@oscharko-dev/keiko 0.2.0-beta.3 → 0.2.0-beta.4

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figma/figmaConnectorErrors.js

@@ -1,26 +1,32 @@
-// Figma connector error shapes (Epic #750, Issues #751, #758, #760).
+// Figma connector error shapes (Epic #750, Issues #751, #758, #760, #884).
 //
 // Coded, safe errors for the server-side Figma connector. A FigmaConnectorError carries
 // ONLY a stable code and a fixed, secret-free message — never the PAT, never a raw Figma
 // payload, never an outbound URL or header value. Mirrors the QI connector error posture
 // in ../connectorErrors.ts so the route tier can serialise it consistently.
 //
-// Complete coded taxonomy (#760); every code is user-actionable. Each ticket-named category maps to
-// one or more codes below:
+// Complete coded taxonomy (#760, #884); every code is user-actionable. Each ticket-named
+// category maps to one or more codes below:
 //   auth          → FIGMA_TOKEN_MISSING | FIGMA_TOKEN_INVALID | FIGMA_TOKEN_EXPIRED
 //                   | FIGMA_TOKEN_REVOKED
 //   consent       → FIGMA_CONSENT_REQUIRED (no recorded read-only-scope acknowledgement)
 //   scope         → FIGMA_INSUFFICIENT_SCOPE
 //   rate-limit    → FIGMA_RATE_LIMITED
 //   not-found     → FIGMA_NOT_FOUND
-//   oversized     → FIGMA_OVERSIZED_SCOPE
+//   oversized     → FIGMA_OVERSIZED_SCOPE | FIGMA_RESPONSE_TOO_LARGE
 //   render-failed → FIGMA_RENDER_FAILED
-//   proxy egress  → FIGMA_PROXY_UNREACHABLE (proxy not reachable / egress refused)
-//                   | FIGMA_PROXY_EGRESS_FAILED (generic egress failure, retained for back-compat)
+//   proxy egress  → FIGMA_PROXY_UNREACHABLE (proxy host unreachable)
+//                   | FIGMA_PROXY_AUTH_REQUIRED (proxy requires authentication)
+//                   | FIGMA_PROXY_BLOCKED_BY_POLICY (proxy denied the request by policy)
+//                   | FIGMA_PROXY_EGRESS_FAILED (generic proxy egress failure, retained for back-compat)
+//   direct egress → FIGMA_NETWORK_UNREACHABLE (DNS/connection/socket error, no proxy)
+//                   | FIGMA_EGRESS_TIMEOUT (request timed out before completion)
+//                   | FIGMA_EGRESS_FAILED (generic direct egress failure; new default)
 //   tls/ca        → FIGMA_TLS_CA_FAILURE (custom-CA / TLS verification failure on egress)
 // FIGMA_MALFORMED_URL, FIGMA_UPSTREAM_UNAVAILABLE, and FIGMA_INTERNAL cover input and last-resort
 // faults. The proxy-aware + custom-CA HTTP client itself is #802; this connector only SURFACES
 // these proxy/TLS codes — it does not implement the proxy transport.
+import { OutboundHttpEgressError, } from "@oscharko-dev/keiko-model-gateway/internal/http";
 const SAFE_MESSAGES = {
     FIGMA_MALFORMED_URL: "The supplied link is not a scoped Figma node link. Paste a board or section link that includes a node id.",
     FIGMA_TOKEN_MISSING: "The Figma connector is not configured. Set a read-only access token before fetching a board.",
@@ -33,10 +39,17 @@ const SAFE_MESSAGES = {
     FIGMA_RENDER_FAILED: "Figma could not render the requested screens. Re-run the snapshot; if it persists, connect a narrower section.",
     FIGMA_PROXY_EGRESS_FAILED: "The Figma request could not be routed through the platform egress proxy. Check proxy connectivity and try again.",
     FIGMA_PROXY_UNREACHABLE: "The platform egress proxy is unreachable. Check the proxy host and port and try again.",
+    FIGMA_PROXY_AUTH_REQUIRED: "The forward proxy requires authentication for the Figma egress request. Configure proxy credentials or an allow rule.",
+    FIGMA_PROXY_BLOCKED_BY_POLICY: "The forward proxy blocked the Figma egress request by policy. Ask the proxy operator to allow api.figma.com and the Figma render hosts.",
     FIGMA_TLS_CA_FAILURE: "The TLS certificate for the Figma egress could not be verified. Check the configured certificate authority bundle and try again.",
     FIGMA_OVERSIZED_SCOPE: "The requested Figma node subtree is too large for a single scoped fetch. Connect a narrower section.",
