@oscharko-dev/keiko 0.2.0-beta.5 → 0.2.0-beta.7

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/domain/figma/normalize.js

@@ -19,11 +19,13 @@
 //   link  — the node carries a navigating prototype interaction/reaction (it navigates).
 //   image — the node has an IMAGE-type fill (and is not TEXT).
 //   text  — the node is a TEXT node.
-// `button`/`input` are the one accepted name heuristic: a tiny, word-boundary, case-insensitive
-// match over the conventional design-system role vocabulary. Boards that don't use these words fall
-// back to `container` — no board's specific names are encoded.
+// `button` is also used for activation-style local prototype actions (for example ON_CLICK variable
+// updates) because they are interactive controls even when they do not navigate. `button`/`input`
+// name heuristics remain a tiny, word-boundary, case-insensitive match over conventional
+// design-system role vocabulary. Boards that don't use these words and carry no prototype action
+// fall back to `container` — no board's specific names are encoded.
 import { asNode, nodeId, nodeName, nodeType, readArray, readNumber, readString, } from "./sourceNode.js";
-import { firstSolidPaintHex } from "./color.js";
+import { firstSolidPaintHex, isVisiblePaint } from "./color.js";
 const BUTTON_ROLE = /\b(?:button|btn|cta)\b/iu;
 const INPUT_ROLE = /\b(?:input|field|textfield|textbox)\b/iu;
 const readBoundingBox = (node) => {
@@ -45,22 +47,62 @@ const readImageFills = (node) => {
         const record = asNode(fill);
         if (record === undefined || readString(record.type) !== "IMAGE")
             continue;
+        if (!isVisiblePaint(record))
+            continue;
         const imageRef = readString(record.imageRef);
         if (imageRef !== undefined)
             out.push({ imageRef });
     }
     return out;
 };
+const actionHasNavigationTarget = (action) => {
+    const record = asNode(action);
+    if (record === undefined)
+        return false;
+    if (readString(record.destinationId) !== undefined)
+        return true;
+    const nav = asNode(record.navigation);
+    if (nav !== undefined && readString(nav.destinationId) !== undefined)
+        return true;
+    return readString(record.type) === "URL" && readString(record.url) !== undefined;
+};
+const interactionHasNavigationTarget = (entry) => {
+    const record = asNode(entry);
+    if (record === undefined)
+        return false;
+    if (readArray(record.actions).some(actionHasNavigationTarget))
+        return true;
+    return actionHasNavigationTarget(record.action);
+};
+const interactionHasLocalAction = (entry) => {
+    const record = asNode(entry);
+    if (record === undefined)
+        return false;
+    const trigger = asNode(record.trigger);
+    const triggerType = trigger !== undefined ? readString(trigger.type) : undefined;
+    if (triggerType !== "ON_CLICK" && triggerType !== "ON_PRESS" && triggerType !== "ON_TAP") {
+        return false;
+    }
+    return readArray(record.actions).length > 0 || asNode(record.action) !== undefined;
+};
 const navigates = (node) => {
     const interactions = readArray(node.interactions);
     const reactions = readArray(node.reactions);
-    return interactions.length > 0 || reactions.length > 0;
+    return (interactions.some(interactionHasNavigationTarget) ||
+        reactions.some(interactionHasNavigationTarget));
+};
+const hasActivation = (node) => {
+    const interactions = readArray(node.interactions);
+    const reactions = readArray(node.reactions);
+    return interactions.some(interactionHasLocalAction) || reactions.some(interactionHasLocalAction);
 };
 const classify = (node, imageFills) => {
     if (nodeType(node) === "TEXT")
         return "text";
     if (navigates(node))
         return "link";
+    if (hasActivation(node))
+        return "button";
     if (imageFills.length > 0)
         return "image";
     const name = nodeName(node);
@@ -156,9 +198,15 @@ const readTypography = (node) => {
     const fontFamily = readString(style.fontFamily);
     const fontSize = readNumber(style.fontSize);
     const fontWeight = readNumber(style.fontWeight);
+    const lineHeight = readNumber(style.lineHeightPx);
     if (fontFamily === undefined || fontSize === undefined || fontWeight === undefined)
         return undefined;
-    return { fontFamily, fontSize, fontWeight };
+    return {
+        fontFamily,
+        fontSize,
+        fontWeight,
+        ...(lineHeight !== undefined ? { lineHeight } : {}),
+    };
 };
 // Subtrees deeper than this are truncated to prevent RangeError on malformed chain-like inputs.
 // Same shared constant as prune.ts — see there for the rationale. Must stay in sync with every

