@oscharko-dev/keiko 0.2.0-beta.3 → 0.2.0-beta.4

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figmaSnapshotAdapter.d.ts

@@ -2,11 +2,23 @@ import { type FigmaSnapshotRecord } from "@oscharko-dev/keiko-evidence";
 import type { UiHandlerDeps } from "../deps.js";
 /** Loads an immutable Figma Snapshot evidence record by runId. Returns `undefined` when not found. */
 export type FigmaSnapshotLoader = (snapshotRunId: string) => FigmaSnapshotRecord | undefined;
+export interface FigmaSnapshotLoaderOptions {
+    /**
+     * Drift seam (#735): a figma-snapshot source pins a write-once, content-addressed runId, so its
+     * content can never change under its identity — re-checking the pinned record would always
+     * report "fresh" even after the board changed and was re-snapshotted. When this flag is set the
+     * loader resolves the LATEST snapshot recorded for the same board scope (fileKey + nodeId) and
+     * returns it instead of the pinned record whenever its integrity hash differs. Screen atom ids
+     * are board-stable (screenId-derived), so compareStaleness sees changed atoms, not orphans.
+     * Used by re-check and regenerate-stale ONLY — the generate path keeps exact pinning.
+     */
+    readonly resolveLatestByScope?: boolean;
+}
 /**
  * Build the snapshot loader. Returns `undefined` when `deps.evidenceDir` is not configured so the
  * ingestion layer maps an attempted figma-snapshot source to QI_FIGMA_SNAPSHOT_UNAVAILABLE.
  */
-export declare function makeFigmaSnapshotLoader(deps: UiHandlerDeps): FigmaSnapshotLoader | undefined;
+export declare function makeFigmaSnapshotLoader(deps: UiHandlerDeps, options?: FigmaSnapshotLoaderOptions): FigmaSnapshotLoader | undefined;
 /** The image-derived semantics a multimodal model recovered for one screen, as additive hints. */
 export interface FigmaVisionScreenRequest {
     readonly screenId: string;

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figmaSnapshotAdapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"figmaSnapshotAdapter.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/figmaSnapshotAdapter.ts"],"names":[],"mappings":"AAiBA,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD,sGAAsG;AACtG,MAAM,MAAM,mBAAmB,GAAG,CAAC,aAAa,EAAE,MAAM,KAAK,mBAAmB,GAAG,SAAS,CAAC;AAE7F;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,mBAAmB,GAAG,SAAS,CAY5F;AAED,kGAAkG;AAClG,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uFAAuF;IACvF,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,kGAAkG;IAClG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,EAAE,wBAAwB,KAAK,SAAS,MAAM,EAAE,CAAC;AAE/F;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,CAC5B,OAAO,EAAE,wBAAwB,EACjC,OAAO,EAAE,MAAM,KACZ,SAAS,MAAM,EAAE,CAAC;AAOvB;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,aAAa,EACnB,UAAU,CAAC,EAAE,eAAe,GAC3B,uBAAuB,CAazB"}
+{"version":3,"file":"figmaSnapshotAdapter.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/figmaSnapshotAdapter.ts"],"names":[],"mappings":"AAiBA,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD,sGAAsG;AACtG,MAAM,MAAM,mBAAmB,GAAG,CAAC,aAAa,EAAE,MAAM,KAAK,mBAAmB,GAAG,SAAS,CAAC;AAE7F,MAAM,WAAW,0BAA0B;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,EACnB,OAAO,CAAC,EAAE,0BAA0B,GACnC,mBAAmB,GAAG,SAAS,CA0BjC;AAED,kGAAkG;AAClG,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uFAAuF;IACvF,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,kGAAkG;IAClG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,EAAE,wBAAwB,KAAK,SAAS,MAAM,EAAE,CAAC;AAE/F;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,CAC5B,OAAO,EAAE,wBAAwB,EACjC,OAAO,EAAE,MAAM,KACZ,SAAS,MAAM,EAAE,CAAC;AAOvB;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,aAAa,EACnB,UAAU,CAAC,EAAE,eAAe,GAC3B,uBAAuB,CAazB"}

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figmaSnapshotAdapter.js

@@ -20,14 +20,27 @@ import { resolveQiMultimodalSelection } from "./modelSelection.js";
  * Build the snapshot loader. Returns `undefined` when `deps.evidenceDir` is not configured so the
  * ingestion layer maps an attempted figma-snapshot source to QI_FIGMA_SNAPSHOT_UNAVAILABLE.
  */
-export function makeFigmaSnapshotLoader(deps) {
+export function makeFigmaSnapshotLoader(deps, options) {
     const evidenceDir = deps.evidenceDir;
     if (evidenceDir === undefined || evidenceDir.length === 0)
         return undefined;
     const store = createNodeFigmaSnapshotStore(evidenceDir);
+    const resolveLatest = options?.resolveLatestByScope === true;
     return (snapshotRunId) => {
         try {
-            return store.load(snapshotRunId);
+            const pinned = store.load(snapshotRunId);
+            if (pinned === undefined || !resolveLatest)
+                return pinned;
+            const entries = store.listByScope(pinned.provenance.fileKey, pinned.provenance.nodeId);
+            const newest = entries[0];
+            if (newest === undefined ||
+                newest.runId === pinned.runId ||
+                newest.integrityHash === pinned.integrityHash) {
+                return pinned;
+            }
+            // Fall back to the pinned record when the newest record fails to load — drift detection
+            // must degrade to "fresh", never crash the re-check.
+            return store.load(newest.runId) ?? pinned;
         }
         catch {
             // A malformed / unreadable record is treated as "not found"; the caller emits a coded error.

