@oscharko-dev/keiko 0.2.0-beta.4 → 0.2.0-beta.6

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/figmaSnapshotRoutes.js

@@ -6,13 +6,15 @@
 //
 //   POST /api/figma/snapshots           — trigger a bounded snapshot-build from a board link
 //   GET  /api/figma/snapshots/:runId    — load a stored snapshot summary for display
+//   GET  /api/figma/snapshots/:runId/screens/:screenIndex/image
+//                                       — stream a stored, token-free PNG side-file
 //
 // Trigger route:
 //   1. Parses board link → (fileKey, nodeId) — rejects malformed / missing node-id links.
 //   2. Resolves the read-only PAT server-side (vault > config > FIGMA_ACCESS_TOKEN env).
 //   3. Builds a runId, runs connector → cleanScopedNodesToScreenIr → buildFigmaSnapshot → store.
 //   4. Returns a minimal summary (runId, screenCount, skippedCount, reduction hint).
-//      No token, no raw IR bytes, no render bytes reach the browser.
+//      No token, no raw IR bytes, no render bytes are embedded in the JSON response.
 //
 // Load route reads the stored immutable evidence record and returns a browser-safe
 // projection. No re-contact with Figma.
@@ -42,25 +44,31 @@
 //   The coalesced build continues — other waiters (if any) are unaffected and will
 //   receive the result when the build settles.
 import { randomUUID } from "node:crypto";
-import { currentGatewayEgressConfig } from "../deps.js";
-import { parseFigmaTarget, deriveFigmaScopeRef, observeFigmaRevoke, EXPECTED_FIGMA_SCOPES, FigmaConnectorError, } from "./figma/index.js";
+import { STREAMING } from "../routes.js";
+import { currentGatewayConfig, currentGatewayEgressConfig, currentRedactionSecrets, } from "../deps.js";
+import { redact } from "@oscharko-dev/keiko-security";
+import { appendFigmaConnectorAudit, parseFigmaTarget, deriveFigmaScopeRef, observeFigmaRevoke, EXPECTED_FIGMA_SCOPES, FigmaConnectorError, resolveScopedPaginationLimits, } from "./figma/index.js";
 import { governedSnapshotBuild, figmaTokenStoreFor, } from "./figmaSnapshotOrchestration.js";
 import { createNodeFigmaSnapshotStore, } from "@oscharko-dev/keiko-evidence";
 // ─── Error helpers ─────────────────────────────────────────────────────────────
+// Operator-facing scope hint, derived from the single source of truth (figmaConsent.EXPECTED_FIGMA_SCOPES)
+// so the re-key guidance can never drift from the scopes the consent ledger records (#758 AC2).
+const READ_ONLY_SCOPE_HINT = EXPECTED_FIGMA_SCOPES.join(", ");
 const FIGMA_ROUTE_ERROR_MESSAGES = {
-    FIGMA_TOKEN_MISSING: "No Figma PAT is configured. Set FIGMA_ACCESS_TOKEN in the server environment (read-only scopes: file_read, files:read).",
+    FIGMA_TOKEN_MISSING: `No Figma PAT is configured. Add one in Keiko config, vault, or FIGMA_ACCESS_TOKEN (read-only scopes: ${READ_ONLY_SCOPE_HINT}).`,
     FIGMA_TOKEN_INVALID: "The configured Figma PAT is invalid. Please rotate the token.",
     FIGMA_TOKEN_EXPIRED: "The configured Figma PAT has expired. Please rotate the token.",
     FIGMA_TOKEN_REVOKED: "The configured Figma PAT has been revoked. Please mint a new token.",
-    FIGMA_INSUFFICIENT_SCOPE: "The configured Figma PAT lacks the required read-only scopes (file_read, files:read).",
+    FIGMA_INSUFFICIENT_SCOPE: `The configured Figma PAT lacks the required read-only scopes (${READ_ONLY_SCOPE_HINT}).`,
     FIGMA_NOT_FOUND: "The Figma board was not found. Check the link and that the PAT can access this file.",
+    FIGMA_NOT_READY: "The selected Figma scope is not release-ready. Pin a Figma version, select a Release section, or mark the frame Ready for dev before snapshotting.",
     FIGMA_UPSTREAM_UNAVAILABLE: "Figma API is temporarily unavailable. Please try again.",
     FIGMA_PROXY_EGRESS_FAILED: "The forward proxy rejected the Figma egress request. Check proxy configuration.",
     FIGMA_PROXY_UNREACHABLE: "The configured forward proxy is unreachable. Check proxy host and port settings.",
     FIGMA_PROXY_AUTH_REQUIRED: "The forward proxy requires authentication. Configure proxy credentials or an allow rule.",
     FIGMA_PROXY_BLOCKED_BY_POLICY: "The forward proxy blocked the Figma egress request. Ask the proxy operator to allow api.figma.com.",
     FIGMA_TLS_CA_FAILURE: "The Figma egress TLS certificate could not be verified. Check the configured CA bundle.",
-    FIGMA_RATE_LIMITED: "Figma rate-limited the snapshot-build. Please wait a moment and try again.",