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/domain/figma/screenIrTestBaseline.d.ts

@@ -1,10 +1,13 @@
 import type { ScreenIr } from "./irTypes.js";
 export type StructuralTestCategory = "field-presence" | "field-validation" | "control-action" | "screen-render" | "state" | "navigation" | "flow" | "a11y" | "coverage-notice";
+export type StructuralTestOutcome = "pass" | "fail" | "expectation";
 /** One deterministic, per-screen-attributable test item derived from the Screen-IR. */
 export interface StructuralTestItem {
     readonly id: string;
     readonly title: string;
     readonly category: StructuralTestCategory;
+    /** Optional machine-readable result semantics for derived checks. */
+    readonly outcome?: StructuralTestOutcome;
     /** Screen provenance so a generated test is attributable to its origin screen. */
     readonly screenId: string;
     readonly screenName: string;
@@ -17,6 +20,7 @@ export interface ScreenTestBaseline {
     readonly screenName: string;
     readonly items: readonly StructuralTestItem[];
 }
+export declare const MAX_IR_NODES_PER_SCREEN = 20000;
 /**
  * Total, defensive Screen-IR parser for the snapshot's opaque `irJson`. Returns `undefined` for a
  * missing or malformed value (no `root`, malformed node tree) so the caller can skip an unparseable

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/domain/figma/screenIrTestBaseline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"screenIrTestBaseline.d.ts","sourceRoot":"","sources":["../../../src/domain/figma/screenIrTestBaseline.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAuB,QAAQ,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,GAChB,kBAAkB,GAClB,gBAAgB,GAChB,eAAe,GACf,OAAO,GAGP,YAAY,GACZ,MAAM,GAGN,MAAM,GACN,iBAAiB,CAAC;AAEtB,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC/C;AAwKD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAKlE;AA2GD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,QAAQ,EAChB,UAAU,GAAE,SAAS,kBAAkB,EAAO,GAC7C,kBAAkB,CAMpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAWvE"}
+{"version":3,"file":"screenIrTestBaseline.d.ts","sourceRoot":"","sources":["../../../src/domain/figma/screenIrTestBaseline.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAuB,QAAQ,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,GAChB,kBAAkB,GAClB,gBAAgB,GAChB,eAAe,GACf,OAAO,GAGP,YAAY,GACZ,MAAM,GAGN,MAAM,GACN,iBAAiB,CAAC;AAEtB,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC;AAEpE,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC/C;AA2DD,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAsI9C;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAKlE;AA2GD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,QAAQ,EAChB,UAAU,GAAE,SAAS,kBAAkB,EAAO,GAC7C,kBAAkB,CAMpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAWvE"}

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/domain/figma/screenIrTestBaseline.js