+    FIGMA_RESPONSE_TOO_LARGE: "The Figma API response exceeded the maximum allowed size. Connect a narrower section to reduce the response.",
     FIGMA_RATE_LIMITED: "Figma rate-limited the snapshot-build after repeated retries. Wait a moment and re-run the snapshot.",
     FIGMA_UPSTREAM_UNAVAILABLE: "The Figma service is currently unavailable. Try the scoped fetch again later.",
+    FIGMA_NETWORK_UNREACHABLE: "The outbound network request to Figma failed (DNS, connection, or socket error). Check network connectivity and egress policy.",
+    FIGMA_EGRESS_TIMEOUT: "The Figma request timed out before completing. Retry; if it persists, raise KEIKO_FIGMA_REQUEST_TIMEOUT_MS or check upstream latency.",
+    FIGMA_EGRESS_FAILED: "The outbound request to Figma failed before a response was received.",
+    FIGMA_BUILD_TIMEOUT: "The snapshot build exceeded the configured deadline. No partial snapshot was stored. Retry or raise KEIKO_FIGMA_BUILD_DEADLINE_MS.",
     FIGMA_INTERNAL: "The Figma connector could not service the request.",
 };
 export const figmaConnectorErrorBody = (code) => ({
@@ -60,7 +73,9 @@ const TLS_CODES = new Set([
     "UNABLE_TO_GET_ISSUER_CERT",
     "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
 ]);
-// Node.js / undici error codes that indicate a connectivity / DNS / timeout failure.
+// Node.js / undici error codes that indicate a direct connectivity / DNS / socket failure.
+// These are only reached when the error did NOT come through the OutboundHttpEgressError proxy
+// path — a raw ECONNREFUSED means no proxy is involved.
 const CONNECTIVITY_CODES = new Set([
     "ECONNREFUSED",
     "ECONNRESET",
@@ -71,20 +86,34 @@ const CONNECTIVITY_CODES = new Set([
     "ECONNABORTED",
     "EHOSTUNREACH",
     "ENETUNREACH",
+    "EPROTO",
+    "EPERM",
+    "EACCES",
     "UND_ERR_CONNECT_TIMEOUT",
     "UND_ERR_HEADERS_TIMEOUT",
     "UND_ERR_BODY_TIMEOUT",
     "UND_ERR_SOCKET",
 ]);
-const OUTBOUND_TLS_CODES = new Set(["TLS_CA_FAILURE"]);
-const OUTBOUND_PROXY_UNREACHABLE_CODES = new Set(["PROXY_UNREACHABLE"]);
-const OUTBOUND_PROXY_EGRESS_CODES = new Set([
+// Mapping from OutboundHttpEgressError codes (proxy path) to FigmaConnectorErrorCodes.
+// FIGMA_PROXY_* codes are ONLY reachable through the OutboundHttpEgressError branch.
+const OUTBOUND_CODE_TO_FIGMA = {
+    TLS_CA_FAILURE: "FIGMA_TLS_CA_FAILURE",
+    PROXY_UNREACHABLE: "FIGMA_PROXY_UNREACHABLE",
+    PROXY_AUTH_REQUIRED: "FIGMA_PROXY_AUTH_REQUIRED",
+    PROXY_BLOCKED_BY_POLICY: "FIGMA_PROXY_BLOCKED_BY_POLICY",
+    PROXY_EGRESS_FAILED: "FIGMA_PROXY_EGRESS_FAILED",
+};
+// String set of OutboundHttpEgressError codes for cross-package-boundary instanceof fallback.
+const OUTBOUND_EGRESS_CODES = new Set([
+    "TLS_CA_FAILURE",
+    "PROXY_UNREACHABLE",
     "PROXY_AUTH_REQUIRED",
     "PROXY_BLOCKED_BY_POLICY",
     "PROXY_EGRESS_FAILED",
 ]);
 const TLS_MSG_RE = /cert|self.?signed|unable to (?:verify|get).*(issuer|cert)|tls/i;
-const CONNECTIVITY_MSG_RE = /socket hang ?up|network|timeout|fetch failed|econn|enotfound/i;
+// "fetch failed" is the Node.js TypeError message for generic direct-network failures (undici).
+const CONNECTIVITY_MSG_RE = /socket hang ?up|network|fetch failed|econn|enotfound/i;
 const extractCode = (err) => {
     if (err !== null && typeof err === "object") {
         const code = err.code;
@@ -106,33 +135,84 @@ const extractMessage = (err) => {
         return err;
     return "";
 };
+const extractName = (err) => {
+    if (err !== null && typeof err === "object") {
+        const name = err.name;
+        if (typeof name === "string")
+            return name;
+    }
+    return "";
+};
+const extractCause = (err) => err !== null && typeof err === "object" ? err.cause : undefined;
+/** Map an outbound egress code string to a FigmaConnectorErrorCode, or return undefined. */
+const mapOutboundCode = (code) => {
+    if (!OUTBOUND_EGRESS_CODES.has(code))
+        return undefined;
+    return OUTBOUND_CODE_TO_FIGMA[code] ?? "FIGMA_PROXY_EGRESS_FAILED";
+};
+// Cross-package-boundary fallback: plain Error with a string .code in the outbound set.
