@caupulican/pi-adaptative 0.81.39 → 0.81.41

package/dist/core/secrets/secret-vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-vault.js","sourceRoot":"","sources":["../../../src/core/secrets/secret-vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI,EAAE,EAAc,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EACN,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,yBAAyB,EACzB,wBAAwB,EACxB,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,EACpB,aAAa,EACb,cAAc,EAQd,gBAAgB,EAEhB,OAAO,EACP,YAAY,EACZ,iBAAiB,EACjB,uBAAuB,EACvB,YAAY,EAGZ,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,EAC7B,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,oBAAoB,GACpB,MAAM,0BAA0B,CAAC;AAalC,OAAO,EACN,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,iCAAiC,EACjC,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,EAC5B,gBAAgB,GAChB,MAAM,0BAA0B,CAAC;AAElC,SAAS,aAAa,CAAC,KAAc,EAAsB;IAC1D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QACtG,CAAC,CAAC,KAAK,CAAC,IAAI;QACZ,CAAC,CAAC,SAAS,CAAC;AAAA,CACb;AAED,KAAK,UAAU,aAAa,CAAC,IAAY,EAA8B;IACtE,IAAI,CAAC;QACJ,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,KAAK,CAAC;IACb,CAAC;AAAA,CACD;AAED,KAAK,UAAU,sBAAsB,CACpC,QAAgB,EAChB,QAAgB,EAChB,KAAqC,EACnB;IAClB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,GAAG,KAAK,wBAAwB,CAAC,CAAC;IAC7G,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,gBAAgB,CACzB,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,qBAAqB,EAClE,GAAG,KAAK,8BAA8B,CACtC,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,gBAAgB,CACzB,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,EAC/D,GAAG,KAAK,gBAAgB,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,SAAS,CAC/E,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,iDAAiD,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;YAC1F,IAAI,SAAS,KAAK,CAAC;gBAAE,MAAM;YAC3B,MAAM,IAAI,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,MAAM,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACf,MAAM,IAAI,gBAAgB,CACzB,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,EAC/D,GAAG,KAAK,0CAA0C,CAClD,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,OAAO,IAAI,CAAC;IACb,CAAC;YAAS,CAAC;QACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;AAAA,CACD;AAED,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAmB;IACjE,OAAO,sBAAsB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,cAAc,CAAC,CAAC;AAAA,CAC9E;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,QAAgB,EAAmB;IAClF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,OAAO,IAAI,CAAC;IACb,CAAC;YAAS,CAAC;QACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;AAAA,CACD;AAED,KAAK,UAAU,sBAAsB,CAAC,IAAY,EAAiB;IAClE,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,QAAQ,EAAE,cAAc,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,yCAAyC,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAAA,CAC9D;AAED,KAAK,UAAU,sBAAsB,CAAC,IAAY,EAAiB;IAClE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAAA,CAC9D;AAaD,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc,EAAW;IAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AAAA,CAC3G;AAED,SAAS,YAAY,CAAC,KAAa,EAAU;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAAA,CACpD;AAED;;;;GAIG;AACH,MAAM,OAAO,WAAW;IACd,SAAS,CAAS;IAClB,eAAe,CAAS;IAChB,OAAO,CAAS;IAChB,OAAO,CAAS;IAChB,GAAG,CAAa;IAChB,oBAAoB,CAA2B;IACxD,SAAS,CAAqB;IAC9B,SAAS,CAAuB;IAChC,cAAc,GAA0B,EAAE,CAAC;IAClC,yBAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEvE,YAAY,OAA2B,EAAE;QACxC,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,eAAe,GAAG,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAAA,CACzD;IAED,MAAM,CAAC,WAAW,CAAC,QAAgB,EAAe;QACjD,OAAO,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAAA,CACrC;IAED,IAAI,UAAU,GAAY;QACzB,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC;IAAA,CACpC;IAED,KAAK,CAAC,MAAM,GAAqB;QAChC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,QAAQ,EAAE,cAAc,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,oCAAoC,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,QAAQ,KAAK,SAAS,CAAC;IAAA,CAC9B;IAED,IAAI,GAAS;QACZ,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;QACvC,IAAI,CAAC,wBAAwB,EAAE,CAAC;IAAA,CAChC;IAED,6EAA6E;IAC7E,oBAAoB,CAAC,GAAW,EAAqB;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAAA,CACtG;IAED,oBAAoB,CAAC,GAAW,EAAW;QAC1C,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;IAAA,CACpD;IAED,uGAAuG;IACvG,mBAAmB,CAAC,IAAY,EAAU;QACzC,IAAI,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG;YACd,GAAG,IAAI,GAAG,CACT,IAAI,CAAC,cAAc;iBACjB,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;iBACzE,MAAM,CAAC,OAAO,CAAC,CACjB;SACD,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACvB,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACpD,SAAS;YACV,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,gBAAgB,YAAY,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YACpF,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,YAAY,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,QAAQ,CAAC;IAAA,CAChB;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAiB;QACnD,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC;YAC9C,IAAI,MAAM,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,sCAAsC,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC7C,MAAM,OAAO,GAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YACrE,IAAI,CAAC;gBACJ,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;gBAC5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACZ,MAAM,KAAK,CAAC;YACb,CAAC;QAAA,CACD,CAAC,CAAC;IAAA,CACH;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAiB;QAC/C,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAC;QAC9G,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,OAAiC,CAAC;QACtC,IAAI,CAAC;YACJ,MAAM,iBAAiB,GAAG,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAC9D,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,iBAAiB,KAAK,IAAI,CAAC,4BAA4B,EAAE;gBAAE,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,KAAK,CAAC;QACb,CAAC;gBAAS,CAAC;YACV,IAAI,OAAO;gBAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;IAAA,CACD;IAED,KAAK,CAAC,YAAY,GAAoC;QACrD,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;IAAA,CAClF;IAED,KAAK,CAAC,aAAa,CAClB,OAAe,EACf,WAA+B,EAC/B,MAAsC,EACN;QAChC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,gDAAgD,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,wBAAwB,IAAI,iBAAiB,CAAC,CAAC;YAC/F,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAAA,CACzD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,oBAAoB,CAC/B,OAAO,EACP,WAAW,EACX,uBAAuB,CAAC,gBAAgB,CAAC,EACzC,SAAS,EACT,IAAI,CACJ,CAAC;IAAA,CACF;IAED,KAAK,CAAC,sBAAsB,CAC3B,OAAe,EACf,WAA+B,EAC/B,QAAgB,EAChB,OAAgD,EAChB;QAChC,OAAO,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAAA,CACjF;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe,EAA+B;QACtE,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,WAAW,CACtB,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,iBAAiB,CAAC,EAAE,MAAM,EAClG,KAAK,CACL,CAAC;IAAA,CACF;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAmB;QAC3D,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACpC,OAAO,sBAAsB,CAAC,WAAW,EAAE,yBAAyB,EAAE,aAAa,CAAC,CAAC;IAAA,CACrF;IAED,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,aAAiC,EAAgC;QACrG,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,eAAe,GAAG,aAAa,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACjE,IAAI,eAAe,IAAI,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;YACjF,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,+CAA+C,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,6BAA6B,GAAG,KAAK,CAAC;QAC1C,IAAI,4BAA4B,GAAG,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,iBAAiB,CAAC,CAAC;YACjG,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;YAC7F,MAAM,SAAS,GAAG,6BAA6B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC;YACzE,IAAI,cAAuB,CAAC;YAC5B,IAAI,oBAA8B,CAAC;YACnC,IAAI,SAAS,GAA0B,EAAE,CAAC;YAC1C,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBACnC,cAAc,GAAG,IAAI,CAAC;gBACtB,oBAAoB,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,CAAC;iBAAM,CAAC;gBACP,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAClC,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,qDAAqD,CAAC,CAAC;gBACvG,CAAC;gBACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC3C,oBAAoB,GAAG,SAAS;qBAC9B,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;qBAClD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACnC,IAAI,oBAAoB,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;oBACpD,MAAM,IAAI,gBAAgB,CACzB,kBAAkB,EAClB,2DAA2D,CAC3D,CAAC;gBACH,CAAC;gBACD,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1E,cAAc,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;YACzC,CAAC;YAED,kFAAkF;YAClF,6BAA6B,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,iBAAiB,CAAC,CAAC;YAC3F,4BAA4B,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;YAC9E,IAAI,cAAc;gBAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;iBACjD,CAAC;gBACL,MAAM,CAAC,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;gBACnD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YAC7C,CAAC;YACD,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,CAAC;QAAA,CAChD,EAAE,IAAI,CAAC,CAAC;QACT,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;QAC1C,OAAO;YACN,OAAO,EAAE,iBAAiB;YAC1B,GAAG,MAAM;YACT,6BAA6B;YAC7B,4BAA4B;SAC5B,CAAC;IAAA,CACF;IAED,iBAAiB,CAAC,OAAe,EAAU;QAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAAA,CACvE;IAED,oBAAoB,CACnB,SAAiB,EACjB,OAAe,EAKd;QACD,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,OAAO,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;QACpE,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,WAAW,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,mDAAmD,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC;IAAA,CACnF;IAED,KAAK,CAAC,0BAA0B,CAAC,GAAW,EAAE,OAAgB,EAAoC;QACjG,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,iBAAiB,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;gBACvD,IAAI,iBAAiB,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,KAAK,iBAAiB;oBAAE,OAAO,EAAE,CAAC;gBAC1F,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ;qBAChC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;qBAC/D,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3E,IAAI,CAAC,OAAO;oBAAE,OAAO,EAAE,CAAC;gBACxB,OAAO,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YAAA,CAChC,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,gBAAgB,CACzB,iBAAiB,EACjB,iBAAiB;oBAChB,CAAC,CAAC,kBAAkB,iBAAiB,kCAAkC;oBACvE,CAAC,CAAC,+CAA+C,CAClD,CAAC;YACH,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACxF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;YAC1F,IAAI,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAC1B,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,SAAS,CAAC,OAAO,CAClG,CAAC;gBACF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACb,MAAM,IAAI,gBAAgB,CACzB,mBAAmB,EACnB,+EAA+E,CAC/E,CAAC;gBACH,CAAC;gBACD,QAAQ,GAAG,MAAM,CAAC;YACnB,CAAC;YACD,MAAM,MAAM,GAAG,6BAA6B,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACxE,OAAO;gBACN,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO;gBACnC,GAAG,QAAQ,CAAC,OAAO;gBACnB,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC1E,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;aAChE,CAAC;QAAA,CACF,EAAE,KAAK,CAAC,CAAC;IAAA,CACV;IAED,KAAK,CAAC,qBAAqB,CAAC,WAAmB,EAAE,OAAe,EAAsC;QACrG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChC,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,iDAAiD,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,kDAAkD,CAAC,CAAC;QACvG,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,MAAM,cAAc,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtF,IAAI,SAAS,KAAK,GAAG,yBAAyB,GAAG,OAAO,EAAE;YAAE,OAAO,iBAAiB,CAAC;QACrF,IAAI,SAAS,CAAC,UAAU,CAAC,yBAAyB,CAAC;YAAE,OAAO,eAAe,CAAC;QAC5E,OAAO,WAAW,CAAC;IAAA,CACnB;IAED,KAAK,CAAC,cAAc,CACnB,OAAe,EACf,WAAmB,EACnB,OAAO,GAKH,EAAE,EACiC;QACvC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACvF,MAAM,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC7E,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;gBACjF,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,8CAA8C,CAAC,CAAC;YACnG,CAAC;YACD,MAAM,sBAAsB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACP,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC;gBAC5B,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,8CAA8C,CAAC,CAAC;YACnG,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,iBAAiB,CAAC,CAAC;YAC7F,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;YAC7F,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CACnC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC,CACvF,CAAC;YACF,MAAM,aAAa,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrG,MAAM,iBAAiB,GAAG,aAAa;gBACtC,CAAC,CAAC,MAAM,CAAC,QAAQ;qBACd,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;qBACvE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC3E,CAAC,CAAC,OAAO,CAAC;YACX,IAAI,aAAa,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzC,MAAM,IAAI,gBAAgB,CACzB,iBAAiB,EACjB,kBAAkB,iBAAiB,kCAAkC,CACrE,CAAC;YACH,CAAC;YACD,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,MAAM,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC/F,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;YACtF,MAAM,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAC5E,MAAM,aAAa,GAAG,6BAA6B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9G,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC;YACjF,IAAI,MAAM,GAAG,GAAG,yBAAyB,GAAG,iBAAiB,gFAAgF,IAAI,EAAE,CAAC;YACpJ,IAAI,CAAC;gBACJ,MAAM,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC5D,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;gBAC1C,IAAI,iBAAiB,EAAE,CAAC;oBACvB,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;gBACpF,CAAC;YACF,CAAC;oBAAS,CAAC;gBACV,MAAM,GAAG,EAAE,CAAC;YACb,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;QAAA,CAClF,EAAE,KAAK,CAAC,CAAC;IAAA,CACV;IAEO,KAAK,CAAC,oBAAoB,CACjC,OAAe,EACf,WAA+B,EAC/B,QAAgB,EAChB,OAA2D,EAC3D,KAAc,EACkB;QAChC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,qBAAqB,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAC/D,MAAM,cAAc,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnG,MAAM,iBAAiB,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAExG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;