@oscharko-dev/keiko 0.2.0-beta.4 → 0.2.0-beta.6

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/figmaSnapshot/store.js

@@ -14,10 +14,12 @@
 // `redactQualityIntelligenceEvidence` before write. The token is never present by construction
 // (the server builder never places it on the in-memory snapshot); redaction is defense-in-depth.
 //
-// Integrity: load() recomputes the snapshot integrity hash and rejects a record whose persisted
-// `integrityHash` disagrees — tampered or truncated records are rejected at the read boundary.
-// NOTE: the PNG side-files are NOT re-hashed on load (they are served separately); the per-screen
-// `sha256` stored in the record serves as the tamper-evidence for each image.
+// Integrity: load() recomputes each persisted screen hash from the stored, redacted IR + image
+// sha256, verifies each PNG side-file against the stored sha256/byteLength, and then recomputes the
+// snapshot integrity hash. Tampered or truncated records are rejected at the read boundary. The
+// optional artifacts (`links`, `tokens`, `metrics`) stay out of the drift hash but carry separate
+// artifact hashes when present; old un-hashed optional artifacts are omitted on load instead of being
+// trusted.
 //
 // Retention: `enforceFigmaSnapshotRetention` deletes snapshot records + their side-file dirs in
 // lock-step with the provided policy. Wiring: call it where the other QI retention enforcement
@@ -27,7 +29,7 @@
 // files) that have no matching record. It is lazy/once — the store calls it on first use so stale
 // dirs from a previously interrupted record() are cleaned up without a separate boot step.
 import { createHash, randomUUID } from "node:crypto";
-import { chmodSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { chmodSync, linkSync, lstatSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
 import { join } from "node:path";
 import { assertContainedRealPath, resolveWithinWorkspace, } from "@oscharko-dev/keiko-workspace";
 import { nodeWorkspaceFs } from "@oscharko-dev/keiko-workspace/internal/fs";
@@ -40,9 +42,12 @@ import { FIGMA_SNAPSHOT_SCHEMA_VERSION, validateFigmaSnapshotRecord, } from "./s
 const QI_DIR_MODE = 0o700;
 const SNAPSHOT_SUFFIX = ".figma-snapshot.json";
 const SIDE_FILE_SUBDIR = "figma-snapshots";
+const MAX_SIDE_FILE_NAME_LENGTH = 128;
+const SIDE_FILE_NAME_PATTERN = /^[A-Za-z0-9._-]+$/u;
 // ─── Integrity hash (mirrors figmaSnapshotHash.ts — inlined so keiko-evidence does not depend
 //     on the private keiko-server package). MUST stay bit-identical with the server builder. ────
 const sha256Hex = (input) => createHash("sha256").update(input, "utf8").digest("hex");
+const sha256Bytes = (input) => createHash("sha256").update(input).digest("hex");
 // Stable stringify: keys emitted in sorted order at every depth (mirrors canonical() in hash.ts).
 function canonical(value) {
     if (value === undefined)
@@ -57,6 +62,50 @@ function canonical(value) {
         .map((key) => `${JSON.stringify(key)}:${canonical(record[key])}`);
     return `{${entries.join(",")}}`;
 }
+const hashArtifact = (value) => sha256Hex(canonical(value));
+// Hash-neutral IR projection (mirrors figmaSnapshotHash.ts in keiko-server). The store accepts
+// `irJson` as opaque JSON, so malformed legacy/tampered shapes fall back to the raw JSON projection;
+// valid Screen-IR gets the exact same hash-neutral field pruning as the builder.
+const HASH_NEUTRAL_IR_KEYS = new Set([
+    "textColor",
+    "backgroundColor",
+    "layout",
+    "sizing",
+    "cornerRadius",
+    "typography",
+]);
+const isJsonObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const stripHashNeutralChild = (child) => isJsonObject(child) ? stripHashNeutralFields(child) : child;
+const stripHashNeutralFields = (node) => {
+    const entries = Object.entries(node).filter(([key]) => key !== "children" && !HASH_NEUTRAL_IR_KEYS.has(key));
+    const rawChildren = node.children;
+    return {
+        ...Object.fromEntries(entries),
+        children: Array.isArray(rawChildren)
+            ? rawChildren.map(stripHashNeutralChild)
+            : [],
+    };
+};
+const hashStableIr = (irJson) => {
+    if (!isJsonObject(irJson) || !isJsonObject(irJson.root))
+        return irJson;
+    return { ...irJson, root: stripHashNeutralFields(irJson.root) };
+};
+const recomputeScreenIntegrityHash = (screen) => sha256Hex(canonical({
+    imageSha256: screen.image.sha256,
+    ir: hashStableIr(screen.irJson),
+    screenId: screen.screenId,
+}));
+const artifactHashesFor = (record) => {
+    const hashes = {
+        ...(record.links !== undefined ? { links: hashArtifact(record.links) } : {}),
+        ...(record.tokens !== undefined ? { tokens: hashArtifact(record.tokens) } : {}),
+        ...(record.metrics !== undefined ? { metrics: hashArtifact(record.metrics) } : {}),
+    };
+    return hashes.links === undefined && hashes.tokens === undefined && hashes.metrics === undefined
+        ? undefined
+        : hashes;
+};
 // Recompute the snapshot-level integrity hash from a loaded record.
