@axlsdk/studio 0.13.8 → 0.15.0

package/dist/middleware.cjs

@@ -43,16 +43,161 @@ var import_ws = require("ws");
 // src/server/index.ts
 var import_node_fs = require("fs");
 var import_node_path = require("path");
-var import_hono12 = require("hono");
+var import_hono15 = require("hono");
 var import_cors = require("hono/cors");
 var import_serve_static = require("@hono/node-server/serve-static");
 
+// src/server/redact.ts
+var REDACTED = "[redacted]";
+var SAFE_ERROR_NAMES = /* @__PURE__ */ new Set([
+  "QuorumNotMet",
+  "NoConsensus",
+  "TimeoutError",
+  "MaxTurnsError",
+  "BudgetExceededError",
+  "ToolDenied"
+]);
+function redactErrorMessage(err, redact) {
+  const raw = err instanceof Error ? err.message : String(err);
+  if (!redact) return raw;
+  const name = err instanceof Error ? err.name : "";
+  return SAFE_ERROR_NAMES.has(name) ? raw : REDACTED;
+}
+function redactValue(value, redact) {
+  if (!redact) return value;
+  return REDACTED;
+}
+function redactExecutionInfo(info, redact) {
+  if (!redact) return info;
+  return {
+    ...info,
+    ...info.result !== void 0 ? { result: REDACTED } : {},
+    ...info.error !== void 0 ? { error: REDACTED } : {}
+  };
+}
+function redactExecutionList(infos, redact) {
+  if (!redact) return infos;
+  return infos.map((info) => redactExecutionInfo(info, redact));
+}
+function redactMemoryValue(value, redact) {
+  if (!redact) return value;
+  return REDACTED;
+}
+function redactMemoryList(entries, redact) {
+  if (!redact) return entries;
+  return entries.map((entry) => ({ key: entry.key, value: REDACTED }));
+}
+function redactChatMessage(msg) {
+  const scrubbed = {
+    role: msg.role,
+    content: REDACTED,
+    ...msg.name !== void 0 ? { name: msg.name } : {},
+    ...msg.tool_call_id !== void 0 ? { tool_call_id: msg.tool_call_id } : {},
+    ...msg.tool_calls !== void 0 ? {
+      tool_calls: msg.tool_calls.map((tc) => ({
+        id: tc.id,
+        type: tc.type,
+        function: {
+          name: tc.function.name,
+          arguments: REDACTED
+        }
+      }))
+    } : {}
+    // providerMetadata deliberately omitted — opaque content.
+  };
+  return scrubbed;
+}
+function redactSessionHistory(history, redact) {
+  if (!redact) return history;
+  return history.map(redactChatMessage);
+}
+function redactStreamEvent(event, redact) {
+  if (!redact) return event;
+  switch (event.type) {
+    case "token":
+      return { type: "token", data: REDACTED };
+    case "tool_call":
+      return { ...event, args: REDACTED };
+    case "tool_result":
+      return { ...event, result: REDACTED };
+    case "tool_approval":
+      return {
+        ...event,
+        args: REDACTED,
+        ...event.reason !== void 0 ? { reason: REDACTED } : {}
+      };
+    case "done":
+      return { type: "done", data: REDACTED };
+    case "error":
+      return { type: "error", message: REDACTED };
+    // Structural events have no user content to scrub.
+    case "agent_start":
+    case "agent_end":
+    case "handoff":
+    case "step":
+      return event;
+  }
+}
+function redactEvalItem(item) {
+  const scrubbed = {
+    ...item,
+    input: REDACTED,
+    output: REDACTED,
+    ...item.annotations !== void 0 ? { annotations: REDACTED } : {},
+    ...item.error !== void 0 ? { error: REDACTED } : {},
+    ...item.scorerErrors !== void 0 ? { scorerErrors: item.scorerErrors.map(() => REDACTED) } : {}
+  };
+  if (item.scoreDetails) {
+    const detailsOut = {};
+    for (const [name, detail] of Object.entries(item.scoreDetails)) {
+      detailsOut[name] = {
+        score: detail.score,
+        ...detail.duration !== void 0 ? { duration: detail.duration } : {},
+        ...detail.cost !== void 0 ? { cost: detail.cost } : {}
+        // metadata deliberately omitted — may contain LLM scorer reasoning
+      };
+    }
+    scrubbed.scoreDetails = detailsOut;
+  }
+  return scrubbed;
+}
+function redactEvalResult(result, redact) {
+  if (!redact) return result;
+  return {
+    ...result,
+    items: result.items.map(redactEvalItem)
+  };
+}
+function redactEvalHistoryEntry(entry, redact) {
+  if (!redact) return entry;
+  return {
+    ...entry,
+    data: redactEvalResult(entry.data, redact)
+  };
+}
+function redactEvalHistoryList(entries, redact) {
+  if (!redact) return entries;
+  return entries.map((e) => redactEvalHistoryEntry(e, redact));
+}
+function redactPendingDecision(decision, redact) {
+  if (!redact) return decision;
+  return {
+    ...decision,
+    prompt: REDACTED,
+    ...decision.metadata !== void 0 ? { metadata: { redacted: true } } : {}
+  };
+}
+function redactPendingDecisionList(decisions, redact) {
+  if (!redact) return decisions;
+  return decisions.map((d) => redactPendingDecision(d, redact));
+}
+
 // src/server/middleware/error-handler.ts
 async function errorHandler(c, next) {
   try {
     await next();
   } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
+    const rawMessage = err instanceof Error ? err.message : String(err);
     const code = err.code ?? "INTERNAL_ERROR";
     let status = 500;
     if ("status" in err) {
@@ -60,46 +205,81 @@ async function errorHandler(c, next) {
       if (typeof errStatus === "number" && errStatus >= 400 && errStatus < 600) {
         status = errStatus;
       }
-    } else if (code === "NOT_FOUND" || message.includes("not found") || message.includes("not registered")) {
+    } else if (code === "NOT_FOUND" || rawMessage.includes("not found") || rawMessage.includes("not registered")) {
       status = 404;
-    } else if (code === "VALIDATION_ERROR" || message.includes("Expected") || message.includes("invalid")) {
+    } else if (code === "VALIDATION_ERROR" || rawMessage.includes("Expected") || rawMessage.includes("invalid")) {
       status = 400;
     }
+    const runtime = c.get("runtime");
+    const redactOn = runtime?.isRedactEnabled?.() ?? false;
     const body = {
       ok: false,
-      error: { code, message }
+      error: { code, message: redactErrorMessage(err, redactOn) }
     };
     return c.json(body, status);
   }
 }
 
 // src/server/ws/connection-manager.ts
-function isBufferedChannel(channel) {
-  return channel.startsWith("execution:");
-}
 var BUFFER_TTL_MS = 3e4;
 var MAX_BUFFER_EVENTS = 500;
+var MAX_WS_FRAME_BYTES = 65536;
+function isBufferedChannel(channel) {
+  return channel.startsWith("execution:") || channel.startsWith("eval:");
+}
+function truncateIfOversized(msg, channel, data) {
+  if (msg.length <= MAX_WS_FRAME_BYTES) return msg;
+  const event = data ?? {};
+  const truncated = {
+    type: "event",
+    channel,
+    data: {
+      ...event,
+      data: {
+        __truncated: true,
+        originalBytes: msg.length,
+        maxBytes: MAX_WS_FRAME_BYTES,
+        hint: "Event exceeded WS frame budget (likely a verbose agent_call with a large messages[] snapshot). Fetch via REST if you need the full payload."
+      }
+    }
+  };
+  return JSON.stringify(truncated);
+}
 var ConnectionManager = class {
   /** channel -> set of WS connections */
   channels = /* @__PURE__ */ new Map();
-  /** ws -> set of subscribed channels (for cleanup) */
+  /** ws -> subscribed channels + optional integrator-supplied metadata */
   connections = /* @__PURE__ */ new Map();
   /** channel -> replay buffer for execution streams */
   buffers = /* @__PURE__ */ new Map();
   maxConnections = 100;
+  filter;
+  /**
+   * Register a broadcast filter. Called once at middleware construction.
+   * The filter runs on every outbound event and can drop or deliver based
+   * on the destination connection's metadata.
+   */
+  setFilter(filter) {
+    this.filter = filter;
+  }
+  /** Attach integrator-supplied metadata to an already-added connection. */
+  setMetadata(ws, metadata) {
+    const entry = this.connections.get(ws);
+    if (entry) entry.metadata = metadata;
+  }
   /** Register a new WS connection. */
   add(ws) {
     if (this.connections.size >= this.maxConnections) {
       ws.close?.();
       return;
     }
-    this.connections.set(ws, /* @__PURE__ */ new Set());
+    this.connections.set(ws, { channels: /* @__PURE__ */ new Set() });
   }
   /** Remove a WS connection and all its subscriptions. */
   remove(ws) {
-    const channels = this.connections.get(ws);
-    if (channels) {
-      for (const ch of channels) {
+    const entry = this.connections.get(ws);
+    if (entry) {
+      for (const ch of entry.channels) {
         this.channels.get(ch)?.delete(ws);
         if (this.channels.get(ch)?.size === 0) {
           this.channels.delete(ch);
@@ -117,12 +297,20 @@ var ConnectionManager = class {
       this.channels.set(channel, subs);
     }
     subs.add(ws);
-    this.connections.get(ws).add(channel);
+    this.connections.get(ws).channels.add(channel);
     const buffer = this.buffers.get(channel);
     if (buffer) {
-      for (const msg of buffer.events) {
+      const metadata = this.connections.get(ws)?.metadata;
+      for (const event of buffer.events) {
+        if (this.filter) {
+          try {
+            if (!this.filter(event.data, metadata)) continue;
+          } catch {
+            continue;
+          }
+        }
         try {
-          ws.send(msg);
+          ws.send(event.msg);
         } catch {
           this.remove(ws);
           return;
@@ -136,11 +324,15 @@ var ConnectionManager = class {
     if (this.channels.get(channel)?.size === 0) {
       this.channels.delete(channel);
     }
-    this.connections.get(ws)?.delete(channel);
+    this.connections.get(ws)?.channels.delete(channel);
   }
   /** Broadcast data to all subscribers of a channel. Buffers events for execution channels. */
   broadcast(channel, data) {
-    const msg = JSON.stringify({ type: "event", channel, data });
+    const msg = truncateIfOversized(
+      JSON.stringify({ type: "event", channel, data }),
+      channel,
+      data
+    );
     if (isBufferedChannel(channel)) {
       let buffer = this.buffers.get(channel);
       if (!buffer) {
@@ -150,7 +342,7 @@ var ConnectionManager = class {
       const event = data;
       const isTerminal = event.type === "done" || event.type === "error";
       if (buffer.events.length < MAX_BUFFER_EVENTS || isTerminal) {
-        buffer.events.push(msg);
+        buffer.events.push({ msg, data });
       }
       if (isTerminal) {
         buffer.complete = true;
@@ -163,6 +355,14 @@ var ConnectionManager = class {
     const subs = this.channels.get(channel);
     if (!subs || subs.size === 0) return;
     for (const ws of [...subs]) {
+      if (this.filter) {
+        const metadata = this.connections.get(ws)?.metadata;
+        try {
+          if (!this.filter(data, metadata)) continue;
+        } catch {
+          continue;
+        }
+      }
       try {
         ws.send(msg);
       } catch {
@@ -178,8 +378,20 @@ var ConnectionManager = class {
       const wildcardChannel = channel.substring(0, colonIdx) + ":*";
       const subs = this.channels.get(wildcardChannel);
       if (!subs || subs.size === 0) return;
-      const msg = JSON.stringify({ type: "event", channel, data });
+      const msg = truncateIfOversized(
+        JSON.stringify({ type: "event", channel, data }),
+        channel,
+        data
+      );
       for (const ws of [...subs]) {
+        if (this.filter) {
+          const metadata = this.connections.get(ws)?.metadata;
+          try {
+            if (!this.filter(data, metadata)) continue;
+          } catch {
+            continue;
+          }
+        }
         try {
           ws.send(msg);
         } catch {
@@ -211,11 +423,11 @@ var ConnectionManager = class {
 };
 