YACzD,IAAI,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,iBAAiB,CAAC,CAAC;YAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;gBACxD,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,iCAAiC,YAAY,YAAY,CAAC,CAAC;YACxG,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3E,IAAI,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,EAAE,GAAG,iBAAiB,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;gBAC5D,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBACzG,IAAI,aAAa,KAAK,CAAC,CAAC;oBAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;oBAC7C,YAAY,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC;gBACxC,IAAI,YAAY,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;oBACpD,MAAM,IAAI,gBAAgB,CACzB,eAAe,EACf,qCAAqC,wBAAwB,sBAAsB,CACnF,CAAC;gBACH,CAAC;YACF,CAAC;YAED,IAAI,YAAY,GAAG,cAAc,CAAC,QAAQ,CAAC;YAC3C,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,IAAI,GAAG,CACrB,6BAA6B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;oBACxE,QAAQ,CAAC,IAAI;oBACb,QAAQ,CAAC,KAAK;iBACd,CAAC,CACF,CAAC;gBACF,KAAK,MAAM,QAAQ,IAAI,cAAc,CAAC,SAAS;oBAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC3F,IAAI,MAAM,CAAC,IAAI,GAAG,yBAAyB,EAAE,CAAC;oBAC7C,MAAM,IAAI,gBAAgB,CACzB,gBAAgB,EAChB,qCAAqC,yBAAyB,aAAa,CAC3E,CAAC;gBACH,CAAC;gBACD,YAAY,GAAG,uBAAuB,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/F,CAAC;YAED,IAAI,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,CAAC,4BAA4B,CAAC,iBAAiB,CAAC,CAAC;gBAC3D,MAAM,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACP,MAAM,GAAG;oBACR,OAAO,EAAE,iBAAiB;oBAC1B,SAAS,EAAE,SAAS;oBACpB,SAAS,EAAE,SAAS;oBACpB,MAAM,EAAE,YAAY;oBACpB,QAAQ,EAAE,EAAE;iBACZ,CAAC;gBACF,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/B,CAAC;YACD,IAAI,qBAAqB,KAAK,SAAS;gBAAE,MAAM,CAAC,WAAW,GAAG,qBAAqB,CAAC;YACpF,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC;YAC7B,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAC,IAAI,CAClC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAC3G,CAAC;YACF,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;YAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAClF,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;QAAA,CAC9B,EAAE,IAAI,CAAC,CAAC;QACT,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IAAA,CACf;IAEO,KAAK,CAAC,4BAA4B,CACzC,WAAmB,EACnB,KAAgC,EAChC,OAA+E,EAC/D;QAChB,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC/B,MAAM,IAAI,gBAAgB,CACzB,sBAAsB,EACtB,yEAAyE,CACzE,CAAC;QACH,CAAC;QACD,IAAI,KAAK,KAAK,WAAW;YAAE,OAAO;QAClC,IAAI,CAAC,OAAO,CAAC,qBAAqB,IAAI,OAAO,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;YACtF,MAAM,IAAI,gBAAgB,CACzB,sBAAsB,EACtB,uFAAuF,CACvF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,KAAK,OAAO,CAAC,wBAAwB,EAAE,CAAC;YACpF,MAAM,IAAI,gBAAgB,CACzB,sBAAsB,EACtB,wEAAwE,CACxE,CAAC;QACH,CAAC;IAAA,CACD;IAEO,KAAK,CAAC,4BAA4B,CAAC,OAA6B,EAAE,WAAmB,EAAiB;QAC7G,IAAI,CAAC;YACJ,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC7C,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;gBAC9B,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;aACjC,CAAC,CAAC;YACH,IAAI,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC;gBAAE,OAAO;QAC7C,CAAC;QAAC,MAAM,CAAC;YACR,wFAAwF;QACzF,CAAC;QACD,MAAM,IAAI,gBAAgB,CACzB,qBAAqB,EACrB,oFAAoF,CACpF,CAAC;IAAA,CACF;IAEO,iBAAiB,CAAC,WAAmB,EAAQ;QACpD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,gBAAgB,CACzB,qBAAqB,EACrB,+DAA+D,CAC/D,CAAC;QACH,CAAC;IAAA,CACD;IAEO,gBAAgB,CAAC,GAAW,EAAE,GAAa,EAAQ;QAC1D,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IAAA,CAC5B;IAEO,gBAAgB,GAAS;QAChC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC3C,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS;gBAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC;IAAA,CACzB;IAEO,iBAAiB,CAAC,OAAe,EAAQ;QAChD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACzE,IAAI,aAAa,KAAK,OAAO;gBAAE,SAAS;YACxC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjD,OAAO,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QACtF,IAAI,MAAM,EAAE,CAAC;YACZ,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS;gBAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;YAC7D,MAAM,CAAC,SAAS,GAAG,EAAE,CAAC;QACvB,CAAC;QACD,IAAI,OAAO;YAAE,IAAI,CAAC,wBAAwB,EAAE,CAAC;IAAA,CAC7C;IAEO,wBAAwB,GAAS;QACxC,IAAI,CAAC;YACJ,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACR,qFAAqF;QACtF,CAAC;IAAA,CACD;IAEO,4BAA4B,GAAW;QAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC3C,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ;iBACrC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC;iBAC9F,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YACvE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5D,KAAK,MAAM,OAAO,IAAI,cAAc;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YACtG,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YACnG,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAAA,CAC1B;IAEO,kBAAkB,CAAC,OAAqB,EAAQ;QACvD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACxD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;YAC7D,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAC/B,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,OAAO,CACtF;gBACA,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;gBACpF,CAAC,CAAC,EAAE;SACL,CAAC,CAAC,CAAC;QACJ,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACnE,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAC1C,CAAC,SAAS,EAAE,EAAE,CACb,SAAS,CAAC,OAAO,KAAK,OAAO,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CACvG,CAAC;YACF,IAAI,CAAC,UAAU;gBAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnE,CAAC;IAAA,CACD;IAEO,oBAAoB,CAC3B,GAAW,EACmE;QAC9E,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,cAAc;aACxB,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ;iBAC9B,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;iBACrE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3E,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAAA,CAC7C,CAAC;aACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;aACxG,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAAA,CAC3F;IAEO,eAAe,GAAmC;QACzD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAAA,CACpD;IAEO,KAAK,CAAC,WAAW,CAAI,SAAoD,EAAE,KAAc,EAAc;QAC9G,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC;YAC/C,MAAM,iBAAiB,GAAG,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAC9D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5C,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACZ,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,kDAAkD,CAAC,CAAC;YACjG,CAAC;YACD,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACtD,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;gBACxC,IAAI,KAAK;oBAAE,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;gBACvD,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;gBACjC,IAAI,iBAAiB,KAAK,IAAI,CAAC,4BAA4B,EAAE;oBAAE,IAAI,CAAC,wBAAwB,EAAE,CAAC;gBAC/F,OAAO,MAAM,CAAC;YACf,CAAC;oBAAS,CAAC;gBACV,YAAY,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QAAA,CACD,CAAC,CAAC;IAAA,CACH;IAEO,KAAK,CAAC,aAAa,CAAC,GAAa,EAAE,OAAqB,EAAE,GAAW,EAAiB;QAC7F,IAAI,UAAU,GAAG,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC;YACJ,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnE,MAAM,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC;gBAAS,CAAC;YACV,UAAU,GAAG,EAAE,CAAC;QACjB,CAAC;IAAA,CACD;IAEO,KAAK,CAAC,2BAA2B,CAAC,MAGzC,EAAmB;QACnB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC5E,IAAI,KAAK,KAAK,iBAAiB;gBAAE,SAAS;YAC1C,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC7B,OAAO,EAAE,CAAC;QACX,CAAC;QACD,OAAO,OAAO,CAAC;IAAA,CACf;IAEO,KAAK,CAAC,4BAA4B,CAAC,OAAe,EAAoB;QAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,sCAAsC,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,KAAK,KAAK,iBAAiB;YAAE,OAAO,KAAK,CAAC;QAC9C,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IAAA,CACZ;CACD","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { constants, promises as fs, type Stats } from \"node:fs\";\nimport { dirname, isAbsolute, join, relative, resolve, sep } from \"node:path\";\nimport { managedSecretEnvDir, secretsDir, secretVaultFile } from \"../agent-paths.ts\";\nimport { redactKnownSecrets } from \"../security/secret-text.ts\";\nimport { withFileLock, writeFileAtomic } from \"../util/atomic-file.ts\";\nimport { MAX_DOTENV_DOCUMENT_BYTES, parseDotenvDocument } from \"./secret-dotenv.ts\";\nimport {\n\tassertPassphrase,\n\tcreateVaultKdf,\n\tDEFAULT_SCRYPT_N,\n\tdecryptPayload,\n\tderiveKey,\n\tMANAGED_ENV_HEADER_PREFIX,\n\tMAX_BINDINGS_PER_PROFILE,\n\tMAX_PROFILES,\n\tMAX_VARIABLES_PER_PROFILE,\n\tMAX_VAULT_FILE_BYTES,\n\tparseEnvelope,\n\tprofileSummary,\n\ttype SecretBindingResolution,\n\ttype SecretBindingSummary,\n\ttype SecretEnvDestinationState,\n\ttype SecretMaterializationResult,\n\ttype SecretProfileSummary,\n\ttype SecretRemovalResult,\n\ttype SecretVariableValue,\n\tSecretVaultError,\n\ttype SecretVaultOptions,\n\tsameKdf,\n\tscrubPayload,\n\tserializeEnvelope,\n\tserializeVariableValues,\n\tVAULT_MARKER,\n\ttype VaultKdf,\n\ttype VaultPayload,\n\tvalidateBindingEnvFile,\n\tvalidateBindingWorkspace,\n\tvalidateDescription,\n\tvalidateDotenvProfileDocument,\n\tvalidateProfileId,\n\tvalidateScryptN,\n\tvalidateSecretValue,\n\tvalidateVariableName,\n} from \"./secret-vault-format.ts\";\n\nexport type {\n\tSecretBindingResolution,\n\tSecretBindingSummary,\n\tSecretEnvDestinationState,\n\tSecretMaterializationResult,\n\tSecretProfileSummary,\n\tSecretRemovalResult,\n\tSecretVariableValue,\n\tSecretVaultErrorCode,\n\tSecretVaultOptions,\n} from \"./secret-vault-format.ts\";\nexport {\n\tMAX_BINDINGS_PER_PROFILE,\n\tMAX_VARIABLES_PER_PROFILE,\n\tSECRET_DESCRIPTION_MAX_CHARS,\n\tSECRET_PRINTABLE_METADATA_PATTERN,\n\tSECRET_PROFILE_ID_MAX_CHARS,\n\tSECRET_PROFILE_ID_PATTERN,\n\tSECRET_VARIABLE_NAME_MAX_CHARS,\n\tSECRET_VARIABLE_NAME_PATTERN,\n\tSecretVaultError,\n} from \"./secret-vault-format.ts\";\n\nfunction nodeErrorCode(error: unknown): string | undefined {\n\treturn typeof error === \"object\" && error !== null && \"code\" in error && typeof error.code === \"string\"\n\t\t? error.code\n\t\t: undefined;\n}\n\nasync function lstatIfExists(path: string): Promise<Stats | undefined> {\n\ttry {\n\t\treturn await fs.lstat(path);\n\t} catch (error) {\n\t\tif (nodeErrorCode(error) === \"ENOENT\") return undefined;\n\t\tthrow error;\n\t}\n}\n\nasync function readBoundedRegularFile(\n\tfilePath: string,\n\tmaxBytes: number,\n\tlabel: \"Secret vault\" | \"Dotenv file\",\n): Promise<string> {\n\tconst before = await fs.lstat(filePath);\n\tif (before.isSymbolicLink()) throw new SecretVaultError(\"symlink_refused\", `${label} symlinks are refused.`);\n\tif (!before.isFile()) {\n\t\tthrow new SecretVaultError(\n\t\t\tlabel === \"Secret vault\" ? \"vault_corrupt\" : \"destination_invalid\",\n\t\t\t`${label} path is not a regular file.`,\n\t\t);\n\t}\n\tif (before.size > maxBytes) {\n\t\tthrow new SecretVaultError(\n\t\t\tlabel === \"Secret vault\" ? \"vault_too_large\" : \"invalid_dotenv\",\n\t\t\t`${label} exceeds its ${label === \"Secret vault\" ? \"4 MiB\" : \"512 KiB\"} limit.`,\n\t\t);\n\t}\n\tconst handle = await fs.open(filePath, constants.O_RDONLY);\n\ttry {\n\t\tconst opened = await handle.stat();\n\t\tif ((before.dev !== opened.dev || before.ino !== opened.ino) && before.ino !== 0 && opened.ino !== 0) {\n\t\t\tthrow new SecretVaultError(\"symlink_refused\", \"Secret vault changed while it was being opened.\");\n\t\t}\n\t\tconst output = Buffer.alloc(Math.min(maxBytes + 1, before.size + 1));\n\t\tlet offset = 0;\n\t\twhile (offset < output.byteLength) {\n\t\t\tconst { bytesRead } = await handle.read(output, offset, output.byteLength - offset, null);\n\t\t\tif (bytesRead === 0) break;\n\t\t\toffset += bytesRead;\n\t\t}\n\t\tif (offset > before.size || offset > maxBytes) {\n\t\t\toutput.fill(0);\n\t\t\tthrow new SecretVaultError(\n\t\t\t\tlabel === \"Secret vault\" ? \"vault_too_large\" : \"invalid_dotenv\",\n\t\t\t\t`${label} grew beyond its limit while being read.`,\n\t\t\t);\n\t\t}\n\t\tconst text = output.toString(\"utf8\", 0, offset);\n\t\toutput.fill(0);\n\t\treturn text;\n\t} finally {\n\t\tawait handle.close();\n\t}\n}\n\nasync function readBoundedFile(filePath: string): Promise<string> {\n\treturn readBoundedRegularFile(filePath, MAX_VAULT_FILE_BYTES, \"Secret vault\");\n}\n\nasync function readFilePrefix(filePath: string, maxBytes: number): Promise<string> {\n\tconst handle = await fs.open(filePath, constants.O_RDONLY);\n\ttry {\n\t\tconst output = Buffer.alloc(maxBytes);\n\t\tconst { bytesRead } = await handle.read(output, 0, output.byteLength, 0);\n\t\tconst text = output.toString(\"utf8\", 0, bytesRead);\n\t\toutput.fill(0);\n\t\treturn text;\n\t} finally {\n\t\tawait handle.close();\n\t}\n}\n\nasync function ensurePrivateDirectory(path: string): Promise<void> {\n\tconst existing = await lstatIfExists(path);\n\tif (existing?.isSymbolicLink()) {\n\t\tthrow new SecretVaultError(\"symlink_refused\", \"Secret storage directory symlinks are refused.\");\n\t}\n\tif (existing && !existing.isDirectory()) {\n\t\tthrow new SecretVaultError(\"destination_invalid\", \"Secret storage path is not a directory.\");\n\t}\n\tawait fs.mkdir(path, { recursive: true, mode: 0o700 });\n\tif (process.platform !== \"win32\") await fs.chmod(path, 0o700);\n}\n\nasync function enforcePrivateFileMode(path: string): Promise<void> {\n\tif (process.platform !== \"win32\") await fs.chmod(path, 0o600);\n}\n\ninterface CachedSecretVariable {\n\tname: string;\n\tvalue: string;\n}\n\ninterface CachedSecretProfile {\n\tprofile: string;\n\tbindings: SecretBindingSummary[];\n\tvariables: CachedSecretVariable[];\n}\n\nfunction isPathInside(root: string, target: string): boolean {\n\tconst fromRoot = relative(root, target);\n\treturn fromRoot === \"\" || (!fromRoot.startsWith(`..${sep}`) && fromRoot !== \"..\" && !isAbsolute(fromRoot));\n}\n\nfunction escapeRegExp(value: string): string {\n\treturn value.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\n/**\n * Encrypted generic credential vault. Only the derived key is retained in memory, until this\n * process explicitly locks the vault or exits. The native model-facing tool receives summaries,\n * never decrypted values or materialization paths.