@@ -58,16 +58,28 @@ function parseImageFills(value) {
 // Subtrees deeper than this are truncated during parse so a chain-like persisted irJson cannot cause
 // a RangeError. Shared constant — see prune.ts for rationale. Must stay in sync with every walk.
 const MAX_TREE_DEPTH = 512;
+// The total accepted node count for one screen is bounded so a pathologically WIDE persisted irJson
+// (flat siblings, not deep nesting — invisible to MAX_TREE_DEPTH) cannot materialise unbounded
+// memory/time during parse and every derivation that walks the resulting tree. The cap is set well
+// above the per-screen node ceiling the governed Figma pipeline enforces before a snapshot is ever
+// written (the connector rejects oversized scopes/screens upstream), so every real board parses fully
+// and byte-identically; only an out-of-band, oversized irJson (e.g. a direct write into the evidence
+// dir) is truncated. Breadth is bounded the same way depth is — silently, at the read boundary.
+export const MAX_IR_NODES_PER_SCREEN = 20_000;
 // Parse a node's children list, dropping any malformed child rather than failing the whole node.
-// depth tracks how deep we are so the recursion is bounded at MAX_TREE_DEPTH.
-function parseIrChildren(value, depth) {
+// depth bounds recursion at MAX_TREE_DEPTH; budget bounds the total accepted node count — once it is
+// exhausted no further siblings are parsed, so a flat-wide children array degrades to a truncated
+// (still well-formed) subtree rather than an unbounded allocation.
+function parseIrChildren(value, depth, budget) {
     if (depth > MAX_TREE_DEPTH)
         return [];
     if (!Array.isArray(value))
         return [];
     const children = [];
     for (const child of value) {
-        const parsed = parseIrNodeAt(child, depth);
+        if (budget.remaining <= 0)
+            break;
+        const parsed = parseIrNodeAt(child, depth, budget);
         if (parsed !== undefined)
             children.push(parsed);
     }
@@ -137,17 +149,23 @@ function parseIrSizing(value) {
 function parseIrTypography(value) {
     if (!isObject(value))
         return undefined;
-    const { fontFamily, fontSize, fontWeight } = value;
+    const { fontFamily, fontSize, fontWeight, lineHeight } = value;
     if (!isString(fontFamily) || !isFiniteNumber(fontSize) || !isFiniteNumber(fontWeight)) {
         return undefined;
     }
-    return { fontFamily, fontSize, fontWeight };
+    return {
+        fontFamily,
+        fontSize,
+        fontWeight,
+        ...(isFiniteNumber(lineHeight) ? { lineHeight } : {}),
+    };
 }
 // Total, defensive IR-node parser: an opaque serialised node (from the snapshot's `irJson`) is
 // accepted only when its required structural fields are present and well-typed; anything malformed
 // yields `undefined` so a corrupt screen degrades to "no items" rather than crashing the run.
-// depth is passed through parseIrChildren to bound total recursion at MAX_TREE_DEPTH.
-function parseIrNodeAt(value, depth) {
+// depth bounds recursion at MAX_TREE_DEPTH; budget bounds the total accepted node count. A node is
+// counted against the budget only once it is accepted, so malformed nodes are free.
+function parseIrNodeAt(value, depth, budget) {
     if (!isObject(value))
         return undefined;
     const { id, name, type, interactionHint } = value;
@@ -155,6 +173,7 @@ function parseIrNodeAt(value, depth) {
         return undefined;
     if (!isString(interactionHint) || !INTERACTION_HINTS.has(interactionHint))
         return undefined;
+    budget.remaining -= 1;
     return {
         id,
         name,
@@ -162,11 +181,11 @@ function parseIrNodeAt(value, depth) {
         interactionHint: interactionHint,
         ...parseOptionalNodeFields(value),
         imageFills: parseImageFills(value.imageFills),
-        children: parseIrChildren(value.children, depth + 1),
+        children: parseIrChildren(value.children, depth + 1, budget),
     };
 }
 function parseIrNode(value) {
-    return parseIrNodeAt(value, 0);
+    return parseIrNodeAt(value, 0, { remaining: MAX_IR_NODES_PER_SCREEN });
 }
 /**
  * Total, defensive Screen-IR parser for the snapshot's opaque `irJson`. Returns `undefined` for a
@@ -267,7 +286,7 @@ function screenRenderItem(ctx) {
         screenName: ctx.screenName,
         id: itemId(ctx.screenId, "screen-render", ctx.screenId, 0),
         category: "screen-render",
-        title: `Screen "${ctx.screenName}" renders and is reachable`,
+        title: `Screen "${ctx.screenName}" renders correctly`,
     };
 }
 /**

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/domain/figma/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../src/domain/figma/tokens.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAEV,YAAY,EAIb,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA4E7C,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,GAAI,SAAS,SAAS,UAAU,EAAE,KAAG,YAiBpE,CAAC;AA0DF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,OAAO,KAAG,YAQlD,CAAC"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../src/domain/figma/tokens.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAEV,YAAY,EAIb,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAoF7C,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,GAAI,SAAS,SAAS,UAAU,EAAE,KAAG,YAiBpE,CAAC;AA0DF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,OAAO,KAAG,YAQlD,CAAC"}