 // This exactly mirrors hashSnapshot() in figmaSnapshotHash.ts:
 //   sha256( canonical({ screens: sorted [{integrityHash,screenId}], snapshotSchemaVersion, version }) )
@@ -71,6 +120,50 @@ function recomputeSnapshotIntegrityHash(record) {
         version: record.provenance.version ?? null,
     }));
 }
+const rehashRecord = (record) => {
+    const screens = record.screens.map((screen) => ({
+        ...screen,
+        integrityHash: recomputeScreenIntegrityHash(screen),
+    }));
+    const rehashed = { ...record, screens };
+    return { ...rehashed, integrityHash: recomputeSnapshotIntegrityHash(rehashed) };
+};
+const EXTERNAL_LINK_TARGET = /^(?:[a-z][a-z0-9+.-]*:\/\/|mailto:|tel:|data:|javascript:)/iu;
+const isExternalLinkTarget = (targetNodeId) => targetNodeId.startsWith("url:") || EXTERNAL_LINK_TARGET.test(targetNodeId);
+const safeLinkRows = (links) => links?.filter((link) => !isExternalLinkTarget(link.targetNodeId));
+const omitUnverifiedArtifacts = (record, omitLinks, omitTokens, omitMetrics) => {
+    if (!omitLinks && !omitTokens && !omitMetrics)
+        return record;
+    const omitted = new Set([
+        ...(omitLinks ? ["links"] : []),
+        ...(omitTokens ? ["tokens"] : []),
+        ...(omitMetrics ? ["metrics"] : []),
+    ]);
+    return Object.fromEntries(Object.entries(record).filter(([key]) => !omitted.has(key)));
+};
+function verifyArtifactHash(kind, value, actualHash, runId) {
+    if (value === undefined) {
+        if (actualHash !== undefined) {
+            throw new EvidenceReadError(`Figma snapshot integrity check failed for run ${runId}: ${kind} artifact missing`);
+        }
+        return false;
+    }
+    if (actualHash === undefined)
+        return true;
+    if (actualHash !== hashArtifact(value)) {
+        throw new EvidenceReadError(`Figma snapshot integrity check failed for run ${runId}: ${kind} artifact hash mismatch`);
+    }
+    return false;
+}
+function verifyOptionalArtifactHashes(record, runId) {
+    const actual = record.artifactHashes;
+    const omitLinks = verifyArtifactHash("links", record.links, actual?.links, runId);
+    const omitTokens = verifyArtifactHash("tokens", record.tokens, actual?.tokens, runId);
+    const omitMetrics = verifyArtifactHash("metrics", record.metrics, actual?.metrics, runId);
+    // Older records predate artifact hashes. The optional fields remain schema-valid, but we do not
+    // trust them for downstream generation without their own tamper evidence.
+    return omitUnverifiedArtifacts(record, omitLinks, omitTokens, omitMetrics);
+}
 // ─── Helpers ─────────────────────────────────────────────────────────────────────────────────
 function realBaseForWrite(baseDir, fs) {
     try {
@@ -102,8 +195,40 @@ function assertSnapshotAbsent(target) {
         throw new EvidenceWriteError("Figma snapshot already exists for this run (write-once)");
     }
 }
-// Write-once: O_EXCL ("wx") refuses if a record for this runId already exists, closing the TOCTOU
-// gap left by the caller's pre-check.
+function runIdFromSnapshotName(name) {
+    if (!name.endsWith(SNAPSHOT_SUFFIX))
+        return undefined;
+    const runId = name.slice(0, -SNAPSHOT_SUFFIX.length);
+    try {
+        assertValidRunId(runId);
+        return runId;
+    }
+    catch {
+        return undefined;
+    }
+}
+function snapshotRecordFiles(baseDir) {
+    let entries;
+    try {
+        entries = readdirSync(baseDir, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const files = [];
+    for (const entry of entries) {
+        if (!entry.isFile() || entry.isSymbolicLink())
+            continue;
+        const runId = runIdFromSnapshotName(entry.name);
+        if (runId === undefined)
+            continue;
+        files.push({ runId, path: join(baseDir, entry.name) });
+    }
+    return files;
+}
+// Write-once: create a temp file, then hard-link it into the final target. `linkSync` is the
+// exclusive commit: it fails with EEXIST if another recorder created the target after the
+// pre-check, unlike `rename`, which would overwrite the winner on POSIX.
 function atomicWriteOnce(target, json, randomSuffix) {
     assertSnapshotAbsent(target);
     const temp = `${target}.${randomSuffix()}.tmp`;
@@ -115,7 +240,16 @@ function atomicWriteOnce(target, json, randomSuffix) {
         catch {
             // non-fatal: not every filesystem supports chmod (e.g. Windows)
         }
-        renameSync(temp, target);
+        try {
+            linkSync(temp, target);
+        }
+        catch (error) {
+            if (error.code === "EEXIST") {
+                throw new EvidenceWriteError("Figma snapshot already exists for this run (write-once)");
+            }
+            throw error;
+        }
+        rmSync(temp, { force: true });
     }
     catch (error) {
         rmSync(temp, { force: true });
@@ -145,6 +279,7 @@ function writeScreenSideFiles(sideFileBase, runId, screens, fs, randomSuffix) {
     });
 }
 function assembleRecord(input, screenRows) {
+    const links = safeLinkRows(input.links);
     const draft = {
         figmaSnapshotSchemaVersion: FIGMA_SNAPSHOT_SCHEMA_VERSION,
         runId: input.runId,
@@ -158,13 +293,69 @@ function assembleRecord(input, screenRows) {
         skippedScreens: input.skippedScreens,
         // Omit `links`/`tokens` entirely when absent so an older snapshot stays byte-minimal and the
         // optional fields never serialise as `undefined` (exactOptionalPropertyTypes-safe).