\n */\nexport class SecretVault {\n\treadonly vaultPath: string;\n\treadonly materializedDir: string;\n\tprivate readonly rootDir: string;\n\tprivate readonly scryptN: number;\n\tprivate readonly now: () => Date;\n\tprivate readonly onEnvironmentChanged: (() => void) | undefined;\n\tprivate cachedKey: Buffer | undefined;\n\tprivate cachedKdf: VaultKdf | undefined;\n\tprivate cachedProfiles: CachedSecretProfile[] = [];\n\tprivate readonly activeProfilesByWorkspace = new Map<string, string>();\n\n\tconstructor(options: SecretVaultOptions) {\n\t\tthis.rootDir = secretsDir(options.agentDir);\n\t\tthis.vaultPath = secretVaultFile(options.agentDir);\n\t\tthis.materializedDir = managedSecretEnvDir(options.agentDir);\n\t\tthis.scryptN = validateScryptN(options.scryptN ?? DEFAULT_SCRYPT_N);\n\t\tthis.now = options.now ?? (() => new Date());\n\t\tthis.onEnvironmentChanged = options.onEnvironmentChanged;\n\t}\n\n\tstatic forAgentDir(agentDir: string): SecretVault {\n\t\treturn new SecretVault({ agentDir });\n\t}\n\n\tget isUnlocked(): boolean {\n\t\treturn this.cachedKey !== undefined;\n\t}\n\n\tasync exists(): Promise<boolean> {\n\t\tconst existing = await lstatIfExists(this.vaultPath);\n\t\tif (existing?.isSymbolicLink()) {\n\t\t\tthrow new SecretVaultError(\"symlink_refused\", \"Secret vault symlinks are refused.\");\n\t\t}\n\t\treturn existing !== undefined;\n\t}\n\n\tlock(): void {\n\t\tthis.cachedKey?.fill(0);\n\t\tthis.cachedKey = undefined;\n\t\tthis.cachedKdf = undefined;\n\t\tthis.clearSecretCache();\n\t\tthis.activeProfilesByWorkspace.clear();\n\t\tthis.notifyEnvironmentChanged();\n\t}\n\n\t/** Environment for the nearest explicitly activated profile covering cwd. */\n\tgetEnvironmentForCwd(cwd: string): NodeJS.ProcessEnv {\n\t\tconst match = this.resolveCachedProfile(cwd);\n\t\tif (!match) return {};\n\t\treturn Object.fromEntries(match.profile.variables.map((variable) => [variable.name, variable.value]));\n\t}\n\n\thasEnvironmentForCwd(cwd: string): boolean {\n\t\treturn this.resolveCachedProfile(cwd) !== undefined;\n\t}\n\n\t/** Remove exact unlocked vault values and high-confidence credential shapes from model-facing text. */\n\tredactSensitiveText(text: string): string {\n\t\tlet redacted = redactKnownSecrets(text);\n\t\tconst values = [\n\t\t\t...new Set(\n\t\t\t\tthis.cachedProfiles\n\t\t\t\t\t.flatMap((profile) => profile.variables.map((variable) => variable.value))\n\t\t\t\t\t.filter(Boolean),\n\t\t\t),\n\t\t].sort((left, right) => right.length - left.length);\n\t\tfor (const value of values) {\n\t\t\tif (value.length >= 4) {\n\t\t\t\tredacted = redacted.split(value).join(\"[REDACTED]\");\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tconst bounded = new RegExp(`(^|[\\\\s=:;,])${escapeRegExp(value)}(?=$|[\\\\s,;])`, \"g\");\n\t\t\tredacted = redacted.replace(bounded, (_match, prefix: string) => `${prefix}[REDACTED]`);\n\t\t}\n\t\treturn redacted;\n\t}\n\n\tasync initialize(passphrase: string): Promise<void> {\n\t\tassertPassphrase(passphrase, true);\n\t\tawait ensurePrivateDirectory(this.rootDir);\n\t\tawait withFileLock(this.vaultPath, async () => {\n\t\t\tif (await lstatIfExists(this.vaultPath)) {\n\t\t\t\tthrow new SecretVaultError(\"already_initialized\", \"Secret vault is already initialized.\");\n\t\t\t}\n\t\t\tconst kdf = createVaultKdf(this.scryptN);\n\t\t\tconst key = await deriveKey(passphrase, kdf);\n\t\t\tconst payload: VaultPayload = { marker: VAULT_MARKER, profiles: [] };\n\t\t\ttry {\n\t\t\t\tawait this.writeEnvelope(kdf, payload, key);\n\t\t\t\tthis.replaceCachedKey(key, kdf);\n\t\t\t} catch (error) {\n\t\t\t\tkey.fill(0);\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t});\n\t}\n\n\tasync unlock(passphrase: string): Promise<void> {\n\t\tassertPassphrase(passphrase, false);\n\t\tif (!(await this.exists())) throw new SecretVaultError(\"not_initialized\", \"Secret vault is not initialized.\");\n\t\tconst envelope = parseEnvelope(await readBoundedFile(this.vaultPath));\n\t\tconst key = await deriveKey(passphrase, envelope.kdf);\n\t\tlet payload: VaultPayload | undefined;\n\t\ttry {\n\t\t\tconst environmentBefore = this.activeEnvironmentFingerprint();\n\t\t\tpayload = decryptPayload(envelope.payload, key);\n\t\t\tthis.replaceCachedKey(key, envelope.kdf);\n\t\t\tthis.refreshSecretCache(payload);\n\t\t\tif (environmentBefore !== this.activeEnvironmentFingerprint()) this.notifyEnvironmentChanged();\n\t\t} catch (error) {\n\t\t\tkey.fill(0);\n\t\t\tthrow error;\n\t\t} finally {\n\t\t\tif (payload) scrubPayload(payload);\n\t\t}\n\t}\n\n\tasync listProfiles(): Promise<SecretProfileSummary[]> {\n\t\treturn this.withPayload((payload) => payload.profiles.map(profileSummary), false);\n\t}\n\n\tasync upsertProfile(\n\t\tprofile: string,\n\t\tdescription: string | undefined,\n\t\tvalues: readonly SecretVariableValue[],\n\t): Promise<SecretProfileSummary> {\n\t\tif (values.length === 0) {\n\t\t\tthrow new SecretVaultError(\"invalid_variable\", \"At least one environment variable is required.\");\n\t\t}\n\t\tconst seenNames = new Set<string>();\n\t\tconst normalizedValues = values.map((entry) => {\n\t\t\tconst name = validateVariableName(entry.name);\n\t\t\tif (seenNames.has(name)) {\n\t\t\t\tthrow new SecretVaultError(\"invalid_variable\", `Environment variable ${name} is duplicated.`);\n\t\t\t}\n\t\t\tseenNames.add(name);\n\t\t\treturn { name, value: validateSecretValue(entry.value) };\n\t\t});\n\t\treturn this.storeProfileDocument(\n\t\t\tprofile,\n\t\t\tdescription,\n\t\t\tserializeVariableValues(normalizedValues),\n\t\t\tundefined,\n\t\t\ttrue,\n\t\t);\n\t}\n\n\tasync replaceProfileDocument(\n\t\tprofile: string,\n\t\tdescription: string | undefined,\n\t\tdocument: string,\n\t\tbinding?: { workspace: string; envFile: string },\n\t): Promise<SecretProfileSummary> {\n\t\treturn this.storeProfileDocument(profile, description, document, binding, false);\n\t}\n\n\tasync getProfileDocument(profile: string): Promise<string | undefined> {\n\t\tconst normalizedProfile = validateProfileId(profile);\n\t\treturn this.withPayload(\n\t\t\t(payload) => payload.profiles.find((candidate) => candidate.profile === normalizedProfile)?.dotenv,\n\t\t\tfalse,\n\t\t);\n\t}\n\n\tasync readOwnerDotenv(destination: string): Promise<string> {\n\t\tthis.assertDestination(destination);\n\t\treturn readBoundedRegularFile(destination, MAX_DOTENV_DOCUMENT_BYTES, \"Dotenv file\");\n\t}\n\n\tasync removeProfile(profile: string, variableNames?: readonly string[]): Promise<SecretRemovalResult> {\n\t\tconst normalizedProfile = validateProfileId(profile);\n\t\tconst normalizedNames = variableNames?.map(validateVariableName);\n\t\tif (normalizedNames && new Set(normalizedNames).size !== normalizedNames.length) {\n\t\t\tthrow new SecretVaultError(\"invalid_variable\", \"Environment variable removals are duplicated.\");\n\t\t}\n\t\tlet managedMaterializationRemoved = false;\n\t\tlet boundMaterializationsRemoved = 0;\n\t\tconst result = await this.withPayload(async (payload) => {\n\t\t\tconst index = payload.profiles.findIndex((candidate) => candidate.profile === normalizedProfile);\n\t\t\tconst record = payload.profiles[index];\n\t\t\tif (!record) throw new SecretVaultError(\"profile_missing\", \"Secret profile does not exist.\");\n\t\t\tconst variables = validateDotenvProfileDocument(record.dotenv).variables;\n\t\t\tlet removedProfile: boolean;\n\t\t\tlet removedVariableNames: string[];\n\t\t\tlet remaining: SecretVariableValue[] = [];\n\t\t\tif (normalizedNames === undefined) {\n\t\t\t\tremovedProfile = true;\n\t\t\t\tremovedVariableNames = variables.map((variable) => variable.name);\n\t\t\t} else {\n\t\t\t\tif (normalizedNames.length === 0) {\n\t\t\t\t\tthrow new SecretVaultError(\"invalid_variable\", \"Select at least one environment variable to remove.\");\n\t\t\t\t}\n\t\t\t\tconst requested = new Set(normalizedNames);\n\t\t\t\tremovedVariableNames = variables\n\t\t\t\t\t.filter((variable) => requested.has(variable.name))\n\t\t\t\t\t.map((variable) => variable.name);\n\t\t\t\tif (removedVariableNames.length !== requested.size) {\n\t\t\t\t\tthrow new SecretVaultError(\n\t\t\t\t\t\t\"invalid_variable\",\n\t\t\t\t\t\t\"One or more requested environment variables do not exist.\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tremaining = variables.filter((variable) => !requested.has(variable.name));\n\t\t\t\tremovedProfile = remaining.length === 0;\n\t\t\t}\n\n\t\t\t// Validate the complete mutation before removing any recoverable materialization.\n\t\t\tmanagedMaterializationRemoved = await this.removeManagedMaterialization(normalizedProfile);\n\t\t\tboundMaterializationsRemoved = await this.removeBoundMaterializations(record);\n\t\t\tif (removedProfile) payload.profiles.splice(index, 1);\n\t\t\telse {\n\t\t\t\trecord.dotenv = serializeVariableValues(remaining);\n\t\t\t\trecord.updatedAt = this.now().toISOString();\n\t\t\t}\n\t\t\treturn { removedProfile, removedVariableNames };\n\t\t}, true);\n\t\tthis.deactivateProfile(normalizedProfile);\n\t\treturn {\n\t\t\tprofile: normalizedProfile,\n\t\t\t...result,\n\t\t\tmanagedMaterializationRemoved,\n\t\t\tboundMaterializationsRemoved,\n\t\t};\n\t}\n\n\tgetManagedEnvPath(profile: string): string {\n\t\treturn join(this.materializedDir, `${validateProfileId(profile)}.env`);\n\t}\n\n\tresolveBindingTarget(\n\t\tworkspace: string,\n\t\tenvFile: string,\n\t): {\n\t\tworkspace: string;\n\t\tenvFile: string;\n\t\tdestination: string;\n\t} {\n\t\tconst normalizedWorkspace = validateBindingWorkspace(resolve(workspace));\n\t\tconst normalizedEnvFile = validateBindingEnvFile(envFile);\n\t\tconst destination = resolve(normalizedWorkspace, normalizedEnvFile);\n\t\tif (!isPathInside(normalizedWorkspace, destination)) {\n\t\t\tthrow new SecretVaultError(\"destination_invalid\", \"Credential target must stay inside its workspace.\");\n\t\t}\n\t\treturn { workspace: normalizedWorkspace, envFile: normalizedEnvFile, destination };\n\t}\n\n\tasync resolveBindingForWorkspace(cwd: string, profile?: string): Promise<SecretBindingResolution> {\n\t\tconst normalizedCwd = resolve(cwd);\n\t\tconst normalizedProfile = profile === undefined ? undefined : validateProfileId(profile);\n\t\treturn this.withPayload((payload) => {\n\t\t\tconst matches = payload.profiles.flatMap((candidate) => {\n\t\t\t\tif (normalizedProfile !== undefined && candidate.profile !== normalizedProfile) return [];\n\t\t\t\tconst binding = candidate.bindings\n\t\t\t\t\t.filter((entry) => isPathInside(entry.workspace, normalizedCwd))\n\t\t\t\t\t.sort((left, right) => right.workspace.length - left.workspace.length)[0];\n\t\t\t\tif (!binding) return [];\n\t\t\t\treturn [{ candidate, binding }];\n\t\t\t});\n\t\t\tif (matches.length === 0) {\n\t\t\t\tthrow new SecretVaultError(\n\t\t\t\t\t\"binding_missing\",\n\t\t\t\t\tnormalizedProfile\n\t\t\t\t\t\t? `Secret profile ${normalizedProfile} is not bound to this workspace.`\n\t\t\t\t\t\t: \"No secret profile is bound to this workspace.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst longestRoot = Math.max(...matches.map((match) => match.binding.workspace.length));\n\t\t\tconst nearest = matches.filter((match) => match.binding.workspace.length === longestRoot);\n\t\t\tlet selected = nearest[0];\n\t\t\tif (nearest.length > 1) {\n\t\t\t\tconst active = nearest.find(\n\t\t\t\t\t(match) => this.activeProfilesByWorkspace.get(match.binding.workspace) === match.candidate.profile,\n\t\t\t\t);\n\t\t\t\tif (!active) {\n\t\t\t\t\tthrow new SecretVaultError(\n\t\t\t\t\t\t\"ambiguous_binding\",\n\t\t\t\t\t\t\"Multiple secret profiles apply to this workspace; select one by profile name.\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tselected = active;\n\t\t\t}\n\t\t\tconst parsed = validateDotenvProfileDocument(selected.candidate.dotenv);\n\t\t\treturn {\n\t\t\t\tprofile: selected.candidate.profile,\n\t\t\t\t...selected.binding,\n\t\t\t\tdestination: resolve(selected.binding.workspace, selected.binding.envFile),\n\t\t\t\tvariableNames: parsed.variables.map((variable) => variable.name),\n\t\t\t};\n\t\t}, false);\n\t}\n\n\tasync inspectEnvDestination(destination: string, profile: string): Promise<SecretEnvDestinationState> {\n\t\tvalidateProfileId(profile);\n\t\tthis.assertDestination(destination);\n\t\tconst existing = await lstatIfExists(destination);\n\t\tif (!existing) return \"missing\";\n\t\tif (existing.isSymbolicLink()) {\n\t\t\tthrow new SecretVaultError(\"symlink_refused\", \"Secret dotenv destination symlinks are refused.\");\n\t\t}\n\t\tif (!existing.isFile()) {\n\t\t\tthrow new SecretVaultError(\"destination_invalid\", \"Secret dotenv destination is not a regular file.\");\n\t\t}\n\t\tconst firstLine = (await readFilePrefix(destination, 512)).split(/\\r?\\n/, 1)[0] ?? \"\";\n\t\tif (firstLine === `${MANAGED_ENV_HEADER_PREFIX}${profile}`) return \"managed-profile\";\n\t\tif (firstLine.startsWith(MANAGED_ENV_HEADER_PREFIX)) return \"managed-other\";\n\t\treturn \"unmanaged\";\n\t}\n\n\tasync materializeEnv(\n\t\tprofile: string,\n\t\tdestination: string,\n\t\toptions: {\n\t\t\tactivationWorkspace?: string;\n\t\t\tallowReplaceUnmanaged?: boolean;\n\t\t\texpectedUnmanagedContent?: string;\n\t\t\tmanaged?: boolean;\n\t\t} = {},\n\t): Promise<SecretMaterializationResult> {\n\t\tconst normalizedProfile = validateProfileId(profile);\n\t\tthis.assertDestination(destination);\n\t\tconst previousState = await this.inspectEnvDestination(destination, normalizedProfile);\n\t\tawait this.assertReplaceableDestination(destination, previousState, options);\n\t\tif (options.managed) {\n\t\t\tif (resolve(destination) !== resolve(this.getManagedEnvPath(normalizedProfile))) {\n\t\t\t\tthrow new SecretVaultError(\"destination_invalid\", \"Managed dotenv destination is not canonical.\");\n\t\t\t}\n\t\t\tawait ensurePrivateDirectory(this.materializedDir);\n\t\t} else {\n\t\t\tconst parent = await lstatIfExists(dirname(destination));\n\t\t\tif (!parent?.isDirectory()) {\n\t\t\t\tthrow new SecretVaultError(\"destination_invalid\", \"Dotenv destination directory does not exist.\");\n\t\t\t}\n\t\t}\n\t\treturn this.withPayload(async (payload) => {\n\t\t\tconst record = payload.profiles.find((candidate) => candidate.profile === normalizedProfile);\n\t\t\tif (!record) throw new SecretVaultError(\"profile_missing\", \"Secret profile does not exist.