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/domain/figma/tokens.js

@@ -29,10 +29,16 @@ const collectTypography = (node, out) => {
     const style = asNode(node.style);
     if (style === undefined)
         return;
-    const fontFamily = readString(style.fontFamily) ?? "";
-    const fontSize = readNumber(style.fontSize) ?? 0;
-    const fontWeight = readNumber(style.fontWeight) ?? 0;
-    const lineHeight = readNumber(style.lineHeightPx) ?? 0;
+    const fontFamily = readString(style.fontFamily);
+    const fontSize = readNumber(style.fontSize);
+    const fontWeight = readNumber(style.fontWeight);
+    const lineHeight = readNumber(style.lineHeightPx);
+    if (fontFamily === undefined ||
+        fontSize === undefined ||
+        fontWeight === undefined ||
+        lineHeight === undefined) {
+        return;
+    }
     const id = `typography:${fontFamily}|${String(fontSize)}|${String(fontWeight)}|${String(lineHeight)}`;
     out.set(id, { id, kind: "typography", fontFamily, fontSize, fontWeight, lineHeight });
 };

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/domain/requirementExcerpt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"requirementExcerpt.d.ts","sourceRoot":"","sources":["../../src/domain/requirementExcerpt.ts"],"names":[],"mappings":"AAgBA,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,EAAG,EAAW,CAAC;AAIzD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKjF"}
+{"version":3,"file":"requirementExcerpt.d.ts","sourceRoot":"","sources":["../../src/domain/requirementExcerpt.ts"],"names":[],"mappings":"AA0BA,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,EAAG,EAAW,CAAC;AAIzD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKjF"}

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/domain/requirementExcerpt.js

@@ -6,12 +6,21 @@
 // server-side canonical text so those surfaces become auditor-readable without ever persisting
 // raw source content.
 //
-// Ordering is load-bearing: the FULL text is redacted FIRST, then whitespace-collapsed, then
-// truncated. Truncating before redaction could split a secret across the cut so the remainder no
-// longer matches any redaction pattern (a partial AWS key is still a leak); redacting first makes
-// the truncation operate on already-safe text. Persistence redacts every string leaf again
-// (defense in depth), so a stored excerpt is redacted at least twice.
+// Ordering is load-bearing: unsafe bidi/zero-width/control code points are stripped FIRST, then the
+// FULL text is redacted, then whitespace-collapsed, then truncated.
+//   * Stripping before redaction is a redaction SAFEGUARD, not just cosmetics: a credential
+//     obfuscated by an interstitial zero-width character (e.g. an AWS key with a U+200B inside it)
+//     slips past redact() — whose patterns match contiguous characters — and would survive into the
+//     excerpt. Removing the spoofing code points first de-obfuscates the text so redact() sees, and
+//     scrubs, the real secret. It also keeps the audit-ready coverage/traceability surfaces free of
+//     invisible/bidi characters (symmetric with the candidate-text chokepoint normaliseCandidateText).
+//   * Truncating before redaction could split a secret across the cut so the remainder no longer
+//     matches any redaction pattern (a partial AWS key is still a leak); redacting first makes the
+//     truncation operate on already-safe text.
+// Persistence redacts every string leaf again (defense in depth), so a stored excerpt is redacted at
+// least twice; the format-char strip sits upstream of every persisted coverage/finding/export surface.
 import { redact } from "@oscharko-dev/keiko-security";
+import { stripUnsafeFormatChars } from "./assertions.js";
 /** Maximum excerpt length in characters, including the trailing ellipsis. */
 export const REQUIREMENT_EXCERPT_MAX_CHARS = 96;
 const ELLIPSIS = "…";
@@ -21,7 +30,7 @@ const ELLIPSIS = "…";
  * same input always yields the same excerpt (no timestamps, no randomness).
  */
 export function buildRequirementExcerpt(canonicalText) {
-    const collapsed = redact(canonicalText).replace(/\s+/gu, " ").trim();
+    const collapsed = redact(stripUnsafeFormatChars(canonicalText)).replace(/\s+/gu, " ").trim();
     if (collapsed.length === 0)
         return undefined;
     if (collapsed.length <= REQUIREMENT_EXCERPT_MAX_CHARS)

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/domain/staleness.d.ts

@@ -21,6 +21,8 @@ export interface CompareStalenessArgs {
         atomId: string;
         envelopeId: string;
         canonicalHashSha256Hex: string;
+        replacementGroupId?: string;
+        replacementOrdinal?: number;
     }[];
     /** Evidence refs from the manifest (atomId → envelopeId mapping). */
     readonly evidenceRefs: readonly {
@@ -42,6 +44,8 @@ export interface CompareStalenessArgs {
         atomId: string;
         envelopeId: string;
         canonicalHashSha256Hex: string;
+        replacementGroupId?: string;
+        replacementOrdinal?: number;
     }[];
 }
 /**