+    FIGMA_RATE_LIMITED: "Figma rate-limited the snapshot-build. Retry with a narrower Release section or lower the Figma fetch limits before re-running.",
     FIGMA_OVERSIZED_SCOPE: "The selected Figma board section is too large. Select a smaller section (frame or page).",
     FIGMA_RESPONSE_TOO_LARGE: "The Figma API response exceeded the size limit. Select a smaller section.",
     FIGMA_NETWORK_UNREACHABLE: "The outbound request to Figma failed. Check network connectivity and egress policy.",
@@ -71,6 +79,7 @@ const FIGMA_ROUTE_ERROR_MESSAGES = {
     FIGMA_BAD_LINK: "The board link is not a valid Figma URL, or it is missing a node-id " +
         "(section/frame anchor required).",
     FIGMA_SNAPSHOT_NOT_FOUND: "No snapshot was found for this run id.",
+    FIGMA_SCREEN_NOT_FOUND: "No captured screen image was found for this snapshot.",
     FIGMA_NO_EVIDENCE_DIR: "The evidence directory is not configured; snapshots cannot be stored.",
     FIGMA_CONSENT_REQUIRED: "Acknowledge the read-only, least-privilege Figma scope before the first snapshot for this board.",
     FIGMA_TOKEN_REVOKED_OK: "The stored Figma PAT was removed.",
@@ -107,6 +116,8 @@ function figmaStatusForCode(code) {
         return 502;
     if (code === "FIGMA_NOT_FOUND")
         return 404;
+    if (code === "FIGMA_NOT_READY")
+        return 412;
     if (code === "FIGMA_RATE_LIMITED")
         return 429;
     if (code === "FIGMA_OVERSIZED_SCOPE")
@@ -226,43 +237,100 @@ function recordToSummary(record, coverage, metrics) {
         })),
     };
 }
+function persistedAuditCounts(record, metrics) {
+    return {
+        screens: metrics.screenCount,
+        renders: metrics.renderCount,
+        skipped: record.skippedScreens.length,
+        designTokens: metrics.designTokenCount,
+        ...(metrics.navGraph !== undefined ? { navTransitions: metrics.navGraph.transitions } : {}),
+    };
+}
+function appendPersistedSnapshotAudit(evidenceDir, result, record, isResnapshot) {
+    appendFigmaConnectorAudit({
+        scopeRef: result.scopeRef,
+        evidenceDir,
+        action: isResnapshot ? "resnapshot" : "snapshot",
+        outcome: "ok",
+        counts: persistedAuditCounts(record, result.metrics),
+        now: result.provenance.fetchedAt,
+    });
+}
+function appendSnapshotRouteFailureAudit(evidenceDir, result, isResnapshot, errorCode) {
+    appendFigmaConnectorAudit({
+        scopeRef: result.scopeRef,
+        evidenceDir,
+        action: isResnapshot ? "resnapshot" : "snapshot",
+        outcome: "error",
+        errorCode,
+        now: result.provenance.fetchedAt,
+    });
+}
 // ─── POST /api/figma/snapshots — parse + validate ─────────────────────────────
-/** Reads and validates the POST body, returning the board link or an error result. */
-async function parseTriggerBody(req) {
-    let raw;
+function parseTriggerJson(raw) {
+    let parsed;
     try {
-        raw = await readBody(req);
+        parsed = JSON.parse(raw);
     }
     catch {
-        return { status: 400, body: figmaErrorBody("FIGMA_BAD_LINK") };
+        return undefined;
     }
-    let parsed;
+    return typeof parsed === "object" && parsed !== null
+        ? parsed
+        : undefined;
+}
+function parseTriggerBoardLink(body) {
+    const boardLink = typeof body.boardLink === "string" ? body.boardLink.trim() : "";
+    return boardLink.length > 0 && parseFigmaTarget(boardLink) !== null ? boardLink : undefined;
+}
+/** Reads and validates the POST body, returning the board link or an error result. */
+async function parseTriggerBody(req) {
+    let raw;
     try {
-        parsed = JSON.parse(raw);
+        raw = await readBody(req);
     }
     catch {
         return { status: 400, body: figmaErrorBody("FIGMA_BAD_LINK") };
     }
-    if (typeof parsed !== "object" || parsed === null) {
+    const body = parseTriggerJson(raw);
+    if (body === undefined) {
         return { status: 400, body: figmaErrorBody("FIGMA_BAD_LINK") };
     }
-    const body = parsed;
-    const boardLink = typeof body.boardLink === "string" ? body.boardLink.trim() : "";
-    if (boardLink.length === 0 || parseFigmaTarget(boardLink) === null) {
+    const boardLink = parseTriggerBoardLink(body);
+    if (boardLink === undefined) {
         return { status: 400, body: figmaErrorBody("FIGMA_BAD_LINK") };
     }
+    const requestedVersion = typeof body.version === "string" ? parseFigmaVersion(body.version) : undefined;
+    const linkVersion = parseFigmaVersionFromLink(boardLink);