\");\n\t\t\tconst binding = record.bindings.find(\n\t\t\t\t(candidate) => resolve(candidate.workspace, candidate.envFile) === resolve(destination),\n\t\t\t);\n\t\t\tconst activationCwd = options.activationWorkspace ? resolve(options.activationWorkspace) : undefined;\n\t\t\tconst activationBinding = activationCwd\n\t\t\t\t? record.bindings\n\t\t\t\t\t\t.filter((candidate) => isPathInside(candidate.workspace, activationCwd))\n\t\t\t\t\t\t.sort((left, right) => right.workspace.length - left.workspace.length)[0]\n\t\t\t\t: binding;\n\t\t\tif (activationCwd && !activationBinding) {\n\t\t\t\tthrow new SecretVaultError(\n\t\t\t\t\t\"binding_missing\",\n\t\t\t\t\t`Secret profile ${normalizedProfile} is not bound to this workspace.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (binding && !options.managed) await this.assertBoundDestinationParent(binding, destination);\n\t\t\tconst currentState = await this.inspectEnvDestination(destination, normalizedProfile);\n\t\t\tawait this.assertReplaceableDestination(destination, currentState, options);\n\t\t\tconst variableNames = validateDotenvProfileDocument(record.dotenv).variables.map((variable) => variable.name);\n\t\t\tconst body = record.dotenv.endsWith(\"\\n\") ? record.dotenv : `${record.dotenv}\\n`;\n\t\t\tlet dotenv = `${MANAGED_ENV_HEADER_PREFIX}${normalizedProfile}\\n# Generated by Pi. Do not edit, inspect, source as shell code, or commit.\\n${body}`;\n\t\t\ttry {\n\t\t\t\tawait writeFileAtomic(destination, dotenv, { mode: 0o600 });\n\t\t\t\tawait enforcePrivateFileMode(destination);\n\t\t\t\tif (activationBinding) {\n\t\t\t\t\tthis.activeProfilesByWorkspace.set(activationBinding.workspace, normalizedProfile);\n\t\t\t\t}\n\t\t\t} finally {\n\t\t\t\tdotenv = \"\";\n\t\t\t}\n\t\t\treturn { profile: normalizedProfile, variableNames, previousState: currentState };\n\t\t}, false);\n\t}\n\n\tprivate async storeProfileDocument(\n\t\tprofile: string,\n\t\tdescription: string | undefined,\n\t\tdocument: string,\n\t\tbinding: { workspace: string; envFile: string } | undefined,\n\t\tmerge: boolean,\n\t): Promise<SecretProfileSummary> {\n\t\tconst normalizedProfile = validateProfileId(profile);\n\t\tconst normalizedDescription = validateDescription(description);\n\t\tconst parsedDocument = validateDotenvProfileDocument(document);\n\t\tconst target = binding ? this.resolveBindingTarget(binding.workspace, binding.envFile) : undefined;\n\t\tconst normalizedBinding = target ? { workspace: target.workspace, envFile: target.envFile } : undefined;\n\n\t\tconst summary = await this.withPayload(async (payload) => {\n\t\t\tlet record = payload.profiles.find((candidate) => candidate.profile === normalizedProfile);\n\t\t\tconst timestamp = this.now().toISOString();\n\t\t\tif (!record && payload.profiles.length >= MAX_PROFILES) {\n\t\t\t\tthrow new SecretVaultError(\"profile_limit\", `Secret vault supports at most ${MAX_PROFILES} profiles.`);\n\t\t\t}\n\t\t\tconst nextBindings = record?.bindings.map((entry) => ({ ...entry })) ?? [];\n\t\t\tif (normalizedBinding) {\n\t\t\t\tconst next = { ...normalizedBinding, updatedAt: timestamp };\n\t\t\t\tconst existingIndex = nextBindings.findIndex((entry) => entry.workspace === normalizedBinding.workspace);\n\t\t\t\tif (existingIndex === -1) nextBindings.push(next);\n\t\t\t\telse nextBindings[existingIndex] = next;\n\t\t\t\tif (nextBindings.length > MAX_BINDINGS_PER_PROFILE) {\n\t\t\t\t\tthrow new SecretVaultError(\n\t\t\t\t\t\t\"profile_limit\",\n\t\t\t\t\t\t`A secret profile supports at most ${MAX_BINDINGS_PER_PROFILE} workspace bindings.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tlet nextDocument = parsedDocument.document;\n\t\t\tif (merge && record) {\n\t\t\t\tconst merged = new Map(\n\t\t\t\t\tvalidateDotenvProfileDocument(record.dotenv).variables.map((variable) => [\n\t\t\t\t\t\tvariable.name,\n\t\t\t\t\t\tvariable.value,\n\t\t\t\t\t]),\n\t\t\t\t);\n\t\t\t\tfor (const variable of parsedDocument.variables) merged.set(variable.name, variable.value);\n\t\t\t\tif (merged.size > MAX_VARIABLES_PER_PROFILE) {\n\t\t\t\t\tthrow new SecretVaultError(\n\t\t\t\t\t\t\"variable_limit\",\n\t\t\t\t\t\t`A secret profile supports at most ${MAX_VARIABLES_PER_PROFILE} variables.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tnextDocument = serializeVariableValues([...merged].map(([name, value]) => ({ name, value })));\n\t\t\t}\n\n\t\t\tif (record) {\n\t\t\t\tawait this.removeManagedMaterialization(normalizedProfile);\n\t\t\t\tawait this.removeBoundMaterializations(record);\n\t\t\t} else {\n\t\t\t\trecord = {\n\t\t\t\t\tprofile: normalizedProfile,\n\t\t\t\t\tcreatedAt: timestamp,\n\t\t\t\t\tupdatedAt: timestamp,\n\t\t\t\t\tdotenv: nextDocument,\n\t\t\t\t\tbindings: [],\n\t\t\t\t};\n\t\t\t\tpayload.profiles.push(record);\n\t\t\t}\n\t\t\tif (normalizedDescription !== undefined) record.description = normalizedDescription;\n\t\t\trecord.dotenv = nextDocument;\n\t\t\trecord.bindings = nextBindings.sort(\n\t\t\t\t(left, right) => left.workspace.localeCompare(right.workspace) || left.envFile.localeCompare(right.envFile),\n\t\t\t);\n\t\t\trecord.updatedAt = timestamp;\n\t\t\tpayload.profiles.sort((left, right) => left.profile.localeCompare(right.profile));\n\t\t\treturn profileSummary(record);\n\t\t}, true);\n\t\tthis.deactivateProfile(normalizedProfile);\n\t\treturn summary;\n\t}\n\n\tprivate async assertReplaceableDestination(\n\t\tdestination: string,\n\t\tstate: SecretEnvDestinationState,\n\t\toptions: { allowReplaceUnmanaged?: boolean; expectedUnmanagedContent?: string },\n\t): Promise<void> {\n\t\tif (state === \"managed-other\") {\n\t\t\tthrow new SecretVaultError(\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"Destination already contains a file managed for another secret profile.\",\n\t\t\t);\n\t\t}\n\t\tif (state !== \"unmanaged\") return;\n\t\tif (!options.allowReplaceUnmanaged || options.expectedUnmanagedContent === undefined) {\n\t\t\tthrow new SecretVaultError(\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"Destination already contains an unmanaged file that was not reviewed for replacement.\",\n\t\t\t);\n\t\t}\n\t\tif ((await this.readOwnerDotenv(destination)) !== options.expectedUnmanagedContent) {\n\t\t\tthrow new SecretVaultError(\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"The reviewed dotenv file changed before replacement and was preserved.\",\n\t\t\t);\n\t\t}\n\t}\n\n\tprivate async assertBoundDestinationParent(binding: SecretBindingSummary, destination: string): Promise<void> {\n\t\ttry {\n\t\t\tconst [workspace, parent] = await Promise.all([\n\t\t\t\tfs.realpath(binding.workspace),\n\t\t\t\tfs.realpath(dirname(destination)),\n\t\t\t]);\n\t\t\tif (isPathInside(workspace, parent)) return;\n\t\t} catch {\n\t\t\t// Collapse filesystem detail so a model-facing failure cannot disclose unrelated paths.\n\t\t}\n\t\tthrow new SecretVaultError(\n\t\t\t\"destination_invalid\",\n\t\t\t\"Credential destination resolves outside its bound workspace or cannot be verified.\",\n\t\t);\n\t}\n\n\tprivate assertDestination(destination: string): void {\n\t\tif (!isAbsolute(destination) || resolve(destination) === resolve(this.vaultPath)) {\n\t\t\tthrow new SecretVaultError(\n\t\t\t\t\"destination_invalid\",\n\t\t\t\t\"Secret dotenv destination must be an absolute non-vault path.\",\n\t\t\t);\n\t\t}\n\t}\n\n\tprivate replaceCachedKey(key: Buffer, kdf: VaultKdf): void {\n\t\tthis.cachedKey?.fill(0);\n\t\tthis.cachedKey = key;\n\t\tthis.cachedKdf = { ...kdf };\n\t}\n\n\tprivate clearSecretCache(): void {\n\t\tfor (const profile of this.cachedProfiles) {\n\t\t\tfor (const variable of profile.variables) variable.value = \"\";\n\t\t}\n\t\tthis.cachedProfiles = [];\n\t}\n\n\tprivate deactivateProfile(profile: string): void {\n\t\tlet changed = false;\n\t\tfor (const [workspace, activeProfile] of this.activeProfilesByWorkspace) {\n\t\t\tif (activeProfile !== profile) continue;\n\t\t\tthis.activeProfilesByWorkspace.delete(workspace);\n\t\t\tchanged = true;\n\t\t}\n\t\tconst cached = this.cachedProfiles.find((candidate) => candidate.profile === profile);\n\t\tif (cached) {\n\t\t\tfor (const variable of cached.variables) variable.value = \"\";\n\t\t\tcached.variables = [];\n\t\t}\n\t\tif (changed) this.notifyEnvironmentChanged();\n\t}\n\n\tprivate notifyEnvironmentChanged(): void {\n\t\ttry {\n\t\t\tthis.onEnvironmentChanged?.();\n\t\t} catch {\n\t\t\t// Credential state changes remain authoritative even if host cleanup is best-effort.\n\t\t}\n\t}\n\n\tprivate activeEnvironmentFingerprint(): string {\n\t\tconst hash = createHash(\"sha256\");\n\t\tfor (const profile of this.cachedProfiles) {\n\t\t\tconst activeBindings = profile.bindings\n\t\t\t\t.filter((binding) => this.activeProfilesByWorkspace.get(binding.workspace) === profile.profile)\n\t\t\t\t.sort((left, right) => left.workspace.localeCompare(right.workspace));\n\t\t\tif (activeBindings.length === 0) continue;\n\t\t\thash.update(`${profile.profile.length}:${profile.profile}`);\n\t\t\tfor (const binding of activeBindings) hash.update(`${binding.workspace.length}:${binding.workspace}`);\n\t\t\tfor (const variable of profile.variables) {\n\t\t\t\thash.update(`${variable.name.length}:${variable.name}${variable.value.length}:${variable.value}`);\n\t\t\t}\n\t\t}\n\t\treturn hash.digest(\"hex\");\n\t}\n\n\tprivate refreshSecretCache(payload: VaultPayload): void {\n\t\tthis.clearSecretCache();\n\t\tthis.cachedProfiles = payload.profiles.map((profile) => ({\n\t\t\tprofile: profile.profile,\n\t\t\tbindings: profile.bindings.map((binding) => ({ ...binding })),\n\t\t\tvariables: profile.bindings.some(\n\t\t\t\t(binding) => this.activeProfilesByWorkspace.get(binding.workspace) === profile.profile,\n\t\t\t)\n\t\t\t\t? parseDotenvDocument(profile.dotenv).variables.map((variable) => ({ ...variable }))\n\t\t\t\t: [],\n\t\t}));\n\t\tfor (const [workspace, profile] of this.activeProfilesByWorkspace) {\n\t\t\tconst stillBound = this.cachedProfiles.some(\n\t\t\t\t(candidate) =>\n\t\t\t\t\tcandidate.profile === profile && candidate.bindings.some((binding) => binding.workspace === workspace),\n\t\t\t);\n\t\t\tif (!stillBound) this.activeProfilesByWorkspace.delete(workspace);\n\t\t}\n\t}\n\n\tprivate resolveCachedProfile(\n\t\tcwd: string,\n\t): { profile: CachedSecretProfile; binding: SecretBindingSummary } | undefined {\n\t\tconst resolvedCwd = resolve(cwd);\n\t\treturn this.cachedProfiles\n\t\t\t.flatMap((profile) => {\n\t\t\t\tconst binding = profile.bindings\n\t\t\t\t\t.filter((candidate) => isPathInside(candidate.workspace, resolvedCwd))\n\t\t\t\t\t.sort((left, right) => right.workspace.length - left.workspace.length)[0];\n\t\t\t\treturn binding ? [{ profile, binding }] : [];\n\t\t\t})\n\t\t\t.filter((match) => this.activeProfilesByWorkspace.get(match.binding.workspace) === match.profile.profile)\n\t\t\t.sort((left, right) => right.binding.workspace.length - left.binding.workspace.length)[0];\n\t}\n\n\tprivate requireUnlocked(): { key: Buffer; kdf: VaultKdf } {\n\t\tif (!this.cachedKey || !this.cachedKdf) {\n\t\t\tthrow new SecretVaultError(\"not_unlocked\", \"Secret vault is locked.\");\n\t\t}\n\t\treturn { key: this.cachedKey, kdf: this.cachedKdf };\n\t}\n\n\tprivate async withPayload<T>(operation: (payload: VaultPayload) => T | Promise<T>, write: boolean): Promise<T> {\n\t\treturn withFileLock(this.vaultPath, async () => {\n\t\t\tconst environmentBefore = this.activeEnvironmentFingerprint();\n\t\t\tconst { key, kdf } = this.requireUnlocked();\n\t\t\tif (!(await lstatIfExists(this.vaultPath))) {\n\t\t\t\tthrow new SecretVaultError(\"not_initialized\", \"Secret vault is not initialized.\");\n\t\t\t}\n\t\t\tconst envelope = parseEnvelope(await readBoundedFile(this.vaultPath));\n\t\t\tif (!sameKdf(kdf, envelope.kdf)) {\n\t\t\t\tthis.lock();\n\t\t\t\tthrow new SecretVaultError(\"unlock_failed\", \"Secret vault changed and must be unlocked again.\");\n\t\t\t}\n\t\t\tconst payload = decryptPayload(envelope.payload, key);\n\t\t\ttry {\n\t\t\t\tconst result = await operation(payload);\n\t\t\t\tif (write) await this.writeEnvelope(kdf, payload, key);\n\t\t\t\tthis.refreshSecretCache(payload);\n\t\t\t\tif (environmentBefore !== this.activeEnvironmentFingerprint()) this.notifyEnvironmentChanged();\n\t\t\t\treturn result;\n\t\t\t} finally {\n\t\t\t\tscrubPayload(payload);\n\t\t\t}\n\t\t});\n\t}\n\n\tprivate async writeEnvelope(kdf: VaultKdf, payload: VaultPayload, key: Buffer): Promise<void> {\n\t\tlet serialized = serializeEnvelope(kdf, payload, key);\n\t\ttry {\n\t\t\tawait writeFileAtomic(this.vaultPath, serialized, { mode: 0o600 });\n\t\t\tawait enforcePrivateFileMode(this.vaultPath);\n\t\t} finally {\n\t\t\tserialized = \"\";\n\t\t}\n\t}\n\n\tprivate async removeBoundMaterializations(record: {\n\t\tprofile: string;\n\t\tbindings: SecretBindingSummary[];\n\t}): Promise<number> {\n\t\tlet removed = 0;\n\t\tfor (const binding of record.bindings) {\n\t\t\tconst destination = resolve(binding.workspace, binding.envFile);\n\t\t\tconst existing = await lstatIfExists(destination);\n\t\t\tif (!existing) continue;\n\t\t\tconst state = await this.inspectEnvDestination(destination, record.profile);\n\t\t\tif (state !== \"managed-profile\") continue;\n\t\t\tawait fs.unlink(destination);\n\t\t\tremoved++;\n\t\t}\n\t\treturn removed;\n\t}\n\n\tprivate async removeManagedMaterialization(profile: string): Promise<boolean> {\n\t\tconst path = this.getManagedEnvPath(profile);\n\t\tconst existing = await lstatIfExists(path);\n\t\tif (!existing) return false;\n\t\tif (existing.isSymbolicLink()) {\n\t\t\tthrow new SecretVaultError(\"symlink_refused\", \"Managed dotenv symlinks are refused.\");\n\t\t}\n\t\tif (!existing.isFile()) {\n\t\t\tthrow new SecretVaultError(\"destination_invalid\", \"Managed dotenv path is not a regular file.\");\n\t\t}\n\t\tconst state = await this.inspectEnvDestination(path, profile);\n\t\tif (state !== \"managed-profile\") return false;\n\t\tawait fs.unlink(path);\n\t\treturn true;\n\t}\n}\n"]}

package/dist/core/session-analytics.d.ts

@@ -7,36 +7,17 @@
  * subtree spend" (footer roll-up, print-mode child reporting), the daily cross-session totals, the
  * /context window estimate, and HTML/JSONL export of the current branch.