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/domain/staleness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"staleness.d.ts","sourceRoot":"","sources":["../../src/domain/staleness.ts"],"names":[],"mappings":"AASA,gDAAgD;AAChD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAC;IAClD,QAAQ,CAAC,aAAa,EAAE,SAAS,eAAe,EAAE,CAAC;CACpD;AAED,MAAM,WAAW,oBAAoB;IACnC,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,SAAS;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,sBAAsB,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5F,6FAA6F;IAC7F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS;QACtC,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,sBAAsB,EAAE,MAAM,CAAC;KAChC,EAAE,CAAC;IACJ,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,SAAS;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACzE,8BAA8B;IAC9B,QAAQ,CAAC,UAAU,EAAE,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IACtF,oEAAoE;IACpE,QAAQ,CAAC,mBAAmB,EAAE,SAAS;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,sBAAsB,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAChG,wFAAwF;IACxF,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS;QAC1C,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,sBAAsB,EAAE,MAAM,CAAC;KAChC,EAAE,CAAC;CACL;AAsLD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,eAAe,CA0B5E"}
+{"version":3,"file":"staleness.d.ts","sourceRoot":"","sources":["../../src/domain/staleness.ts"],"names":[],"mappings":"AASA,gDAAgD;AAChD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAC;IAClD,QAAQ,CAAC,aAAa,EAAE,SAAS,eAAe,EAAE,CAAC;CACpD;AAED,MAAM,WAAW,oBAAoB;IACnC,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,SAAS;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,sBAAsB,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5F,6FAA6F;IAC7F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS;QACtC,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,EAAE,CAAC;IACJ,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,SAAS;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACzE,8BAA8B;IAC9B,QAAQ,CAAC,UAAU,EAAE,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IACtF,oEAAoE;IACpE,QAAQ,CAAC,mBAAmB,EAAE,SAAS;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,sBAAsB,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAChG,wFAAwF;IACxF,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS;QAC1C,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,EAAE,CAAC;CACL;AAoaD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,eAAe,CAgC5E"}