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figmaSnapshotOrchestration.d.ts

@@ -14,6 +14,15 @@ export interface GovernedSnapshotDeps {
     readonly pagination?: Partial<ScopedPaginationLimits>;
     /** Shared enterprise egress settings for Figma API + render downloads (#802). */
     readonly egress?: OutboundHttpEgressConfig | undefined;
+    /**
+     * Creation-time overrides forwarded to the default HTTP and render ports when no explicit
+     * httpPort/renderPort is injected. Currently only `timeoutMs` (maps to
+     * KEIKO_FIGMA_REQUEST_TIMEOUT_MS). Ignored when httpPort/renderPort are injected directly
+     * (route tests supply fakes that honour their own timeouts).
+     */
+    readonly portOptions?: {
+        readonly timeoutMs?: number;
+    };
     readonly httpPort?: FigmaHttpPort;
     readonly renderPort?: FigmaRenderPort;
     readonly keychainAccess?: FigmaKeychainAccess;

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figmaSnapshotOrchestration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"figmaSnapshotOrchestration.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/figmaSnapshotOrchestration.ts"],"names":[],"mappings":"AAeA,OAAO,EAOL,qBAAqB,EAQrB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAKhG,KAAK,cAAc,GAAG,wBAAwB,CAAC,cAAc,CAAC;AAE9D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,uFAAuF;IACvF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,+CAA+C;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACtD,iFAAiF;IACjF,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAEvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,mBAAmB,CAAC;CAC/C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;CAClC;AAMD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,oBAAoB,KAAG,MAAM,GAAG,SAWzE,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,kBAAkB,GAC7B,MAAM,IAAI,CAAC,oBAAoB,EAAE,KAAK,GAAG,aAAa,GAAG,gBAAgB,CAAC,KACzE,UAAU,CAAC,OAAO,qBAAqB,CAOzC,CAAC;AAqDF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GAChC,WAAW,MAAM,EACjB,MAAM,oBAAoB,EAC1B,sBAAoB,KACnB,OAAO,CAAC,sBAAsB,CAiDhC,CAAC"}
+{"version":3,"file":"figmaSnapshotOrchestration.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/figmaSnapshotOrchestration.ts"],"names":[],"mappings":"AAeA,OAAO,EAOL,qBAAqB,EAQrB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAKhG,KAAK,cAAc,GAAG,wBAAwB,CAAC,cAAc,CAAC;AAE9D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,uFAAuF;IACvF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,+CAA+C;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACtD,iFAAiF;IACjF,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACvD;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAEvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,mBAAmB,CAAC;CAC/C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;CAClC;AAMD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,oBAAoB,KAAG,MAAM,GAAG,SAWzE,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,kBAAkB,GAC7B,MAAM,IAAI,CAAC,oBAAoB,EAAE,KAAK,GAAG,aAAa,GAAG,gBAAgB,CAAC,KACzE,UAAU,CAAC,OAAO,qBAAqB,CAOzC,CAAC;AAqDF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GAChC,WAAW,MAAM,EACjB,MAAM,oBAAoB,EAC1B,sBAAoB,KACnB,OAAO,CAAC,sBAAsB,CAmDhC,CAAC"}

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figmaSnapshotOrchestration.js

@@ -91,8 +91,8 @@ export const governedSnapshotBuild = async (boardLink, deps, isResnapshot = fals
     if (target === null)
         throw new FigmaConnectorError("FIGMA_MALFORMED_URL");
     const scopeRef = deriveFigmaScopeRef(target.fileKey, target.nodeId);
-    const httpPort = deps.httpPort ?? createDefaultFigmaHttpPort(deps.egress);
-    const renderPort = deps.renderPort ?? createDefaultFigmaRenderPort(deps.egress);
+    const httpPort = deps.httpPort ?? createDefaultFigmaHttpPort(deps.egress, undefined, deps.portOptions);
+    const renderPort = deps.renderPort ?? createDefaultFigmaRenderPort(deps.egress, undefined, deps.portOptions);
     const vaultToken = readFigmaVaultToken(deps);
     gateConsent(deps, scopeRef);
     // Render-token (vault > config > env). Throws FIGMA_TOKEN_MISSING when nothing is configured.

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figmaSnapshotRoutes.d.ts

@@ -51,7 +51,15 @@ export interface FigmaScreenSummary {
     /** Byte size of the rendered PNG. */
     readonly imageByteLength: number;
 }
-export declare function handleFigmaTriggerSnapshot(ctx: RouteContext, deps: UiHandlerDeps): Promise<RouteResult>;
+interface CoalescedBuildEntry {
+    readonly promise: Promise<RouteResult>;
+}
+/** Injectable for tests — returns the module-level map by default. */
+export declare function makeInFlightMap(): Map<string, CoalescedBuildEntry>;
+/** Reset the module-level coalescing map. Used by tests to ensure isolation. */
+export declare function resetInFlightMap(): void;
+export declare function handleFigmaTriggerSnapshot(ctx: RouteContext, deps: UiHandlerDeps, inFlight?: Map<string, CoalescedBuildEntry>): Promise<RouteResult>;
 export declare function handleFigmaRevokeToken(ctx: RouteContext, deps: UiHandlerDeps): RouteResult;
 export declare function handleFigmaLoadSnapshot(ctx: RouteContext, deps: UiHandlerDeps): RouteResult;
+export {};
 //# sourceMappingURL=figmaSnapshotRoutes.d.ts.map