+// Used when instanceof check fails because OutboundHttpEgressError came from a different
+// package copy (e.g. stale dist during tests).
+const mapOutboundCodeFallback = (topCode, causeCode) => {
+    if (topCode !== undefined && OUTBOUND_EGRESS_CODES.has(topCode)) {
+        return mapOutboundCode(topCode) ?? "FIGMA_PROXY_EGRESS_FAILED";
+    }
+    if (causeCode !== undefined && OUTBOUND_EGRESS_CODES.has(causeCode)) {
+        return mapOutboundCode(causeCode) ?? "FIGMA_PROXY_EGRESS_FAILED";
+    }
+    return undefined;
+};
+// (a) OutboundHttpEgressError path — a proxy was genuinely in play.
+// FIGMA_PROXY_* codes are ONLY reachable through this function.
+const classifyOutbound = (err, cause, topCode, causeCode) => {
+    const outbound = err instanceof OutboundHttpEgressError
+        ? err
+        : cause instanceof OutboundHttpEgressError
+            ? cause
+            : undefined;
+    if (outbound !== undefined)
+        return mapOutboundCode(outbound.code) ?? "FIGMA_PROXY_EGRESS_FAILED";
+    return mapOutboundCodeFallback(topCode, causeCode);
+};
+// (b) TLS by code or message.
+const classifyTls = (code, msg) => (code !== undefined && TLS_CODES.has(code)) || TLS_MSG_RE.test(msg)
+    ? "FIGMA_TLS_CA_FAILURE"
+    : undefined;
+// (c) Timeout / abort names — check both err and its cause.
+const isAbortName = (name) => name === "TimeoutError" || name === "AbortError";
+const classifyTimeout = (err, cause) => isAbortName(extractName(err)) || isAbortName(extractName(cause))
+    ? "FIGMA_EGRESS_TIMEOUT"
+    : undefined;
+// (d) Direct connectivity codes / messages — no proxy involved.
+const classifyConnectivity = (code, msg) => (code !== undefined && CONNECTIVITY_CODES.has(code)) || CONNECTIVITY_MSG_RE.test(msg)
+    ? "FIGMA_NETWORK_UNREACHABLE"
+    : undefined;
 /**
  * Classify a transport-level throw from `fetch` or the body read into a stable
  * {@link FigmaConnectorErrorCode}. Side-effect-free and total — any non-Error
- * throwable (string, undefined) maps to `FIGMA_PROXY_EGRESS_FAILED`.
+ * throwable (string, undefined) maps to `FIGMA_EGRESS_FAILED`.
+ *
+ * Precedence:
+ *   (a) OutboundHttpEgressError (or plain Error with outbound code, for cross-package resilience)
+ *       → proxy/TLS-via-proxy codes. FIGMA_PROXY_* codes are ONLY reachable via this branch.
+ *   (b) TLS trust codes / messages → FIGMA_TLS_CA_FAILURE.
+ *   (c) Timeout / abort names (DOMException AbortError, Node TimeoutError) → FIGMA_EGRESS_TIMEOUT.
+ *   (d) Direct connectivity codes / messages → FIGMA_NETWORK_UNREACHABLE.
+ *   (e) Default → FIGMA_EGRESS_FAILED.
  *
  * Inspects `err.code`, `err.cause.code`, and `err.message` in that order of
  * precedence so Node.js `TypeError: fetch failed` wrappers (undici wraps the
  * underlying `cause.code`) are classified correctly.
  */
 export const classifyFigmaTransportError = (err) => {
-    const code = extractCode(err) ?? extractCauseCode(err);
-    if (code !== undefined) {
-        if (OUTBOUND_TLS_CODES.has(code))
-            return "FIGMA_TLS_CA_FAILURE";
-        if (OUTBOUND_PROXY_UNREACHABLE_CODES.has(code))
-            return "FIGMA_PROXY_UNREACHABLE";
-        if (OUTBOUND_PROXY_EGRESS_CODES.has(code))
-            return "FIGMA_PROXY_EGRESS_FAILED";
-        if (TLS_CODES.has(code))
-            return "FIGMA_TLS_CA_FAILURE";
-        if (CONNECTIVITY_CODES.has(code))
-            return "FIGMA_PROXY_UNREACHABLE";
-    }
+    const cause = extractCause(err);
+    const topCode = extractCode(err);
+    const causeCode = extractCauseCode(err);
+    const code = topCode ?? causeCode;
     const msg = extractMessage(err);
-    if (TLS_MSG_RE.test(msg))
-        return "FIGMA_TLS_CA_FAILURE";
-    if (CONNECTIVITY_MSG_RE.test(msg))
-        return "FIGMA_PROXY_UNREACHABLE";
-    return "FIGMA_PROXY_EGRESS_FAILED";
+    return (classifyOutbound(err, cause, topCode, causeCode) ??
+        classifyTls(code, msg) ??
+        classifyTimeout(err, cause) ??
+        classifyConnectivity(code, msg) ??
+        "FIGMA_EGRESS_FAILED");
 };