  */
-import type { AgentMessage, AgentState } from "@caupulican/pi-agent-core";
+import { type AgentMessage, type AgentState } from "@caupulican/pi-agent-core";
 import { type SessionManager } from "@caupulican/pi-agent-core/node";
-import type { Model, ToolArgumentExecutionOutcome, ToolArgumentTeachState, ToolArgumentValidationTelemetryEvent, Usage } from "@caupulican/pi-ai";
-import { type SessionStats, type SpawnedUsageTotals } from "./agent-session.ts";
+import type { Model, Usage } from "@caupulican/pi-ai";
+import { type SessionStats, type SpawnedUsageTotals } from "./agent-session-contracts.ts";
 import { type SessionCostSummary } from "./cost/cost-summary.ts";
 import { type DailyUsageTotals } from "./cost/daily-usage.ts";
 import type { ContextUsage, ToolDefinition } from "./extensions/index.ts";
 import type { SettingsManager } from "./settings-manager.ts";
 import { type ToolArgumentValidationLogRecord } from "./tool-recovery-log-records.ts";
+import { type ToolArgumentValidationStats } from "./tool-recovery-stats.ts";
 export declare const TOOL_ARGUMENT_VALIDATION_CUSTOM_TYPE = "tool_argument_validation";
-export interface ToolArgumentValidationTeachEfficacy {
-    recurrenceBefore: number;
-    recurrenceAfter: number;
-    repairedThenSucceeded: number;
-    repairedThenFailed: number;
-    repairedThenNotRun: number;
-}
-export interface ToolArgumentValidationStats {
-    clean: number;
-    repaired: number;
-    bounced: number;
-    failureModes: Record<string, number>;
-    repairsApplied: Record<string, number>;
-    taught: Record<ToolArgumentTeachState, number>;
-    executionOutcome: Record<ToolArgumentExecutionOutcome, number>;
-    teachEfficacy: Record<string, ToolArgumentValidationTeachEfficacy>;
-}
-export interface ToolArgumentValidationRecord extends ToolArgumentValidationTelemetryEvent {
-    version: 1;
-}
 export interface SessionAnalyticsDeps {
     /** Live agent state — assistant-message usage and message counts are read from here. */
     getState(): AgentState;

package/dist/core/session-analytics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-analytics.d.ts","sourceRoot":"","sources":["../../src/core/session-analytics.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAON,KAAK,cAAc,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAEX,KAAK,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,oCAAoC,EACpC,KAAK,EACL,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EACN,KAAK,YAAY,EAGjB,KAAK,kBAAkB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAKN,KAAK,kBAAkB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGN,KAAK,gBAAgB,EAGrB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAEN,KAAK,+BAA+B,EACpC,MAAM,gCAAgC,CAAC;AAQxC,eAAO,MAAM,oCAAoC,6BAA6B,CAAC;AAE/E,MAAM,WAAW,mCAAmC;IACnD,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,2BAA2B;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,EAAE,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;IAC/C,gBAAgB,EAAE,MAAM,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC;IAC/D,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,mCAAmC,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,4BAA6B,SAAQ,oCAAoC;IACzF,OAAO,EAAE,CAAC,CAAC;CACX;AAED,MAAM,WAAW,oBAAoB;IACpC,0FAAwF;IACxF,QAAQ,IAAI,UAAU,CAAC;IACvB,sGAAoG;IACpG,WAAW,IAAI,YAAY,EAAE,CAAC;IAC9B,iFAA+E;IAC/E,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IACnC,uFAAqF;IACrF,iBAAiB,IAAI,cAAc,CAAC;IACpC,kDAAgD;IAChD,kBAAkB,IAAI,eAAe,CAAC;IACtC,4EAA4E;IAC5E,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;IAC5D,2GAA2G;IAC3G,2BAA2B,IAAI,MAAM,CAAC;CACtC;AAED,qBAAa,gBAAgB;IAC5B,iEAAiE;IACjE,OAAO,CAAC,wBAAwB,CAAC,CAG/B;IACF,0GAA0G;IAC1G,OAAO,CAAC,gBAAgB,CAAC,CAMvB;IACF;0FACsF;IACtF,OAAO,CAAC,iBAAiB,CAAC,CAMxB;IACF,iHAAiH;IACjH,OAAO,CAAC,4BAA4B,CAA0C;IAC9E,4EAA4E;IAC5E,OAAO,CAAC,yBAAyB,CAAC,CAIhC;IAEF,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;IAE5C,YAAY,IAAI,EAAE,oBAAoB,EAErC;IAED,eAAe,IAAI,YAAY,CAgD9B;IAED,sBAAsB,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAkBxD;IAED,4BAA4B,CAAC,MAAM,EAAE,+BAA+B,GAAG,IAAI,CAI1E;IAED,OAAO,CAAC,wCAAwC;IAkBhD,8BAA8B,IAAI,2BAA2B,CAgC5D;IAED;;;;;;;;;OASG;IACH,kBAAkB,IAAI,KAAK,CAuD1B;IAED;;;;;;;;;;;OAWG;IACH,eAAe,CACd,KAAK,EAAE,KAAK,EACZ,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GACpE,MAAM,GAAG,SAAS,CAcpB;IAED,OAAO,CAAC,2BAA2B;IAqBnC;;;OAGG;IACH,eAAe,IAAI,kBAAkB,CAGpC;IAED,cAAc,CAAC,GAAG,OAAa,GAAG,kBAAkB,CA2BnD;IAED,mBAAmB,CAAC,GAAG,OAAa,GAAG,gBAAgB,CA2BtD;IAED,sBAAsB,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,EAAE,GAAG,OAAa,GAAG,MAAM,CAExF;IAED,OAAO,CAAC,2BAA2B;IAoEnC,eAAe,IAAI,YAAY,GAAG,SAAS,CAuB1C;IAED;;;;OAIG;IACG,YAAY,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBvD;IAED;;;;;OAKG;IACH,aAAa,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAgCzC;IAED;;;;OAIG;IACH,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAuBzC;CACD","sourcesContent":["/**\n * Session usage / cost / stats accounting, context-window usage, and session export.\n *\n * Extracted verbatim from agent-session.ts (god-file decomposition). Read-only over the session\n * except for its two owned memo caches (`_spawnedUsageCache`, `_dailyUsageCache`) — it never mutates\n * agent or session state. Single source of truth for \"how much did this session and its spawned\n * subtree spend\" (footer roll-up, print-mode child reporting), the daily cross-session totals, the\n * /context window estimate, and HTML/JSONL export of the current branch.\n */\n\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\nimport type { AgentMessage, AgentState } from \"@caupulican/pi-agent-core\";\nimport {\n\tCURRENT_SESSION_VERSION,\n\tcalculateContextTokens,\n\testimateContextTokens,\n\tgetLatestCompactionEntry,\n\ttype SessionEntry,\n\ttype SessionHeader,\n\ttype SessionManager,\n} from \"@caupulican/pi-agent-core/node\";\nimport type {\n\tAssistantMessage,\n\tModel,\n\tToolArgumentExecutionOutcome,\n\tToolArgumentTeachState,\n\tToolArgumentValidationTelemetryEvent,\n\tUsage,\n} from \"@caupulican/pi-ai\";\nimport { getSessionsDir } from \"../config.ts\";\nimport { theme } from \"../modes/interactive/theme/theme.ts\";\nimport { resolvePath } from \"../utils/paths.ts\";\nimport {\n\ttype SessionStats,\n\tSPAWNED_USAGE_CUSTOM_TYPE,\n\ttype SpawnedUsageReport,\n\ttype SpawnedUsageTotals,\n} from \"./agent-session.ts\";\nimport {\n\taccumulateCurrentSessionCostsFromEntries,\n\ttype CurrentSessionCostAccumulator,\n\tcreateCurrentSessionCostAccumulator,\n\tcreateSessionCostSummary,\n\ttype SessionCostSummary,\n} from \"./cost/cost-summary.ts\";\nimport {\n\taggregateDailyUsageFromSessionFiles,\n\taggregateDailyUsageFromSessionRoot,\n\ttype DailyUsageTotals,\n\tformatDailyUsageBreakdown,\n\tgetLocalDayWindow,\n} from \"./cost/daily-usage.ts\";\nimport { exportSessionToHtml, type ToolHtmlRenderer } from \"./export-html/index.ts\";\nimport { createToolHtmlRenderer } from \"./export-html/tool-renderer.ts\";\nimport type { ContextUsage, ToolDefinition } from \"./extensions/index.ts\";\nimport type { SettingsManager } from \"./settings-manager.ts\";\nimport {\n\tisToolArgumentValidationLogRecord,\n\ttype ToolArgumentValidationLogRecord,\n} from \"./tool-recovery-log-records.ts\";\nimport {\n\tconsumeToolArgumentValidationRecord,\n\tcreateEmptyToolArgumentValidationStats,\n\tgetToolRecoveryRecordSequence,\n\treadPersistedToolRecoveryStats,\n} from \"./tool-recovery-stats.ts\";\n\nexport const TOOL_ARGUMENT_VALIDATION_CUSTOM_TYPE = \"tool_argument_validation\";\n\nexport interface ToolArgumentValidationTeachEfficacy {\n\trecurrenceBefore: number;\n\trecurrenceAfter: number;\n\trepairedThenSucceeded: number;\n\trepairedThenFailed: number;\n\trepairedThenNotRun: number;\n}\n\nexport interface ToolArgumentValidationStats {\n\tclean: number;\n\trepaired: number;\n\tbounced: number;\n\tfailureModes: Record<string, number>;\n\trepairsApplied: Record<string, number>;\n\ttaught: Record<ToolArgumentTeachState, number>;\n\texecutionOutcome: Record<ToolArgumentExecutionOutcome, number>;\n\tteachEfficacy: Record<string, ToolArgumentValidationTeachEfficacy>;\n}\n\nexport interface ToolArgumentValidationRecord extends ToolArgumentValidationTelemetryEvent {\n\tversion: 1;\n}\n\nexport interface SessionAnalyticsDeps {\n\t/** Live agent state — assistant-message usage and message counts are read from here. */\n\tgetState(): AgentState;\n\t/** All messages (agent state view) — used for context-window estimation and last-assistant text. */\n\tgetMessages(): AgentMessage[];\n\t/** Current session model — its context window bounds the /context estimate. */\n\tgetModel(): Model<any> | undefined;\n\t/** Session log — entries feed spawned-usage roll-up, daily totals, branch export. */\n\tgetSessionManager(): SessionManager;\n\t/** Settings — the export theme is read here. */\n\tgetSettingsManager(): SettingsManager;\n\t/** Resolve a tool definition for the HTML export's custom-tool renderer. */\n\tgetToolDefinition(name: string): ToolDefinition | undefined;\n\t/** Sidecar recovery telemetry log; read on demand so turn handling never writes session custom entries. */\n\tgetToolRecoveryEventLogPath(): string;\n}\n\nexport class SessionAnalytics {\n\t/** Incremental aggregate over append-ordered session entries. */\n\tprivate _currentSessionCostCache?: {\n\t\tentryCount: number;\n\t\taccumulator: CurrentSessionCostAccumulator;\n\t};\n\t/** Memoized daily usage totals with a short TTL, keyed by the resolved scope dir and local-day window. */\n\tprivate _dailyUsageCache?: {\n\t\tsessionDir: string;\n\t\twindowStartMs: number;\n\t\twindowEndMs: number;\n\t\texpiresAt: number;\n\t\ttotals: DailyUsageTotals;\n\t};\n\t/** Memoized full cost summary. The footer renders on every streamed delta and keystroke, so\n\t * rescanning a long session log there turns redraw into O(entries) work per frame. */\n\tprivate _costSummaryCache?: {\n\t\tentryCount: number;\n\t\tdailyTotals: DailyUsageTotals;\n\t\twindowStartMs: number;\n\t\twindowEndMs: number;\n\t\tsummary: SessionCostSummary;\n\t};\n\t/** Cumulative stats initialized once from persisted telemetry, then updated without retaining record details. */\n\tprivate _toolArgumentValidationStats: ToolArgumentValidationStats | undefined;\n\t/** Incremental context-usage state keyed by the append-only branch leaf. */\n\tprivate _postCompactionUsageCache?: {\n\t\tleafId: string | null;\n\t\thasCompaction: boolean;\n\t\thasPostCompactionUsage: boolean;\n\t};\n\n\tprivate readonly deps: SessionAnalyticsDeps;\n\n\tconstructor(deps: SessionAnalyticsDeps) {\n\t\tthis.deps = deps;\n\t}\n\n\tgetSessionStats(): SessionStats {\n\t\tconst state = this.deps.getState();\n\t\tconst userMessages = state.messages.filter((m) => m.role === \"user\").length;\n\t\tconst assistantMessages = state.messages.filter((m) => m.role === \"assistant\").length;\n\t\tconst toolResults = state.messages.filter((m) => m.role === \"toolResult\").length;\n\n\t\tlet toolCalls = 0;\n\t\tlet totalInput = 0;\n\t\tlet totalOutput = 0;\n\t\tlet totalCacheRead = 0;\n\t\tlet totalCacheWrite = 0;\n\t\tlet totalCost = 0;\n\n\t\tfor (const message of state.messages) {\n\t\t\tif (message.role === \"assistant\") {\n\t\t\t\tconst assistantMsg = message as AssistantMessage;\n\t\t\t\ttoolCalls += assistantMsg.content.filter((c) => c.type === \"toolCall\").length;\n\t\t\t\ttotalInput += assistantMsg.usage.input;\n\t\t\t\ttotalOutput += assistantMsg.usage.output;\n\t\t\t\ttotalCacheRead += assistantMsg.usage.cacheRead;\n\t\t\t\ttotalCacheWrite += assistantMsg.usage.cacheWrite;\n\t\t\t\ttotalCost += assistantMsg.usage.cost.total;\n\t\t\t}\n\t\t}\n\n\t\tconst toolArgumentValidation = this.getToolArgumentValidationStats();\n\t\tconst compactionGates = this.getCompactionGateStats();\n\n\t\treturn {\n\t\t\tsessionFile: this.deps.getSessionManager().getSessionFile(),\n\t\t\tsessionId: this.deps.getSessionManager().getSessionId(),\n\t\t\tuserMessages,\n\t\t\tassistantMessages,\n\t\t\ttoolCalls,\n\t\t\ttoolResults,\n\t\t\ttotalMessages: state.messages.length,\n\t\t\ttokens: {\n\t\t\t\tinput: totalInput,\n\t\t\t\toutput: totalOutput,\n\t\t\t\tcacheRead: totalCacheRead,\n\t\t\t\tcacheWrite: totalCacheWrite,\n\t\t\t\ttotal: totalInput + totalOutput + totalCacheRead + totalCacheWrite,\n\t\t\t},\n\t\t\tcost: totalCost,\n\t\t\tcontextUsage: this.getContextUsage(),\n\t\t\ttoolArgumentValidation,\n\t\t\tcompactionGates,\n\t\t};\n\t}\n\n\tgetCompactionGateStats(): SessionStats[\"compactionGates\"] {\n\t\tlet gateFailures = 0;\n\t\tlet deterministicGapFills = 0;\n\t\tlet compactionsWithGateFailures = 0;\n\t\tfor (const entry of this.deps.getSessionManager().getEntries()) {\n\t\t\tif (entry.type !