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figmaSnapshotRoutes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"figmaSnapshotRoutes.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/figmaSnapshotRoutes.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAA8B,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAE5E,OAAO,EAOL,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EAExB,MAAM,kBAAkB,CAAC;AAgH1B,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2FAA2F;IAC3F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACjD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wFAAwF;IACxF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,kCAAkC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qCAAqC;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAmMD,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAkCtB;AAID,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CA4B1F;AAID,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAwB3F"}
+{"version":3,"file":"figmaSnapshotRoutes.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/figmaSnapshotRoutes.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAA8B,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAE5E,OAAO,EAOL,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EAExB,MAAM,kBAAkB,CAAC;AAoI1B,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2FAA2F;IAC3F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACjD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wFAAwF;IACxF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,kCAAkC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qCAAqC;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAgOD,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;CACxC;AAMD,sEAAsE;AACtE,wBAAgB,eAAe,IAAI,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAElE;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAmED,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,EACnB,QAAQ,GAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAsB,GAC9D,OAAO,CAAC,WAAW,CAAC,CAqCtB;AAID,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CA4B1F;AAID,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAwB3F"}

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figmaSnapshotRoutes.js

@@ -19,6 +19,28 @@
 //
 // Both routes honour the existing QI error-envelope convention:
 //   { error: { code: string; message: string } }
+//
+// In-flight coalescing (item 2):
+//   Concurrent POSTs for the same scope (fileKey:nodeId) share ONE build promise. The FIRST
+//   caller starts the governed build, mints the runId ONCE, persists ONCE (inside the build
+//   chain so a deadline-expired-but-completed build still persists and is recoverable via an
+//   immediate retry POST). Subsequent callers await the same promise and receive the same
+//   runId/response. The entry is removed on settle (finally). Failures propagate to all
+//   waiters with the same coded error.
+//
+// Build deadline (item 3):
+//   KEIKO_FIGMA_BUILD_DEADLINE_MS (default 600 000 ms). The awaiting handler races the
+//   coalesced build promise against a deadline rejection. On deadline the handler responds
+//   504 FIGMA_BUILD_TIMEOUT WITHOUT a runId. The coalesced build itself continues (other
+//   waiters may exist); persist is INSIDE the build chain, so if/when the build completes
+//   a subsequent POST for the same scope finds the map empty and re-coalesces cheaply.
+//   The underlying build is bounded by per-fetch timeouts and pagination budgets.
+//
+// Client disconnect (item 4):
+//   The handler listens for the 'close' event on ctx.req. On disconnect the per-waiter
+//   race resolves promptly (504 FIGMA_BUILD_TIMEOUT body never sent over the wire).
+//   The coalesced build continues — other waiters (if any) are unaffected and will
+//   receive the result when the build settles.
 import { randomUUID } from "node:crypto";
 import { currentGatewayEgressConfig } from "../deps.js";
 import { parseFigmaTarget, deriveFigmaScopeRef, observeFigmaRevoke, EXPECTED_FIGMA_SCOPES, FigmaConnectorError, } from "./figma/index.js";
@@ -35,9 +57,16 @@ const FIGMA_ROUTE_ERROR_MESSAGES = {
     FIGMA_UPSTREAM_UNAVAILABLE: "Figma API is temporarily unavailable. Please try again.",
     FIGMA_PROXY_EGRESS_FAILED: "The forward proxy rejected the Figma egress request. Check proxy configuration.",
     FIGMA_PROXY_UNREACHABLE: "The configured forward proxy is unreachable. Check proxy host and port settings.",
+    FIGMA_PROXY_AUTH_REQUIRED: "The forward proxy requires authentication. Configure proxy credentials or an allow rule.",
+    FIGMA_PROXY_BLOCKED_BY_POLICY: "The forward proxy blocked the Figma egress request. Ask the proxy operator to allow api.figma.com.",
     FIGMA_TLS_CA_FAILURE: "The Figma egress TLS certificate could not be verified. Check the configured CA bundle.",
     FIGMA_RATE_LIMITED: "Figma rate-limited the snapshot-build. Please wait a moment and try again.",
     FIGMA_OVERSIZED_SCOPE: "The selected Figma board section is too large. Select a smaller section (frame or page).",
+    FIGMA_RESPONSE_TOO_LARGE: "The Figma API response exceeded the size limit. Select a smaller section.",
+    FIGMA_NETWORK_UNREACHABLE: "The outbound request to Figma failed. Check network connectivity and egress policy.",
+    FIGMA_EGRESS_TIMEOUT: "The Figma request timed out. Retry or raise KEIKO_FIGMA_REQUEST_TIMEOUT_MS.",
+    FIGMA_EGRESS_FAILED: "The outbound request to Figma failed before a response was received.",
+    FIGMA_BUILD_TIMEOUT: "The snapshot build exceeded the configured deadline. No partial snapshot was stored.",
     FIGMA_INTERNAL: "An unexpected error occurred during the snapshot-build.",
     FIGMA_BAD_LINK: "The board link is not a valid Figma URL, or it is missing a node-id " +
         "(section/frame anchor required).",
@@ -55,7 +84,7 @@ function figmaErrorBody(code) {
     // board reference — only the static scope strings.
     return code === "FIGMA_CONSENT_REQUIRED" ? { ...base, scopes: EXPECTED_FIGMA_SCOPES } : base;
 }
-// Codes that map to 502 (upstream/auth problems, not client errors).
+// Codes that map to 502 (upstream/auth/egress problems, not client errors).
 const FIGMA_502_CODES = new Set([
     "FIGMA_TOKEN_MISSING",
     "FIGMA_TOKEN_INVALID",
@@ -64,8 +93,14 @@ const FIGMA_502_CODES = new Set([
     "FIGMA_INSUFFICIENT_SCOPE",
     "FIGMA_PROXY_EGRESS_FAILED",
     "FIGMA_PROXY_UNREACHABLE",
+    "FIGMA_PROXY_AUTH_REQUIRED",
+    "FIGMA_PROXY_BLOCKED_BY_POLICY",
     "FIGMA_TLS_CA_FAILURE",
     "FIGMA_UPSTREAM_UNAVAILABLE",
+    "FIGMA_NETWORK_UNREACHABLE",
+    "FIGMA_EGRESS_TIMEOUT",
+    "FIGMA_EGRESS_FAILED",
+    "FIGMA_RESPONSE_TOO_LARGE",
 ]);
 function figmaStatusForCode(code) {
     if (FIGMA_502_CODES.has(code))
@@ -79,6 +114,8 @@ function figmaStatusForCode(code) {
     // Precondition Required: the operator must acknowledge the read-only scope before the build (#760).
     if (code === "FIGMA_CONSENT_REQUIRED")
         return 428;
+    if (code === "FIGMA_BUILD_TIMEOUT")
+        return 504;
     return 500;
 }
 // ─── Body reader ───────────────────────────────────────────────────────────────
@@ -245,6 +282,25 @@ function figmaPaginationFromEnv(env) {