+    const version = requestedVersion ?? linkVersion;
     return {
         boardLink,
+        ...(version !== undefined ? { version } : {}),
         // Explicit read-only-scope acknowledgement (#760): records consent BEFORE the first fetch.
         acknowledgeReadOnly: body.acknowledgeReadOnly === true,
         // Audited as a re-snapshot (#759): a fresh, explicit, full scoped re-fetch — never a delta.
         isResnapshot: body.isResnapshot === true,
     };
 }
+const FIGMA_VERSION_PATTERN = /^[A-Za-z0-9._:-]{1,256}$/u;
+function parseFigmaVersion(raw) {
+    const value = raw.trim();
+    return FIGMA_VERSION_PATTERN.test(value) ? value : undefined;
+}
+function parseFigmaVersionFromLink(boardLink) {
+    try {
+        const url = new URL(boardLink);
+        const raw = url.searchParams.get("version-id") ?? url.searchParams.get("version");
+        return raw === null ? undefined : parseFigmaVersion(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
 // Deployment-overridable deep scoped-pagination budgets (#837). Operators on a tighter Figma plan can
 // dial concurrency/depth/screen-count down (or up) via env without a code change; an unset or
 // non-positive value falls back to the connector default. Mirrors the #532 KEIKO_GROUNDING_* pattern.
-function figmaPaginationFromEnv(env) {
+export function figmaPaginationFromEnv(env) {
     const readPositiveInt = (raw) => {
         if (raw === undefined)
             return undefined;
@@ -280,7 +348,7 @@ function figmaPaginationFromEnv(env) {
     apply("maxFetchesPerScreen", "KEIKO_FIGMA_MAX_FETCHES_PER_SCREEN");
     apply("maxScreensDeep", "KEIKO_FIGMA_MAX_SCREENS_DEEP");
     apply("fetchConcurrency", "KEIKO_FIGMA_FETCH_CONCURRENCY");
-    return overrides;
+    return resolveScopedPaginationLimits(overrides);
 }
 /** Default total snapshot-build deadline in milliseconds (10 minutes). */
 const DEFAULT_BUILD_DEADLINE_MS = 600_000;
@@ -301,12 +369,27 @@ function figmaBuildDeadlineMsFromEnv(env) {
 function figmaRequestTimeoutMsFromEnv(env) {
     return readPositiveIntEnv(env.KEIKO_FIGMA_REQUEST_TIMEOUT_MS, DEFAULT_REQUEST_TIMEOUT_MS);
 }
+// F9 observability: a `FIGMA_INTERNAL` 500 is the catch-all for an UNEXPECTED build/persist failure;
+// the coded body is content-free, so on its own an operator cannot tell a transient render-body
+// malformation from a filesystem failure from a genuine bug. Log the redacted cause (class + message,
+// secrets scrubbed) so the incident is diagnosable without ever leaking a token or provider body.
+// Matches the redacted-console.error convention (memory-salience.ts). Only fires for FIGMA_INTERNAL —
+// expected coded errors (consent/auth/rate-limit) stay quiet (they are already audited).
+function logFigmaInternal(stage, err, deps) {
+    const name = err instanceof Error ? err.constructor.name : typeof err;
+    const message = err instanceof Error ? err.message : String(err);
+    // eslint-disable-next-line no-console
+    console.error(`figma snapshot-build failed (${stage}): ${name}`, redact(message, currentRedactionSecrets(deps)));
+}
 // Map a thrown error from the governed build to a coded route result: a coded connector error maps to
 // its status (consent-required → 428, auth → 502, rate-limit → 429, …); anything else is a safe 500.
-function figmaErrorResult(err) {
+function figmaErrorResult(err, deps) {
     if (err instanceof FigmaConnectorError) {
+        if (err.code === "FIGMA_INTERNAL")
+            logFigmaInternal("build", err, deps);
         return { status: figmaStatusForCode(err.code), body: figmaErrorBody(err.code) };
     }
+    logFigmaInternal("build", err, deps);
     return { status: 500, body: figmaErrorBody("FIGMA_INTERNAL") };
 }
 /**
@@ -314,7 +397,7 @@ function figmaErrorResult(err) {
  * transitions (#811 navigation graph) and the deterministic design-tokens artifact (#752, consumed by
  * design-to-code #755) — both hash-neutral and both previously dropped by the route.
  */
-function persistSnapshot(evidenceDir, runId, result) {
+function persistSnapshot(evidenceDir, runId, result, deps) {
     const store = createNodeFigmaSnapshotStore(evidenceDir);
     try {
         store.record({
@@ -333,12 +416,21 @@ function persistSnapshot(evidenceDir, runId, result) {
             })),
             ...(result.snapshot.links !== undefined ? { links: result.snapshot.links } : {}),
             tokens: result.ir.tokens,
+            metrics: result.metrics,
         });