== \"compaction\") continue;\n\t\t\tconst details = entry.details;\n\t\t\tif (!details || typeof details !== \"object\") continue;\n\t\t\tconst rawGateFailures = (details as { verificationGateFailures?: unknown }).verificationGateFailures;\n\t\t\tconst rawGapFills = (details as { deterministicGapFills?: unknown }).deterministicGapFills;\n\t\t\tconst entryGateFailures =\n\t\t\t\ttypeof rawGateFailures === \"number\" && Number.isFinite(rawGateFailures) ? rawGateFailures : 0;\n\t\t\tconst entryGapFills = typeof rawGapFills === \"number\" && Number.isFinite(rawGapFills) ? rawGapFills : 0;\n\t\t\tgateFailures += entryGateFailures;\n\t\t\tdeterministicGapFills += entryGapFills;\n\t\t\tif (entryGateFailures > 0) compactionsWithGateFailures++;\n\t\t}\n\t\treturn { gateFailures, deterministicGapFills, compactionsWithGateFailures };\n\t}\n\n\trecordToolArgumentValidation(record: ToolArgumentValidationLogRecord): void {\n\t\tconst stats = this.getToolArgumentValidationStats();\n\t\tconsumeToolArgumentValidationRecord(stats, record);\n\t\tthis._toolArgumentValidationStats = stats;\n\t}\n\n\tprivate readToolArgumentValidationSidecarRecords(): ToolArgumentValidationLogRecord[] {\n\t\tconst filePath = this.deps.getToolRecoveryEventLogPath();\n\t\tif (!existsSync(filePath)) return [];\n\t\tconst records: ToolArgumentValidationLogRecord[] = [];\n\t\ttry {\n\t\t\tconst sessionId = this.deps.getSessionManager().getSessionId();\n\t\t\tfor (const line of readFileSync(filePath, \"utf-8\").split(\"\\n\")) {\n\t\t\t\tif (line.trim().length === 0) continue;\n\t\t\t\tconst parsed = JSON.parse(line) as unknown;\n\t\t\t\tif (!isToolArgumentValidationLogRecord(parsed) || parsed.sessionId !== sessionId) continue;\n\t\t\t\trecords.push(parsed);\n\t\t\t}\n\t\t} catch {\n\t\t\treturn [];\n\t\t}\n\t\treturn records;\n\t}\n\n\tgetToolArgumentValidationStats(): ToolArgumentValidationStats {\n\t\tif (this._toolArgumentValidationStats) return structuredClone(this._toolArgumentValidationStats);\n\t\tconst eventLogPath = this.deps.getToolRecoveryEventLogPath();\n\t\tconst sessionId = this.deps.getSessionManager().getSessionId();\n\t\tconst persisted = readPersistedToolRecoveryStats(eventLogPath, sessionId);\n\t\tconst stats = persisted ? structuredClone(persisted.stats) : createEmptyToolArgumentValidationStats();\n\t\tconst seen = new Set<string>();\n\t\tconst consume = (record: ToolArgumentValidationRecord, key: string): void => {\n\t\t\tif (seen.has(key)) return;\n\t\t\tseen.add(key);\n\t\t\tconsumeToolArgumentValidationRecord(stats, record);\n\t\t};\n\n\t\tfor (const entry of this.deps.getSessionManager().getEntries()) {\n\t\t\tif (entry.type !== \"custom\" || entry.customType !== TOOL_ARGUMENT_VALIDATION_CUSTOM_TYPE) continue;\n\t\t\tconst record = entry.data as ToolArgumentValidationRecord | undefined;\n\t\t\tif (!record || record.version !== 1) continue;\n\t\t\tconsume(record, `legacy:${entry.id}`);\n\t\t}\n\t\tfor (const record of this.readToolArgumentValidationSidecarRecords()) {\n\t\t\tif (\n\t\t\t\tpersisted &&\n\t\t\t\trecord.sessionId === sessionId &&\n\t\t\t\tgetToolRecoveryRecordSequence(record) <= persisted.lastRecordSequence\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tconsume(record, record.recordId);\n\t\t}\n\n\t\tthis._toolArgumentValidationStats = stats;\n\t\treturn structuredClone(stats);\n\t}\n\n\t/**\n\t * Cumulative usage (full breakdown) for this session's entire spawn subtree: its own\n\t * assistant messages PLUS every `spawned_usage` report it has rolled up. Single source of\n\t * truth for \"how much did this session and everything it spawned spend\" — used by print-mode\n\t * to emit a child's total so a spawner can roll it up via {@link addSpawnedUsage}.\n\t *\n\t * Including the `spawned_usage` reports is what keeps the single-hop invariant intact: a child\n\t * that itself spawned grandchildren must report own + sub-usage in one number, or the parent\n\t * silently under-counts the grandchildren.\n\t */\n\tgetCumulativeUsage(): Usage {\n\t\tlet input = 0;\n\t\tlet output = 0;\n\t\tlet cacheRead = 0;\n\t\tlet cacheWrite = 0;\n\t\tlet totalTokens = 0;\n\t\tlet costInput = 0;\n\t\tlet costOutput = 0;\n\t\tlet costCacheRead = 0;\n\t\tlet costCacheWrite = 0;\n\t\tlet costTotal = 0;\n\t\tconst add = (usage: Usage) => {\n\t\t\tinput += usage.input;\n\t\t\toutput += usage.output;\n\t\t\tcacheRead += usage.cacheRead;\n\t\t\tcacheWrite += usage.cacheWrite;\n\t\t\ttotalTokens += usage.totalTokens;\n\t\t\tcostInput += usage.cost.input;\n\t\t\tcostOutput += usage.cost.output;\n\t\t\tcostCacheRead += usage.cost.cacheRead;\n\t\t\tcostCacheWrite += usage.cost.cacheWrite;\n\t\t\tcostTotal += usage.cost.total;\n\t\t};\n\t\tfor (const message of this.deps.getState().messages) {\n\t\t\tif (message.role !== \"assistant\") continue;\n\t\t\tconst usage = (message as AssistantMessage).usage;\n\t\t\tif (!usage) continue;\n\t\t\tadd(usage);\n\t\t}\n\t\t// Roll up usage this session attributed to its own spawned children (single-hop).\n\t\tconst seenSpawnedReportIds = new Set<string>();\n\t\tfor (const entry of this.deps.getSessionManager().getEntries()) {\n\t\t\tif (entry.type !== \"custom\" || entry.customType !== SPAWNED_USAGE_CUSTOM_TYPE) continue;\n\t\t\tconst data = entry.data as SpawnedUsageReport | undefined;\n\t\t\tif (!data?.usage) continue;\n\t\t\tif (data.reportId) {\n\t\t\t\tif (seenSpawnedReportIds.has(data.reportId)) continue;\n\t\t\t\tseenSpawnedReportIds.add(data.reportId);\n\t\t\t}\n\t\t\tadd(data.usage);\n\t\t}\n\t\treturn {\n\t\t\tinput,\n\t\t\toutput,\n\t\t\tcacheRead,\n\t\t\tcacheWrite,\n\t\t\ttotalTokens,\n\t\t\tcost: {\n\t\t\t\tinput: costInput,\n\t\t\t\toutput: costOutput,\n\t\t\t\tcacheRead: costCacheRead,\n\t\t\t\tcacheWrite: costCacheWrite,\n\t\t\t\ttotal: costTotal,\n\t\t\t},\n\t\t};\n\t}\n\n\t/**\n\t * Record usage spent by a spawned/subagent session so the footer can roll it into the\n\t * displayed cost. Persisted as a `CustomEntry` (`customType: \"spawned_usage\"`, Model A) so\n\t * it survives reload and is reconstructed exactly like main usage; a new/forked session\n\t * starts fresh because it owns a new log file.\n\t *\n\t * Idempotent on `opts.reportId`: a re-report (retry, duplicate `agent_end`) with a\n\t * previously-seen id is ignored, so cost cannot be double-counted. Honors the single-hop\n\t * invariant documented on {@link SpawnedUsageReport}.\n\t *\n\t * @returns the id of the appended entry, or `undefined` if the report was a duplicate.\n\t */\n\taddSpawnedUsage(\n\t\tusage: Usage,\n\t\topts?: { label?: string; sourceSessionId?: string; reportId?: string },\n\t): string | undefined {\n\t\tconst reportId = opts?.reportId;\n\t\tif (reportId && this.getCurrentSessionCostTotals().seenSubagentReportIds.has(reportId)) {\n\t\t\treturn undefined;\n\t\t}\n\t\tconst report: SpawnedUsageReport = {\n\t\t\tusage,\n\t\t\tlabel: opts?.label,\n\t\t\tsourceSessionId: opts?.sourceSessionId,\n\t\t\treportId,\n\t\t};\n\t\tconst entryId = this.deps.getSessionManager().appendCustomEntry(SPAWNED_USAGE_CUSTOM_TYPE, report);\n\t\tif (reportId) this.getCurrentSessionCostTotals();\n\t\treturn entryId;\n\t}\n\n\tprivate getCurrentSessionCostTotals(): CurrentSessionCostAccumulator {\n\t\tconst sessionManager = this.deps.getSessionManager();\n\t\tconst entryCount = sessionManager.getEntryCount?.() ?? sessionManager.getEntries().length;\n\t\tlet cache = this._currentSessionCostCache;\n\t\tconst getEntriesSince = sessionManager.getEntriesSince?.bind(sessionManager);\n\t\tif (!cache || entryCount < cache.entryCount || !getEntriesSince) {\n\t\t\tcache = {\n\t\t\t\tentryCount,\n\t\t\t\taccumulator: accumulateCurrentSessionCostsFromEntries(\n\t\t\t\t\tcreateCurrentSessionCostAccumulator(),\n\t\t\t\t\tsessionManager.getEntries(),\n\t\t\t\t),\n\t\t\t};\n\t\t\tthis._currentSessionCostCache = cache;\n\t\t} else if (entryCount > cache.entryCount) {\n\t\t\taccumulateCurrentSessionCostsFromEntries(cache.accumulator, getEntriesSince(cache.entryCount));\n\t\t\tcache.entryCount = entryCount;\n\t\t}\n\t\treturn cache.accumulator;\n\t}\n\n\t/**\n\t * Aggregate all recorded spawned-usage reports (see {@link addSpawnedUsage}). The append-ordered\n\t * accumulator processes only new entries, so repeated turns do not rescan the full session.\n\t */\n\tgetSpawnedUsage(): SpawnedUsageTotals {\n\t\tconst current = this.getCurrentSessionCostTotals();\n\t\treturn { cost: current.subagentCost, reports: current.subagentReports };\n\t}\n\n\tgetCostSummary(now = new Date()): SessionCostSummary {\n\t\tconst sessionManager = this.deps.getSessionManager();\n\t\tconst entryCount = sessionManager.getEntryCount?.