 // src/server/ws/protocol.ts
-var VALID_CHANNEL_PREFIXES = ["execution:", "trace:"];
-var VALID_EXACT_CHANNELS = ["costs", "decisions"];
+var VALID_CHANNEL_PREFIXES = ["execution:", "trace:", "eval:"];
+var VALID_EXACT_CHANNELS = ["costs", "decisions", "eval-trends", "workflow-stats", "trace-stats"];
 var MAX_CHANNEL_LENGTH = 256;
 function handleWsMessage(raw, socket, connMgr) {
-  if (raw.length > 65536) {
+  if (raw.length > MAX_WS_FRAME_BYTES) {
     return JSON.stringify({ type: "error", message: "Message too large" });
   }
   let msg;
@@ -275,92 +487,609 @@ function createWsHandlers(connMgr) {
   };
 }
 
-// src/server/cost-aggregator.ts
-var CostAggregator = class {
-  constructor(connMgr) {
+// src/server/aggregates/aggregate-snapshots.ts
+var WINDOW_MS = {
+  "24h": 24 * 60 * 60 * 1e3,
+  "7d": 7 * 24 * 60 * 60 * 1e3,
+  "30d": 30 * 24 * 60 * 60 * 1e3,
+  all: Number.POSITIVE_INFINITY
+};
+function withinWindow(ts, window, now) {
+  return ts >= now - WINDOW_MS[window];
+}
+var REBUILD_INTERVAL_MS = 5 * 6e4;
+var ALL_WINDOWS = new Set(Object.keys(WINDOW_MS));
+function parseWindowParam(raw, fallback = "7d") {
+  return raw && ALL_WINDOWS.has(raw) ? raw : fallback;
+}
+var AggregateSnapshots = class {
+  constructor(windows, emptyState, connMgr, channel, broadcastTransform) {
+    this.windows = windows;
+    this.emptyState = emptyState;
     this.connMgr = connMgr;
+    this.channel = channel;
+    this.broadcastTransform = broadcastTransform;
+    this.snapshots = new Map(windows.map((w) => [w, emptyState()]));
+  }
+  snapshots;
+  /** Replace all snapshots atomically — used after a full rebuild. */
+  replace(fresh) {
+    this.snapshots = fresh;
+    this.broadcast();
+  }
+  /** Apply a reducer update to every window where `ts` falls inside the window. */
+  fold(ts, update) {
+    const now = Date.now();
+    let changed = false;
+    for (const window of this.windows) {
+      if (withinWindow(ts, window, now)) {
+        const prev = this.snapshots.get(window);
+        this.snapshots.set(window, update(prev));
+        changed = true;
+      }
+    }
+    if (changed) this.broadcast();
+  }
+  get(window) {
+    return this.snapshots.get(window) ?? this.emptyState();
+  }
+  getAll() {
+    return Object.fromEntries(this.snapshots);
+  }
+  broadcast() {
+    const snapshots = this.broadcastTransform ? Object.fromEntries(
+      this.windows.map((w) => [w, this.broadcastTransform(this.snapshots.get(w))])
+    ) : this.getAll();
+    this.connMgr.broadcast(this.channel, {
+      snapshots,
+      updatedAt: Date.now()
+    });
+  }
+};
+
+// src/server/aggregates/trace-aggregator.ts
+var TraceAggregator = class {
+  snaps;
+  interval;
+  listener;
+  options;
+  constructor(options) {
+    this.options = options;
+    this.snaps = new AggregateSnapshots(
+      options.windows,
+      options.emptyState,
+      options.connMgr,
+      options.channel,
+      options.broadcastTransform
+    );
+  }
+  async start() {
+    await this.rebuild();
+    this.listener = (event) => {
+      this.snaps.fold(event.timestamp, (prev) => this.options.reducer(prev, event));
+    };
+    this.options.runtime.on("trace", this.listener);
+    this.interval = setInterval(
+      () => this.rebuild().catch((err) => console.error("[axl-studio] rebuild failed:", err)),
+      REBUILD_INTERVAL_MS
+    );
+  }
+  async rebuild() {
+    const executions = await this.options.runtime.getExecutions();
+    const cap = this.options.executionCap ?? 2e3;
+    const capped = executions.slice(0, cap);
+    const now = Date.now();
+    const fresh = new Map(
+      this.options.windows.map((w) => [w, this.options.emptyState()])
+    );
+    for (const exec of capped) {
+      for (const event of exec.steps) {
+        for (const window of this.options.windows) {
+          if (withinWindow(event.timestamp, window, now)) {
+            fresh.set(window, this.options.reducer(fresh.get(window), event));
+          }
+        }
+      }
+    }
+    this.snaps.replace(fresh);
+  }
+  getSnapshot(window) {
+    return this.snaps.get(window);
+  }
+  getAllSnapshots() {
+    return this.snaps.getAll();
+  }
+  close() {
+    if (this.listener) this.options.runtime.off("trace", this.listener);
+    if (this.interval) clearInterval(this.interval);
+  }
+};
+
+// src/server/aggregates/reducers.ts
+var finite = (v) => Number.isFinite(v) ? v : 0;
+function isLogEvent(event, eventName) {
+  if (event.type === eventName) return true;
+  if (event.type === "log" && event.data != null && typeof event.data === "object") {
+    return event.data.event === eventName;
   }
-  data = {
+  return false;
+}
+function emptyRetry() {
+  return {
+    primary: 0,
+    primaryCalls: 0,
+    schema: 0,
+    schemaCalls: 0,
+    validate: 0,
+    validateCalls: 0,
+    guardrail: 0,
+    guardrailCalls: 0,
+    retryCalls: 0
+  };
+}
+function emptyCostData() {
+  return {
     totalCost: 0,
     totalTokens: { input: 0, output: 0, reasoning: 0 },
     byAgent: {},
     byModel: {},
-    byWorkflow: {}
+    byWorkflow: {},
+    retry: emptyRetry(),
+    byEmbedder: {}
   };
-  /** Process a trace event and update cost data. */
-  onTrace(event) {
-    if (event.cost == null && !event.tokens) return;
-    const cost = Number.isFinite(event.cost) ? event.cost : 0;
-    const tokens = event.tokens ?? {};
-    this.data.totalCost += cost;
-    this.data.totalTokens.input += tokens.input ?? 0;
-    this.data.totalTokens.output += tokens.output ?? 0;
-    this.data.totalTokens.reasoning += tokens.reasoning ?? 0;
-    if (event.agent) {
-      const entry = this.data.byAgent[event.agent] ?? { cost: 0, calls: 0 };
-      entry.cost += cost;
-      entry.calls += 1;
-      this.data.byAgent[event.agent] = entry;
-    }
-    if (event.model) {
-      const entry = this.data.byModel[event.model] ?? {
-        cost: 0,
-        calls: 0,
-        tokens: { input: 0, output: 0 }
+}
+function reduceCost(acc, event) {
+  const isWorkflowStart = isLogEvent(event, "workflow_start");
+  if (isWorkflowStart && event.workflow) {
+    const byWorkflow2 = { ...acc.byWorkflow };
+    const prev = byWorkflow2[event.workflow] ?? { cost: 0, executions: 0 };
+    byWorkflow2[event.workflow] = { ...prev, executions: prev.executions + 1 };
+    return { ...acc, byWorkflow: byWorkflow2 };
+  }
+  if (event.cost == null && !event.tokens) return acc;
+  const cost = finite(event.cost);
+  const tokens = event.tokens ?? {};
+  const totalTokens = event.type === "agent_call" ? {
+    input: acc.totalTokens.input + finite(tokens.input),
+    output: acc.totalTokens.output + finite(tokens.output),
+    reasoning: acc.totalTokens.reasoning + finite(tokens.reasoning)
+  } : acc.totalTokens;
+  const byAgent = { ...acc.byAgent };
+  if (event.agent) {
+    const prev = byAgent[event.agent] ?? { cost: 0, calls: 0 };
+    byAgent[event.agent] = { cost: prev.cost + cost, calls: prev.calls + 1 };
+  }
+  const byModel = { ...acc.byModel };
+  if (event.model) {
+    const prev = byModel[event.model] ?? { cost: 0, calls: 0, tokens: { input: 0, output: 0 } };
+    byModel[event.model] = {
+      cost: prev.cost + cost,
+      calls: prev.calls + 1,
+      tokens: {
+        input: prev.tokens.input + finite(tokens.input),
+        output: prev.tokens.output + finite(tokens.output)
+      }
+    };
+  }
+  const byWorkflow = { ...acc.byWorkflow };
+  if (event.workflow) {
+    const prev = byWorkflow[event.workflow] ?? { cost: 0, executions: 0 };
+    byWorkflow[event.workflow] = {
+      cost: prev.cost + cost,
+      executions: prev.executions + (isWorkflowStart ? 1 : 0)
+    };
+  }
+  let retry = acc.retry;
+  if (event.type === "agent_call") {
+    const d = event.data ?? {};
+    const reason = d.retryReason;
+    retry = { ...acc.retry };
+    if (reason === "schema") {
+      retry.schema += cost;
+      retry.schemaCalls += 1;
+      retry.retryCalls += 1;
+    } else if (reason === "validate") {
+      retry.validate += cost;
+      retry.validateCalls += 1;
+      retry.retryCalls += 1;
+    } else if (reason === "guardrail") {
+      retry.guardrail += cost;
+      retry.guardrailCalls += 1;
+      retry.retryCalls += 1;
+    } else {
+      retry.primary += cost;
+      retry.primaryCalls += 1;
+    }
+  }
+  let byEmbedder = acc.byEmbedder;
+  if (event.type === "log") {
+    const d = event.data ?? {};
+    if (d.event === "memory_remember" || d.event === "memory_recall") {
+      byEmbedder = { ...acc.byEmbedder };
+      const modelKey = d.usage?.model ?? "unknown";
+      const embedTokens = typeof d.usage?.tokens === "number" ? finite(d.usage.tokens) : 0;
+      const prev = byEmbedder[modelKey] ?? { cost: 0, calls: 0, tokens: 0 };
+      byEmbedder[modelKey] = {
+        cost: prev.cost + cost,
+        calls: prev.calls + 1,
+        tokens: prev.tokens + embedTokens
       };
-      entry.cost += cost;
-      entry.calls += 1;
-      entry.tokens.input += tokens.input ?? 0;
-      entry.tokens.output += tokens.output ?? 0;
-      this.data.byModel[event.model] = entry;
-    }
-    if (event.workflow) {
-      const entry = this.data.byWorkflow[event.workflow] ?? { cost: 0, executions: 0 };
-      entry.cost += cost;
-      if (event.type === "workflow_start") entry.executions += 1;
-      this.data.byWorkflow[event.workflow] = entry;
-    }
-    this.connMgr.broadcast("costs", this.data);
-  }
-  /** Get current aggregated cost data. */
-  getData() {
-    return this.data;
-  }
-  /** Reset all accumulated data. */
-  reset() {
-    this.data = {
-      totalCost: 0,
-      totalTokens: { input: 0, output: 0, reasoning: 0 },
-      byAgent: {},
-      byModel: {},
-      byWorkflow: {}
+    }
+  }
+  return {
+    totalCost: acc.totalCost + cost,
+    totalTokens,
+    byAgent,
+    byModel,
+    byWorkflow,
+    retry,
+    byEmbedder
+  };
+}
+function emptyEvalTrendData() {
+  return { byEval: {}, totalRuns: 0, totalCost: 0 };
+}
+function extractScores(data) {
+  if (!data || typeof data !== "object") return {};
+  const result = data;
+  const summary = result.summary;
+  const scorers = summary?.scorers;
+  if (!scorers) return {};
+  const out = {};
+  for (const [name, entry] of Object.entries(scorers)) {
+    if (typeof entry === "number" && Number.isFinite(entry)) {
+      out[name] = entry;
+    } else if (entry && typeof entry === "object" && Number.isFinite(entry.mean)) {
+      out[name] = entry.mean;
+    }
+  }
+  return out;
+}
+function extractCost(data) {
+  if (!data || typeof data !== "object") return 0;
+  const result = data;
+  if (Number.isFinite(result.totalCost)) return result.totalCost;