     }
-    catch {
+    catch (e) {
+        logFigmaInternal("persist.record", e, deps);
+        return { status: 500, body: figmaErrorBody("FIGMA_INTERNAL") };
+    }
+    let record;
+    try {
+        record = store.load(runId);
+    }
+    catch (e) {
+        logFigmaInternal("persist.load", e, deps);
         return { status: 500, body: figmaErrorBody("FIGMA_INTERNAL") };
     }
-    const record = store.load(runId);
     if (record === undefined)
         return { status: 500, body: figmaErrorBody("FIGMA_INTERNAL") };
     return record;
@@ -354,12 +446,12 @@ export function makeInFlightMap() {
 export function resetInFlightMap() {
     defaultInFlightMap = new Map();
 }
-/** Derive the scope key (fileKey:nodeId) for the in-flight map. */
-function scopeKeyFor(boardLink) {
+/** Derive the coalescing key (fileKey:nodeId:operation:consent) for the in-flight map. */
+function coalescingKeyFor(boardLink, acknowledgeReadOnly, isResnapshot, version) {
     const target = parseFigmaTarget(boardLink);
     if (target === null)
         return undefined;
-    return `${target.fileKey}:${target.nodeId}`;
+    return `${target.fileKey}:${target.nodeId}:${version ?? "latest"}:${isResnapshot ? "resnapshot" : "snapshot"}:${acknowledgeReadOnly ? "ack" : "noack"}`;
 }
 // Starts the governed build + persist and removes the map entry on settle.
 // Persist is INSIDE this chain: if a caller's deadline fires but the build later completes,
@@ -376,19 +468,25 @@ function startCoalescedBuild(scopeKey, inFlight, boardLink, body, evidenceDir, d
                 env: deps.env,
                 now: new Date().toISOString(),
                 acknowledgeReadOnly: body.acknowledgeReadOnly,
+                version: body.version,
                 pagination: figmaPaginationFromEnv(deps.env),
                 egress: currentGatewayEgressConfig(deps),
+                configToken: currentGatewayConfig(deps)?.figma?.accessToken,
                 portOptions: { timeoutMs: figmaRequestTimeoutMsFromEnv(deps.env) },
+                deferSuccessAudit: true,
             }, body.isResnapshot);
         }
         catch (err) {
-            return figmaErrorResult(err);
+            return figmaErrorResult(err, deps);
         }
         const runId = `fs-${randomUUID()}`;
-        const stored = persistSnapshot(evidenceDir, runId, result);
-        if ("status" in stored)
+        const stored = persistSnapshot(evidenceDir, runId, result, deps);
+        if ("status" in stored) {
+            appendSnapshotRouteFailureAudit(evidenceDir, result, body.isResnapshot, "FIGMA_INTERNAL");
             return stored;
-        return { status: 201, body: recordToSummary(stored, result.coverage, result.metrics) };
+        }
+        appendPersistedSnapshotAudit(evidenceDir, result, stored, body.isResnapshot);
+        return { status: 201, body: recordToSummary(stored, result.coverage, stored.metrics) };
     };
     const promise = buildAndPersist().finally(() => {
         inFlight.delete(scopeKey);
@@ -396,13 +494,20 @@ function startCoalescedBuild(scopeKey, inFlight, boardLink, body, evidenceDir, d
     inFlight.set(scopeKey, { promise });
     return promise;
 }
-// Returns a promise that rejects with a FIGMA_BUILD_TIMEOUT error after `ms` milliseconds.
-function deadlineRejection(ms) {
-    return new Promise((_resolve, reject) => {
-        setTimeout(() => {
+function makeDeadline(ms) {
+    let timerId;
+    const promise = new Promise((_resolve, reject) => {
+        timerId = setTimeout(() => {
             reject(new FigmaConnectorError("FIGMA_BUILD_TIMEOUT"));
         }, ms);
+        timerId.unref();
     });
+    return {
+        promise,
+        clear: () => {
+            clearTimeout(timerId);
+        },
+    };
 }
 // ─── POST /api/figma/snapshots ─────────────────────────────────────────────────
 export async function handleFigmaTriggerSnapshot(ctx, deps, inFlight = defaultInFlightMap) {
@@ -414,7 +519,7 @@ export async function handleFigmaTriggerSnapshot(ctx, deps, inFlight = defaultIn
     if ("status" in bodyResult)
         return bodyResult;
     const body = bodyResult;
-    const scopeKey = scopeKeyFor(body.boardLink);
+    const scopeKey = coalescingKeyFor(body.boardLink, body.acknowledgeReadOnly, body.isResnapshot, body.version);
     if (scopeKey === undefined) {
         // parseTriggerBody already validates the board link; this is a belt-and-suspenders guard.