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figma/figmaHttpPort.d.ts

@@ -9,11 +9,20 @@ export interface FigmaHttpResponse {
     readonly headers: Readonly<Record<string, string>>;
 }
 export type FigmaHttpPort = (request: FigmaHttpRequest) => Promise<FigmaHttpResponse>;
+/** Optional creation-time overrides for the default HTTP port. */
+export interface FigmaHttpPortOptions {
+    readonly timeoutMs?: number;
+    readonly maxResponseBytes?: number;
+}
 /**
  * Thin default adapter over the platform `fetch`. This is the ONLY place `fetch` is named.
- * It forwards the caller-built headers verbatim and reads the body as JSON; it does not
- * log, retry, or inspect the token. Resilience/backoff is out of scope here (#759); the
- * proxy/custom-CA transport is the platform prerequisite (#802) that replaces this adapter.
+ * It forwards the caller-built headers verbatim and reads the body as JSON with an explicit
+ * byte cap; it does not log, retry, or inspect the token. Resilience/backoff is out of scope
+ * here (#759); the proxy/custom-CA transport is the platform prerequisite (#802) that replaces
+ * this adapter.
+ *
+ * `redirect: "manual"` prevents the PAT auth header from following a cross-origin redirect.
+ * A 3xx response surfaces as a non-2xx port result; the connector treats non-2xx as upstream error.
  */
-export declare const createDefaultFigmaHttpPort: (egress?: OutboundHttpEgressConfig, fetchImpl?: typeof fetch) => FigmaHttpPort;
+export declare const createDefaultFigmaHttpPort: (egress?: OutboundHttpEgressConfig, fetchImpl?: typeof fetch, options?: FigmaHttpPortOptions) => FigmaHttpPort;
 //# sourceMappingURL=figmaHttpPort.d.ts.map

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figma/figmaHttpPort.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"figmaHttpPort.d.ts","sourceRoot":"","sources":["../../../src/qualityIntelligence/figma/figmaHttpPort.ts"],"names":[],"mappings":"AAYA,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,iDAAiD,CAAC;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAGvB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpD;AAED,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAsBtF;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,GACrC,SAAS,wBAAwB,EACjC,YAAY,OAAO,KAAK,KACvB,aAiBF,CAAC"}
+{"version":3,"file":"figmaHttpPort.d.ts","sourceRoot":"","sources":["../../../src/qualityIntelligence/figma/figmaHttpPort.ts"],"names":[],"mappings":"AAgBA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,iDAAiD,CAAC;AAQzD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAGvB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpD;AAED,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEtF,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAYD;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,GACrC,SAAS,wBAAwB,EACjC,YAAY,OAAO,KAAK,EACxB,UAAU,oBAAoB,KAC7B,aA4BF,CAAC"}

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figma/figmaHttpPort.js

@@ -8,8 +8,16 @@
 // `X-Figma-Token` auth header). The token is materialised into that header ONLY by the
 // default adapter below, immediately before the platform `fetch` call — it is never
 // logged here and never re-emitted by the port.
+//
+// redirect: "manual" is set so the PAT auth header can never silently follow a
+// cross-origin redirect. A 3xx response surfaces as a non-2xx status; the connector
+// layer treats any non-2xx as an upstream error.
 import { classifyFigmaTransportError, FigmaConnectorError } from "./figmaConnectorErrors.js";
-import { gatewayFetch, } from "@oscharko-dev/keiko-model-gateway/internal/http";
+import { gatewayFetch, readJsonCapped, } from "@oscharko-dev/keiko-model-gateway/internal/http";
+/** Default request timeout in milliseconds for Figma HTTP API calls. */
+const DEFAULT_TIMEOUT_MS = 60_000;
+/** Default maximum JSON response body size (10 MiB). */
+const DEFAULT_MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
 // Collects the response headers into a plain lower-cased map. `Headers` already lower-cases
 // names, so this is a faithful, allocation-bounded copy with no token (request-only header).
 const collectHeaders = (response) => {
@@ -19,34 +27,38 @@ const collectHeaders = (response) => {
     });
     return out;
 };
-const parseJsonBody = async (response) => {
-    const text = await response.text();
-    if (text.length === 0)
-        return undefined;
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return undefined;
-    }
-};
 /**
  * Thin default adapter over the platform `fetch`. This is the ONLY place `fetch` is named.
- * It forwards the caller-built headers verbatim and reads the body as JSON; it does not
- * log, retry, or inspect the token. Resilience/backoff is out of scope here (#759); the
- * proxy/custom-CA transport is the platform prerequisite (#802) that replaces this adapter.
+ * It forwards the caller-built headers verbatim and reads the body as JSON with an explicit
+ * byte cap; it does not log, retry, or inspect the token. Resilience/backoff is out of scope
+ * here (#759); the proxy/custom-CA transport is the platform prerequisite (#802) that replaces
+ * this adapter.
+ *
+ * `redirect: "manual"` prevents the PAT auth header from following a cross-origin redirect.
+ * A 3xx response surfaces as a non-2xx port result; the connector treats non-2xx as upstream error.
  */
-export const createDefaultFigmaHttpPort = (egress, fetchImpl) => {
+export const createDefaultFigmaHttpPort = (egress, fetchImpl, options) => {
+    const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const maxResponseBytes = options?.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
     return async (request) => {
+        const signal = AbortSignal.timeout(timeoutMs);
         try {
             const response = await gatewayFetch(request.url, {
                 method: "GET",
                 headers: { ...request.headers },
+                redirect: "manual",
+                signal,
                 ...(egress !== undefined ? { egress } : {}),
                 ...(fetchImpl !== undefined ? { fetchImpl } : {}),
             });
             const headers = collectHeaders(response);
-            const json = await parseJsonBody(response);
+            let json;
+            try {
+                json = await readJsonCapped(response, maxResponseBytes);
+            }
+            catch {
+                throw new FigmaConnectorError("FIGMA_RESPONSE_TOO_LARGE");
+            }
             return { status: response.status, json, headers };
         }
         catch (err) {