+  const summary = result.summary;
+  return Number.isFinite(summary?.totalCost) ? summary.totalCost : 0;
+}
+function extractModel(data) {
+  if (!data || typeof data !== "object") return void 0;
+  const result = data;
+  const metadata = result.metadata;
+  const counts = metadata?.modelCounts;
+  if (counts && typeof counts === "object" && !Array.isArray(counts)) {
+    const entries = Object.entries(counts).filter(
+      ([, v]) => typeof v === "number"
+    );
+    if (entries.length > 0) {
+      entries.sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]));
+      return entries[0][0];
+    }
+  }
+  const models = metadata?.models;
+  if (Array.isArray(models) && typeof models[0] === "string") return models[0];
+  return void 0;
+}
+function extractDuration(data) {
+  if (!data || typeof data !== "object") return void 0;
+  const result = data;
+  return Number.isFinite(result.duration) ? result.duration : void 0;
+}
+function computeScoreStats(runs) {
+  const scorerNames = /* @__PURE__ */ new Set();
+  for (const run of runs) {
+    for (const name of Object.keys(run.scores)) scorerNames.add(name);
+  }
+  const mean = {};
+  const std = {};
+  for (const name of scorerNames) {
+    const values = runs.map((r) => r.scores[name]).filter((v) => v != null);
+    if (values.length === 0) continue;
+    const m = values.reduce((a, b) => a + b, 0) / values.length;
+    mean[name] = m;
+    const variance = values.reduce((sum, v) => sum + (v - m) ** 2, 0) / values.length;
+    std[name] = Math.sqrt(variance);
+  }
+  return { mean, std };
+}
+function reduceEvalTrends(acc, entry) {
+  const scores = extractScores(entry.data);
+  const cost = extractCost(entry.data);
+  const model = extractModel(entry.data);
+  const duration = extractDuration(entry.data);
+  const run = {
+    timestamp: entry.timestamp,
+    id: entry.id,
+    scores,
+    cost,
+    ...model !== void 0 ? { model } : {},
+    ...duration !== void 0 ? { duration } : {}
+  };
+  const byEval = { ...acc.byEval };
+  const prev = byEval[entry.eval];
+  const MAX_EVAL_RUNS = 50;
+  const allRuns = prev ? [...prev.runs, run] : [run];
+  const runs = allRuns.length > MAX_EVAL_RUNS ? allRuns.slice(-MAX_EVAL_RUNS) : allRuns;
+  const { mean, std } = computeScoreStats(runs);
+  const latestScores = prev && prev.runs.length > 0 && prev.runs[prev.runs.length - 1].timestamp > run.timestamp ? prev.latestScores : scores;
+  byEval[entry.eval] = {
+    runs,
+    latestScores,
+    scoreMean: mean,
+    scoreStd: std,
+    costTotal: (prev?.costTotal ?? 0) + cost,
+    runCount: (prev?.runCount ?? 0) + 1
+  };
+  return {
+    byEval,
+    totalRuns: acc.totalRuns + 1,
+    totalCost: acc.totalCost + cost
+  };
+}
+var MAX_DURATIONS = 200;
+function emptyWorkflowStatsData() {
+  return { byWorkflow: {}, totalExecutions: 0, failureRate: 0 };
+}
+function percentile(sorted, p) {
+  if (sorted.length === 0) return 0;
+  const idx = p / 100 * (sorted.length - 1);
+  const lower = Math.floor(idx);
+  const upper = Math.ceil(idx);
+  if (lower === upper) return sorted[lower];
+  return sorted[lower] + (sorted[upper] - sorted[lower]) * (idx - lower);
+}
+function reduceWorkflowStats(acc, execution) {
+  const byWorkflow = { ...acc.byWorkflow };
+  const prev = byWorkflow[execution.workflow] ?? {
+    total: 0,
+    completed: 0,
+    failed: 0,
+    durations: [],
+    durationSum: 0,
+    avgDuration: 0
+  };
+  const dur = finite(execution.duration);
+  const durations = [...prev.durations];
+  const insertIdx = durations.findIndex((d) => d > dur);
+  if (insertIdx === -1) durations.push(dur);
+  else durations.splice(insertIdx, 0, dur);
+  if (durations.length > MAX_DURATIONS) durations.shift();
+  const total = prev.total + 1;
+  const completed = prev.completed + (execution.status === "completed" ? 1 : 0);
+  const failed = prev.failed + (execution.status === "failed" ? 1 : 0);
+  const durationSum = prev.durationSum + dur;
+  const avgDuration = durationSum / total;
+  byWorkflow[execution.workflow] = {
+    total,
+    completed,
+    failed,
+    durations,
+    durationSum,
+    avgDuration
+  };
+  const totalExecutions = acc.totalExecutions + 1;
+  const totalFailed = Object.values(byWorkflow).reduce((sum, w) => sum + w.failed, 0);
+  const failureRate = totalExecutions > 0 ? totalFailed / totalExecutions : 0;
+  return { byWorkflow, totalExecutions, failureRate };
+}
+function getWorkflowPercentiles(entry) {
+  return {
+    durationP50: percentile(entry.durations, 50),
+    durationP95: percentile(entry.durations, 95)
+  };
+}
+function enrichWorkflowStats(data) {
+  const byWorkflow = {};
+  for (const [name, entry] of Object.entries(data.byWorkflow)) {
+    const { durationP50, durationP95 } = getWorkflowPercentiles(entry);
+    byWorkflow[name] = {
+      total: entry.total,
+      completed: entry.completed,
+      failed: entry.failed,
+      durationP50,
+      durationP95,
+      avgDuration: entry.avgDuration
+    };
+  }
+  return {
+    byWorkflow,
+    totalExecutions: data.totalExecutions,
+    failureRate: data.failureRate
+  };
+}
+function emptyTraceStatsData() {
+  return {
+    eventTypeCounts: {},
+    byTool: {},
+    retryByAgent: {},
+    totalEvents: 0
+  };
+}
+function reduceTraceStats(acc, event) {
+  const eventTypeCounts = { ...acc.eventTypeCounts };
+  eventTypeCounts[event.type] = (eventTypeCounts[event.type] ?? 0) + 1;
+  const byTool = { ...acc.byTool };
+  if (event.type === "tool_call" || event.type === "tool_denied" || event.type === "tool_approval") {
+    const toolName = event.tool;
+    const prev = byTool[toolName] ?? { calls: 0, denied: 0, approved: 0 };
+    const isDeniedEvent = event.type === "tool_denied";
+    const isApprovalEvent = event.type === "tool_approval";
+    const eventData = isDeniedEvent || isApprovalEvent ? event.data : void 0;
+    const isApproved = isDeniedEvent && eventData?.approved === true || isApprovalEvent && eventData?.approved === true;
+    const isDenied = isDeniedEvent && !eventData?.approved || isApprovalEvent && eventData?.approved === false;
+    byTool[toolName] = {
+      calls: prev.calls + (event.type === "tool_call" ? 1 : 0),
+      denied: prev.denied + (isDenied ? 1 : 0),
+      approved: prev.approved + (isApproved ? 1 : 0)
+    };
+  }
+  const retryByAgent = { ...acc.retryByAgent };
+  if (event.agent && event.type === "agent_call") {
+    const data = event.data;
+    if (data?.retryReason) {
+      const prev = retryByAgent[event.agent] ?? { schema: 0, validate: 0, guardrail: 0 };
+      const reason = data.retryReason;
+      if (reason in prev) {
+        retryByAgent[event.agent] = { ...prev, [reason]: prev[reason] + 1 };
+      }
+    }
+  }
+  return {
+    eventTypeCounts,
+    byTool,
+    retryByAgent,
+    totalEvents: acc.totalEvents + 1
+  };
+}
+
+// src/server/aggregates/execution-aggregator.ts
+var ExecutionAggregator = class {
+  snaps;
+  interval;
+  listener;
+  options;
+  /** Generation counter to prevent stale async fold after rebuild. */
+  generation = 0;
+  constructor(options) {
+    this.options = options;
+    this.snaps = new AggregateSnapshots(
+      options.windows,
+      options.emptyState,
+      options.connMgr,
+      options.channel,
+      options.broadcastTransform
+    );
+  }
+  async start() {
+    await this.rebuild();
+    this.listener = (event) => {
+      if (!isLogEvent(event, "workflow_end")) return;
+      const gen = this.generation;
+      this.options.runtime.getExecution(event.executionId).then((exec) => {
+        if (this.generation !== gen) return;
+        if (exec) {
+          this.snaps.fold(exec.startedAt, (prev) => this.options.reducer(prev, exec));
+        }
+      }).catch((err) => console.error("[axl-studio] execution fold failed:", err));
     };
+    this.options.runtime.on("trace", this.listener);
+    this.interval = setInterval(
+      () => this.rebuild().catch((err) => console.error("[axl-studio] rebuild failed:", err)),
+      REBUILD_INTERVAL_MS
+    );
+  }
+  async rebuild() {
+    this.generation++;
+    const executions = await this.options.runtime.getExecutions();
+    const cap = this.options.executionCap ?? 2e3;
+    const capped = executions.slice(0, cap);
+    const now = Date.now();
+    const fresh = new Map(
+      this.options.windows.map((w) => [w, this.options.emptyState()])
+    );
+    for (const exec of capped) {
+      for (const window of this.options.windows) {
+        if (withinWindow(exec.startedAt, window, now)) {
+          fresh.set(window, this.options.reducer(fresh.get(window), exec));
+        }
+      }
+    }
+    this.snaps.replace(fresh);
+  }
+  getSnapshot(window) {
+    return this.snaps.get(window);
+  }
+  getAllSnapshots() {
+    return this.snaps.getAll();
+  }
+  close() {
+    if (this.listener) this.options.runtime.off("trace", this.listener);
+    if (this.interval) clearInterval(this.interval);
+  }
+};
+
+// src/server/aggregates/eval-aggregator.ts
+var EvalAggregator = class {
+  snaps;
+  interval;
+  listener;
+  options;
+  constructor(options) {
+    this.options = options;
+    this.snaps = new AggregateSnapshots(
+      options.windows,
+      options.emptyState,
+      options.connMgr,
+      options.channel,
+      options.broadcastTransform
+    );
+  }
+  async start() {
+    await this.rebuild();
+    this.listener = (entry) => {
+      this.snaps.fold(entry.timestamp, (prev) => this.options.reducer(prev, entry));
+    };
+    this.options.runtime.on("eval_result", this.listener);
+    this.interval = setInterval(
+      () => this.rebuild().catch((err) => console.error("[axl-studio] rebuild failed:", err)),
+      REBUILD_INTERVAL_MS
+    );
+  }
+  async rebuild() {
+    const history = await this.options.runtime.getEvalHistory();
+    const cap = this.options.entryCap ?? 500;
+    const capped = history.slice(0, cap);
+    const now = Date.now();
+    const fresh = new Map(
+      this.options.windows.map((w) => [w, this.options.emptyState()])
+    );
+    for (const entry of capped) {
+      for (const window of this.options.windows) {
+        if (withinWindow(entry.timestamp, window, now)) {
+          fresh.set(window, this.options.reducer(fresh.get(window), entry));
+        }
+      }
+    }
+    this.snaps.replace(fresh);
+  }
+  getSnapshot(window) {
+    return this.snaps.get(window);
+  }
+  getAllSnapshots() {
+    return this.snaps.getAll();
+  }
+  close() {
+    if (this.listener) this.options.runtime.off("eval_result", this.listener);
+    if (this.interval) clearInterval(this.interval);
   }
 };
 