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/domain/staleness.js

@@ -36,6 +36,9 @@ function envelopeOrderOf(evidenceRefs) {
 }
 const UNKNOWN_ENVELOPE = "unknown";
 const REQUIREMENTS_ENVELOPE_PREFIX = "qi-src-req-";
+const ALIGN_INSERT_DELETE_COST = 3;
+const ALIGN_SUBSTITUTE_COST = 4;
+const ALIGN_CROSS_OLD_ATOM_COST = 10;
 const staleReason = (candidateId, reason, envelopeId) => ({ candidateId, reason, envelopeId });
 function buildAtomFingerprintMap(fingerprints) {
     const map = new Map();
@@ -43,17 +46,166 @@ function buildAtomFingerprintMap(fingerprints) {
         map.set(fp.atomId, {
             envelopeId: fp.envelopeId,
             canonicalHashSha256Hex: fp.canonicalHashSha256Hex,
+            ...(fp.replacementGroupId !== undefined ? { replacementGroupId: fp.replacementGroupId } : {}),
+            ...(fp.replacementOrdinal !== undefined ? { replacementOrdinal: fp.replacementOrdinal } : {}),
         });
     }
     return map;
 }
-function classifyMissingCurrentAtom(candidateId, envelopeId, ctx) {
+function replacementEntriesByGroup(fingerprints) {
+    const groups = new Map();
+    for (const fp of fingerprints ?? []) {
+        if (fp.replacementGroupId === undefined || fp.replacementOrdinal === undefined)
+            continue;
+        const entry = {
+            atomId: fp.atomId,
+            canonicalHashSha256Hex: fp.canonicalHashSha256Hex,
+            replacementGroupId: fp.replacementGroupId,
+            replacementOrdinal: fp.replacementOrdinal,
+        };
+        const group = groups.get(fp.replacementGroupId);
+        if (group === undefined) {
+            groups.set(fp.replacementGroupId, [entry]);
+        }
+        else {
+            group.push(entry);
+        }
+    }
+    for (const group of groups.values()) {
+        group.sort((a, b) => a.replacementOrdinal - b.replacementOrdinal);
+    }
+    return groups;
+}
+function alignmentPairCost(oldEntry, currentEntry, oldAtomIds) {
+    if (oldEntry.atomId === currentEntry.atomId)
+        return 0;
+    if (currentEntry.canonicalHashSha256Hex === oldEntry.canonicalHashSha256Hex)
+        return 0;
+    return oldAtomIds.has(currentEntry.atomId) ? ALIGN_CROSS_OLD_ATOM_COST : ALIGN_SUBSTITUTE_COST;
+}
+function replacementEntryAt(entries, index) {
+    const entry = entries[index];
+    if (entry === undefined)
+        throw new Error("Replacement alignment index out of bounds.");
+    return entry;
+}
+function matrixValue(matrix, row, col) {
+    const value = matrix[row]?.[col];
+    if (value === undefined)
+        throw new Error("Replacement alignment matrix index out of bounds.");
+    return value;
+}
+function setMatrixValue(matrix, row, col, value) {
+    const rowValues = matrix[row];
+    if (rowValues === undefined) {
+        throw new Error("Replacement alignment matrix index out of bounds.");
+    }
+    rowValues[col] = value;
+}
+function buildAlignmentCostMatrix(oldEntries, currentEntries, oldAtomIds) {
+    const matrix = Array.from({ length: oldEntries.length + 1 }, () => Array.from({ length: currentEntries.length + 1 }, () => 0));
+    for (let oldIndex = 1; oldIndex <= oldEntries.length; oldIndex += 1) {
+        setMatrixValue(matrix, oldIndex, 0, oldIndex * ALIGN_INSERT_DELETE_COST);
+    }
+    for (let currentIndex = 1; currentIndex <= currentEntries.length; currentIndex += 1) {
+        setMatrixValue(matrix, 0, currentIndex, currentIndex * ALIGN_INSERT_DELETE_COST);
+    }
+    for (let oldIndex = 1; oldIndex <= oldEntries.length; oldIndex += 1) {
+        for (let currentIndex = 1; currentIndex <= currentEntries.length; currentIndex += 1) {
+            const pairCost = alignmentPairCost(replacementEntryAt(oldEntries, oldIndex - 1), replacementEntryAt(currentEntries, currentIndex - 1), oldAtomIds);
+            const pair = matrixValue(matrix, oldIndex - 1, currentIndex - 1) + pairCost;
+            const deletion = matrixValue(matrix, oldIndex - 1, currentIndex) + ALIGN_INSERT_DELETE_COST;
+            const insertion = matrixValue(matrix, oldIndex, currentIndex - 1) + ALIGN_INSERT_DELETE_COST;
+            setMatrixValue(matrix, oldIndex, currentIndex, Math.min(pair, deletion, insertion));
+        }
+    }
+    return matrix;
+}
+function alignReplacementEntries(oldEntries, currentEntries) {
+    const mapping = new Map();
+    const oldAtomIds = new Set(oldEntries.map((entry) => entry.atomId));
+    const costs = buildAlignmentCostMatrix(oldEntries, currentEntries, oldAtomIds);
+    let oldIndex = oldEntries.length;
+    let currentIndex = currentEntries.length;
+    while (oldIndex > 0 && currentIndex > 0) {
+        const oldEntry = replacementEntryAt(oldEntries, oldIndex - 1);
+        const currentEntry = replacementEntryAt(currentEntries, currentIndex - 1);
+        const pairCost = alignmentPairCost(oldEntry, currentEntry, oldAtomIds);
+        const currentCost = matrixValue(costs, oldIndex, currentIndex);
+        const pair = matrixValue(costs, oldIndex - 1, currentIndex - 1) + pairCost;
+        const deletion = matrixValue(costs, oldIndex - 1, currentIndex) + ALIGN_INSERT_DELETE_COST;