-        ...(input.links !== undefined ? { links: input.links } : {}),
+        ...(links !== undefined ? { links } : {}),
         ...(input.tokens !== undefined ? { tokens: input.tokens } : {}),
+        ...(input.metrics !== undefined ? { metrics: input.metrics } : {}),
         integrityHash: input.integrityHash,
         redactionSummary: { totalStringsScanned: 0, stringsRedacted: 0, patternsMatched: {} },
     };
     const { redacted, summary } = redactQualityIntelligenceEvidence(draft);
-    return { ...redacted, redactionSummary: summary };
+    const rehashed = rehashRecord(redacted);
+    const artifactHashes = artifactHashesFor(rehashed);
+    return {
+        ...rehashed,
+        ...(artifactHashes !== undefined ? { artifactHashes } : {}),
+        redactionSummary: summary,
+    };
+}
+function isAllowedSideFileName(name) {
+    if (name.length === 0 || name.length > MAX_SIDE_FILE_NAME_LENGTH)
+        return false;
+    return !name.startsWith(".") && SIDE_FILE_NAME_PATTERN.test(name);
+}
+function verifyScreenIntegrity(screen, runId) {
+    const expected = recomputeScreenIntegrityHash(screen);
+    if (screen.integrityHash !== expected) {
+        throw new EvidenceReadError(`Figma snapshot integrity check failed for run ${runId}: screen ${screen.screenId} hash mismatch`);
+    }
+}
+function readVerifiedScreenImageSideFile(ctx, runId, image) {
+    const name = image.relativePath;
+    if (!isAllowedSideFileName(name)) {
+        throw new EvidenceReadError(`Figma snapshot integrity check failed for run ${runId}: invalid image side-file path`);
+    }
+    const runDir = join(ctx.sideFileBase, runId);
+    let realRunDir;
+    try {
+        realRunDir = ctx.fs.realPath(runDir);
+    }
+    catch {
+        throw new EvidenceReadError(`Figma snapshot integrity check failed for run ${runId}: image side-file directory missing`);
+    }
+    const lexical = resolveWithinWorkspace(realRunDir, name);
+    const absolute = assertContainedRealPath(ctx.fs, realRunDir, lexical, name);
+    const stat = lstatSync(absolute, { throwIfNoEntry: false });
+    if (stat === undefined || !stat.isFile() || stat.isSymbolicLink()) {
+        throw new EvidenceReadError(`Figma snapshot integrity check failed for run ${runId}: image side-file missing`);
+    }
+    const bytes = readFileSync(absolute);
+    if (bytes.byteLength !== image.byteLength || sha256Bytes(bytes) !== image.sha256) {
+        throw new EvidenceReadError(`Figma snapshot integrity check failed for run ${runId}: image side-file hash mismatch`);
+    }
+    return bytes;
+}
+function verifyScreenImageSideFile(ctx, runId, screen) {
+    readVerifiedScreenImageSideFile(ctx, runId, screen.image);
+}
+function verifyPersistedScreens(ctx, rec, runId) {
+    for (const screen of rec.screens) {
+        verifyScreenIntegrity(screen, runId);
+        verifyScreenImageSideFile(ctx, runId, screen);
+    }
+}
+function verifyPersistedScreenMetadata(rec, runId) {
+    for (const screen of rec.screens)
+        verifyScreenIntegrity(screen, runId);
 }
 // Parse one raw JSON string from a snapshot record file into a scope entry, or null when the
 // file does not belong to the requested scope or cannot be parsed.
@@ -246,22 +437,12 @@ export function enforceFigmaSnapshotRetention(evidenceDir, profile) {
     if (!dirStat?.isDirectory())
         return;
     // Scan for snapshot records and sort by fetchedAt ascending so we remove the oldest first.
-    let entries;
-    try {
-        entries = readdirSync(qiDir);
-    }
-    catch {
-        return;
-    }
     const records = [];
-    for (const name of entries) {
-        if (!name.endsWith(SNAPSHOT_SUFFIX))
-            continue;
-        const runId = name.slice(0, -SNAPSHOT_SUFFIX.length);
-        const fetchedAt = readFetchedAt(join(qiDir, name));
+    for (const file of snapshotRecordFiles(qiDir)) {
+        const fetchedAt = readFetchedAt(file.path);
         // Unparseable records are skipped — do not evict conservatively.
         if (fetchedAt !== undefined)
-            records.push({ runId, fetchedAt });
+            records.push({ runId: file.runId, fetchedAt });
     }
     // Sort oldest first (ascending fetchedAt) so we evict the oldest beyond the cap.
     records.sort((a, b) => (a.fetchedAt < b.fetchedAt ? -1 : a.fetchedAt > b.fetchedAt ? 1 : 0));
@@ -324,30 +505,59 @@ function loadOp(ctx, runId) {
     if (!validateFigmaSnapshotRecord(parsed).ok)
         return undefined;
     const rec = parsed;
-    // Integrity check: recompute and reject on mismatch. The PNG side-files are NOT re-hashed
-    // on load — each screen's `sha256` field is the tamper evidence for the image bytes.
+    // Integrity check: recompute and reject on mismatch. Screen rows are verified before the
+    // snapshot-level hash so stale/tampered IR or image refs cannot hide behind an old screen hash.
+    verifyPersistedScreens(ctx, rec, runId);
     const expected = recomputeSnapshotIntegrityHash(rec);
     if (rec.integrityHash !== expected) {
         throw new EvidenceReadError(`Figma snapshot integrity check failed for run ${runId}: hash mismatch`);
     }
-    return rec;
+    return verifyOptionalArtifactHashes(rec, runId);
 }
-function listByScopeOp(ctx, fileKey, nodeId) {
+function loadMetadataOp(ctx, runId) {
+    assertValidRunId(runId);
+    ctx.ensureSwept();
     const realBase = realBaseForRead(ctx.qiDir, ctx.fs);
     if (realBase === undefined)
-        return [];
-    let entries;
+        return undefined;
+    const target = join(realBase, `${runId}${SNAPSHOT_SUFFIX}`);
+    if (lstatSync(target, { throwIfNoEntry: false })?.isFile() !== true)
+        return undefined;
+    let parsed;
     try {
-        entries = readdirSync(realBase);
+        parsed = JSON.parse(readFileSync(target, "utf8"));
     }
-    catch {
-        return [];
+    catch (error) {
+        throw new EvidenceReadError(`Figma snapshot is not valid JSON: ${error instanceof Error ? error.message : "unknown"}`);
+    }
+    if (!validateFigmaSnapshotRecord(parsed).ok)