 // src/server/routes/health.ts
 var import_hono = require("hono");
-var app = new import_hono.Hono();
-app.get("/health", (c) => {
-  const runtime = c.get("runtime");
-  return c.json({
-    ok: true,
-    data: {
-      status: "healthy",
-      workflows: runtime.getWorkflowNames().length,
-      agents: runtime.getAgents().length,
-      tools: runtime.getTools().length
-    }
+function createHealthRoutes(readOnly) {
+  const app6 = new import_hono.Hono();
+  app6.get("/health", (c) => {
+    const runtime = c.get("runtime");
+    return c.json({
+      ok: true,
+      data: {
+        status: "healthy",
+        readOnly,
+        workflows: runtime.getWorkflowNames().length,
+        agents: runtime.getAgents().length,
+        tools: runtime.getTools().length
+      }
+    });
   });
-});
-var health_default = app;
+  return app6;
+}
 
 // src/server/routes/workflows.ts
 var import_hono2 = require("hono");
 var import_axl = require("@axlsdk/axl");
 function createWorkflowRoutes(connMgr) {
-  const app7 = new import_hono2.Hono();
-  app7.get("/workflows", (c) => {
+  const app6 = new import_hono2.Hono();
+  app6.get("/workflows", (c) => {
     const runtime = c.get("runtime");
     const workflows = runtime.getWorkflows().map((w) => ({
       name: w.name,
@@ -369,7 +1098,7 @@ function createWorkflowRoutes(connMgr) {
     }));
     return c.json({ ok: true, data: workflows });
   });
-  app7.get("/workflows/:name", (c) => {
+  app6.get("/workflows/:name", (c) => {
     const runtime = c.get("runtime");
     const name = c.req.param("name");
     const workflow = runtime.getWorkflow(name);
@@ -388,7 +1117,7 @@ function createWorkflowRoutes(connMgr) {
       }
     });
   });
-  app7.post("/workflows/:name/execute", async (c) => {
+  app6.post("/workflows/:name/execute", async (c) => {
     const runtime = c.get("runtime");
     const name = c.req.param("name");
     const workflow = runtime.getWorkflow(name);
@@ -402,28 +1131,38 @@ function createWorkflowRoutes(connMgr) {
     if (body.stream) {
       const stream = runtime.stream(name, body.input ?? {}, { metadata: body.metadata });
       const executionId = `stream-${Date.now()}`;
+      const redactOn = runtime.isRedactEnabled();
       (async () => {
         for await (const event of stream) {
-          connMgr.broadcastWithWildcard(`execution:${executionId}`, event);
+          connMgr.broadcastWithWildcard(
+            `execution:${executionId}`,
+            redactStreamEvent(event, redactOn)
+          );
         }
       })();
       return c.json({ ok: true, data: { executionId, streaming: true } });
     }
     const result = await runtime.execute(name, body.input ?? {}, { metadata: body.metadata });
-    return c.json({ ok: true, data: { result } });
+    return c.json({
+      ok: true,
+      data: { result: redactValue(result, runtime.isRedactEnabled()) }
+    });
   });
-  return app7;
+  return app6;
 }
 