() ?? sessionManager.getEntries().length;\n\t\tconst window = getLocalDayWindow(now);\n\t\tconst dailyTotals = this.getDailyUsageTotals(now);\n\t\tconst cached = this._costSummaryCache;\n\t\tif (\n\t\t\tcached?.entryCount === entryCount &&\n\t\t\tcached.dailyTotals === dailyTotals &&\n\t\t\tcached.windowStartMs === window.startMs &&\n\t\t\tcached.windowEndMs === window.endMs\n\t\t) {\n\t\t\treturn cached.summary;\n\t\t}\n\t\tconst summary = createSessionCostSummary({\n\t\t\tcurrentTotals: this.getCurrentSessionCostTotals(),\n\t\t\tdailyTotals,\n\t\t\ttodayWindow: window,\n\t\t});\n\t\tthis._costSummaryCache = {\n\t\t\tentryCount,\n\t\t\tdailyTotals,\n\t\t\twindowStartMs: window.startMs,\n\t\t\twindowEndMs: window.endMs,\n\t\t\tsummary,\n\t\t};\n\t\treturn summary;\n\t}\n\n\tgetDailyUsageTotals(now = new Date()): DailyUsageTotals {\n\t\tconst sessionManager = this.deps.getSessionManager();\n\t\tconst sessionDir = sessionManager.getSessionDir();\n\t\tconst scope = sessionManager.usesDefaultSessionDir() ? getSessionsDir() : sessionDir;\n\t\tconst nowMs = now.getTime();\n\t\tconst window = getLocalDayWindow(now);\n\t\tif (\n\t\t\tthis._dailyUsageCache?.sessionDir === scope &&\n\t\t\tthis._dailyUsageCache.windowStartMs === window.startMs &&\n\t\t\tthis._dailyUsageCache.windowEndMs === window.endMs &&\n\t\t\tthis._dailyUsageCache.expiresAt > nowMs\n\t\t) {\n\t\t\treturn this._dailyUsageCache.totals;\n\t\t}\n\t\tconst sessionFile = sessionManager.getSessionFile();\n\t\tconst liveSession = sessionFile ? { filePath: sessionFile, entries: sessionManager.getEntries() } : undefined;\n\t\tconst totals = sessionManager.usesDefaultSessionDir()\n\t\t\t? aggregateDailyUsageFromSessionRoot(scope, window, liveSession)\n\t\t\t: aggregateDailyUsageFromSessionFiles(sessionDir, window, liveSession);\n\t\tthis._dailyUsageCache = {\n\t\t\tsessionDir: scope,\n\t\t\twindowStartMs: window.startMs,\n\t\t\twindowEndMs: window.endMs,\n\t\t\texpiresAt: Math.min(nowMs + 10_000, window.endMs),\n\t\t\ttotals,\n\t\t};\n\t\treturn totals;\n\t}\n\n\tgetDailyUsageBreakdown(formatLabel?: (label: string) => string, now = new Date()): string {\n\t\treturn formatDailyUsageBreakdown(this.getDailyUsageTotals(now), formatLabel);\n\t}\n\n\tprivate getPostCompactionUsageState(): { hasCompaction: boolean; hasPostCompactionUsage: boolean } {\n\t\tconst sessionManager = this.deps.getSessionManager();\n\t\tconst indexedSessionManager = sessionManager as unknown as {\n\t\t\tgetLeafId?: () => string | null;\n\t\t\tgetEntry?: (id: string) => SessionEntry | undefined;\n\t\t};\n\t\tconst getLeafId = indexedSessionManager.getLeafId?.bind(sessionManager);\n\t\tconst getEntry = indexedSessionManager.getEntry?.bind(sessionManager);\n\t\tconst leafId = getLeafId?.();\n\t\tif (getLeafId && getEntry && leafId !== undefined) {\n\t\t\tif (this._postCompactionUsageCache?.leafId === leafId) {\n\t\t\t\treturn { ...this._postCompactionUsageCache };\n\t\t\t}\n\t\t\tconst appended: SessionEntry[] = [];\n\t\t\tconst cachedLeafId = this._postCompactionUsageCache?.leafId;\n\t\t\tlet currentId = leafId;\n\t\t\tconst seen = new Set<string>();\n\t\t\twhile (currentId !== null && currentId !== cachedLeafId && !seen.has(currentId)) {\n\t\t\t\tseen.add(currentId);\n\t\t\t\tconst entry = getEntry(currentId);\n\t\t\t\tif (!entry) break;\n\t\t\t\tappended.push(entry);\n\t\t\t\tcurrentId = entry.parentId;\n\t\t\t}\n\t\t\tconst extendsCachedBranch = this._postCompactionUsageCache !== undefined && currentId === cachedLeafId;\n\t\t\tconst state = extendsCachedBranch\n\t\t\t\t? { ...this._postCompactionUsageCache! }\n\t\t\t\t: { leafId: null, hasCompaction: false, hasPostCompactionUsage: false };\n\t\t\tif (!extendsCachedBranch && currentId !== null) {\n\t\t\t\twhile (currentId !== null && !seen.has(currentId)) {\n\t\t\t\t\tseen.add(currentId);\n\t\t\t\t\tconst entry = getEntry(currentId);\n\t\t\t\t\tif (!entry) break;\n\t\t\t\t\tappended.push(entry);\n\t\t\t\t\tcurrentId = entry.parentId;\n\t\t\t\t}\n\t\t\t}\n\t\t\tfor (let index = appended.length - 1; index >= 0; index--) {\n\t\t\t\tconst entry = appended[index];\n\t\t\t\tif (entry.type === \"compaction\") {\n\t\t\t\t\tstate.hasCompaction = true;\n\t\t\t\t\tstate.hasPostCompactionUsage = false;\n\t\t\t\t} else if (entry.type === \"message\" && entry.message.role === \"assistant\") {\n\t\t\t\t\tconst assistant = entry.message;\n\t\t\t\t\tif (assistant.stopReason !== \"aborted\" && assistant.stopReason !== \"error\" && state.hasCompaction) {\n\t\t\t\t\t\tstate.hasPostCompactionUsage = calculateContextTokens(assistant.usage) > 0;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\tstate.leafId = leafId;\n\t\t\tthis._postCompactionUsageCache = state;\n\t\t\treturn { ...state };\n\t\t}\n\n\t\tconst branchEntries = sessionManager.getBranch();\n\t\tconst latestCompaction = getLatestCompactionEntry(branchEntries);\n\t\tif (!latestCompaction) return { hasCompaction: false, hasPostCompactionUsage: false };\n\t\tconst compactionIndex = branchEntries.lastIndexOf(latestCompaction);\n\t\tfor (let index = branchEntries.length - 1; index > compactionIndex; index--) {\n\t\t\tconst entry = branchEntries[index];\n\t\t\tif (entry.type !== \"message\" || entry.message.role !== \"assistant\") continue;\n\t\t\tconst assistant = entry.message;\n\t\t\tif (assistant.stopReason === \"aborted\" || assistant.stopReason === \"error\") continue;\n\t\t\treturn { hasCompaction: true, hasPostCompactionUsage: calculateContextTokens(assistant.usage) > 0 };\n\t\t}\n\t\treturn { hasCompaction: true, hasPostCompactionUsage: false };\n\t}\n\n\tgetContextUsage(): ContextUsage | undefined {\n\t\tconst model = this.deps.getModel();\n\t\tif (!model) return undefined;\n\n\t\tconst contextWindow = model.contextWindow ?? 0;\n\t\tif (contextWindow <= 0) return undefined;\n\n\t\t// After compaction, the last assistant usage reflects pre-compaction context size.\n\t\t// Walk backward only to the nearest compaction instead of rebuilding the whole branch on\n\t\t// every footer invalidation; the distance is bounded by the live post-compaction context.\n\t\tconst compactionState = this.getPostCompactionUsageState();\n\t\tif (compactionState.hasCompaction && !compactionState.hasPostCompactionUsage) {\n\t\t\treturn { tokens: null, contextWindow, percent: null };\n\t\t}\n\n\t\tconst estimate = estimateContextTokens(this.deps.getMessages());\n\t\tconst percent = (estimate.tokens / contextWindow) * 100;\n\n\t\treturn {\n\t\t\ttokens: estimate.tokens,\n\t\t\tcontextWindow,\n\t\t\tpercent,\n\t\t};\n\t}\n\n\t/**\n\t * Export session to HTML.\n\t * @param outputPath Optional output path (defaults to session directory)\n\t * @returns Path to exported file\n\t */\n\tasync exportToHtml(outputPath?: string): Promise<string> {\n\t\tconst sessionManager = this.deps.getSessionManager();\n\t\tconst themeName = this.deps.getSettingsManager().getTheme();\n\n\t\t// Create tool renderer if we have an extension runner (for custom tool HTML rendering)\n\t\tconst toolRenderer: ToolHtmlRenderer = createToolHtmlRenderer({\n\t\t\tgetToolDefinition: (name) => this.deps.getToolDefinition(name),\n\t\t\ttheme,\n\t\t\tcwd: sessionManager.getCwd(),\n\t\t});\n\n\t\treturn await exportSessionToHtml(sessionManager, this.deps.getState(), {\n\t\t\toutputPath,\n\t\t\tthemeName,\n\t\t\ttoolRenderer,\n\t\t});\n\t}\n\n\t/**\n\t * Export the current session branch to a JSONL file.\n\t * Writes the session header followed by all entries on the current branch path.\n\t * @param outputPath Target file path. If omitted, generates a timestamped file in cwd.\n\t * @returns The resolved output file path.\n\t */\n\texportToJsonl(outputPath?: string): string {\n\t\tconst sessionManager = this.deps.getSessionManager();\n\t\tconst filePath = resolvePath(\n\t\t\toutputPath ?? `session-${new Date().toISOString().replace(/[:.]/g, \"-\")}.jsonl`,\n\t\t\tprocess.cwd(),\n\t\t);\n\t\tconst dir = dirname(filePath);\n\t\tif (!existsSync(dir)) {\n\t\t\tmkdirSync(dir, { recursive: true });\n\t\t}\n\n\t\tconst header: SessionHeader = {\n\t\t\ttype: \"session\",\n\t\t\tversion: CURRENT_SESSION_VERSION,\n\t\t\tid: sessionManager.getSessionId(),\n\t\t\ttimestamp: new Date().toISOString(),\n\t\t\tcwd: sessionManager.getCwd(),\n\t\t};\n\n\t\tconst branchEntries = sessionManager.getBranch();\n\t\tconst lines = [JSON.stringify(header)];\n\n\t\t// Re-chain parentIds to form a linear sequence\n\t\tlet prevId: string | null = null;\n\t\tfor (const entry of branchEntries) {\n\t\t\tconst linear = { ...entry, parentId: prevId };\n\t\t\tlines.push(JSON.stringify(linear));\n\t\t\tprevId = entry.id;\n\t\t}\n\n\t\twriteFileSync(filePath, `${lines.join(\"\\n\")}\\n`);\n\t\treturn filePath;\n\t}\n\n\t/**\n\t * Get text content of last assistant message.\n\t * Useful for /copy command.\n\t * @returns Text content, or undefined if no assistant message exists\n\t */\n\tgetLastAssistantText(): string | undefined {\n\t\tconst lastAssistant = this.deps\n\t\t\t.getMessages()\n\t\t\t.slice()\n\t\t\t.reverse()\n\t\t\t.find((m) => {\n\t\t\t\tif (m.role !== \"assistant\") return false;\n\t\t\t\tconst msg = m as AssistantMessage;\n\t\t\t\t// Skip aborted messages with no content\n\t\t\t\tif (msg.stopReason === \"aborted\" && msg.content.length === 0) return false;\n\t\t\t\treturn true;\n\t\t\t});\n\n\t\tif (!lastAssistant) return undefined;\n\n\t\tlet text = \"\";\n\t\tfor (const content of (lastAssistant as AssistantMessage).content) {\n\t\t\tif (content.type === \"text\") {\n\t\t\t\ttext += content.text;\n\t\t\t}\n\t\t}\n\n\t\treturn text.trim() || undefined;\n\t}\n}\n"]}
+{"version":3,"file":"session-analytics.d.ts","sourceRoot":"","sources":["../../src/core/session-analytics.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EACN,KAAK,YAAY,EACjB,KAAK,UAAU,EAIf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAON,KAAK,cAAc,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAoB,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAIxE,OAAO,EAEN,KAAK,YAAY,EAGjB,KAAK,kBAAkB,EACvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAKN,KAAK,kBAAkB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGN,KAAK,gBAAgB,EAGrB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAEN,KAAK,+BAA+B,EACpC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAMN,KAAK,2BAA2B,EAChC,MAAM,0BAA0B,CAAC;AAElC,eAAO,MAAM,oCAAoC,6BAA6B,CAAC;AAE/E,MAAM,WAAW,oBAAoB;IACpC,0FAAwF;IACxF,QAAQ,IAAI,UAAU,CAAC;IACvB,sGAAoG;IACpG,WAAW,IAAI,YAAY,EAAE,CAAC;IAC9B,iFAA+E;IAC/E,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IACnC,uFAAqF;IACrF,iBAAiB,IAAI,cAAc,CAAC;IACpC,kDAAgD;IAChD,kBAAkB,IAAI,eAAe,CAAC;IACtC,4EAA4E;IAC5E,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;IAC5D,2GAA2G;IAC3G,2BAA2B,IAAI,MAAM,CAAC;CACtC;AAED,qBAAa,gBAAgB;IAC5B,iEAAiE;IACjE,OAAO,CAAC,wBAAwB,CAAC,CAG/B;IACF,0GAA0G;IAC1G,OAAO,CAAC,gBAAgB,CAAC,CAMvB;IACF;0FACsF;IACtF,OAAO,CAAC,iBAAiB,CAAC,CAMxB;IACF,iHAAiH;IACjH,OAAO,CAAC,4BAA4B,CAA0C;IAC9E,4EAA4E;IAC5E,OAAO,CAAC,yBAAyB,CAAC,CAIhC;IAEF,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;IAE5C,YAAY,IAAI,EAAE,oBAAoB,EAErC;IAED,eAAe,IAAI,YAAY,CAgD9B;IAED,sBAAsB,IAAI,YAAY,CAAC,iBAAiB,CAAC,CA2CxD;IAED,4BAA4B,CAAC,MAAM,EAAE,+BAA+B,GAAG,IAAI,CAI1E;IAED,OAAO,CAAC,wCAAwC;IAkBhD,8BAA8B,IAAI,2BAA2B,CAgC5D;IAED;;;;;;;;;OASG;IACH,kBAAkB,IAAI,KAAK,CAoB1B;IAED;;;;;;;;;;;OAWG;IACH,eAAe,CACd,KAAK,EAAE,KAAK,EACZ,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GACpE,MAAM,GAAG,SAAS,CAcpB;IAED,OAAO,CAAC,2BAA2B;IAqBnC;;;OAGG;IACH,eAAe,IAAI,kBAAkB,CAGpC;IAED,cAAc,CAAC,GAAG,OAAa,GAAG,kBAAkB,CA2BnD;IAED,mBAAmB,CAAC,GAAG,OAAa,GAAG,gBAAgB,CA2BtD;IAED,sBAAsB,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,EAAE,GAAG,OAAa,GAAG,MAAM,CAExF;IAED,OAAO,CAAC,2BAA2B;IAoEnC,eAAe,IAAI,YAAY,GAAG,SAAS,CAuB1C;IAED;;;;OAIG;IACG,YAAY,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBvD;IAED;;;;;OAKG;IACH,aAAa,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAgCzC;IAED;;;;OAIG;IACH,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAuBzC;CACD","sourcesContent":["/**\n * Session usage / cost / stats accounting, context-window usage, and session export.\n *\n * Extracted verbatim from agent-session.ts (god-file decomposition). Read-only over the session\n * except for its two owned memo caches (`_spawnedUsageCache`, `_dailyUsageCache`) — it never mutates\n * agent or session state. Single source of truth for \"how much did this session and its spawned\n * subtree spend\" (footer roll-up, print-mode child reporting), the daily cross-session totals, the\n * /context window estimate, and HTML/JSONL export of the current branch.