+        return undefined;
+    const rec = parsed;
+    verifyPersistedScreenMetadata(rec, runId);
+    const expected = recomputeSnapshotIntegrityHash(rec);
+    if (rec.integrityHash !== expected) {
+        throw new EvidenceReadError(`Figma snapshot integrity check failed for run ${runId}: hash mismatch`);
     }
+    return verifyOptionalArtifactHashes(rec, runId);
+}
+function loadImageOp(ctx, runId, image) {
+    assertValidRunId(runId);
+    ctx.ensureSwept();
+    const bytes = readVerifiedScreenImageSideFile(ctx, runId, image);
+    return {
+        mimeType: image.mimeType,
+        bytes,
+        sha256: image.sha256,
+        byteLength: image.byteLength,
+    };
+}
+function listByScopeOp(ctx, fileKey, nodeId) {
+    const realBase = realBaseForRead(ctx.qiDir, ctx.fs);
+    if (realBase === undefined)
+        return [];
     const results = [];
-    for (const name of entries) {
-        if (!name.endsWith(SNAPSHOT_SUFFIX))
-            continue;
-        const entry = parseScopeEntry(join(realBase, name), fileKey, nodeId);
+    for (const file of snapshotRecordFiles(realBase)) {
+        const entry = parseScopeEntry(file.path, fileKey, nodeId);
         if (entry !== null)
             results.push(entry);
     }
@@ -374,6 +584,8 @@ export function createNodeFigmaSnapshotStore(evidenceDir, options = {}) {
     return {
         record: (input) => recordOp(ctx, input),
         load: (runId) => loadOp(ctx, runId),
+        loadMetadata: (runId) => loadMetadataOp(ctx, runId),
+        loadImage: (runId, image) => loadImageOp(ctx, runId, image),
         location: (runId) => {
             assertValidRunId(runId);
             const realBase = realBaseForRead(qiDir, ctx.fs);

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/index.d.ts

@@ -1,18 +1,18 @@
 export { QUALITY_INTELLIGENCE_EVIDENCE_SCHEMA_VERSION, validateQualityIntelligenceEvidenceManifest, } from "./manifestSchema.js";
-export type { QualityIntelligenceEvidenceManifest, QualityIntelligenceEvidenceRefRow, QualityIntelligenceExportRow, QualityIntelligenceFindingRow, QualityIntelligenceIntegrityHashes, QualityIntelligenceManifestTotals, QualityIntelligenceProvenanceRefs, QualityIntelligenceRedactionSummary, QualityIntelligenceSchemaValidationResult, QualityIntelligenceCoverageMatrixRow, QualityIntelligenceAtomFingerprintRow, QualityIntelligenceSourceFingerprintRow, } from "./manifestSchema.js";
+export type { QualityIntelligenceBinaryExportMode, QualityIntelligenceTraceabilityExportMode, QualityIntelligenceEvidenceManifest, QualityIntelligenceEvidenceRefRow, QualityIntelligenceExportRow, QualityIntelligenceExportTarget, QualityIntelligenceFindingRow, QualityIntelligenceIntegrityHashes, QualityIntelligenceManifestTotals, QualityIntelligenceProvenanceRefs, QualityIntelligenceRedactionSummary, QualityIntelligenceSchemaValidationResult, QualityIntelligenceCoverageMatrixRow, QualityIntelligenceAtomFingerprintRow, QualityIntelligenceSourceFingerprintRow, } from "./manifestSchema.js";
 export { redactQualityIntelligenceEvidence } from "./redaction.js";
 export type { QualityIntelligenceRedactionOptions, QualityIntelligenceRedactionResult, } from "./redaction.js";
 export { QUALITY_INTELLIGENCE_DEFAULT_RETENTION_PROFILE_ID, QUALITY_INTELLIGENCE_RETENTION_PROFILES, getQualityIntelligenceRetentionProfile, } from "./retentionPolicy.js";
 export type { QualityIntelligenceRetentionProfile } from "./retentionPolicy.js";
-export { createInMemoryQualityIntelligenceLocalStore, createNodeQualityIntelligenceLocalStore, listQualityIntelligenceRuns, loadQualityIntelligenceRun, recordQualityIntelligenceRun, QI_SUBDIR, } from "./store.js";
-export type { QualityIntelligenceLoadOptions, QualityIntelligenceLocalStore, QualityIntelligenceNodeStoreOptions, QualityIntelligenceRecordInput, QualityIntelligenceRecordOptions, QualityIntelligenceRecordResult, } from "./store.js";
+export { appendQualityIntelligenceExportRow, createInMemoryQualityIntelligenceLocalStore, createNodeQualityIntelligenceLocalStore, listQualityIntelligenceRuns, loadQualityIntelligenceRun, recordQualityIntelligenceRun, QI_SUBDIR, } from "./store.js";
+export type { QualityIntelligenceExportEvidenceInput, QualityIntelligenceLoadOptions, QualityIntelligenceLocalStore, QualityIntelligenceNodeStoreOptions, QualityIntelligenceRecordInput, QualityIntelligenceRecordOptions, QualityIntelligenceRecordResult, } from "./store.js";
 export { QUALITY_INTELLIGENCE_CANDIDATES_SCHEMA_VERSION, recordQualityIntelligenceCandidates, loadQualityIntelligenceCandidates, deleteQualityIntelligenceCandidates, applyQualityIntelligenceCandidateEdit, } from "./candidatesArtifact.js";
 export type { QualityIntelligenceCandidateRow, QualityIntelligenceCandidatesArtifact, QualityIntelligenceCandidatesStoreOptions, RecordQualityIntelligenceCandidatesInput, ApplyQualityIntelligenceCandidateEditInput, ApplyQualityIntelligenceCandidateEditResult, QualityIntelligenceCandidateEditErrorReason, } from "./candidatesArtifact.js";
 export { createNodeContainedJsonArtifactStore, type ContainedJsonArtifactStore, type ContainedJsonArtifactStoreOptions, } from "./companionStore.js";
 export { FIGMA_SNAPSHOT_SCHEMA_VERSION, validateFigmaSnapshotRecord, } from "./figmaSnapshot/schema.js";
 export type { FigmaSnapshotImageRef, FigmaSnapshotLinkRow, FigmaSnapshotProvenanceRow, FigmaSnapshotRecord, FigmaSnapshotRedactionSummary, FigmaSnapshotScreenRow, FigmaSnapshotSkipReason, FigmaSnapshotSkippedScreenRow, FigmaSnapshotValidationResult, } from "./figmaSnapshot/schema.js";
 export { createNodeFigmaSnapshotStore } from "./figmaSnapshot/store.js";
-export type { FigmaSnapshotStore, FigmaSnapshotStoreOptions, RecordFigmaSnapshotInput, RecordFigmaSnapshotResult, RecordFigmaSnapshotScreenInput, } from "./figmaSnapshot/store.js";
+export type { FigmaSnapshotImageBytes, FigmaSnapshotStore, FigmaSnapshotStoreOptions, RecordFigmaSnapshotInput, RecordFigmaSnapshotResult, RecordFigmaSnapshotScreenInput, } from "./figmaSnapshot/store.js";
