedCompanionSuffixes = options.evidenceDir === undefined
+        ? []
+        : removeRunCompanions(options.evidenceDir, runId, options.companionSuffixes);
     if (options.sideFileRoot !== undefined) {
         removeSideFileDirIfPresent(runId, options.sideFileRoot);
     }
@@ -120,7 +162,8 @@ export function deleteQualityIntelligenceRun(runId, options = {}) {
     return {
         runId,
         status,
-        auditEvent: { type: "qi:run:deleted", runId, status, at },
+        removedCompanionSuffixes,
+        auditEvent: { type: "qi:run:deleted", runId, status, removedCompanionSuffixes, at },
     };
 }
 export function quarantineCorruptQualityIntelligenceManifest(evidenceDir, runId, options = {}) {

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/store.ts"],"names":[],"mappings":"AAoCA,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAGL,KAAK,mCAAmC,EACxC,KAAK,qCAAqC,EAE1C,KAAK,uCAAuC,EAC7C,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,KAAK,mCAAmC,EACzC,MAAM,gBAAgB,CAAC;AAIxB,eAAO,MAAM,SAAS,OAAO,CAAC;AAU9B,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,mCAAmC,KAAK,MAAM,CAAC;IAC3E,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,mCAAmC,GAAG,SAAS,CAAC;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7C;AAID,wBAAgB,2CAA2C,IAAI,6BAA6B,CAsB3F;AAkQD,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;CACtC;AAMD,wBAAgB,uCAAuC,CACrD,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,mCAAwC,GAChD,6BAA6B,CAgB/B;AAID,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC/D,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC/D,QAAQ,CAAC,QAAQ,EAAE,mCAAmC,CAAC,UAAU,CAAC,CAAC;IACnE,QAAQ,CAAC,OAAO,EAAE,mCAAmC,CAAC,SAAS,CAAC,CAAC;IACjE,QAAQ,CAAC,YAAY,EAAE,mCAAmC,CAAC,cAAc,CAAC,CAAC;IAC3E,QAAQ,CAAC,cAAc,EAAE,mCAAmC,CAAC,gBAAgB,CAAC,CAAC;IAC/E,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,CAAC,EAAE,mCAAmC,CAAC,gBAAgB,CAAC,CAAC;IAChF,oIAAoI;IACpI,QAAQ,CAAC,YAAY,CAAC,EAAE,mCAAmC,CAAC,cAAc,CAAC,CAAC;IAC5E,kFAAkF;IAClF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,uCAAuC,EAAE,CAAC;IACjF,yFAAyF;IACzF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,qCAAqC,EAAE,CAAC;IAC7E,mEAAmE;IACnE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,mCAAmC,GAAG,SAAS,CAAC;CACtE;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,mCAAmC,CAAC;IACvD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AA0HD,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,8BAA8B,EACrC,OAAO,GAAE,gCAAqC,GAC7C,+BAA+B,CAkCjC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,8BAAmC,GAC3C,mCAAmC,GAAG,SAAS,CAGjD;AAED,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,8BAAmC,GAC3C,SAAS,MAAM,EAAE,CAGnB"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/store.ts"],"names":[],"mappings":"AAoCA,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAGL,KAAK,mCAAmC,EACxC,KAAK,qCAAqC,EAE1C,KAAK,uCAAuC,EAC7C,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,KAAK,mCAAmC,EACzC,MAAM,gBAAgB,CAAC;AAIxB,eAAO,MAAM,SAAS,OAAO,CAAC;AAU9B,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,mCAAmC,KAAK,MAAM,CAAC;IAC3E,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,mCAAmC,GAAG,SAAS,CAAC;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7C;AAID,wBAAgB,2CAA2C,IAAI,6BAA6B,CAsB3F;AA4QD,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;CACtC;AAMD,wBAAgB,uCAAuC,CACrD,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,mCAAwC,GAChD,6BAA6B,CAgB/B;AAID,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC/D,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC/D,QAAQ,CAAC,QAAQ,EAAE,mCAAmC,CAAC,UAAU,CAAC,CAAC;IACnE,QAAQ,CAAC,OAAO,EAAE,mCAAmC,CAAC,SAAS,CAAC,CAAC;IACjE,QAAQ,CAAC,YAAY,EAAE,mCAAmC,CAAC,cAAc,CAAC,CAAC;IAC3E,QAAQ,CAAC,cAAc,EAAE,mCAAmC,CAAC,gBAAgB,CAAC,CAAC;IAC/E,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,CAAC,EAAE,mCAAmC,CAAC,gBAAgB,CAAC,CAAC;IAChF,oIAAoI;IACpI,QAAQ,CAAC,YAAY,CAAC,EAAE,mCAAmC,CAAC,cAAc,CAAC,CAAC;IAC5E,kFAAkF;IAClF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,uCAAuC,EAAE,CAAC;IACjF,yFAAyF;IACzF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,qCAAqC,EAAE,CAAC;IAC7E,mEAAmE;IACnE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,mCAAmC,GAAG,SAAS,CAAC;CACtE;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,mCAAmC,CAAC;IACvD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AA0ID,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,8BAA8B,EACrC,OAAO,GAAE,gCAAqC,GAC7C,+BAA+B,CA2CjC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,8BAAmC,GAC3C,mCAAmC,GAAG,SAAS,CAGjD;AAED,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,8BAAmC,GAC3C,SAAS,MAAM,EAAE,CAGnB"}