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figma/figmaRenderPort.d.ts

@@ -9,11 +9,21 @@ export interface FigmaRenderResponse {
     readonly headers: Readonly<Record<string, string>>;
 }
 export type FigmaRenderPort = (request: FigmaRenderRequest) => Promise<FigmaRenderResponse>;
+/** Optional creation-time overrides for the default render port. */
+export interface FigmaRenderPortOptions {
+    readonly timeoutMs?: number;
+    readonly maxResponseBytes?: number;
+}
 /**
  * Thin default adapter over the platform `fetch`. This is the ONLY place in the render path
  * `fetch` is named. It forwards the caller-built headers verbatim and reads the body as raw
- * bytes; it does not log, retry, or inspect any token. Resilience/backoff is out of scope here
- * (#759); the proxy/custom-CA transport is the platform prerequisite (#802) that replaces this.
+ * bytes with an explicit byte cap; it does not log, retry, or inspect any token. Resilience/
+ * backoff is out of scope here (#759); the proxy/custom-CA transport is the platform
+ * prerequisite (#802) that replaces this.
+ *
+ * `redirect: "manual"` prevents any caller-supplied auth header from following a cross-origin
+ * redirect. A 3xx response surfaces as a non-2xx port result; the connector treats it as
+ * upstream error.
  */
-export declare const createDefaultFigmaRenderPort: (egress?: OutboundHttpEgressConfig, fetchImpl?: typeof fetch) => FigmaRenderPort;
+export declare const createDefaultFigmaRenderPort: (egress?: OutboundHttpEgressConfig, fetchImpl?: typeof fetch, options?: FigmaRenderPortOptions) => FigmaRenderPort;
 //# sourceMappingURL=figmaRenderPort.d.ts.map

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figma/figmaRenderPort.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"figmaRenderPort.d.ts","sourceRoot":"","sources":["../../../src/qualityIntelligence/figma/figmaRenderPort.ts"],"names":[],"mappings":"AAcA,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,iDAAiD,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAG3B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpD;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,GACvC,SAAS,wBAAwB,EACjC,YAAY,OAAO,KAAK,KACvB,eAoBF,CAAC"}
+{"version":3,"file":"figmaRenderPort.d.ts","sourceRoot":"","sources":["../../../src/qualityIntelligence/figma/figmaRenderPort.ts"],"names":[],"mappings":"AAkBA,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,iDAAiD,CAAC;AAQzD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAG3B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpD;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAE5F,oEAAoE;AACpE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAiCD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACvC,SAAS,wBAAwB,EACjC,YAAY,OAAO,KAAK,EACxB,UAAU,sBAAsB,KAC/B,eA0BF,CAAC"}