         return { status: 400, body: figmaErrorBody("FIGMA_BAD_LINK") };
@@ -425,18 +530,26 @@ export async function handleFigmaTriggerSnapshot(ctx, deps, inFlight = defaultIn
         ? existing.promise
         : startCoalescedBuild(scopeKey, inFlight, body.boardLink, body, evidenceDir, deps);
     const deadlineMs = figmaBuildDeadlineMsFromEnv(deps.env);
+    const deadline = makeDeadline(deadlineMs);
     // Per-waiter race: deadline + client-disconnect both resolve this waiter promptly while the
     // coalesced build (and its persist) continues uninterrupted for other waiters.
+    // Named handler so removeListener can target it precisely in the finally block.
+    let onClose;
     const disconnectPromise = new Promise((_resolve, reject) => {
-        ctx.req.once("close", () => {
+        onClose = () => {
             reject(new FigmaConnectorError("FIGMA_BUILD_TIMEOUT"));
-        });
+        };
+        ctx.req.once("close", onClose);
     });
     try {
-        return await Promise.race([buildPromise, deadlineRejection(deadlineMs), disconnectPromise]);
+        return await Promise.race([buildPromise, deadline.promise, disconnectPromise]);
     }
     catch (err) {
-        return figmaErrorResult(err);
+        return figmaErrorResult(err, deps);
+    }
+    finally {
+        deadline.clear();
+        ctx.req.removeListener("close", onClose);
     }
 }
 // ─── DELETE /api/figma/token — revoke the stored PAT (#758 rotation/revocation, #760 audit) ───
@@ -460,7 +573,7 @@ export function handleFigmaRevokeToken(ctx, deps) {
         });
     }
     catch (err) {
-        return figmaErrorResult(err);
+        return figmaErrorResult(err, deps);
     }
     return {
         status: 200,
@@ -483,7 +596,7 @@ export function handleFigmaLoadSnapshot(ctx, deps) {
     const store = createNodeFigmaSnapshotStore(evidenceDir);
     let record;
     try {
-        record = store.load(runId);
+        record = store.loadMetadata(runId);
     }
     catch {
         return { status: 500, body: figmaErrorBody("FIGMA_INTERNAL") };
@@ -491,5 +604,56 @@ export function handleFigmaLoadSnapshot(ctx, deps) {
     if (record === undefined) {
         return { status: 404, body: figmaErrorBody("FIGMA_SNAPSHOT_NOT_FOUND") };
     }
-    return { status: 200, body: recordToSummary(record) };
+    return { status: 200, body: recordToSummary(record, undefined, record.metrics) };
+}
+// ─── GET /api/figma/snapshots/:runId/screens/:screenIndex/image ──────────────
+function parseScreenIndex(raw) {
+    if (raw === undefined || raw.length === 0)
+        return undefined;
+    const parsed = Number(raw);
+    return Number.isInteger(parsed) && parsed >= 0 && String(parsed) === raw ? parsed : undefined;
+}
+function loadSnapshotRecordForImage(evidenceDir, runId) {
+    const store = createNodeFigmaSnapshotStore(evidenceDir);
+    let record;
+    try {
+        record = store.load(runId);
+    }
+    catch {
+        return { status: 500, body: figmaErrorBody("FIGMA_INTERNAL") };
+    }
+    return record === undefined
+        ? { status: 404, body: figmaErrorBody("FIGMA_SCREEN_NOT_FOUND") }
+        : { store, record };
+}
+export function handleFigmaLoadSnapshotImage(ctx, deps) {
+    const evidenceDir = deps.evidenceDir;
+    if (evidenceDir === undefined || evidenceDir.length === 0) {
+        return { status: 503, body: figmaErrorBody("FIGMA_NO_EVIDENCE_DIR") };
+    }
+    const runId = ctx.params.runId ?? "";
+    const screenIndex = parseScreenIndex(ctx.params.screenIndex);
+    if (runId.length === 0 || screenIndex === undefined) {
+        return { status: 404, body: figmaErrorBody("FIGMA_SCREEN_NOT_FOUND") };
+    }
+    const loaded = loadSnapshotRecordForImage(evidenceDir, runId);
+    if ("status" in loaded)
+        return loaded;
+    const screen = loaded.record.screens[screenIndex];
+    if (screen === undefined) {
+        return { status: 404, body: figmaErrorBody("FIGMA_SCREEN_NOT_FOUND") };
+    }
+    try {
+        const image = loaded.store.loadImage(runId, screen.image);
+        ctx.res.statusCode = 200;
+        ctx.res.setHeader("Content-Type", image.mimeType);
+        ctx.res.setHeader("Content-Length", String(image.byteLength));
+        ctx.res.setHeader("Cache-Control", "no-store");
+        ctx.res.setHeader("ETag", `"sha256-${image.sha256}"`);
+        ctx.res.end(image.bytes);
+        return STREAMING;
+    }
+    catch {
+        return { status: 500, body: figmaErrorBody("FIGMA_INTERNAL") };
+    }
 }