     apply("fetchConcurrency", "KEIKO_FIGMA_FETCH_CONCURRENCY");
     return overrides;
 }
+/** Default total snapshot-build deadline in milliseconds (10 minutes). */
+const DEFAULT_BUILD_DEADLINE_MS = 600_000;
+/** Default per-fetch request timeout in milliseconds (1 minute). */
+const DEFAULT_REQUEST_TIMEOUT_MS = 60_000;
+// Parses a positive-integer env var, returning the default when the value is absent or invalid.
+function readPositiveIntEnv(raw, defaultValue) {
+    if (raw === undefined)
+        return defaultValue;
+    const value = Number(raw);
+    return Number.isInteger(value) && value > 0 ? value : defaultValue;
+}
+/** KEIKO_FIGMA_BUILD_DEADLINE_MS — total build deadline used by the coalesced promise race. */
+function figmaBuildDeadlineMsFromEnv(env) {
+    return readPositiveIntEnv(env.KEIKO_FIGMA_BUILD_DEADLINE_MS, DEFAULT_BUILD_DEADLINE_MS);
+}
+/** KEIKO_FIGMA_REQUEST_TIMEOUT_MS — per-fetch timeout threaded into the transport ports. */
+function figmaRequestTimeoutMsFromEnv(env) {
+    return readPositiveIntEnv(env.KEIKO_FIGMA_REQUEST_TIMEOUT_MS, DEFAULT_REQUEST_TIMEOUT_MS);
+}
 // Map a thrown error from the governed build to a coded route result: a coded connector error maps to
 // its status (consent-required → 428, auth → 502, rate-limit → 429, …); anything else is a safe 500.
 function figmaErrorResult(err) {
@@ -287,8 +343,69 @@ function persistSnapshot(evidenceDir, runId, result) {
         return { status: 500, body: figmaErrorBody("FIGMA_INTERNAL") };
     return record;
 }
+// The map is module-level so it is shared across concurrent requests on the same server instance.
+// It is exposed via makeInFlightMap so tests can inject a fresh map (isolation without mocking).
+let defaultInFlightMap = new Map();
+/** Injectable for tests — returns the module-level map by default. */
+export function makeInFlightMap() {
+    return defaultInFlightMap;
+}
+/** Reset the module-level coalescing map. Used by tests to ensure isolation. */
+export function resetInFlightMap() {
+    defaultInFlightMap = new Map();
+}
+/** Derive the scope key (fileKey:nodeId) for the in-flight map. */
+function scopeKeyFor(boardLink) {
+    const target = parseFigmaTarget(boardLink);
+    if (target === null)
+        return undefined;
+    return `${target.fileKey}:${target.nodeId}`;
+}
+// Starts the governed build + persist and removes the map entry on settle.
+// Persist is INSIDE this chain: if a caller's deadline fires but the build later completes,
+// the record is stored and an immediate retry POST coalesces or finds it via the GET route.
+function startCoalescedBuild(scopeKey, inFlight, boardLink, body, evidenceDir, deps) {
+    const buildAndPersist = async () => {
+        let result;
+        try {
+            // The governed build resolves the vault>config>env PAT (#758), gates on recorded read-only
+            // consent before any egress + audits the action + computes metrics (#760), and deep-fetches +
+            // renders within the snapshot boundary (#837/#759). Errors (incl. consent-required) are coded.
+            result = await governedSnapshotBuild(boardLink, {
+                evidenceDir,
+                env: deps.env,
+                now: new Date().toISOString(),
+                acknowledgeReadOnly: body.acknowledgeReadOnly,
+                pagination: figmaPaginationFromEnv(deps.env),
+                egress: currentGatewayEgressConfig(deps),
+                portOptions: { timeoutMs: figmaRequestTimeoutMsFromEnv(deps.env) },
+            }, body.isResnapshot);
+        }
+        catch (err) {
+            return figmaErrorResult(err);
+        }
+        const runId = `fs-${randomUUID()}`;
+        const stored = persistSnapshot(evidenceDir, runId, result);
+        if ("status" in stored)
+            return stored;
+        return { status: 201, body: recordToSummary(stored, result.coverage, result.metrics) };
+    };
+    const promise = buildAndPersist().finally(() => {
+        inFlight.delete(scopeKey);
+    });
+    inFlight.set(scopeKey, { promise });
+    return promise;
+}
+// Returns a promise that rejects with a FIGMA_BUILD_TIMEOUT error after `ms` milliseconds.
+function deadlineRejection(ms) {
+    return new Promise((_resolve, reject) => {
+        setTimeout(() => {
+            reject(new FigmaConnectorError("FIGMA_BUILD_TIMEOUT"));
+        }, ms);
+    });
+}
 // ─── POST /api/figma/snapshots ─────────────────────────────────────────────────
-export async function handleFigmaTriggerSnapshot(ctx, deps) {
+export async function handleFigmaTriggerSnapshot(ctx, deps, inFlight = defaultInFlightMap) {
     const evidenceDir = deps.evidenceDir;
     if (evidenceDir === undefined || evidenceDir.length === 0) {
         return { status: 503, body: figmaErrorBody("FIGMA_NO_EVIDENCE_DIR") };
@@ -297,28 +414,30 @@ export async function handleFigmaTriggerSnapshot(ctx, deps) {
     if ("status" in bodyResult)
         return bodyResult;
     const body = bodyResult;
-    let result;
+    const scopeKey = scopeKeyFor(body.boardLink);
+    if (scopeKey === undefined) {
+        // parseTriggerBody already validates the board link; this is a belt-and-suspenders guard.
+        return { status: 400, body: figmaErrorBody("FIGMA_BAD_LINK") };
+    }
+    // Coalesce: join an existing build for this scope, or start a new one.
+    const existing = inFlight.get(scopeKey);
+    const buildPromise = existing !== undefined
+        ? existing.promise
+        : startCoalescedBuild(scopeKey, inFlight, body.boardLink, body, evidenceDir, deps);
+    const deadlineMs = figmaBuildDeadlineMsFromEnv(deps.env);
+    // Per-waiter race: deadline + client-disconnect both resolve this waiter promptly while the
+    // coalesced build (and its persist) continues uninterrupted for other waiters.
+    const disconnectPromise = new Promise((_resolve, reject) => {
+        ctx.req.once("close", () => {
+            reject(new FigmaConnectorError("FIGMA_BUILD_TIMEOUT"));
+        });
+    });
     try {
-        // The governed build resolves the vault>config>env PAT (#758), gates on recorded read-only
-        // consent before any egress + audits the action + computes metrics (#760), and deep-fetches +
-        // renders within the snapshot boundary (#837/#759). Errors (incl. consent-required) are coded.
-        result = await governedSnapshotBuild(body.boardLink, {
-            evidenceDir,
-            env: deps.env,
-            now: new Date().toISOString(),
-            acknowledgeReadOnly: body.acknowledgeReadOnly,
-            pagination: figmaPaginationFromEnv(deps.env),
-            egress: currentGatewayEgressConfig(deps),
-        }, body.isResnapshot);
+        return await Promise.race([buildPromise, deadlineRejection(deadlineMs), disconnectPromise]);
     }
     catch (err) {
         return figmaErrorResult(err);
     }
-    const runId = `fs-${randomUUID()}`;
-    const stored = persistSnapshot(evidenceDir, runId, result);
-    if ("status" in stored)
-        return stored;
-    return { status: 201, body: recordToSummary(stored, result.coverage, result.metrics) };
 }
 // ─── DELETE /api/figma/token — revoke the stored PAT (#758 rotation/revocation, #760 audit) ───
 export function handleFigmaRevokeToken(ctx, deps) {