 export { applyQualityIntelligenceRetention, deleteQualityIntelligenceRun, quarantineCorruptQualityIntelligenceManifest, snapshotQualityIntelligenceRunsForRecovery, } from "./retention.js";
 export type { QualityIntelligenceDeleteOptions, QualityIntelligenceDeletionReceipt, QualityIntelligenceDeletionStatus, QualityIntelligenceQuarantineOptions, QualityIntelligenceQuarantineReceipt, QualityIntelligenceRecoverySnapshot, QualityIntelligenceRetentionDecision, QualityIntelligenceRetentionDecisionInput, QualityIntelligenceRetentionResult, QualityIntelligenceRunDeletedEvent, QualityIntelligenceRunSnapshotEntry, } from "./retention.js";
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/index.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,4CAA4C,EAC5C,2CAA2C,GAC5C,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,mCAAmC,EACnC,iCAAiC,EACjC,4BAA4B,EAC5B,6BAA6B,EAC7B,kCAAkC,EAClC,iCAAiC,EACjC,iCAAiC,EACjC,mCAAmC,EACnC,yCAAyC,EACzC,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,GACxC,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,iCAAiC,EAAE,MAAM,gBAAgB,CAAC;AACnE,YAAY,EACV,mCAAmC,EACnC,kCAAkC,GACnC,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,iDAAiD,EACjD,uCAAuC,EACvC,sCAAsC,GACvC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,mCAAmC,EAAE,MAAM,sBAAsB,CAAC;AAGhF,OAAO,EACL,2CAA2C,EAC3C,uCAAuC,EACvC,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B,EAC5B,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,8BAA8B,EAC9B,6BAA6B,EAC7B,mCAAmC,EACnC,8BAA8B,EAC9B,gCAAgC,EAChC,+BAA+B,GAChC,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,8CAA8C,EAC9C,mCAAmC,EACnC,iCAAiC,EACjC,mCAAmC,EACnC,qCAAqC,GACtC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,+BAA+B,EAC/B,qCAAqC,EACrC,yCAAyC,EACzC,wCAAwC,EACxC,0CAA0C,EAC1C,2CAA2C,EAC3C,2CAA2C,GAC5C,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,oCAAoC,EACpC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,GACvC,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,YAAY,EACV,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,iCAAiC,EACjC,4BAA4B,EAC5B,4CAA4C,EAC5C,0CAA0C,GAC3C,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,gCAAgC,EAChC,kCAAkC,EAClC,iCAAiC,EACjC,oCAAoC,EACpC,oCAAoC,EACpC,mCAAmC,EACnC,oCAAoC,EACpC,yCAAyC,EACzC,kCAAkC,EAClC,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/index.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,4CAA4C,EAC5C,2CAA2C,GAC5C,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,mCAAmC,EACnC,yCAAyC,EACzC,mCAAmC,EACnC,iCAAiC,EACjC,4BAA4B,EAC5B,+BAA+B,EAC/B,6BAA6B,EAC7B,kCAAkC,EAClC,iCAAiC,EACjC,iCAAiC,EACjC,mCAAmC,EACnC,yCAAyC,EACzC,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,GACxC,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,iCAAiC,EAAE,MAAM,gBAAgB,CAAC;AACnE,YAAY,EACV,mCAAmC,EACnC,kCAAkC,GACnC,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,iDAAiD,EACjD,uCAAuC,EACvC,sCAAsC,GACvC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,mCAAmC,EAAE,MAAM,sBAAsB,CAAC;AAGhF,OAAO,EACL,kCAAkC,EAClC,2CAA2C,EAC3C,uCAAuC,EACvC,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B,EAC5B,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,sCAAsC,EACtC,8BAA8B,EAC9B,6BAA6B,EAC7B,mCAAmC,EACnC,8BAA8B,EAC9B,gCAAgC,EAChC,+BAA+B,GAChC,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,8CAA8C,EAC9C,mCAAmC,EACnC,iCAAiC,EACjC,mCAAmC,EACnC,qCAAqC,GACtC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,+BAA+B,EAC/B,qCAAqC,EACrC,yCAAyC,EACzC,wCAAwC,EACxC,0CAA0C,EAC1C,2CAA2C,EAC3C,2CAA2C,GAC5C,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,oCAAoC,EACpC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,GACvC,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,YAAY,EACV,uBAAuB,EACvB,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,iCAAiC,EACjC,4BAA4B,EAC5B,4CAA4C,EAC5C,0CAA0C,GAC3C,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,gCAAgC,EAChC,kCAAkC,EAClC,iCAAiC,EACjC,oCAAoC,EACpC,oCAAoC,EACpC,mCAAmC,EACnC,oCAAoC,EACpC,yCAAyC,EACzC,kCAAkC,EAClC,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,gBAAgB,CAAC"}

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/index.js

@@ -10,7 +10,7 @@ export { redactQualityIntelligenceEvidence } from "./redaction.js";
 // ─── Retention profiles (M1) ───────────────────────────────────────────────────────
 export { QUALITY_INTELLIGENCE_DEFAULT_RETENTION_PROFILE_ID, QUALITY_INTELLIGENCE_RETENTION_PROFILES, getQualityIntelligenceRetentionProfile, } from "./retentionPolicy.js";
 // ─── Local-state store + CRUD (M2) ─────────────────────────────────────────────────
-export { createInMemoryQualityIntelligenceLocalStore, createNodeQualityIntelligenceLocalStore, listQualityIntelligenceRuns, loadQualityIntelligenceRun, recordQualityIntelligenceRun, QI_SUBDIR, } from "./store.js";
+export { appendQualityIntelligenceExportRow, createInMemoryQualityIntelligenceLocalStore, createNodeQualityIntelligenceLocalStore, listQualityIntelligenceRuns, loadQualityIntelligenceRun, recordQualityIntelligenceRun, QI_SUBDIR, } from "./store.js";
 // ─── Generated-candidate companion artifact (Issue #280) ────────────────────────────
 export { QUALITY_INTELLIGENCE_CANDIDATES_SCHEMA_VERSION, recordQualityIntelligenceCandidates, loadQualityIntelligenceCandidates, deleteQualityIntelligenceCandidates, applyQualityIntelligenceCandidateEdit, } from "./candidatesArtifact.js";
 export { createNodeContainedJsonArtifactStore, } from "./companionStore.js";

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/manifestSchema.d.ts

@@ -1,5 +1,21 @@
 import type { QualityIntelligence } from "@oscharko-dev/keiko-contracts";
 type QualityIntelligenceExportAdapter = QualityIntelligence.QualityIntelligenceExportAdapter;
+/**
+ * Binary export modes assembled at the runtime/route level (Issue #283 + #711) rather than by a pure
+ * domain adapter — a paginated text PDF and a STORE ZIP bundle. They are not part of the contract
+ * `QualityIntelligenceExportAdapter` union (which drives the serialise dispatch + TMS classification),
+ * but an export-evidence row must be able to record them faithfully as the produced target type.