 // src/server/routes/executions.ts
 var import_hono3 = require("hono");
-var app2 = new import_hono3.Hono();
-app2.get("/executions", async (c) => {
+var app = new import_hono3.Hono();
+app.get("/executions", async (c) => {
   const runtime = c.get("runtime");
   const executions = await runtime.getExecutions();
-  return c.json({ ok: true, data: executions });
+  return c.json({
+    ok: true,
+    data: redactExecutionList(executions, runtime.isRedactEnabled())
+  });
 });
-app2.get("/executions/:id", async (c) => {
+app.get("/executions/:id", async (c) => {
   const runtime = c.get("runtime");
   const id = c.req.param("id");
   const execution = await runtime.getExecution(id);
@@ -433,21 +1172,24 @@ app2.get("/executions/:id", async (c) => {
       404
     );
   }
-  return c.json({ ok: true, data: execution });
+  return c.json({
+    ok: true,
+    data: redactExecutionInfo(execution, runtime.isRedactEnabled())
+  });
 });
-app2.post("/executions/:id/abort", (c) => {
+app.post("/executions/:id/abort", (c) => {
   const runtime = c.get("runtime");
   const id = c.req.param("id");
   runtime.abort(id);
   return c.json({ ok: true, data: { aborted: true } });
 });
-var executions_default = app2;
+var executions_default = app;
 
 // src/server/routes/sessions.ts
 var import_hono4 = require("hono");
 function createSessionRoutes(connMgr) {
-  const app7 = new import_hono4.Hono();
-  app7.get("/sessions", async (c) => {
+  const app6 = new import_hono4.Hono();
+  app6.get("/sessions", async (c) => {
     const runtime = c.get("runtime");
     const store = runtime.getStateStore();
     if (!store.listSessions) {
@@ -461,15 +1203,24 @@ function createSessionRoutes(connMgr) {
     }
     return c.json({ ok: true, data: sessions });
   });
-  app7.get("/sessions/:id", async (c) => {
+  app6.get("/sessions/:id", async (c) => {
     const runtime = c.get("runtime");
     const store = runtime.getStateStore();
     const id = c.req.param("id");
     const history = await store.getSession(id);
     const handoffHistory = await store.getSessionMeta(id, "handoffHistory");
-    return c.json({ ok: true, data: { id, history, handoffHistory: handoffHistory ?? [] } });
+    return c.json({
+      ok: true,
+      data: {
+        id,
+        history: redactSessionHistory(history, runtime.isRedactEnabled()),
+        // HandoffRecord has no content fields (source/target/mode/
+        // timestamp/duration) — nothing to scrub.
+        handoffHistory: handoffHistory ?? []
+      }
+    });
   });
-  app7.post("/sessions/:id/send", async (c) => {
+  app6.post("/sessions/:id/send", async (c) => {
     const runtime = c.get("runtime");
     const id = c.req.param("id");
     const body = await c.req.json();
@@ -477,7 +1228,7 @@ function createSessionRoutes(connMgr) {
     const result = await session.send(body.workflow, body.message);
     return c.json({ ok: true, data: { result } });
   });
-  app7.post("/sessions/:id/stream", async (c) => {
+  app6.post("/sessions/:id/stream", async (c) => {
     const runtime = c.get("runtime");
     const id = c.req.param("id");
     const body = await c.req.json();
@@ -491,21 +1242,21 @@ function createSessionRoutes(connMgr) {
     })();
     return c.json({ ok: true, data: { executionId, streaming: true } });
   });
-  app7.delete("/sessions/:id", async (c) => {
+  app6.delete("/sessions/:id", async (c) => {
     const runtime = c.get("runtime");
     const store = runtime.getStateStore();
     const id = c.req.param("id");
     await store.deleteSession(id);
     return c.json({ ok: true, data: { deleted: true } });
   });
-  return app7;
+  return app6;
 }
 
 // src/server/routes/agents.ts
 var import_hono5 = require("hono");
 var import_axl2 = require("@axlsdk/axl");
-var app3 = new import_hono5.Hono();
-app3.get("/agents", (c) => {
+var app2 = new import_hono5.Hono();
+app2.get("/agents", (c) => {
   const runtime = c.get("runtime");
   const agents = runtime.getAgents().map((a) => ({
     name: a._name,
@@ -524,7 +1275,7 @@ app3.get("/agents", (c) => {
   }));
   return c.json({ ok: true, data: agents });
 });
-app3.get("/agents/:name", (c) => {
+app2.get("/agents/:name", (c) => {
   const runtime = c.get("runtime");
   const name = c.req.param("name");
   const agent = runtime.getAgent(name);
@@ -580,13 +1331,13 @@ app3.get("/agents/:name", (c) => {
     }
   });
 });
-var agents_default = app3;
+var agents_default = app2;
 
 // src/server/routes/tools.ts
 var import_hono6 = require("hono");
 var import_axl3 = require("@axlsdk/axl");
-var app4 = new import_hono6.Hono();
-app4.get("/tools", (c) => {
+var app3 = new import_hono6.Hono();
+app3.get("/tools", (c) => {
   const runtime = c.get("runtime");
   const tools = runtime.getTools().map((t) => ({
     name: t.name,
@@ -597,7 +1348,7 @@ app4.get("/tools", (c) => {
   }));
   return c.json({ ok: true, data: tools });
 });
-app4.get("/tools/:name", (c) => {
+app3.get("/tools/:name", (c) => {
   const runtime = c.get("runtime");
   const name = c.req.param("name");
   const tool = runtime.getTool(name);
@@ -624,7 +1375,7 @@ app4.get("/tools/:name", (c) => {
     }
   });
 });
-app4.post("/tools/:name/test", async (c) => {
+app3.post("/tools/:name/test", async (c) => {
   const runtime = c.get("runtime");
   const name = c.req.param("name");
   const tool = runtime.getTool(name);
@@ -637,14 +1388,17 @@ app4.post("/tools/:name/test", async (c) => {
   const body = await c.req.json();
   const ctx = runtime.createContext();
   const result = await tool.run(ctx, body.input);
-  return c.json({ ok: true, data: { result } });
+  return c.json({
+    ok: true,
+    data: { result: redactValue(result, runtime.isRedactEnabled()) }
+  });
 });
-var tools_default = app4;
+var tools_default = app3;
 
 // src/server/routes/memory.ts
 var import_hono7 = require("hono");
-var app5 = new import_hono7.Hono();
-app5.get("/memory/:scope", async (c) => {
+var app4 = new import_hono7.Hono();
+app4.get("/memory/:scope", async (c) => {
   const runtime = c.get("runtime");
   const store = runtime.getStateStore();
   const scope = c.req.param("scope");
@@ -652,9 +1406,9 @@ app5.get("/memory/:scope", async (c) => {
     return c.json({ ok: true, data: [] });
   }
   const entries = await store.getAllMemory(scope);
-  return c.json({ ok: true, data: entries });
+  return c.json({ ok: true, data: redactMemoryList(entries, runtime.isRedactEnabled()) });
 });
-app5.get("/memory/:scope/:key", async (c) => {
+app4.get("/memory/:scope/:key", async (c) => {
   const runtime = c.get("runtime");
   const store = runtime.getStateStore();
   const scope = c.req.param("scope");
@@ -672,9 +1426,12 @@ app5.get("/memory/:scope/:key", async (c) => {
       404
     );
   }
-  return c.json({ ok: true, data: { key, value } });
+  return c.json({
+    ok: true,
+    data: { key, value: redactMemoryValue(value, runtime.isRedactEnabled()) }
+  });
 });
-app5.put("/memory/:scope/:key", async (c) => {
+app4.put("/memory/:scope/:key", async (c) => {
   const runtime = c.get("runtime");
   const store = runtime.getStateStore();
   const scope = c.req.param("scope");
@@ -689,7 +1446,7 @@ app5.put("/memory/:scope/:key", async (c) => {
   await store.saveMemory(scope, key, body.value);
   return c.json({ ok: true, data: { saved: true } });
 });
-app5.delete("/memory/:scope/:key", async (c) => {
+app4.delete("/memory/:scope/:key", async (c) => {
   const runtime = c.get("runtime");
   const store = runtime.getStateStore();
   const scope = c.req.param("scope");
@@ -703,64 +1460,100 @@ app5.delete("/memory/:scope/:key", async (c) => {
   await store.deleteMemory(scope, key);
   return c.json({ ok: true, data: { deleted: true } });
 });
-app5.post("/memory/search", async (c) => {
+app4.post("/memory/search", async (c) => {
   return c.json({
     ok: true,
     data: { results: [], message: "Semantic search requires MemoryManager with vector store" }
   });
 });
-var memory_default = app5;
+var memory_default = app4;
 
 // src/server/routes/decisions.ts
 var import_hono8 = require("hono");
-var app6 = new import_hono8.Hono();
-app6.get("/decisions", async (c) => {
+var app5 = new import_hono8.Hono();
+app5.get("/decisions", async (c) => {
   const runtime = c.get("runtime");
   const decisions = await runtime.getPendingDecisions();
-  return c.json({ ok: true, data: decisions });
+  return c.json({
+    ok: true,
+    data: redactPendingDecisionList(decisions, runtime.isRedactEnabled())
+  });
 });
-app6.post("/decisions/:executionId/resolve", async (c) => {
+app5.post("/decisions/:executionId/resolve", async (c) => {
   const runtime = c.get("runtime");
   const executionId = c.req.param("executionId");
   const body = await c.req.json();
   await runtime.resolveDecision(executionId, body);
   return c.json({ ok: true, data: { resolved: true } });
 });
-var decisions_default = app6;
+var decisions_default = app5;
 