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/generationPort.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generationPort.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/generationPort.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,iCAAiC,EAGlC,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIhD,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,SAAgB,IAAI,EAAE,MAAM,CAAC;gBACjB,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAiED,MAAM,MAAM,kBAAkB,GAC1B,MAAM,GACN;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C,CAAC;AAsHN,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,kBAAkB,GACzB,iCAAiC,CAMnC"}
+{"version":3,"file":"generationPort.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/generationPort.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,iCAAiC,EAGlC,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIhD,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,SAAgB,IAAI,EAAE,MAAM,CAAC;gBACjB,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAwFD,MAAM,MAAM,kBAAkB,GAC1B,MAAM,GACN;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C,CAAC;AAsHN,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,kBAAkB,GACzB,iCAAiC,CAMnC"}

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/generationPort.js

@@ -22,9 +22,31 @@ function capabilityFor(deps, modelId) {
         ? findCapability(modelId)
         : findConfiguredCapability(deps.config, modelId);
 }
-// Strip C0/C1 control characters (keep tab/LF/CR) via a code-point scan so the `no-control-regex`
-// rule stays satisfied; then neutralise any literal evidence delimiter so untrusted text cannot
-// close the <qi-evidence> block early.
+// Invisible / directional format controls that NFKC does NOT remove: zero-width characters
+// (ZWSP/ZWNJ/ZWJ and the BOM/ZWNBSP) and bidirectional controls (LRM/RLM, the LRE…RLO embedding/
+// override block, and the isolate block). They carry no legitimate meaning in untrusted source
+// evidence but can smuggle homoglyph/bidi deception into the model prompt — and into any candidate
+// rendered or exported from it. Stripping them is content-preserving for real text (#278 Audit
+// Addendum: normalise untrusted content before model prompt construction, rendering, or export).
+function isInvisibleFormatControl(cp) {
+    return ((cp >= 0x200b && cp <= 0x200f) || // ZWSP, ZWNJ, ZWJ, LRM, RLM
+        (cp >= 0x202a && cp <= 0x202e) || // LRE, RLE, PDF, LRO, RLO
+        (cp >= 0x2066 && cp <= 0x2069) || // LRI, RLI, FSI, PDI
+        cp === 0xfeff // BOM / ZWNBSP
+    );
+}
+// A code point that must be stripped from evidence text: C0 controls (except tab/LF/CR), DEL, C1
+// controls, or an invisible zero-width/bidi format control. Tab/LF/CR survive as legitimate text
+// whitespace so multi-line evidence keeps its structure.
+function isStrippableEvidenceCodePoint(cp) {
+    return ((cp <= 0x1f && cp !== 0x09 && cp !== 0x0a && cp !== 0x0d) ||
+        cp === 0x7f ||
+        (cp >= 0x80 && cp <= 0x9f) ||
+        isInvisibleFormatControl(cp));
+}
+// Strip control / invisible format characters via a code-point scan so the `no-control-regex` rule
+// stays satisfied; then neutralise any literal evidence delimiter so untrusted text cannot close the
+// <qi-evidence> block early.
 function scrubEvidenceText(text) {
     const normalised = text.normalize("NFKC");
     let out = "";
@@ -32,10 +54,7 @@ function scrubEvidenceText(text) {
         const cp = ch.codePointAt(0);
         if (cp === undefined)
             continue;
-        const isStrippable = (cp <= 0x1f && cp !== 0x09 && cp !== 0x0a && cp !== 0x0d) ||
-            cp === 0x7f ||
-            (cp >= 0x80 && cp <= 0x9f);
-        if (!isStrippable)
+        if (!isStrippableEvidenceCodePoint(cp))
             out += ch;
     }
     return out.replace(/<\/?qi-evidence/giu, "[evidence]");