+        const insertion = matrixValue(costs, oldIndex, currentIndex - 1) + ALIGN_INSERT_DELETE_COST;
+        if (pairCost === 0 && currentCost === pair) {
+            mapping.set(oldEntry.atomId, currentEntry.atomId);
+            oldIndex -= 1;
+            currentIndex -= 1;
+        }
+        else if (currentCost === insertion) {
+            currentIndex -= 1;
+        }
+        else if (currentCost === deletion) {
+            oldIndex -= 1;
+        }
+        else {
+            mapping.set(oldEntry.atomId, currentEntry.atomId);
+            oldIndex -= 1;
+            currentIndex -= 1;
+        }
+    }
+    return mapping;
+}
+function buildReplacementAtomMap(oldFingerprints, currentFingerprints) {
+    const oldGroups = replacementEntriesByGroup(oldFingerprints);
+    const currentGroups = replacementEntriesByGroup(currentFingerprints);
+    const mapping = new Map();
+    for (const [groupId, oldEntries] of oldGroups) {
+        const currentEntries = currentGroups.get(groupId);
+        if (currentEntries === undefined)
+            continue;
+        for (const [oldAtomId, currentAtomId] of alignReplacementEntries(oldEntries, currentEntries)) {
+            mapping.set(oldAtomId, currentAtomId);
+        }
+    }
+    return mapping;
+}
+function buildAtomIdsByEnvelope(fingerprints) {
+    const map = new Map();
+    for (const fp of fingerprints ?? []) {
+        const current = map.get(fp.envelopeId);
+        if (current === undefined) {
+            map.set(fp.envelopeId, [fp.atomId]);
+        }
+        else {
+            current.push(fp.atomId);
+        }
+    }
+    return map;
+}
+function replacementAtomIdForMissingCurrentAtom(atomId, ctx) {
+    return ctx.currentReplacementAtomIdsByOldAtomId.get(atomId);
+}
+function positionalRequirementReplacementAtomId(atomId, envelopeId, ctx) {
+    const oldAtomIds = ctx.oldAtomIdsByEnvelope.get(envelopeId) ?? [];
+    const currentAtomIds = ctx.currentAtomIdsByEnvelope.get(envelopeId) ?? [];
+    const oldIndex = oldAtomIds.indexOf(atomId);
+    return oldIndex >= 0 ? currentAtomIds[oldIndex] : undefined;
+}
+function classifyMissingCurrentAtom(candidateId, atomId, envelopeId, ctx) {
     if (!ctx.currentMap.has(envelopeId)) {
         return staleReason(candidateId, "source-removed", envelopeId);
     }
-    return envelopeId.startsWith(REQUIREMENTS_ENVELOPE_PREFIX)
-        ? staleReason(candidateId, "source-changed", envelopeId)
-        : staleReason(candidateId, "source-removed", envelopeId);
+    const replacementAtomId = replacementAtomIdForMissingCurrentAtom(atomId, ctx);
+    if (replacementAtomId !== undefined && !ctx.oldAtoms.has(replacementAtomId)) {
+        return staleReason(candidateId, "source-changed", envelopeId);
+    }
+    if (!envelopeId.startsWith(REQUIREMENTS_ENVELOPE_PREFIX)) {
+        return staleReason(candidateId, "source-removed", envelopeId);
+    }
+    const currentAtomAtSamePosition = positionalRequirementReplacementAtomId(atomId, envelopeId, ctx);
+    if (currentAtomAtSamePosition !== undefined && !ctx.oldAtoms.has(currentAtomAtSamePosition)) {
+        return staleReason(candidateId, "source-changed", envelopeId);
+    }
+    return staleReason(candidateId, "source-removed", envelopeId);
 }
 function classifyCandidateWithAtomFingerprints(candidate, ctx) {
     if (candidate.derivedFromAtomIds.length === 0) {
@@ -72,7 +224,7 @@ function classifyCandidateWithAtomFingerprints(candidate, ctx) {
             }
             continue;
         }
-        const missingCurrentAtomReason = classifyMissingCurrentAtom(candidate.id, oldAtom.envelopeId, ctx);
+        const missingCurrentAtomReason = classifyMissingCurrentAtom(candidate.id, atomId, oldAtom.envelopeId, ctx);
         if (missingCurrentAtomReason.reason === "source-changed") {
             changedEnvelopeId ??= oldAtom.envelopeId;
             continue;
@@ -113,7 +265,8 @@ function classifyEnvelopeLevelCandidate(candidateId, orderedEnvelopeIds, ctx) {
  * an unresolvable atom is treated as changed so an invalid test is never silently kept fresh.
  */
 function classifyCandidate(candidate, ctx) {
-    const hasAtomMetadata = ctx.oldAtoms.size > 0 && candidate.derivedFromAtomIds.every((atomId) => ctx.oldAtoms.has(atomId));
+    const hasAtomMetadata = ctx.oldAtoms.size > 0 &&
+        candidate.derivedFromAtomIds.every((atomId) => ctx.oldAtoms.has(atomId));
     if (hasAtomMetadata) {
         return classifyCandidateWithAtomFingerprints(candidate, ctx);
     }
@@ -137,6 +290,9 @@ export function compareStaleness(args) {
         envelopeOrder: envelopeOrderOf(args.evidenceRefs),
         oldAtoms: buildAtomFingerprintMap(args.oldAtomFingerprints),
         currentAtoms: buildAtomFingerprintMap(args.currentAtomFingerprints),
+        currentReplacementAtomIdsByOldAtomId: buildReplacementAtomMap(args.oldAtomFingerprints, args.currentAtomFingerprints),
+        oldAtomIdsByEnvelope: buildAtomIdsByEnvelope(args.oldAtomFingerprints),
+        currentAtomIdsByEnvelope: buildAtomIdsByEnvelope(args.currentAtomFingerprints),
     };
     const fresh = [];
     const changedStale = [];