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figma/figmaRenderPort.js

@@ -10,20 +10,69 @@
 // Figma auth header (the ephemeral url is pre-signed), but the seam still forwards whatever
 // headers the caller supplies so the proxy adapter can add transport headers. The token is
 // never materialised here and never logged.
+//
+// redirect: "manual" is set so any auth header supplied by the caller cannot follow a
+// cross-origin redirect. A 3xx response surfaces as a non-2xx status; the connector
+// layer treats non-2xx as upstream error.
 import { classifyFigmaTransportError, FigmaConnectorError } from "./figmaConnectorErrors.js";
 import { gatewayFetch, } from "@oscharko-dev/keiko-model-gateway/internal/http";
+/** Default request timeout in milliseconds for Figma render downloads. */
+const DEFAULT_TIMEOUT_MS = 60_000;
+/** Default maximum render response body size (32 MiB). */
+const DEFAULT_MAX_RESPONSE_BYTES = 32 * 1024 * 1024;
+/**
+ * Read a streaming response body up to `maxBytes`, accumulating into a Uint8Array.
+ * Throws a {@link FigmaConnectorError} with `FIGMA_RESPONSE_TOO_LARGE` if the cap is exceeded.
+ */
+const readBytesCapped = async (response, maxBytes) => {
+    if (response.body === null) {
+        const buffer = await response.arrayBuffer();
+        return new Uint8Array(buffer);
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > maxBytes) {
+            await reader.cancel();
+            throw new FigmaConnectorError("FIGMA_RESPONSE_TOO_LARGE");
+        }
+        chunks.push(value);
+    }
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        out.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return out;
+};
 /**
  * Thin default adapter over the platform `fetch`. This is the ONLY place in the render path
  * `fetch` is named. It forwards the caller-built headers verbatim and reads the body as raw
- * bytes; it does not log, retry, or inspect any token. Resilience/backoff is out of scope here
- * (#759); the proxy/custom-CA transport is the platform prerequisite (#802) that replaces this.
+ * bytes with an explicit byte cap; it does not log, retry, or inspect any token. Resilience/
+ * backoff is out of scope here (#759); the proxy/custom-CA transport is the platform
+ * prerequisite (#802) that replaces this.
+ *
+ * `redirect: "manual"` prevents any caller-supplied auth header from following a cross-origin
+ * redirect. A 3xx response surfaces as a non-2xx port result; the connector treats it as
+ * upstream error.
  */
-export const createDefaultFigmaRenderPort = (egress, fetchImpl) => {
+export const createDefaultFigmaRenderPort = (egress, fetchImpl, options) => {
+    const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const maxResponseBytes = options?.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
     return async (request) => {
+        const signal = AbortSignal.timeout(timeoutMs);
         try {
             const response = await gatewayFetch(request.url, {
                 method: "GET",
                 headers: { ...request.headers },
+                redirect: "manual",
+                signal,
                 ...(egress !== undefined ? { egress } : {}),
                 ...(fetchImpl !== undefined ? { fetchImpl } : {}),
             });
@@ -31,8 +80,8 @@ export const createDefaultFigmaRenderPort = (egress, fetchImpl) => {
             response.headers.forEach((value, name) => {
                 headers[name] = value;
             });
-            const buffer = await response.arrayBuffer();
-            return { status: response.status, bytes: new Uint8Array(buffer), headers };
+            const bytes = await readBytesCapped(response, maxResponseBytes);
+            return { status: response.status, bytes, headers };
         }
         catch (err) {
             if (err instanceof FigmaConnectorError)

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figma/figmaSnapshotBuilder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"figmaSnapshotBuilder.d.ts","sourceRoot":"","sources":["../../../src/qualityIntelligence/figma/figmaSnapshotBuilder.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EAGV,aAAa,EAEd,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAWzF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,EAAE,wBAAwB,CAAC,cAAc,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,qEAAqE;IACrE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IACxC,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;CAClC;AA+GD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAC7B,OAAO,uBAAuB,KAC7B,OAAO,CAAC,aAAa,CA6BvB,CAAC"}
+{"version":3,"file":"figmaSnapshotBuilder.d.ts","sourceRoot":"","sources":["../../../src/qualityIntelligence/figma/figmaSnapshotBuilder.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EAGV,aAAa,EAEd,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAWzF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,EAAE,wBAAwB,CAAC,cAAc,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,qEAAqE;IACrE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IACxC,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;CAClC;AAwLD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAC7B,OAAO,uBAAuB,KAC7B,OAAO,CAAC,aAAa,CA6BvB,CAAC"}

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figma/figmaSnapshotBuilder.js