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/judgePort.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"judgePort.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/judgePort.ts"],"names":[],"mappings":"AAUA,OAAO,EAKL,KAAK,WAAW,EAGjB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAEV,uBAAuB,EAExB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAgB,IAAI,EAAE,MAAM,CAAC;gBACjB,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAQD,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,gBAAgB;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACvD;AAKD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAavD;AA8CD,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,EACrB,aAAa,GAAE,SAAS,kBAAkB,EAAO,GAChD,SAAS,WAAW,EAAE,CAoBxB;AAkID,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,CAW1E;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,gBAAgB,EACvB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACvC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,CA6CnF"}
+{"version":3,"file":"judgePort.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/judgePort.ts"],"names":[],"mappings":"AAUA,OAAO,EAKL,KAAK,WAAW,EAGjB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAEV,uBAAuB,EAExB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAgB,IAAI,EAAE,MAAM,CAAC;gBACjB,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAQD,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,gBAAgB;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACvD;AAgCD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASvD;AA8CD,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,EACrB,aAAa,GAAE,SAAS,kBAAkB,EAAO,GAChD,SAAS,WAAW,EAAE,CAoBxB;AAkID,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,CAW1E;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,gBAAgB,EACvB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACvC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,CA6CnF"}

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/judgePort.js

@@ -22,9 +22,31 @@ function capabilityFor(deps, modelId) {
         ? findCapability(modelId)
         : findConfiguredCapability(deps.config, modelId);
 }
-// Strip C0/C1 control characters (keep tab/LF/CR) and neutralise any literal
-// <qi-...> delimiter so untrusted candidate/source text cannot break the prompt boundary.
-// Mirrors scrubEvidenceText from generationPort.ts (Issue #284 defence-in-depth).
+// Invisible / directional format controls that NFKC does NOT remove: zero-width characters
+// (ZWSP/ZWNJ/ZWJ, BOM/ZWNBSP) and bidirectional controls (LRM/RLM, the LRE…RLO embedding/override
+// block, and the isolate block). They carry no legitimate meaning in untrusted candidate/source
+// text but can smuggle homoglyph/bidi deception into the judge prompt — and into any rationale or
+// finding rendered/exported from it (#278 Audit Addendum).
+function isInvisibleFormatControl(cp) {
+    return ((cp >= 0x200b && cp <= 0x200f) || // ZWSP, ZWNJ, ZWJ, LRM, RLM
+        (cp >= 0x202a && cp <= 0x202e) || // LRE, RLE, PDF, LRO, RLO
+        (cp >= 0x2066 && cp <= 0x2069) || // LRI, RLI, FSI, PDI
+        cp === 0xfeff // BOM / ZWNBSP
+    );
+}
+// A code point that must be stripped from candidate/source text: C0 controls (except tab/LF/CR),
+// DEL, C1 controls, or an invisible zero-width/bidi format control. Tab/LF/CR survive as legitimate
+// whitespace. Kept at parity with isStrippableEvidenceCodePoint in generationPort.ts.
+function isStrippableCandidateCodePoint(cp) {
+    return ((cp <= 0x1f && cp !== 0x09 && cp !== 0x0a && cp !== 0x0d) ||
+        cp === 0x7f ||
+        (cp >= 0x80 && cp <= 0x9f) ||
+        isInvisibleFormatControl(cp));
+}
+// Strip control / invisible format characters (keep tab/LF/CR), then neutralise any literal
+// <qi-...> delimiter so untrusted candidate/source text cannot break the prompt boundary. Kept at
+// parity with scrubEvidenceText in generationPort.ts (Issue #284/#278 defence-in-depth); the shared
+// parity is locked by tests in judgePort.test.ts.
 export function scrubCandidateText(text) {
     const normalised = text.normalize("NFKC");
     let out = "";
@@ -32,10 +54,7 @@ export function scrubCandidateText(text) {
         const cp = ch.codePointAt(0);
         if (cp === undefined)
             continue;
-        const isStrippable = (cp <= 0x1f && cp !== 0x09 && cp !== 0x0a && cp !== 0x0d) ||
-            cp === 0x7f ||
-            (cp >= 0x80 && cp <= 0x9f);
-        if (!isStrippable)
+        if (!isStrippableCandidateCodePoint(cp))
             out += ch;
     }
     return out.replace(/<\/?qi-[a-z-]+/giu, "[qi-data]");

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/reCheckRoutes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reCheckRoutes.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/reCheckRoutes.ts"],"names":[],"mappings":"AAiDA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAgkChD,wBAAsB,eAAe,CACnC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAgCtB;AAED,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CA2BtB;AAED,eAAO,MAAM,sBAAsB,EAAE,SAAS,eAAe,EAW5D,CAAC"}
+{"version":3,"file":"reCheckRoutes.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/reCheckRoutes.ts"],"names":[],"mappings":"AAiDA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAkkChD,wBAAsB,eAAe,CACnC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAgCtB;AAED,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CA2BtB;AAED,eAAO,MAAM,sBAAsB,EAAE,SAAS,eAAe,EAW5D,CAAC"}