+ */
+export type QualityIntelligenceBinaryExportMode = "pdf" | "zip-bundle";
+/**
+ * Traceability matrix export modes produced by the dedicated traceability route (Epic #734,
+ * Issue #740). Like binary modes, these are assembled at the route level — the matrix serializers
+ * are separate from the candidate-export adapters — so they extend the evidence target union here
+ * rather than the contract `QualityIntelligenceExportAdapter`.
+ */
+export type QualityIntelligenceTraceabilityExportMode = "traceability-csv" | "traceability-markdown";
+/** Any target an export-evidence row may record: a domain adapter, a binary bundle mode, or a traceability matrix mode. */
+export type QualityIntelligenceExportTarget = QualityIntelligenceExportAdapter | QualityIntelligenceBinaryExportMode | QualityIntelligenceTraceabilityExportMode;
 type QualityIntelligenceLifecycleStatus = QualityIntelligence.QualityIntelligenceLifecycleStatus;
 type QualityIntelligenceRunId = QualityIntelligence.QualityIntelligenceRunId;
 type QualityIntelligenceValidationFindingKind = QualityIntelligence.QualityIntelligenceValidationFindingKind;
@@ -59,9 +75,17 @@ export interface QualityIntelligenceFindingRow {
 }
 export interface QualityIntelligenceExportRow {
     readonly id: string;
-    readonly targetAdapter: QualityIntelligenceExportAdapter;
+    readonly targetAdapter: QualityIntelligenceExportTarget;
     readonly integrityHash: string;
     readonly redactionAttested: boolean;
+    /**
+     * Whether this row records a dry-run preview rather than a materialised export (Issue #283, AC4).
+     * Absent/`false` means the export produced a downloadable artifact (local serialisation or a
+     * binary PDF/ZIP bundle); `true` means only a preview was rendered. Additive and optional:
+     * manifests written before #283 carry no export rows at all, and the strict-schema gate validates
+     * only top-level keys, so no schema-version bump is required.
+     */
+    readonly dryRun?: boolean;
 }
 export interface QualityIntelligenceEvidenceRefRow {
     readonly envelopeId: string;
@@ -78,6 +102,13 @@ export interface QualityIntelligenceAtomFingerprintRow {
     readonly atomId: string;
     readonly envelopeId: string;
     readonly canonicalHashSha256Hex: string;
+    /**
+     * Optional opaque key for finding the current replacement atom during targeted regeneration. This is
+     * a hash-derived metadata key, not raw source text or a local filesystem path.
+     */
+    readonly replacementGroupId?: string;
+    /** Stable ordinal within replacementGroupId for same-document requirement replacements. */
+    readonly replacementOrdinal?: number;
 }
 export interface QualityIntelligenceProvenanceRefs {
     readonly envelopeIds: readonly string[];
@@ -101,7 +132,7 @@ export interface QualityIntelligenceEvidenceManifest {
     readonly integrityHashes: QualityIntelligenceIntegrityHashes;
     /** Optional: per-atom coverage classification (refs + status, no raw text). Added in #738. */
     readonly coverageMatrix?: readonly QualityIntelligenceCoverageMatrixRow[];
-    /** Optional: run quality score — percent of judged candidates rated "strong" [0-100]; null when the judge stage was skipped. Added in #736. */
+    /** Optional: run quality score — percent of candidates with a strong judge outcome [0-100]; null when the judge stage was skipped. Added in #736. */
     readonly qualityScore?: number | null;
     /** Optional: per-envelope content fingerprints for drift detection (Epic #735, Issue #742). */
     readonly sourceFingerprints?: readonly QualityIntelligenceSourceFingerprintRow[];

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/manifestSchema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifestSchema.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/manifestSchema.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,KAAK,gCAAgC,GAAG,mBAAmB,CAAC,gCAAgC,CAAC;AAC7F,KAAK,kCAAkC,GAAG,mBAAmB,CAAC,kCAAkC,CAAC;AACjG,KAAK,wBAAwB,GAAG,mBAAmB,CAAC,wBAAwB,CAAC;AAC7E,KAAK,wCAAwC,GAC3C,mBAAmB,CAAC,wCAAwC,CAAC;AAC/D,KAAK,2BAA2B,GAAG,mBAAmB,CAAC,2BAA2B,CAAC;AACnF,KAAK,iCAAiC,GAAG,mBAAmB,CAAC,iCAAiC,CAAC;AAE/F,eAAO,MAAM,4CAA4C,EAAG,CAAU,CAAC;AAKvE,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,4FAA4F;IAC5F,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAKD,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,gBAAgB,GAAG,WAAW,CAAC;IAC5D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;CAC9C;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,wCAAwC,CAAC;IACxD,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;IAC/C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,aAAa,EAAE,gCAAgC,CAAC;IACzD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACrC;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE,kCAAkC,CAAC;CAC9D;AAED,8FAA8F;AAC9F,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;CACzC;AAED,gGAAgG;AAChG,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;CACzC;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,iCAAiC,CAAC;CAC5D;AAWD,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,uBAAuB,EAAE,OAAO,4CAA4C,CAAC;IACtF,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;IAClE,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,SAAS,6BAA6B,EAAE,CAAC;IAC5D,QAAQ,CAAC,OAAO,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAC1D,QAAQ,CAAC,YAAY,EAAE,SAAS,iCAAiC,EAAE,CAAC;IACpE,QAAQ,CAAC,cAAc,EAAE,iCAAiC,CAAC;IAC3D,QAAQ,CAAC,gBAAgB,EAAE,mCAAmC,CAAC;IAC/D,QAAQ,CAAC,eAAe,EAAE,kCAAkC,CAAC;IAC7D,8FAA8F;IAC9F,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,oCAAoC,EAAE,CAAC;IAC1E,+IAA+I;IAC/I,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,+FAA+F;IAC/F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,uCAAuC,EAAE,CAAC;IACjF,0FAA0F;IAC1F,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,qCAAqC,EAAE,CAAC;IAC7E,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,kGAAkG;IAClG,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAuCD,MAAM,WAAW,yCAAyC;IACxD,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAKD,wBAAgB,2CAA2C,CACzD,KAAK,EAAE,OAAO,GACb,yCAAyC,CAqB3C"}