 // src/server/routes/costs.ts
 var import_hono9 = require("hono");
 function createCostRoutes(costAggregator) {
-  const app7 = new import_hono9.Hono();
-  app7.get("/costs", (c) => {
-    return c.json({ ok: true, data: costAggregator.getData() });
+  const app6 = new import_hono9.Hono();
+  app6.get("/costs", (c) => {
+    if (c.req.query("windows") === "all") {
+      return c.json({ ok: true, data: costAggregator.getAllSnapshots() });
+    }
+    const window = parseWindowParam(c.req.query("window"));
+    return c.json({ ok: true, data: costAggregator.getSnapshot(window) });
   });
-  app7.post("/costs/reset", (c) => {
-    costAggregator.reset();
-    return c.json({ ok: true, data: { reset: true } });
+  app6.post("/costs/reset", (c) => {
+    return c.json(
+      {
+        ok: false,
+        error: {
+          code: "GONE",
+          message: "POST /api/costs/reset was removed in @axlsdk/studio 0.15. Cost aggregates are now time-windowed and rebuilt from StateStore history. Use GET /api/costs?window=24h|7d|30d|all to narrow the view instead of resetting."
+        }
+      },
+      410
+    );
   });
-  return app7;
+  return app6;
 }
 
 // src/server/routes/evals.ts
+var import_node_crypto = require("crypto");
 var import_hono10 = require("hono");
-function createEvalRoutes(evalLoader) {
-  const app7 = new import_hono10.Hono();
-  app7.get("/evals", async (c) => {
+function createEvalRoutes(connMgr, evalLoader) {
+  const app6 = new import_hono10.Hono();
+  const activeRuns = /* @__PURE__ */ new Map();
+  app6.get("/evals", async (c) => {
     if (evalLoader) await evalLoader();
     const runtime = c.get("runtime");
     const evals = runtime.getRegisteredEvals();
     return c.json({ ok: true, data: evals });
   });
-  app7.get("/evals/history", async (c) => {
+  app6.get("/evals/history", async (c) => {
     const runtime = c.get("runtime");
     const history = await runtime.getEvalHistory();
-    return c.json({ ok: true, data: history });
+    return c.json({
+      ok: true,
+      data: redactEvalHistoryList(history, runtime.isRedactEnabled())
+    });
   });
-  app7.post("/evals/:name/run", async (c) => {
+  app6.delete("/evals/history/:id", async (c) => {
+    const runtime = c.get("runtime");
+    const id = c.req.param("id");
+    const deleted = await runtime.deleteEvalResult(id);
+    if (!deleted) {
+      return c.json(
+        {
+          ok: false,
+          error: { code: "NOT_FOUND", message: `Eval history entry "${id}" not found` }
+        },
+        404
+      );
+    }
+    return c.json({ ok: true, data: { id, deleted: true } });
+  });
+  app6.post("/evals/:name/run", async (c) => {
     if (evalLoader) await evalLoader();
     const runtime = c.get("runtime");
     const name = c.req.param("name");
+    const redactOn = runtime.isRedactEnabled();
     const entry = runtime.getRegisteredEval(name);
     if (!entry) {
       return c.json(
@@ -769,42 +1562,143 @@ function createEvalRoutes(evalLoader) {
       );
     }
     let runs = 1;
+    let stream = false;
+    let captureTraces = false;
     try {
       const body = await c.req.json().catch(() => ({}));
       if (typeof body.runs === "number" && Number.isFinite(body.runs) && body.runs > 1) {
         runs = Math.min(Math.floor(body.runs), 25);
       }
+      if (body.stream === true) {
+        stream = true;
+      }
+      if (body.captureTraces === true) {
+        captureTraces = true;
+      }
     } catch {
     }
+    if (stream) {
+      const evalRunId = `eval-${(0, import_node_crypto.randomUUID)()}`;
+      const ac = new AbortController();
+      activeRuns.set(evalRunId, ac);
+      (async () => {
+        try {
+          if (runs > 1) {
+            const runGroupId = (0, import_node_crypto.randomUUID)();
+            const results = [];
+            for (let r = 0; r < runs; r++) {
+              if (ac.signal.aborted) break;
+              const result = await runtime.runRegisteredEval(name, {
+                metadata: { runGroupId, runIndex: r },
+                signal: ac.signal,
+                captureTraces,
+                onProgress: (event) => {
+                  if (event.type === "run_done") return;
+                  connMgr.broadcastWithWildcard(`eval:${evalRunId}`, {
+                    ...event,
+                    run: r + 1,
+                    totalRuns: runs
+                  });
+                }
+              });
+              results.push(result);
+              connMgr.broadcastWithWildcard(`eval:${evalRunId}`, {
+                type: "run_done",
+                run: r + 1,
+                totalRuns: runs
+              });
+            }
+            if (results.length > 0) {
+              connMgr.broadcastWithWildcard(`eval:${evalRunId}`, {
+                type: "done",
+                evalResultId: results[0].id,
+                runGroupId
+              });
+            } else {
+              connMgr.broadcastWithWildcard(`eval:${evalRunId}`, {
+                type: "error",
+                message: "All runs were cancelled"
+              });
+            }
+          } else {
+            const result = await runtime.runRegisteredEval(name, {
+              signal: ac.signal,
+              captureTraces,
+              onProgress: (event) => {
+                if (event.type === "run_done") return;
+                connMgr.broadcastWithWildcard(`eval:${evalRunId}`, event);
+              }
+            });
+            connMgr.broadcastWithWildcard(`eval:${evalRunId}`, {
+              type: "done",
+              evalResultId: result.id
+            });
+          }
+        } catch (err) {
+          connMgr.broadcastWithWildcard(`eval:${evalRunId}`, {
+            type: "error",
+            message: redactErrorMessage(err, redactOn)
+          });
+        } finally {
+          activeRuns.delete(evalRunId);
+        }
+      })();
+      return c.json({ ok: true, data: { evalRunId } });
+    }
     try {
       if (runs > 1) {
-        const { randomUUID } = await import("crypto");
         const { aggregateRuns } = await import("@axlsdk/eval");
-        const runGroupId = randomUUID();
+        const runGroupId = (0, import_node_crypto.randomUUID)();
         const results = [];
         for (let r = 0; r < runs; r++) {
           const result2 = await runtime.runRegisteredEval(name, {
-            metadata: { runGroupId, runIndex: r }
+            metadata: { runGroupId, runIndex: r },
+            captureTraces
           });
           results.push(result2);
         }
         const typedResults = results;
         const aggregate = aggregateRuns(typedResults);
         const first = typedResults[0];
-        const result = { ...first, _multiRun: { aggregate, allRuns: typedResults } };
-        return c.json({ ok: true, data: result });
+        const result = {
+          ...first,
+          _multiRun: { aggregate, allRuns: typedResults }
+        };
+        return c.json({
+          ok: true,
+          data: redactEvalResult(result, redactOn)
+        });
       } else {
-        const result = await runtime.runRegisteredEval(name);
-        return c.json({ ok: true, data: result });
+        const result = await runtime.runRegisteredEval(name, { captureTraces });
+        return c.json({
+          ok: true,
+          data: redactEvalResult(result, redactOn)
+        });
       }
     } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      return c.json({ ok: false, error: { code: "EVAL_ERROR", message } }, 400);
+      return c.json(
+        { ok: false, error: { code: "EVAL_ERROR", message: redactErrorMessage(err, redactOn) } },
+        400
+      );
+    }
+  });
+  app6.post("/evals/runs/:evalRunId/cancel", (c) => {
+    const evalRunId = c.req.param("evalRunId");
+    const ac = activeRuns.get(evalRunId);
+    if (!ac) {
+      return c.json(
+        { ok: false, error: { code: "NOT_FOUND", message: "No active eval run found" } },
+        404
+      );
     }
+    ac.abort();
+    activeRuns.delete(evalRunId);
+    return c.json({ ok: true, data: { cancelled: true } });
   });
-  app7.post("/evals/:name/rescore", async (c) => {
+  app6.post("/evals/:name/rescore", async (c) => {
     if (evalLoader) await evalLoader();
     const runtime = c.get("runtime");
+    const redactOn = runtime.isRedactEnabled();
     const name = c.req.param("name");
     const body = await c.req.json();
     if (!body.resultId || typeof body.resultId !== "string") {
@@ -842,31 +1736,167 @@ function createEvalRoutes(evalLoader) {
         timestamp: Date.now(),
         data: result
       });
-      return c.json({ ok: true, data: result });
+      return c.json({
+        ok: true,
+        data: redactEvalResult(result, redactOn)
+      });
     } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      return c.json({ ok: false, error: { code: "EVAL_ERROR", message } }, 400);
+      return c.json(
+        { ok: false, error: { code: "EVAL_ERROR", message: redactErrorMessage(err, redactOn) } },
+        400
+      );
     }
   });
-  app7.post("/evals/compare", async (c) => {
+  app6.post("/evals/compare", async (c) => {
     const runtime = c.get("runtime");
+    const redactOn = runtime.isRedactEnabled();
     const body = await c.req.json();
+    const validateIdParam = (v, name) => {
+      if (typeof v === "string") return v === "" ? `${name} must be non-empty` : null;
+      if (Array.isArray(v)) {
+        if (v.length === 0) return `${name} must be a non-empty array`;
+        for (const elem of v) {
+          if (typeof elem !== "string" || elem === "") {
+            return `${name} array must contain only non-empty strings`;
+          }
+        }
+        return null;
+      }
+      return `${name} is required (string or string[])`;
+    };
+    const baselineErr = validateIdParam(body.baselineId, "baselineId");
+    const candidateErr = validateIdParam(body.candidateId, "candidateId");
+    if (baselineErr || candidateErr) {
+      return c.json(
+        {
+          ok: false,
+          error: {
+            code: "BAD_REQUEST",
+            message: [baselineErr, candidateErr].filter(Boolean).join("; ")
+          }
+        },
+        400
+      );
+    }
+    const history = await runtime.getEvalHistory();
+    const byId = new Map(history.map((h) => [h.id, h.data]));
+    const missing = [];
+    const resolveOne = (id) => {
+      const data = byId.get(id);
+      if (!data) missing.push(id);
+      return data;
+    };
+    const resolveSelection = (idOrIds) => {
+      if (Array.isArray(idOrIds)) {
+        const unique = Array.from(new Set(idOrIds));
+        if (unique.length === 1) return resolveOne(unique[0]);
+        const results = [];
+        for (const id of unique) {
+          const data = resolveOne(id);
+          if (data) results.push(data);
+        }
+        return results;
+      }
+      return resolveOne(idOrIds);
+    };
+    const baseline = resolveSelection(body.baselineId);
+    const candidate = resolveSelection(body.candidateId);
+    if (missing.length > 0) {
+      return c.json(
+        {
+          ok: false,
+          error: {
+            code: "NOT_FOUND",
+            message: `Eval result(s) not found in history: ${missing.join(", ")}`
+          }
+        },
+        404
+      );
+    }
     try {
-      const result = await runtime.evalCompare(body.baseline, body.candidate, body.options);
+      const result = await runtime.evalCompare(baseline, candidate, body.options);
       return c.json({ ok: true, data: result });
     } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      return c.json({ ok: false, error: { code: "EVAL_ERROR", message } }, 400);
+      return c.json(
+        {
+          ok: false,
+          error: { code: "COMPARE_FAILED", message: redactErrorMessage(err, redactOn) }
+        },
+        400
+      );
     }
   });
-  return app7;
+  app6.post("/evals/import", async (c) => {
+    const runtime = c.get("runtime");
+    const body = await c.req.json();
+    const bad = (message) => c.json({ ok: false, error: { code: "BAD_REQUEST", message } }, 400);
+    if (!body.result || typeof body.result !== "object") {
+      return bad("result is required");
+    }
+    const result = body.result;
+    if (!Array.isArray(result.items)) {
+      return bad("result.items must be an array");
+    }
+    if (typeof result.summary !== "object" || result.summary == null) {
+      return bad("result.summary must be an object");
+    }
+    if (typeof result.dataset !== "string" || !result.dataset) {
+      return bad("result.dataset must be a non-empty string (required for compare)");
+    }
+    const summary = result.summary;
+    if (typeof summary.scorers !== "object" || summary.scorers == null) {
+      return bad("result.summary.scorers must be an object");
+    }
+    const summaryScorerNames = Object.keys(summary.scorers);
+    const items = result.items;
+    const summaryScorerSet = new Set(summaryScorerNames);
+    const uncoveredAcrossItems = /* @__PURE__ */ new Set();
+    for (const item of items) {
+      const itemScores = item?.scores;
+      if (itemScores && typeof itemScores === "object") {
+        for (const name of Object.keys(itemScores)) {
+          if (!summaryScorerSet.has(name)) uncoveredAcrossItems.add(name);
+        }
+      }
+    }
+    if (uncoveredAcrossItems.size > 0) {
+      return bad(
+        `item scores reference scorer(s) not in summary.scorers: ${[...uncoveredAcrossItems].join(", ")}`
+      );
+    }
+    const trim = (v) => typeof v === "string" && v.trim() !== "" ? v.trim() : void 0;
+    const metadataObj = typeof result.metadata === "object" && result.metadata != null ? result.metadata : {};
+    const workflowsFromMeta = Array.isArray(metadataObj.workflows) ? metadataObj.workflows : [];
+    const primaryWorkflow = workflowsFromMeta.find((w) => typeof w === "string");
+    const evalName = trim(body.eval) ?? trim(primaryWorkflow) ?? // Legacy fallback: pre-0.14 CLI artifacts had workflow at the top level.
+    trim(result.workflow) ?? "imported";
+    const id = (0, import_node_crypto.randomUUID)();
+    const timestamp = Date.now();
+    const imported = {
+      ...result,
+      id,
+      metadata: typeof result.metadata === "object" && result.metadata != null ? result.metadata : {}
+    };
+    await runtime.saveEvalResult({
+      id,
+      eval: evalName,
+      timestamp,
+      data: imported
+    });
+    return c.json({ ok: true, data: { id, eval: evalName, timestamp } });
+  });
+  function closeActiveRuns() {
+    for (const ac of activeRuns.values()) ac.abort();
+    activeRuns.clear();
+  }
+  return { app: app6, closeActiveRuns };
 }
 