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/reCheckRoutes.js

@@ -269,7 +269,9 @@ function ingestSourcesForDrift(sources, ingestRunId, deps) {
                 runId: ingestRunId,
                 registeredAt: new Date().toISOString(),
                 capsuleResolver: makeCapsuleResolver(deps),
-                figmaSnapshotLoader: makeFigmaSnapshotLoader(deps),
+                // Drift must see the board's LATEST snapshot, not the pinned immutable record — a pinned
+                // write-once runId can never drift under its own identity (#735). Generate keeps pinning.
+                figmaSnapshotLoader: makeFigmaSnapshotLoader(deps, { resolveLatestByScope: true }),
                 figmaVision: makeFigmaVisionHintProvider(deps),
             }),
         };

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/runIngestion.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runIngestion.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/runIngestion.ts"],"names":[],"mappings":"AASA,OAAO,EAAuB,KAAK,mBAAmB,IAAI,EAAE,EAAE,MAAM,+BAA+B,CAAC;AAqBpG,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,KAAK,EACV,+BAA+B,EAC/B,kCAAkC,EACnC,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAwC9F,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAgB,IAAI,EAAE,MAAM,CAAC;gBACjB,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC,MAAM,CAAC,CAAC;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC,MAAM,CAAC,CAAC;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,iCAAiC,EAAE,CAAC;IACpE,QAAQ,CAAC,aAAa,EAAE,SAAS,+BAA+B,EAAE,CAAC;IACnE,QAAQ,CAAC,cAAc,EAAE;QACvB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC,iCAAiC,CAAC;KAC/D,CAAC;IACF,QAAQ,CAAC,eAAe,EAAE,SAAS,eAAe,EAAE,CAAC;IACrD,yFAAyF;IACzF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,eAAe,EAAE,CAAC;CACrD;AAwvBD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,kCAAkC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,gHAAgH;IAChH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACvD;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAC/D;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;CAC5D;AAsED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,iBAAiB,CAiDtF"}
+{"version":3,"file":"runIngestion.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/runIngestion.ts"],"names":[],"mappings":"AASA,OAAO,EAAuB,KAAK,mBAAmB,IAAI,EAAE,EAAE,MAAM,+BAA+B,CAAC;AAqBpG,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,KAAK,EACV,+BAA+B,EAC/B,kCAAkC,EACnC,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAyC9F,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAgB,IAAI,EAAE,MAAM,CAAC;gBACjB,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC,MAAM,CAAC,CAAC;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC,MAAM,CAAC,CAAC;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,iCAAiC,EAAE,CAAC;IACpE,QAAQ,CAAC,aAAa,EAAE,SAAS,+BAA+B,EAAE,CAAC;IACnE,QAAQ,CAAC,cAAc,EAAE;QACvB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC,iCAAiC,CAAC;KAC/D,CAAC;IACF,QAAQ,CAAC,eAAe,EAAE,SAAS,eAAe,EAAE,CAAC;IACrD,yFAAyF;IACzF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,eAAe,EAAE,CAAC;CACrD;AAoyBD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,kCAAkC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,gHAAgH;IAChH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACvD;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAC/D;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;CAC5D;AAsED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,iBAAiB,CAiDtF"}