+{"version":3,"file":"manifestSchema.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/manifestSchema.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,KAAK,gCAAgC,GAAG,mBAAmB,CAAC,gCAAgC,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,MAAM,mCAAmC,GAAG,KAAK,GAAG,YAAY,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,MAAM,yCAAyC,GACjD,kBAAkB,GAClB,uBAAuB,CAAC;AAE5B,2HAA2H;AAC3H,MAAM,MAAM,+BAA+B,GACvC,gCAAgC,GAChC,mCAAmC,GACnC,yCAAyC,CAAC;AAC9C,KAAK,kCAAkC,GAAG,mBAAmB,CAAC,kCAAkC,CAAC;AACjG,KAAK,wBAAwB,GAAG,mBAAmB,CAAC,wBAAwB,CAAC;AAC7E,KAAK,wCAAwC,GAC3C,mBAAmB,CAAC,wCAAwC,CAAC;AAC/D,KAAK,2BAA2B,GAAG,mBAAmB,CAAC,2BAA2B,CAAC;AACnF,KAAK,iCAAiC,GAAG,mBAAmB,CAAC,iCAAiC,CAAC;AAE/F,eAAO,MAAM,4CAA4C,EAAG,CAAU,CAAC;AAKvE,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,4FAA4F;IAC5F,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAKD,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,gBAAgB,GAAG,WAAW,CAAC;IAC5D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;CAC9C;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,wCAAwC,CAAC;IACxD,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;IAC/C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,aAAa,EAAE,+BAA+B,CAAC;IACxD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE,kCAAkC,CAAC;CAC9D;AAED,8FAA8F;AAC9F,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;CACzC;AAED,gGAAgG;AAChG,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,2FAA2F;IAC3F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,iCAAiC,CAAC;CAC5D;AAWD,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,uBAAuB,EAAE,OAAO,4CAA4C,CAAC;IACtF,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;IAClE,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,SAAS,6BAA6B,EAAE,CAAC;IAC5D,QAAQ,CAAC,OAAO,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAC1D,QAAQ,CAAC,YAAY,EAAE,SAAS,iCAAiC,EAAE,CAAC;IACpE,QAAQ,CAAC,cAAc,EAAE,iCAAiC,CAAC;IAC3D,QAAQ,CAAC,gBAAgB,EAAE,mCAAmC,CAAC;IAC/D,QAAQ,CAAC,eAAe,EAAE,kCAAkC,CAAC;IAC7D,8FAA8F;IAC9F,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,oCAAoC,EAAE,CAAC;IAC1E,qJAAqJ;IACrJ,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,+FAA+F;IAC/F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,uCAAuC,EAAE,CAAC;IACjF,0FAA0F;IAC1F,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,qCAAqC,EAAE,CAAC;IAC7E,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,kGAAkG;IAClG,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAuCD,MAAM,WAAW,yCAAyC;IACxD,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAKD,wBAAgB,2CAA2C,CACzD,KAAK,EAAE,OAAO,GACb,yCAAyC,CAqB3C"}

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/store.d.ts

@@ -30,7 +30,7 @@ export interface QualityIntelligenceRecordInput {
     readonly provenanceRefs: QualityIntelligenceEvidenceManifest["provenanceRefs"];
     /** Optional coverage matrix (per-atom status, refs only). Added in #738. */
     readonly coverageMatrix?: QualityIntelligenceEvidenceManifest["coverageMatrix"];
-    /** Optional run quality score — percent of judged candidates rated "strong" [0-100]; null when judge was skipped. Added in #736. */
+    /** Optional run quality score — percent of candidates with a strong judge outcome [0-100]; null when judge was skipped. Added in #736. */
     readonly qualityScore?: QualityIntelligenceEvidenceManifest["qualityScore"];
     /** Optional per-envelope content fingerprints for drift detection (Epic #735). */
     readonly sourceFingerprints?: readonly QualityIntelligenceSourceFingerprintRow[];
@@ -53,6 +53,39 @@ export interface QualityIntelligenceRecordResult {
     readonly location: string;
 }
 export declare function recordQualityIntelligenceRun(input: QualityIntelligenceRecordInput, options?: QualityIntelligenceRecordOptions): QualityIntelligenceRecordResult;
+export interface QualityIntelligenceExportEvidenceInput {
+    readonly runId: string;
+    /** The export row to append: target adapter, artifact id, integrity hash, attestation, mode. */
+    readonly export: QualityIntelligenceEvidenceManifest["exports"][number];
+}
+/**
+ * Append one export-evidence row to an already-recorded run manifest (Issue #283, AC4 — "export
+ * evidence records target type, artifact IDs, mapping profile, and result without leaking secrets";
+ * Audit Addendum — "audit evidence for every export action").
+ *
+ * Every QI export action — a local serialisation download, a binary PDF/ZIP bundle, or a dry-run
+ * preview — emits one audit row recording WHAT was exported (`targetAdapter`), the artifact id, its
+ * integrity hash, the redaction attestation, and whether it was a dry-run. The disabled external-TMS
+ * write path produces no artifact and therefore records nothing.
+ *
+ * Rows are deduplicated by `(id, dryRun)` so re-exporting the same adapter in the same mode is
+ * idempotent — the audit captures each distinct (artifact, mode) once rather than once per click,
+ * which also bounds manifest growth.