 // src/server/routes/playground.ts
 var import_hono11 = require("hono");
 function createPlaygroundRoutes(connMgr) {
-  const app7 = new import_hono11.Hono();
-  app7.post("/playground/chat", async (c) => {
+  const app6 = new import_hono11.Hono();
+  app6.post("/playground/chat", async (c) => {
     const runtime = c.get("runtime");
     const body = await c.req.json();
     if (!body.message || typeof body.message !== "string" || !body.message.trim()) {
@@ -897,13 +1927,14 @@ function createPlaygroundRoutes(connMgr) {
     const store = runtime.getStateStore();
     const history = await store.getSession(sessionId);
     history.push({ role: "user", content: body.message });
+    const redactOn = runtime.isRedactEnabled();
+    const broadcast = (event) => {
+      connMgr.broadcastWithWildcard(`execution:${executionId}`, redactStreamEvent(event, redactOn));
+    };
     const ctx = runtime.createContext({
       sessionHistory: history,
       onToken: (token) => {
-        connMgr.broadcastWithWildcard(`execution:${executionId}`, {
-          type: "token",
-          data: token
-        });
+        broadcast({ type: "token", data: token });
       }
     });
     (async () => {
@@ -912,12 +1943,9 @@ function createPlaygroundRoutes(connMgr) {
         const resultText = typeof result === "string" ? result : JSON.stringify(result);
         history.push({ role: "assistant", content: resultText });
         await store.saveSession(sessionId, history);
-        connMgr.broadcastWithWildcard(`execution:${executionId}`, {
-          type: "done",
-          data: resultText
-        });
+        broadcast({ type: "done", data: resultText });
       } catch (err) {
-        connMgr.broadcastWithWildcard(`execution:${executionId}`, {
+        broadcast({
           type: "error",
           message: err instanceof Error ? err.message : String(err)
         });
@@ -928,42 +1956,111 @@ function createPlaygroundRoutes(connMgr) {
       data: { sessionId, executionId, streaming: true }
     });
   });
-  return app7;
+  return app6;
+}
+
+// src/server/routes/eval-trends.ts
+var import_hono12 = require("hono");
+function createEvalTrendsRoutes(aggregator) {
+  const app6 = new import_hono12.Hono();
+  app6.get("/eval-trends", (c) => {
+    const window = parseWindowParam(c.req.query("window"));
+    return c.json({ ok: true, data: aggregator.getSnapshot(window) });
+  });
+  return app6;
+}
+
+// src/server/routes/workflow-stats.ts
+var import_hono13 = require("hono");
+function createWorkflowStatsRoutes(aggregator) {
+  const app6 = new import_hono13.Hono();
+  app6.get("/workflow-stats", (c) => {
+    const window = parseWindowParam(c.req.query("window"));
+    return c.json({ ok: true, data: enrichWorkflowStats(aggregator.getSnapshot(window)) });
+  });
+  return app6;
+}
+
+// src/server/routes/trace-stats.ts
+var import_hono14 = require("hono");
+function createTraceStatsRoutes(aggregator) {
+  const app6 = new import_hono14.Hono();
+  app6.get("/trace-stats", (c) => {
+    const window = parseWindowParam(c.req.query("window"));
+    return c.json({ ok: true, data: aggregator.getSnapshot(window) });
+  });
+  return app6;
 }
 