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/generationPort.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generationPort.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/generationPort.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,iCAAiC,EAGlC,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIhD,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,SAAgB,IAAI,EAAE,MAAM,CAAC;gBACjB,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAwFD,MAAM,MAAM,kBAAkB,GAC1B,MAAM,GACN;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C,CAAC;AAsHN,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,kBAAkB,GACzB,iCAAiC,CAMnC"}
+{"version":3,"file":"generationPort.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/generationPort.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,iCAAiC,EAGlC,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIhD,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,SAAgB,IAAI,EAAE,MAAM,CAAC;gBACjB,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAmGD,MAAM,MAAM,kBAAkB,GAC1B,MAAM,GACN;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C,CAAC;AAsHN,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,kBAAkB,GACzB,iCAAiC,CAMnC"}

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/generationPort.js

@@ -59,11 +59,22 @@ function scrubEvidenceText(text) {
     }
     return out.replace(/<\/?qi-evidence/giu, "[evidence]");
 }
+// Second line of defence behind the structural fence (Issue #284 AC1: "Untrusted content cannot
+// override system or workflow instructions"). After scrubbing, run the natural-language
+// prompt-injection scanner on each evidence block: a detected imperative ("ignore previous
+// instructions", a `system:` role line, a jailbreak token, …) is NOT silently passed through — the
+// block is tagged with the matched pattern names so the model sees the evidence is suspect (it is
+// already DATA, never instructions, per the system prompt). Non-blocking by design: a requirement
+// that legitimately quotes such a phrase must still produce a run, so detection annotates the block
+// rather than failing the run. The pattern names are corpus slugs (`[a-z-]`), inert in an attribute.
 function buildEvidenceBlocks(evidence) {
     return evidence
         .map((e) => {
         const kind = e.kind.replace(/[^a-z0-9-]/giu, "");
-        return `<qi-evidence index="${String(e.index)}" kind="${kind}">\n${scrubEvidenceText(e.text)}\n</qi-evidence>`;
+        const scrubbed = scrubEvidenceText(e.text);
+        const scan = QualityIntelligenceHardening.scanForPromptInjections(scrubbed);
+        const flagged = scan.safe ? "" : ` flagged="prompt-injection:${scan.injections.join(",")}"`;
+        return `<qi-evidence index="${String(e.index)}" kind="${kind}"${flagged}>\n${scrubbed}\n</qi-evidence>`;
     })
         .join("\n");
 }

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/handoffErrors.d.ts

@@ -1,4 +1,4 @@
-export type QiHandoffErrorCode = "QI_HANDOFF_BAD_REQUEST" | "QI_HANDOFF_UNKNOWN_CHAT_MESSAGE" | "QI_HANDOFF_FORBIDDEN_PAYLOAD" | "QI_HANDOFF_INTERNAL";
+export type QiHandoffErrorCode = "QI_HANDOFF_BAD_REQUEST" | "QI_HANDOFF_PAYLOAD_TOO_LARGE" | "QI_HANDOFF_UNKNOWN_CHAT_MESSAGE" | "QI_HANDOFF_FORBIDDEN_PAYLOAD" | "QI_HANDOFF_INTERNAL";
 export interface QiHandoffErrorBody {
     readonly error: {
         readonly code: QiHandoffErrorCode;

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/handoffErrors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handoffErrors.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/handoffErrors.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,kBAAkB,GAC1B,wBAAwB,GACxB,iCAAiC,GACjC,8BAA8B,GAC9B,qBAAqB,CAAC;AAE1B,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF;AAWD,eAAO,MAAM,kBAAkB,GAAI,MAAM,kBAAkB,KAAG,kBAE5D,CAAC"}
+{"version":3,"file":"handoffErrors.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/handoffErrors.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,kBAAkB,GAC1B,wBAAwB,GACxB,8BAA8B,GAC9B,iCAAiC,GACjC,8BAA8B,GAC9B,qBAAqB,CAAC;AAE1B,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF;AAaD,eAAO,MAAM,kBAAkB,GAAI,MAAM,kBAAkB,KAAG,kBAE5D,CAAC"}

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/handoffErrors.js

@@ -11,6 +11,7 @@
 // concerns. Test parity with the connector error tests is enforced in `__tests__/`.
 const SAFE_MESSAGES = {
     QI_HANDOFF_BAD_REQUEST: "The request body is not a valid Quality Intelligence handoff envelope.",
+    QI_HANDOFF_PAYLOAD_TOO_LARGE: "The Quality Intelligence handoff envelope exceeds the maximum permitted size.",
     QI_HANDOFF_UNKNOWN_CHAT_MESSAGE: "The referenced Conversation Center chat message could not be located.",
     QI_HANDOFF_FORBIDDEN_PAYLOAD: "The handoff envelope contained a forbidden field. Handoff envelopes may not carry chat content, credentials, headers, or URLs.",
     QI_HANDOFF_INTERNAL: "The Quality Intelligence handoff route could not service the request.",