+ *
+ * Invariants preserved (mirrors {@link recordQualityIntelligenceRun}):
+ *  - the new row's string leaves pass the persist redactor before assembly (the row carries only
+ *    ids / an enum / a sha-256 hash / booleans, so this is a no-op in practice, but the persist
+ *    redactor is applied unconditionally to keep the fail-closed contract uniform);
+ *  - `integrityHashes.exports` is recomputed over the full new collection; the other hash groups are
+ *    carried over unchanged because their collections did not change;
+ *  - `totals.exports` stays equal to `exports.length` (asserted on read);
+ *  - the counts-only `redactionSummary` folds in the new row's scan;
+ *  - the manifest is rewritten through the same atomic O_EXCL temp + rename path.
+ *
+ * Throws `EvidenceReadError` when the run manifest does not exist (an export cannot precede its run)
+ * and `EvidenceWriteError` when neither `store` nor `evidenceDir` is supplied or the write fails.
+ */
+export declare function appendQualityIntelligenceExportRow(input: QualityIntelligenceExportEvidenceInput, options?: QualityIntelligenceRecordOptions): QualityIntelligenceRecordResult;
 export interface QualityIntelligenceLoadOptions {
     readonly store?: QualityIntelligenceLocalStore | undefined;
     readonly evidenceDir?: string | undefined;

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/store.ts"],"names":[],"mappings":"AAoCA,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAGL,KAAK,mCAAmC,EACxC,KAAK,qCAAqC,EAE1C,KAAK,uCAAuC,EAC7C,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,KAAK,mCAAmC,EACzC,MAAM,gBAAgB,CAAC;AAIxB,eAAO,MAAM,SAAS,OAAO,CAAC;AAU9B,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,mCAAmC,KAAK,MAAM,CAAC;IAC3E,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,mCAAmC,GAAG,SAAS,CAAC;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7C;AAID,wBAAgB,2CAA2C,IAAI,6BAA6B,CAsB3F;AA4QD,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;CACtC;AAMD,wBAAgB,uCAAuC,CACrD,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,mCAAwC,GAChD,6BAA6B,CAgB/B;AAID,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC/D,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC/D,QAAQ,CAAC,QAAQ,EAAE,mCAAmC,CAAC,UAAU,CAAC,CAAC;IACnE,QAAQ,CAAC,OAAO,EAAE,mCAAmC,CAAC,SAAS,CAAC,CAAC;IACjE,QAAQ,CAAC,YAAY,EAAE,mCAAmC,CAAC,cAAc,CAAC,CAAC;IAC3E,QAAQ,CAAC,cAAc,EAAE,mCAAmC,CAAC,gBAAgB,CAAC,CAAC;IAC/E,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,CAAC,EAAE,mCAAmC,CAAC,gBAAgB,CAAC,CAAC;IAChF,oIAAoI;IACpI,QAAQ,CAAC,YAAY,CAAC,EAAE,mCAAmC,CAAC,cAAc,CAAC,CAAC;IAC5E,kFAAkF;IAClF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,uCAAuC,EAAE,CAAC;IACjF,yFAAyF;IACzF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,qCAAqC,EAAE,CAAC;IAC7E,mEAAmE;IACnE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,mCAAmC,GAAG,SAAS,CAAC;CACtE;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,mCAAmC,CAAC;IACvD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AA0ID,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,8BAA8B,EACrC,OAAO,GAAE,gCAAqC,GAC7C,+BAA+B,CA2CjC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,8BAAmC,GAC3C,mCAAmC,GAAG,SAAS,CAGjD;AAED,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,8BAAmC,GAC3C,SAAS,MAAM,EAAE,CAGnB"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/store.ts"],"names":[],"mappings":"AAoCA,OAAO,EAA0B,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAIzF,OAAO,EAGL,KAAK,mCAAmC,EACxC,KAAK,qCAAqC,EAE1C,KAAK,uCAAuC,EAC7C,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,KAAK,mCAAmC,EACzC,MAAM,gBAAgB,CAAC;AAIxB,eAAO,MAAM,SAAS,OAAO,CAAC;AAU9B,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,mCAAmC,KAAK,MAAM,CAAC;IAC3E,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,mCAAmC,GAAG,SAAS,CAAC;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7C;AAID,wBAAgB,2CAA2C,IAAI,6BAA6B,CAsB3F;AA8QD,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;CACtC;AAMD,wBAAgB,uCAAuC,CACrD,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,mCAAwC,GAChD,6BAA6B,CAgB/B;AAID,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC/D,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC/D,QAAQ,CAAC,QAAQ,EAAE,mCAAmC,CAAC,UAAU,CAAC,CAAC;IACnE,QAAQ,CAAC,OAAO,EAAE,mCAAmC,CAAC,SAAS,CAAC,CAAC;IACjE,QAAQ,CAAC,YAAY,EAAE,mCAAmC,CAAC,cAAc,CAAC,CAAC;IAC3E,QAAQ,CAAC,cAAc,EAAE,mCAAmC,CAAC,gBAAgB,CAAC,CAAC;IAC/E,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,CAAC,EAAE,mCAAmC,CAAC,gBAAgB,CAAC,CAAC;IAChF,0IAA0I;IAC1I,QAAQ,CAAC,YAAY,CAAC,EAAE,mCAAmC,CAAC,cAAc,CAAC,CAAC;IAC5E,kFAAkF;IAClF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,uCAAuC,EAAE,CAAC;IACjF,yFAAyF;IACzF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,qCAAqC,EAAE,CAAC;IAC7E,mEAAmE;IACnE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,mCAAmC,GAAG,SAAS,CAAC;CACtE;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,mCAAmC,CAAC;IACvD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AA0ID,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,8BAA8B,EACrC,OAAO,GAAE,gCAAqC,GAC7C,+BAA+B,CA2CjC;AAID,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;CACzE;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,sCAAsC,EAC7C,OAAO,GAAE,gCAAqC,GAC7C,+BAA+B,CAoCjC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,8BAAmC,GAC3C,mCAAmC,GAAG,SAAS,CAGjD;AAED,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,8BAAmC,GAC3C,SAAS,MAAM,EAAE,CAGnB"}