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/runIngestion.js

@@ -25,12 +25,13 @@ function perSourceAtomBudget(total, sourceCount) {
         return total;
     return Math.max(1, Math.floor(total / sourceCount));
 }
-// Global per-run evidence byte budget. Each source kind (workspace / file / capsule) was previously
-// allowed ~192KB INDEPENDENTLY, so N large sources summed to N×192KB and blew the model prompt cap
-// (MAX_PROMPT_BYTES = 256KB) — failing the entire N+1 run with QI_PROMPT_TOO_LARGE (Epic #729
-// headline). The byte budget is now a single global pool split fairly across sources, mirroring the
-// atom-budget split, so the merged evidence text stays bounded regardless of N. A single source keeps
-// the full budget (identical to the prior single-source behaviour).
+// Global per-run evidence byte budget. Each source kind (workspace / file / capsule /
+// figma-snapshot) was previously allowed ~192KB INDEPENDENTLY, so N large sources summed to N×192KB
+// and blew the model prompt cap (MAX_PROMPT_BYTES = 256KB) — failing the entire N+1 run with
+// QI_PROMPT_TOO_LARGE (Epic #729 headline). The byte budget is now a single global pool split fairly
+// across sources, mirroring the atom-budget split, so the merged evidence text stays bounded
+// regardless of N. A single source keeps the full budget (identical to the prior single-source
+// behaviour). figma-snapshot uses the same split via figmaScreenDocs (mirrors processCapsuleDocs).
 const EVIDENCE_BUDGET_BYTES = 196_608;
 // Never starve a source below this many bytes — a tiny share is still usable context.
 const MIN_SOURCE_BUDGET_BYTES = 4_096;
@@ -53,9 +54,33 @@ export class QiIngestionError extends Error {
         this.name = "QiIngestionError";
     }
 }
+// Credential token shapes mirrored from keiko-contracts `fieldLooksUnsafe` so a connected
+// source's display label can never echo a secret back to the browser-surfaced envelope
+// (#277/#278 envelope display-surface invariant — the label is the only user-derived envelope
+// field; localRef/origin/integrityHash are server-built and hash-derived).
+const CREDENTIAL_LABEL_SHAPES = [
+    /AKIA[0-9A-Z]{12,}/gu,
+    /(?:ghp_|gho_|github_pat_)[A-Za-z0-9_]{20,}/gu,
+    /xox[baprs]-[A-Za-z0-9-]{10,}/gu,
+    /sk-[A-Za-z0-9]{16,}/gu,
+    /\bBearer\s+\S+/giu,
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----/gu,
+];
 const sanitiseLabel = (label) => {
-    const trimmed = label.replace(/https?:\/\/\S+/giu, "").trim();
-    const safe = trimmed.length === 0 ? "Untitled source" : trimmed;
+    // Strip any URL authority — ANY scheme (http, file, s3, ftp, …), not just http(s) — plus the
+    // well-known credential token shapes, so a browser-supplied label never carries a URL or secret
+    // into the envelope display surface that is streamed back to the client (#277/#278).
+    let cleaned = label.replace(/[a-z][a-z0-9+.-]*:\/\/\S+/giu, " ");
+    for (const shape of CREDENTIAL_LABEL_SHAPES)
+        cleaned = cleaned.replace(shape, " ");
+    cleaned = cleaned.trim();
+    // Collapse an absolute POSIX / Windows-drive / UNC path label to its final segment so the
+    // display label never leaks the filesystem layout (the basename is the useful display token).
+    if (/^(?:\/|[A-Za-z]:[\\/]|\\\\)/u.test(cleaned)) {
+        const segments = cleaned.split(/[\\/]/u).filter((s) => s.length > 0);
+        cleaned = (segments[segments.length - 1] ?? "").trim();
+    }
+    const safe = cleaned.length === 0 ? "Untitled source" : cleaned;
     return safe.length > MAX_LABEL_CHARS ? `${safe.slice(0, MAX_LABEL_CHARS - 1)}…` : safe;
 };
 // Reject a source whose absolute path (any segment) names a denied credential location. isDenied
@@ -520,7 +545,14 @@ function a11yItemsByScreen(parsed) {
 // items (#811) AND its accessibility test items (#812) — concatenated, neither replacing the other —
 // through the `extraItems` seam, then optionally with vision hints. The per-run byte budget bounds
 // the cumulative corpus so an oversized board never hard-fails on QI_PROMPT_TOO_LARGE.
-function figmaScreenDocs(record, vision) {
+// The byteBudget is the caller's fair share of the global evidence pool (Epic #729 N+1 split)
+// so a figma-snapshot source never consumes more than its fair slice alongside other sources.
+function figmaScreenDocs(record, vision, byteBudget) {
+    // Mirror processCapsuleDocs (:558-563): the per-run corpus budget is the smaller of the capsule's
+    // own ceiling and this source's fair share of the global evidence byte budget (Epic #729 N+1
+    // split). The per-document cap is likewise never larger than the per-run budget.
+    const perRunBudget = Math.min(CAPSULE_BUDGET_BYTES, byteBudget);
+    const perDocBudget = Math.min(CAPSULE_MAX_BYTES_PER_DOCUMENT, perRunBudget);
     const parsed = parseScreens(record);
     const navItems = navItemsByScreen(parsed, record.links ?? []);
     const a11yItems = a11yItemsByScreen(parsed);
@@ -530,18 +562,18 @@ function figmaScreenDocs(record, vision) {
         const extraItems = [...(navItems.get(ir.id) ?? []), ...(a11yItems.get(ir.id) ?? [])];
         const baseline = QualityIntelligenceFigma.deriveScreenTestBaseline(ir, extraItems);
         const augmented = visionAugmentedScreenText(baseline, row, vision);
-        const capped = truncateToUtf8Bytes(redact(augmented), CAPSULE_MAX_BYTES_PER_DOCUMENT);
+        const capped = truncateToUtf8Bytes(redact(augmented), perDocBudget);
         if (capped.trim().length === 0)
             continue;
         const bytes = utf8ByteLength(capped);
-        if (docs.length > 0 && totalBytes + bytes > CAPSULE_BUDGET_BYTES)
+        if (docs.length > 0 && totalBytes + bytes > perRunBudget)
             break;
         docs.push({ documentId: `${row.screenId} (${ir.name})`, text: capped });
         totalBytes += bytes;
     }
     return docs;
 }
-function ingestFigmaSnapshot(source, index, registeredAt, loader, vision) {
+function ingestFigmaSnapshot(source, index, registeredAt, loader, vision, byteBudget) {
     const label = sanitiseLabel(source.label);
     const record = loader(source.snapshotRunId);
     if (record === undefined) {
@@ -550,15 +582,19 @@ function ingestFigmaSnapshot(source, index, registeredAt, loader, vision) {
     if (record.screens.length === 0) {
         throw new QiIngestionError("QI_SOURCE_EMPTY", `Figma snapshot "${label}" has no screens.`);
     }
-    const docs = figmaScreenDocs(record, vision);
+    const docs = figmaScreenDocs(record, vision, byteBudget);
     if (docs.length === 0) {
         throw new QiIngestionError("QI_SOURCE_EMPTY", `Figma snapshot "${label}" produced no usable screen baseline.`);
     }
     const joinedText = docs.map((d) => d.text).join("\n");
     const envelopeId = envelopeIdFor(index, label, source.snapshotRunId);
+    // A stored Figma Snapshot is figma evidence, not repository context. Use the dedicated
+    // `figma-evidence` envelope kind (#278 AC2 "represented as an explicit connector-backed source"
+    // + AC4 citation/audit attribution) so the persisted envelope, source-mix priority, and any
+    // kind-grouped audit rollup classify it correctly instead of folding it into repo context.
     const envelope = {
         id: envelopeId,
-        kind: "repository-context",
+        kind: "figma-evidence",
         displayLabel: label,
         provenance: {
             origin: `figma-snapshot:${source.snapshotRunId}`,
@@ -592,7 +628,7 @@ function ingestOne(source, index, registeredAt, capsuleResolver, figmaSnapshotLo
             if (figmaSnapshotLoader === undefined) {
                 throw new QiIngestionError("QI_FIGMA_SNAPSHOT_UNAVAILABLE", "Figma-snapshot sources are unavailable: the evidence directory is not configured.");
             }
-            return ingestFigmaSnapshot(source, index, registeredAt, figmaSnapshotLoader, figmaVision);
+            return ingestFigmaSnapshot(source, index, registeredAt, figmaSnapshotLoader, figmaVision, byteBudget);
     }
 }
 /**