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/handoffRoutes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handoffRoutes.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/handoffRoutes.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AA6RhD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,qBAAqB,GAChC,UAAS,qBAA0B,KAClC,CAAC,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,WAAW,CAAC,CAwCnE,CAAC;AAEF,eAAO,MAAM,eAAe,QA1ClB,YAAY,QAAQ,aAAa,KAAK,OAAO,CAAC,WAAW,CA0Cb,CAAC;AAKvD,eAAO,MAAM,sBAAsB,EAAE,SAAS,eAAe,EAM5D,CAAC"}
+{"version":3,"file":"handoffRoutes.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/handoffRoutes.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAiUhD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,qBAAqB,GAChC,UAAS,qBAA0B,KAClC,CAAC,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,WAAW,CAAC,CAwCnE,CAAC;AAEF,eAAO,MAAM,eAAe,QA1ClB,YAAY,QAAQ,aAAa,KAAK,OAAO,CAAC,WAAW,CA0Cb,CAAC;AAKvD,eAAO,MAAM,sBAAsB,EAAE,SAAS,eAAe,EAM5D,CAAC"}

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/handoffRoutes.js

@@ -108,7 +108,7 @@ const isAllowedAction = (value) => {
 };
 const fail = (code = "QI_HANDOFF_BAD_REQUEST") => ({
     kind: "err",
-    result: errResult(code === "QI_HANDOFF_FORBIDDEN_PAYLOAD" ? 400 : 400, code),
+    result: errResult(400, code),
 });
 const hasOnlyAllowedKeys = (obj, allowed) => {
     for (const key of Object.keys(obj)) {
@@ -213,18 +213,34 @@ const buildHandoffMessage = (resolved, envelope, now, linkedRunId) => ({
     taskType: HANDOFF_TASK_TYPE,
 });
 // For a "design-tests" handoff, start a model-routed QI run in the BACKGROUND from the chat's
-// connected workspace folder. Fire-and-forget: the run registers with the in-flight registry (so it
+// connected workspace context. Fire-and-forget: the run registers with the in-flight registry (so it
 // surfaces in the run list) and persists to evidence on completion; the handoff returns the run id
 // immediately so the Conversation Center can link + poll it. The run goes through the Keiko Model
 // Gateway + Harness like any QI run — this is the governed workflow handoff (Issue #281), not a
 // parallel chat/agent/model path.
-const startHandoffRun = (deps, root) => {
+//
+// Multi-source (Epic #532/#729): a chat may connect more than one folder. The run ingests EVERY
+// connected workspace root so the QI run covers the full context the user connected — not just the
+// first folder. `executeQiRun` already applies the per-run source cap, deny-list guard, and byte
+// budget over the source list.
+//
+// `envelope.payloadRef.sourceEnvelopeIds` are reserved for a future capability that narrows the run
+// to a user-selected SUBSET of the connected context; until that resolver exists the run faithfully
+// ingests the chat's whole connected workspace context, so an empty (or any) id list is honoured by
+// using the connected scopes.
+const startHandoffRun = (deps, roots) => {
     const runId = `qi-run-${randomUUID()}`;
     const registeredAt = new Date().toISOString();
     const controller = qiRunRegistry.register(runId, registeredAt);
     const totals = { candidates: 0, findings: 0, exports: 0 };
     void executeQiRun({
-        request: { sources: [{ kind: "workspace", label: "Conversation Center", path: root }] },
+        request: {
+            sources: roots.map((path) => ({
+                kind: "workspace",
+                label: "Conversation Center",
+                path,
+            })),
+        },
         runId,
         deps,
         registeredAt,
@@ -246,15 +262,31 @@ const startHandoffRun = (deps, root) => {
     });
     return runId;
 };
+// Collect the distinct, non-empty absolute roots of a chat's connected workspace context. Prefers
+// the canonical multi-source `connectedScopes` list (Epic #532); falls back to the legacy singular
+// `connectedScope` for older chats. Non-folder scopes (no `root`) are skipped — the handoff run
+// ingests workspace folders only. Order-preserving exact-string de-duplication.
+const collectConnectedRoots = (chat) => {
+    const scopes = chat?.connectedScopes ?? (chat?.connectedScope !== undefined ? [chat.connectedScope] : []);
+    const roots = [];
+    for (const scope of scopes) {
+        const root = scope.root;
+        if (typeof root === "string" && root.length > 0 && !roots.includes(root)) {
+            roots.push(root);
+        }
+    }
+    return roots;
+};
 // Resolve the run id linked to a handoff: a "design-tests" handoff over a chat with a connected
-// folder starts a background run; otherwise it falls back to any run id the envelope already carried.
+// workspace context starts a background run; otherwise it falls back to any run id the envelope
+// already carried.
 const resolveHandoffRunId = (deps, envelope, chatId) => {
     if (envelope.promptedAction !== "design-tests")
         return envelope.runId;
     const chat = deps.store.findChatById(chatId);
-    const root = chat?.connectedScope?.root;
-    if (root !== undefined && root.length > 0)
-        return startHandoffRun(deps, root);
+    const roots = collectConnectedRoots(chat);
+    if (roots.length > 0)
+        return startHandoffRun(deps, roots);
     return envelope.runId;
 };
 export const createHandleQiHandoff = (options = {}) => {
@@ -266,7 +298,7 @@ export const createHandleQiHandoff = (options = {}) => {
         }
         catch (e) {
             if (e instanceof BodyTooLargeError) {
-                return errResult(413, "QI_HANDOFF_BAD_REQUEST");
+                return errResult(413, "QI_HANDOFF_PAYLOAD_TOO_LARGE");
             }
             return errResult(400, "QI_HANDOFF_BAD_REQUEST");
         }