 // src/server/index.ts
 function createServer(options) {
   const { runtime, staticRoot, basePath = "", readOnly = false } = options;
-  const app7 = new import_hono12.Hono();
+  const app6 = new import_hono15.Hono();
   const connMgr = new ConnectionManager();
-  const costAggregator = new CostAggregator(connMgr);
+  const windows = ["24h", "7d", "30d", "all"];
+  const costAggregator = new TraceAggregator({
+    runtime,
+    connMgr,
+    channel: "costs",
+    reducer: reduceCost,
+    emptyState: emptyCostData,
+    windows
+  });
+  const workflowStatsAggregator = new ExecutionAggregator({
+    runtime,
+    connMgr,
+    channel: "workflow-stats",
+    reducer: reduceWorkflowStats,
+    emptyState: emptyWorkflowStatsData,
+    windows,
+    broadcastTransform: enrichWorkflowStats
+  });
+  const traceStatsAggregator = new TraceAggregator({
+    runtime,
+    connMgr,
+    channel: "trace-stats",
+    reducer: reduceTraceStats,
+    emptyState: emptyTraceStatsData,
+    windows
+  });
+  const evalTrendsAggregator = new EvalAggregator({
+    runtime,
+    connMgr,
+    channel: "eval-trends",
+    reducer: reduceEvalTrends,
+    emptyState: emptyEvalTrendData,
+    windows
+  });
   if (options.cors !== false) {
-    app7.use("*", (0, import_cors.cors)());
+    app6.use("*", (0, import_cors.cors)());
   }
-  app7.use("*", errorHandler);
-  app7.use("*", async (c, next) => {
+  app6.use("*", errorHandler);
+  app6.use("*", async (c, next) => {
     c.set("runtime", runtime);
     await next();
   });
   if (readOnly) {
     const blocked = [
-      "POST /api/workflows",
-      "POST /api/executions",
-      "POST /api/sessions",
-      "DELETE /api/sessions",
-      "PUT /api/memory",
-      "DELETE /api/memory",
-      "POST /api/decisions",
-      "POST /api/costs",
-      "POST /api/tools",
-      "POST /api/evals",
-      "POST /api/playground"
+      /^POST \/api\/workflows(\/|$)/,
+      /^POST \/api\/executions(\/|$)/,
+      /^POST \/api\/sessions(\/|$)/,
+      /^DELETE \/api\/sessions(\/|$)/,
+      /^PUT \/api\/memory(\/|$)/,
+      /^DELETE \/api\/memory(\/|$)/,
+      /^POST \/api\/decisions(\/|$)/,
+      /^POST \/api\/tools(\/|$)/,
+      /^POST \/api\/evals\/import$/,
+      /^POST \/api\/evals\/[^/]+\/run$/,
+      /^POST \/api\/evals\/[^/]+\/rescore$/,
+      /^POST \/api\/evals\/runs\/[^/]+\/cancel$/,
+      /^DELETE \/api\/evals\/history\/[^/]+$/,
+      /^POST \/api\/playground(\/|$)/
     ];
-    app7.use("/api/*", async (c, next) => {
+    app6.use("/api/*", async (c, next) => {
       const apiIdx = c.req.path.indexOf("/api/");
       const apiPath = apiIdx >= 0 ? c.req.path.slice(apiIdx) : c.req.path;
       const key = `${c.req.method} ${apiPath}`;
-      if (blocked.some((b) => key.startsWith(b))) {
+      if (blocked.some((re) => re.test(key))) {
         return c.json(
           {
             ok: false,
@@ -975,8 +2072,8 @@ function createServer(options) {
       await next();
     });
   }
-  const api = new import_hono12.Hono();
-  api.route("/", health_default);
+  const api = new import_hono15.Hono();
+  api.route("/", createHealthRoutes(readOnly));
   api.route("/", createWorkflowRoutes(connMgr));
   api.route("/", executions_default);
   api.route("/", createSessionRoutes(connMgr));
@@ -985,20 +2082,29 @@ function createServer(options) {
   api.route("/", memory_default);
   api.route("/", decisions_default);
   api.route("/", createCostRoutes(costAggregator));
-  api.route("/", createEvalRoutes(options.evalLoader));
+  api.route("/", createEvalTrendsRoutes(evalTrendsAggregator));
+  api.route("/", createWorkflowStatsRoutes(workflowStatsAggregator));
+  api.route("/", createTraceStatsRoutes(traceStatsAggregator));
+  const { app: evalApp, closeActiveRuns } = createEvalRoutes(connMgr, options.evalLoader);
+  api.route("/", evalApp);
   api.route("/", createPlaygroundRoutes(connMgr));
-  app7.route("/api", api);
+  app6.route("/api", api);
   const traceListener = (event) => {
     const traceEvent = event;
     if (traceEvent.executionId) {
       connMgr.broadcastWithWildcard(`trace:${traceEvent.executionId}`, traceEvent);
     }
-    costAggregator.onTrace(traceEvent);
     if (traceEvent.type === "await_human") {
       connMgr.broadcast("decisions", traceEvent);
     }
   };
   runtime.on("trace", traceListener);
+  const aggregatorStartPromise = Promise.all([
+    costAggregator.start(),
+    workflowStatsAggregator.start(),
+    traceStatsAggregator.start(),
+    evalTrendsAggregator.start()
+  ]).catch((err) => console.error("[axl-studio] aggregator start failed:", err));
   if (staticRoot) {
     const indexPath = (0, import_node_path.resolve)(staticRoot, "index.html");
     let spaHtml;
@@ -1028,7 +2134,7 @@ function createServer(options) {
       root: staticRoot,
       rewriteRequestPath: basePath ? (path) => path.startsWith(basePath) ? path.slice(basePath.length) || "/" : path : void 0
     });
-    app7.use("/*", async (c, next) => {
+    app6.use("/*", async (c, next) => {
       const reqPath = c.req.path;
       const resolved = basePath && reqPath.startsWith(basePath) ? reqPath.slice(basePath.length) || "/" : reqPath;
       if (resolved === "/" || resolved === "/index.html" || resolved === "/ws") {
@@ -1037,7 +2143,7 @@ function createServer(options) {
       return staticHandler(c, next);
     });
     if (spaHtml) {
-      app7.get("*", async (c, next) => {
+      app6.get("*", async (c, next) => {
         const resolved = basePath && c.req.path.startsWith(basePath) ? c.req.path.slice(basePath.length) || "/" : c.req.path;
         if (resolved === "/ws") return next();
         return c.html(spaHtml);
@@ -1045,12 +2151,25 @@ function createServer(options) {
     }
   }
   return {
-    app: app7,
+    app: app6,
     connMgr,
     costAggregator,
+    workflowStatsAggregator,
+    traceStatsAggregator,
+    evalTrendsAggregator,
+    aggregatorStartPromise,
     /** Create WS handlers. Call before registering static/SPA routes are reached. */
     createWsHandlers: () => createWsHandlers(connMgr),
-    traceListener
+    traceListener,
+    /** Abort all active streaming eval runs. */
+    closeActiveRuns,
+    /** Close all aggregators (clear intervals and unsubscribe listeners). */
+    closeAggregators: () => {
+      costAggregator.close();
+      workflowStatsAggregator.close();
+      traceStatsAggregator.close();
+      evalTrendsAggregator.close();
+    }
   };
 }
 
@@ -1232,7 +2351,13 @@ async function registerConditions(conditions) {
 // src/middleware.ts
 var import_meta2 = {};
 function createStudioMiddleware(options) {
-  const { runtime, serveClient = true, verifyUpgrade, readOnly = false } = options;
+  const {
+    runtime,
+    serveClient = true,
+    verifyUpgrade,
+    readOnly = false,
+    filterTraceEvent
+  } = options;
   const basePath = normalizeBasePath(options.basePath);
   const staticRoot = serveClient ? resolveClientDist() : void 0;
   if (serveClient && !staticRoot) {
@@ -1242,7 +2367,7 @@ function createStudioMiddleware(options) {
     );
   }
   const evalLoader = options.evals ? createEvalLoader(options.evals, runtime) : void 0;
-  const { app: app7, connMgr, traceListener } = createServer({
+  const { app: app6, connMgr, traceListener, closeActiveRuns, closeAggregators } = createServer({
     runtime,
     staticRoot,
     basePath,
@@ -1251,12 +2376,15 @@ function createStudioMiddleware(options) {
     // Host framework owns CORS policy
     evalLoader
   });
+  if (filterTraceEvent) {
+    connMgr.setFilter(filterTraceEvent);
+  }
   if (process.env.NODE_ENV === "production" && !verifyUpgrade) {
     console.warn(
       "[axl-studio] WARNING: Studio middleware mounted in production without verifyUpgrade. WebSocket connections are not authenticated. All registered workflows, tools, and agents are accessible. See https://axlsdk.com/docs/studio/security"
     );
   }
-  const listener = (0, import_node_server.getRequestListener)(app7.fetch, {
+  const listener = (0, import_node_server.getRequestListener)(app6.fetch, {
     overrideGlobalObjects: false
   });
   let closed = false;
@@ -1291,7 +2419,7 @@ function createStudioMiddleware(options) {
       }
     });
   }
-  function handleWebSocket(ws) {
+  function handleWebSocket(ws, metadata) {
     if (closed) {
       ws.close();
       return;
@@ -1301,6 +2429,9 @@ function createStudioMiddleware(options) {
       close: () => ws.close()
     };
     connMgr.add(socket);
+    if (metadata !== void 0) {
+      connMgr.setMetadata(socket, metadata);
+    }
     ws.on("message", (raw) => {
       const reply = handleWsMessage(String(raw), socket, connMgr);
       if (reply) ws.send(reply);
@@ -1323,32 +2454,42 @@ function createStudioMiddleware(options) {
     upgradeHandler = async (req, socket, head) => {
       const pathname = new URL(req.url, `http://${req.headers.host}`).pathname;
       if (pathname !== wsPath) return;
+      if (closed) {
+        socket.destroy();
+        return;
+      }
+      let connectionMetadata;
       if (verifyUpgrade) {
         try {
-          const allowed = await verifyUpgrade(req);
+          const result = await verifyUpgrade(req);
+          const allowed = typeof result === "boolean" ? result : result.allowed;
           if (!allowed) {
             socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
             socket.destroy();
             return;
           }
+          if (typeof result === "object" && result !== null) {
+            connectionMetadata = result.metadata;
+          }
         } catch {
           socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
           socket.destroy();
           return;
         }
       }
-      if (!wss) {
+      if (closed || !wss) {
         socket.destroy();
         return;
       }
       wss.handleUpgrade(req, socket, head, (ws) => {
-        handleWebSocket(ws);
+        handleWebSocket(ws, connectionMetadata);
       });
     };
     server.on("upgrade", upgradeHandler);
   }
   function close() {
     closed = true;
+    closeActiveRuns();
     connMgr.closeAll();
     if (upgradeHandler && serverRef) {
       serverRef.removeListener("upgrade", upgradeHandler);
@@ -1362,12 +2503,13 @@ function createStudioMiddleware(options) {
     if (traceListener) {
       runtime.removeListener("trace", traceListener);
     }
+    closeAggregators();
   }
   return {
     handler,
     handleWebSocket,
     upgradeWebSocket,
-    app: app7,
+    app: app6,
     connectionManager: connMgr,
     close
   };