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/domain/testDesignModel.d.ts

@@ -7,14 +7,26 @@ export interface DesignTestCaseCandidatesInput {
     readonly atoms: readonly QualityIntelligence.QualityIntelligenceEvidenceAtom[];
     readonly profile?: PolicyProfile;
 }
+/**
+ * Stable provenance discriminator carried by every deterministic-baseline candidate.
+ *
+ * The model-delta builder (`parseGeneratedCandidates`) never emits this tag, so it is a reliable
+ * "this is a generic determinism-floor stub, not a judged model candidate" marker — unlike a null
+ * `qualityVerdict`, which is also null whenever the judge stage is skipped entirely. Render-layer
+ * consumers sort baseline-tagged candidates to the end so judged candidates lead the deliverable;
+ * the persisted manifest order stays `[...baseline, ...delta]` (Issue #763 contract). The tag is
+ * additive and feeds no candidate id (`sha256(v2<atomHash><index>)`), dedup signature, or manifest
+ * hash, so it is determinism-safe.
+ */
+export declare const DETERMINISTIC_BASELINE_PROVENANCE_TAG = "source:deterministic-baseline";
 /**
  * Produce deterministic draft candidates from the intent summary + atoms.
  * Returns the empty array when the atom list is empty. Atoms are first
  * sorted by canonical hash so input ordering does not affect IDs.
  *
  * Candidate IDs are derived as
- * `qi-candidate-<32-hex-of-sha256(v1<runId><atomHash><index>)>`
- * — collision-resistant and round-trip-stable.
+ * `qi-candidate-<32-hex-of-sha256(v2<atomHash><index>)>` — collision-resistant,
+ * run-independent, and round-trip-stable for the same evidence.
  */
 export declare const designTestCaseCandidates: (input: DesignTestCaseCandidatesInput) => readonly QualityIntelligence.QualityIntelligenceTestCaseCandidate[];
 //# sourceMappingURL=testDesignModel.d.ts.map

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/domain/testDesignModel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testDesignModel.d.ts","sourceRoot":"","sources":["../../src/domain/testDesignModel.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAIpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGxD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC,wBAAwB,CAAC;IAC7D,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,mBAAmB,CAAC,+BAA+B,EAAE,CAAC;IAC/E,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;CAClC;AA6GD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GACnC,OAAO,6BAA6B,KACnC,SAAS,mBAAmB,CAAC,oCAAoC,EAoCnE,CAAC"}
+{"version":3,"file":"testDesignModel.d.ts","sourceRoot":"","sources":["../../src/domain/testDesignModel.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAIpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGxD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC,wBAAwB,CAAC;IAC7D,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,mBAAmB,CAAC,+BAA+B,EAAE,CAAC;IAC/E,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;CAClC;AAoFD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qCAAqC,kCAAkC,CAAC;AAwDrF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GACnC,OAAO,6BAA6B,KACnC,SAAS,mBAAmB,CAAC,oCAAoC,EAoCnE,CAAC"}