@@ -29,6 +29,37 @@ const chunk = (items, size) => {
         out.push(items.slice(i, i + size));
     return out;
 };
+// Returns true when the hostname is an IP literal or a local/loopback name that must be blocked.
+const isBlockedHostname = (h) => h.length === 0 ||
+    /^\d+\.\d+\.\d+\.\d+$/.test(h) ||
+    h.startsWith("[") ||
+    h === "localhost" ||
+    h.endsWith(".localhost") ||
+    h.endsWith(".local");
+// Validates that a render URL returned by the Figma API is safe to follow. Blocks http:
+// (plaintext) and IP-literal hostnames (RFC-1918, loopback, link-local) to prevent SSRF via
+// a compromised or MITM'd API response. A broad IP-block is preferred over a tight CDN
+// allowlist because Figma's pre-signed render URLs span multiple AWS S3 regions/CDN fronts.
+const isRenderUrlSafe = (raw) => {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== "https:")
+        return false;
+    // Normalise: lowercase + strip exactly one trailing dot so "localhost." == "localhost".
+    const h = url.hostname.toLowerCase().replace(/\.$/, "");
+    if (isBlockedHostname(h))
+        return false;
+    // Only allow the default HTTPS port (443 or implicit) — non-standard ports indicate an
+    // internal service, not a CDN. url.port is "" when the port is the scheme default.
+    if (url.port !== "" && url.port !== "443")
+        return false;
+    return true;
+};
 const buildImagesUrl = (fileKey, ids, version) => {
     const url = new URL(`${FIGMA_API_ORIGIN}/v1/images/${encodeURIComponent(fileKey)}`);
     url.searchParams.set("ids", ids.join(","));
@@ -79,24 +110,65 @@ const requestRenderUrls = async (input, screenIds) => {
 const skip = (screenId, reason) => ({
     skipped: { screenId, reason },
 });
-// Downloads one screen's render bytes and classifies the result into a kept screen or a skip. The
-// pre-signed byte download is wrapped in the same deterministic 429 backoff; a single screen still
-// failing after retries degrades to a skip (partial render), never aborting the whole build.
+// Classifies a finished render download into a skip reason, or null when the bytes are usable.
+const renderSkipReason = (response, maxBytes) => {
+    if (response === null)
+        return "render-fetch-failed";
+    if (response.status < 200 || response.status >= 300)
+        return "render-fetch-failed";
+    if (response.bytes.length === 0)
+        return "render-empty";
+    if (response.bytes.length > maxBytes)
+        return "render-oversized";
+    return null;
+};
+// Hard-egress codes for the render-byte download host (S3/CDN — a DIFFERENT host than
+// api.figma.com). If the render port throws a FigmaConnectorError in this family, it means
+// TLS or proxy is misconfigured for the render CDN; swallowing it would yield a "successful"
+// snapshot with every screen skipped while hiding the root cause. Re-throw to abort the build,
+// consistent with the DEEP_FETCH_ABORT_CODES discipline in figmaScopedPagination.ts.
+// Using ReadonlySet<string> so this set is forward-compatible with the new codes
+// (FIGMA_PROXY_AUTH_REQUIRED, FIGMA_PROXY_BLOCKED_BY_POLICY) landing in a parallel change to
+// figmaConnectorErrors.ts without requiring a re-touch of this file.
+const RENDER_EGRESS_ABORT_CODES = new Set([
+    "FIGMA_TLS_CA_FAILURE",
+    "FIGMA_PROXY_UNREACHABLE",
+    "FIGMA_PROXY_EGRESS_FAILED",
+    "FIGMA_PROXY_AUTH_REQUIRED",
+    "FIGMA_PROXY_BLOCKED_BY_POLICY",
+]);
+// Classifies a render-port throw into a re-throw (hard egress abort) or a coded skip outcome.
+// Hard-egress errors abort the whole build — they affect every screen on the same host so
+// swallowing them would silently produce an empty snapshot.
+const classifyRenderError = (screenId, err) => {
+    if (err instanceof FigmaConnectorError) {
+        if (RENDER_EGRESS_ABORT_CODES.has(err.code))
+            throw err;
+        return skip(screenId, `render-fetch-failed:${err.code}`);
+    }
+    return skip(screenId, "render-fetch-failed");
+};
+// Downloads one screen's render bytes and classifies the result into a kept screen or a skip.
+// A single screen failing after retries degrades to a skip (partial render), never aborting.
+// Exception: hard egress errors (TLS/proxy misconfiguration) abort via classifyRenderError.
 const resolveScreen = async (input, ir, renderUrl) => {
     if (renderUrl === null)
         return skip(ir.id, "render-url-missing");
+    if (!isRenderUrlSafe(renderUrl))
+        return skip(ir.id, "render-url-blocked");
     const maxBytes = input.maxImageBytes ?? DEFAULT_MAX_IMAGE_BYTES;
     const policy = input.retryPolicy ?? DEFAULT_FIGMA_RETRY_POLICY;
     const sleep = input.sleep ?? realFigmaRetrySleep;
-    const response = await fetchWithBackoff(() => input.renderPort({ url: renderUrl, headers: {} }), policy, sleep).catch(() => null);
-    if (response === null)
-        return skip(ir.id, "render-fetch-failed");
-    if (response.status < 200 || response.status >= 300)
-        return skip(ir.id, "render-fetch-failed");
-    if (response.bytes.length === 0)
-        return skip(ir.id, "render-empty");
-    if (response.bytes.length > maxBytes)
-        return skip(ir.id, "render-oversized");
+    let response;
+    try {
+        response = await fetchWithBackoff(() => input.renderPort({ url: renderUrl, headers: {} }), policy, sleep);
+    }
+    catch (err) {
+        return classifyRenderError(ir.id, err);
+    }
+    const reason = renderSkipReason(response, maxBytes);
+    if (reason !== null)
+        return skip(ir.id, reason);
     const sha256 = hashBytes(response.bytes);
     const screen = {
         screenId: ir.id,

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figma/figmaSnapshotHash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"figmaSnapshotHash.d.ts","sourceRoot":"","sources":["../../../src/qualityIntelligence/figma/figmaSnapshotHash.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAEzF,KAAK,QAAQ,GAAG,wBAAwB,CAAC,QAAQ,CAAC;AAyClD,kFAAkF;AAClF,eAAO,MAAM,UAAU,GAAI,UAAU,MAAM,EAAE,IAAI,QAAQ,EAAE,aAAa,MAAM,KAAG,MACV,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,YAAY,GACvB,uBAAuB,MAAM,EAC7B,SAAS,MAAM,GAAG,SAAS,EAC3B,WAAW,SAAS;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAAE,EAAE,KAClF,MAKF,CAAC;AAEF,eAAO,MAAM,SAAS,GAAI,OAAO,UAAU,KAAG,MACI,CAAC"}
+{"version":3,"file":"figmaSnapshotHash.d.ts","sourceRoot":"","sources":["../../../src/qualityIntelligence/figma/figmaSnapshotHash.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAEzF,KAAK,QAAQ,GAAG,wBAAwB,CAAC,QAAQ,CAAC;AAwDlD,kFAAkF;AAClF,eAAO,MAAM,UAAU,GAAI,UAAU,MAAM,EAAE,IAAI,QAAQ,EAAE,aAAa,MAAM,KAAG,MACV,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,YAAY,GACvB,uBAAuB,MAAM,EAC7B,SAAS,MAAM,GAAG,SAAS,EAC3B,WAAW,SAAS;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAAE,EAAE,KAClF,MAKF,CAAC;AAEF,eAAO,MAAM,SAAS,GAAI,OAAO,UAAU,KAAG,MACI,CAAC"}