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/index.d.ts

@@ -11,6 +11,7 @@ export { applyReviewDecision, appendEditAudit, loadRunReviewState, runReviewStat
 export { QI_REVIEW_ROUTE_GROUP, handleQiReview } from "./reviewRoutes.js";
 export { QI_EXPORT_ROUTE_GROUP, handleQiExport } from "./exportRoutes.js";
 export { QI_EDIT_ROUTE_GROUP, handleQiEditCandidate } from "./editRoutes.js";
+export { QI_RETENTION_ROUTE_GROUP, handleQiDeleteRun } from "./retentionRoutes.js";
 export { QI_TRACEABILITY_ROUTE_GROUP, handleQiTraceabilityExport } from "./traceabilityRoutes.js";
 export { QI_RECHECK_ROUTE_GROUP, handleQiReCheck, handleQiRegenerateStale, } from "./reCheckRoutes.js";
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,EAChC,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,mCAAmC,EACnC,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEjE,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtF,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAE1E,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAE1E,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAElG,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,uBAAuB,GACxB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,EAChC,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,mCAAmC,EACnC,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEjE,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtF,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAE1E,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAE1E,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEnF,OAAO,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAElG,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,uBAAuB,GACxB,MAAM,oBAAoB,CAAC"}

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/index.js

@@ -28,6 +28,8 @@ export { QI_REVIEW_ROUTE_GROUP, handleQiReview } from "./reviewRoutes.js";
 export { QI_EXPORT_ROUTE_GROUP, handleQiExport } from "./exportRoutes.js";
 // Issue #726 (Epic #712) — inline-edit route group.
 export { QI_EDIT_ROUTE_GROUP, handleQiEditCandidate } from "./editRoutes.js";
+// Issue #282 follow-up — run-deletion control route group (DELETE /runs/:id, ADR-0023 D8).
+export { QI_RETENTION_ROUTE_GROUP, handleQiDeleteRun } from "./retentionRoutes.js";
 // Issue #740 (Epic #734) — requirement↔test traceability matrix export route group.
 export { QI_TRACEABILITY_ROUTE_GROUP, handleQiTraceabilityExport } from "./traceabilityRoutes.js";
 // Issue #743 (Epic #735) — drift re-check + targeted regeneration route group.

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/judgePort.d.ts

@@ -17,7 +17,9 @@ export declare function scrubCandidateText(text: string): string;
 export declare function buildJudgePrompt(candidateText: string, sourceContext?: readonly JudgeSourceContext[]): readonly ChatMessage[];
 export declare function parseJudgeVerdict(rawText: string): TestQualityJudgeVerdict;
 export interface QiJudgePort {
-    readonly judge: (input: JudgePromptInput, signal?: AbortSignal) => Promise<TestQualityJudgeVerdict>;
+    readonly judge: (input: JudgePromptInput, signal?: AbortSignal) => Promise<TestQualityJudgeVerdict & {
+        readonly gatewayCallCount: number;
+    }>;
 }
 /**
  * Build a judge port bound to one model id. Applies the qi:judge-logic capability gate

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/judgePort.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"judgePort.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/judgePort.ts"],"names":[],"mappings":"AAUA,OAAO,EAKL,KAAK,WAAW,EAGjB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAEV,uBAAuB,EAExB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAgB,IAAI,EAAE,MAAM,CAAC;gBACjB,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAQD,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,gBAAgB;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACvD;AAgCD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASvD;AA8CD,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,EACrB,aAAa,GAAE,SAAS,kBAAkB,EAAO,GAChD,SAAS,WAAW,EAAE,CAoBxB;AAkID,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,CAW1E;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,gBAAgB,EACvB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACvC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,CA6CnF"}
+{"version":3,"file":"judgePort.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/judgePort.ts"],"names":[],"mappings":"AAUA,OAAO,EAKL,KAAK,WAAW,EAGjB,MAAM,mCAAmC,CAAC;AAM3C,OAAO,KAAK,EAEV,uBAAuB,EAExB,MAAM,+BAA+B,CAAC;AAKvC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAgB,IAAI,EAAE,MAAM,CAAC;gBACjB,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAQD,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,gBAAgB;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACvD;AAgCD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASvD;AAyBD,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,EACrB,aAAa,GAAE,SAAS,kBAAkB,EAAO,GAChD,SAAS,WAAW,EAAE,CAqBxB;AAkKD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,CAW1E;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,gBAAgB,EACvB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,uBAAuB,GAAG;QAAE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,CAqDnF"}