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figma/figmaSnapshotHash.js

@@ -23,18 +23,26 @@ const canonical = (value) => {
         .map((key) => `${JSON.stringify(key)}:${canonical(record[key])}`);
     return `{${entries.join(",")}}`;
 };
-const stripA11yColors = (node) => {
-    const projected = {
-        ...node,
-        children: node.children.map(stripA11yColors),
+// Keys excluded from the integrity hash. Using a static Set + Object.entries filter avoids both
+// dynamic-delete (no-dynamic-delete) and unused-var issues while keeping the whitelist explicit.
+const HASH_NEUTRAL_KEYS = new Set([
+    "textColor",
+    "backgroundColor",
+    "layout",
+    "sizing",
+    "cornerRadius",
+    "typography",
+]);
+const stripHashNeutralFields = (node) => {
+    const entries = Object.entries(node).filter(([key]) => key !== "children" && !HASH_NEUTRAL_KEYS.has(key));
+    return {
+        ...Object.fromEntries(entries),
+        children: node.children.map(stripHashNeutralFields),
     };
-    delete projected.textColor;
-    delete projected.backgroundColor;
-    return projected;
 };
 const hashStableIr = (ir) => ({
     ...ir,
-    root: stripA11yColors(ir.root),
+    root: stripHashNeutralFields(ir.root),
 });
 /** sha256 over the canonical per-screen identity: {screenId, ir, imageSha256}. */
 export const hashScreen = (screenId, ir, imageSha256) => sha256Hex(canonical({ imageSha256, ir: hashStableIr(ir), screenId }));

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figma/figmaSnapshotTypes.d.ts

@@ -16,8 +16,12 @@ export interface FigmaSnapshotScreen {
     /** sha256 over the canonical {screenId, ir, imageSha256} body — the per-screen drift identity. */
     readonly integrityHash: string;
 }
-/** Why a detected screen produced no render and was excluded from `screens` (partial-render). */
-export type FigmaSkippedScreenReason = "render-url-missing" | "render-fetch-failed" | "render-empty" | "render-oversized";
+/** Why a detected screen produced no render and was excluded from `screens` (partial-render).
+ * The `render-fetch-failed` member also appears as `render-fetch-failed:<CODE>` when the fetch
+ * threw a FigmaConnectorError — the code suffix lets metrics distinguish an egress
+ * misconfiguration (e.g. `FIGMA_EGRESS_TIMEOUT`) from an unclassified network flake.
+ */
+export type FigmaSkippedScreenReason = "render-url-missing" | "render-url-blocked" | "render-fetch-failed" | `render-fetch-failed:${string}` | "render-empty" | "render-oversized";
 export interface FigmaSkippedScreen {
     readonly screenId: string;
     readonly reason: FigmaSkippedScreenReason;

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figma/figmaSnapshotTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"figmaSnapshotTypes.d.ts","sourceRoot":"","sources":["../../../src/qualityIntelligence/figma/figmaSnapshotTypes.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,KAAK,QAAQ,GAAG,wBAAwB,CAAC,QAAQ,CAAC;AAElD,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,kGAAkG;IAClG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,iGAAiG;AACjG,MAAM,MAAM,wBAAwB,GAChC,oBAAoB,GACpB,qBAAqB,GACrB,cAAc,GACd,kBAAkB,CAAC;AAEvB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACjD,QAAQ,CAAC,cAAc,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,wBAAwB,CAAC,eAAe,EAAE,CAAC;IACrE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC"}
+{"version":3,"file":"figmaSnapshotTypes.d.ts","sourceRoot":"","sources":["../../../src/qualityIntelligence/figma/figmaSnapshotTypes.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,KAAK,QAAQ,GAAG,wBAAwB,CAAC,QAAQ,CAAC;AAElD,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,kGAAkG;IAClG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC,oBAAoB,GACpB,oBAAoB,GACpB,qBAAqB,GACrB,uBAAuB,MAAM,EAAE,GAC/B,cAAc,GACd,kBAAkB,CAAC;AAEvB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACjD,QAAQ,CAAC,cAAc,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,wBAAwB,CAAC,eAAe,EAAE,CAAC;IACrE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC"}