\n */\n\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\nimport {\n\ttype AgentMessage,\n\ttype AgentState,\n\taddUsage,\n\tcreateEmptyUsage,\n\tgetSessionEntryUsage,\n} from \"@caupulican/pi-agent-core\";\nimport {\n\tCURRENT_SESSION_VERSION,\n\tcalculateContextTokens,\n\testimateContextTokens,\n\tgetLatestCompactionEntry,\n\ttype SessionEntry,\n\ttype SessionHeader,\n\ttype SessionManager,\n} from \"@caupulican/pi-agent-core/node\";\nimport type { AssistantMessage, Model, Usage } from \"@caupulican/pi-ai\";\nimport { getSessionsDir } from \"../config.ts\";\nimport { theme } from \"../modes/interactive/theme/theme.ts\";\nimport { resolvePath } from \"../utils/paths.ts\";\nimport {\n\ttype CompactionGateCheckStats,\n\ttype SessionStats,\n\tSPAWNED_USAGE_CUSTOM_TYPE,\n\ttype SpawnedUsageReport,\n\ttype SpawnedUsageTotals,\n} from \"./agent-session-contracts.ts\";\nimport {\n\taccumulateCurrentSessionCostsFromEntries,\n\ttype CurrentSessionCostAccumulator,\n\tcreateCurrentSessionCostAccumulator,\n\tcreateSessionCostSummary,\n\ttype SessionCostSummary,\n} from \"./cost/cost-summary.ts\";\nimport {\n\taggregateDailyUsageFromSessionFiles,\n\taggregateDailyUsageFromSessionRoot,\n\ttype DailyUsageTotals,\n\tformatDailyUsageBreakdown,\n\tgetLocalDayWindow,\n} from \"./cost/daily-usage.ts\";\nimport { exportSessionToHtml, type ToolHtmlRenderer } from \"./export-html/index.ts\";\nimport { createToolHtmlRenderer } from \"./export-html/tool-renderer.ts\";\nimport type { ContextUsage, ToolDefinition } from \"./extensions/index.ts\";\nimport type { SettingsManager } from \"./settings-manager.ts\";\nimport {\n\tisToolArgumentValidationLogRecord,\n\ttype ToolArgumentValidationLogRecord,\n} from \"./tool-recovery-log-records.ts\";\nimport {\n\tconsumeToolArgumentValidationRecord,\n\tcreateEmptyToolArgumentValidationStats,\n\tgetToolRecoveryRecordSequence,\n\treadPersistedToolRecoveryStats,\n\ttype ToolArgumentValidationRecord,\n\ttype ToolArgumentValidationStats,\n} from \"./tool-recovery-stats.ts\";\n\nexport const TOOL_ARGUMENT_VALIDATION_CUSTOM_TYPE = \"tool_argument_validation\";\n\nexport interface SessionAnalyticsDeps {\n\t/** Live agent state — assistant-message usage and message counts are read from here. */\n\tgetState(): AgentState;\n\t/** All messages (agent state view) — used for context-window estimation and last-assistant text. */\n\tgetMessages(): AgentMessage[];\n\t/** Current session model — its context window bounds the /context estimate. */\n\tgetModel(): Model<any> | undefined;\n\t/** Session log — entries feed spawned-usage roll-up, daily totals, branch export. */\n\tgetSessionManager(): SessionManager;\n\t/** Settings — the export theme is read here. */\n\tgetSettingsManager(): SettingsManager;\n\t/** Resolve a tool definition for the HTML export's custom-tool renderer. */\n\tgetToolDefinition(name: string): ToolDefinition | undefined;\n\t/** Sidecar recovery telemetry log; read on demand so turn handling never writes session custom entries. */\n\tgetToolRecoveryEventLogPath(): string;\n}\n\nexport class SessionAnalytics {\n\t/** Incremental aggregate over append-ordered session entries. */\n\tprivate _currentSessionCostCache?: {\n\t\tentryCount: number;\n\t\taccumulator: CurrentSessionCostAccumulator;\n\t};\n\t/** Memoized daily usage totals with a short TTL, keyed by the resolved scope dir and local-day window. */\n\tprivate _dailyUsageCache?: {\n\t\tsessionDir: string;\n\t\twindowStartMs: number;\n\t\twindowEndMs: number;\n\t\texpiresAt: number;\n\t\ttotals: DailyUsageTotals;\n\t};\n\t/** Memoized full cost summary. The footer renders on every streamed delta and keystroke, so\n\t * rescanning a long session log there turns redraw into O(entries) work per frame. */\n\tprivate _costSummaryCache?: {\n\t\tentryCount: number;\n\t\tdailyTotals: DailyUsageTotals;\n\t\twindowStartMs: number;\n\t\twindowEndMs: number;\n\t\tsummary: SessionCostSummary;\n\t};\n\t/** Cumulative stats initialized once from persisted telemetry, then updated without retaining record details. */\n\tprivate _toolArgumentValidationStats: ToolArgumentValidationStats | undefined;\n\t/** Incremental context-usage state keyed by the append-only branch leaf. */\n\tprivate _postCompactionUsageCache?: {\n\t\tleafId: string | null;\n\t\thasCompaction: boolean;\n\t\thasPostCompactionUsage: boolean;\n\t};\n\n\tprivate readonly deps: SessionAnalyticsDeps;\n\n\tconstructor(deps: SessionAnalyticsDeps) {\n\t\tthis.deps = deps;\n\t}\n\n\tgetSessionStats(): SessionStats {\n\t\tlet userMessages = 0;\n\t\tlet assistantMessages = 0;\n\t\tlet toolResults = 0;\n\t\tlet totalMessages = 0;\n\t\tlet toolCalls = 0;\n\t\tconst usage = createEmptyUsage();\n\n\t\tfor (const entry of this.deps.getSessionManager().getEntries()) {\n\t\t\tconst entryUsage = getSessionEntryUsage(entry);\n\t\t\tif (entryUsage) addUsage(usage, entryUsage);\n\t\t\tif (entry.type !== \"message\") continue;\n\t\t\ttotalMessages++;\n\t\t\tconst message = entry.message;\n\t\t\tif (message.role === \"user\") {\n\t\t\t\tuserMessages++;\n\t\t\t} else if (message.role === \"toolResult\") {\n\t\t\t\ttoolResults++;\n\t\t\t} else if (message.role === \"assistant\") {\n\t\t\t\tassistantMessages++;\n\t\t\t\tconst assistantMsg = message;\n\t\t\t\ttoolCalls += assistantMsg.content.filter((c) => c.type === \"toolCall\").length;\n\t\t\t}\n\t\t}\n\n\t\tconst toolArgumentValidation = this.getToolArgumentValidationStats();\n\t\tconst compactionGates = this.getCompactionGateStats();\n\n\t\treturn {\n\t\t\tsessionFile: this.deps.getSessionManager().getSessionFile(),\n\t\t\tsessionId: this.deps.getSessionManager().getSessionId(),\n\t\t\tuserMessages,\n\t\t\tassistantMessages,\n\t\t\ttoolCalls,\n\t\t\ttoolResults,\n\t\t\ttotalMessages,\n\t\t\ttokens: {\n\t\t\t\tinput: usage.input,\n\t\t\t\toutput: usage.output,\n\t\t\t\tcacheRead: usage.cacheRead,\n\t\t\t\tcacheWrite: usage.cacheWrite,\n\t\t\t\ttotal: usage.input + usage.output + usage.cacheRead + usage.cacheWrite,\n\t\t\t},\n\t\t\tcost: usage.cost.total,\n\t\t\tcontextUsage: this.getContextUsage(),\n\t\t\ttoolArgumentValidation,\n\t\t\tcompactionGates,\n\t\t};\n\t}\n\n\tgetCompactionGateStats(): SessionStats[\"compactionGates\"] {\n\t\tlet gateFailures = 0;\n\t\tlet deterministicGapFills = 0;\n\t\tlet compactionsWithGateFailures = 0;\n\t\tconst checks = new Map<string, CompactionGateCheckStats>();\n\t\tfor (const entry of this.deps.getSessionManager().getEntries()) {\n\t\t\tif (entry.type !== \"compaction\") continue;\n\t\t\tconst details = entry.details;\n\t\t\tif (!details || typeof details !== \"object\") continue;\n\t\t\tconst rawGateFailures = (details as { verificationGateFailures?: unknown }).verificationGateFailures;\n\t\t\tconst rawGapFills = (details as { deterministicGapFills?: unknown }).deterministicGapFills;\n\t\t\tconst rawChecks = (details as { verificationGateChecks?: unknown }).verificationGateChecks;\n\t\t\tconst entryGateFailures =\n\t\t\t\ttypeof rawGateFailures === \"number\" && Number.isFinite(rawGateFailures) ? rawGateFailures : 0;\n\t\t\tconst entryGapFills = typeof rawGapFills === \"number\" && Number.isFinite(rawGapFills) ? rawGapFills : 0;\n\t\t\tgateFailures += entryGateFailures;\n\t\t\tdeterministicGapFills += entryGapFills;\n\t\t\tif (entryGateFailures > 0) compactionsWithGateFailures++;\n\t\t\tif (rawChecks && typeof rawChecks === \"object\" && !Array.isArray(rawChecks)) {\n\t\t\t\tfor (const [check, rawStats] of Object.entries(rawChecks)) {\n\t\t\t\t\tif (!rawStats || typeof rawStats !== \"object\" || Array.isArray(rawStats)) continue;\n\t\t\t\t\tconst stats = rawStats as Record<string, unknown>;\n\t\t\t\t\tconst failures = stats.failures;\n\t\t\t\t\tif (typeof failures !== \"number\" || !Number.isFinite(failures) || failures <= 0) continue;\n\t\t\t\t\tconst current = checks.get(check) ?? { failures: 0 };\n\t\t\t\t\tcurrent.failures += failures;\n\t\t\t\t\tif (typeof stats.minScore === \"number\" && Number.isFinite(stats.minScore)) {\n\t\t\t\t\t\tcurrent.minScore = Math.min(current.minScore ?? stats.minScore, stats.minScore);\n\t\t\t\t\t}\n\t\t\t\t\tif (typeof stats.maxScore === \"number\" && Number.isFinite(stats.maxScore)) {\n\t\t\t\t\t\tcurrent.maxScore = Math.max(current.maxScore ?? stats.maxScore, stats.maxScore);\n\t\t\t\t\t}\n\t\t\t\t\tif (typeof stats.threshold === \"number\" && Number.isFinite(stats.threshold)) {\n\t\t\t\t\t\tcurrent.threshold = stats.threshold;\n\t\t\t\t\t}\n\t\t\t\t\tif (stats.comparator === \"minimum\" || stats.comparator === \"maximum\") {\n\t\t\t\t\t\tcurrent.comparator = stats.comparator;\n\t\t\t\t\t}\n\t\t\t\t\tchecks.set(check, current);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn { gateFailures, deterministicGapFills, compactionsWithGateFailures, checks: Object.fromEntries(checks) };\n\t}\n\n\trecordToolArgumentValidation(record: ToolArgumentValidationLogRecord): void {\n\t\tconst stats = this.getToolArgumentValidationStats();\n\t\tconsumeToolArgumentValidationRecord(stats, record);\n\t\tthis._toolArgumentValidationStats = stats;\n\t}\n\n\tprivate readToolArgumentValidationSidecarRecords(): ToolArgumentValidationLogRecord[] {\n\t\tconst filePath = this.deps.getToolRecoveryEventLogPath();\n\t\tif (!existsSync(filePath)) return [];\n\t\tconst records: ToolArgumentValidationLogRecord[] = [];\n\t\ttry {\n\t\t\tconst sessionId = this.deps.getSessionManager().getSessionId();\n\t\t\tfor (const line of readFileSync(filePath, \"utf-8\").split(\"\\n\")) {\n\t\t\t\tif (line.trim().length === 0) continue;\n\t\t\t\tconst parsed = JSON.parse(line) as unknown;\n\t\t\t\tif (!isToolArgumentValidationLogRecord(parsed) || parsed.sessionId !== sessionId) continue;\n\t\t\t\trecords.push(parsed);\n\t\t\t}\n\t\t} catch {\n\t\t\treturn [];\n\t\t}\n\t\treturn records;\n\t}\n\n\tgetToolArgumentValidationStats(): ToolArgumentValidationStats {\n\t\tif (this._toolArgumentValidationStats) return structuredClone(this._toolArgumentValidationStats);\n\t\tconst eventLogPath = this.deps.getToolRecoveryEventLogPath();\n\t\tconst sessionId = this.deps.getSessionManager().getSessionId();\n\t\tconst persisted = readPersistedToolRecoveryStats(eventLogPath, sessionId);\n\t\tconst stats = persisted ? structuredClone(persisted.stats) : createEmptyToolArgumentValidationStats();\n\t\tconst seen = new Set<string>();\n\t\tconst consume = (record: ToolArgumentValidationRecord, key: string): void => {\n\t\t\tif (seen.has(key)) return;\n\t\t\tseen.add(key);\n\t\t\tconsumeToolArgumentValidationRecord(stats, record);\n\t\t};\n\n\t\tfor (const entry of this.deps.getSessionManager().getEntries()) {\n\t\t\tif (entry.type !== \"custom\" || entry.customType !== TOOL_ARGUMENT_VALIDATION_CUSTOM_TYPE) continue;\n\t\t\tconst record = entry.data as ToolArgumentValidationRecord | undefined;\n\t\t\tif (!record || record.version !== 1) continue;\n\t\t\tconsume(record, `legacy:${entry.id}`);\n\t\t}\n\t\tfor (const record of this.readToolArgumentValidationSidecarRecords()) {\n\t\t\tif (\n\t\t\t\tpersisted &&\n\t\t\t\trecord.sessionId === sessionId &&\n\t\t\t\tgetToolRecoveryRecordSequence(record) <= persisted.lastRecordSequence\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tconsume(record, record.recordId);\n\t\t}\n\n\t\tthis._toolArgumentValidationStats = stats;\n\t\treturn structuredClone(stats);\n\t}\n\n\t/**\n\t * Cumulative usage (full breakdown) for this session's entire spawn subtree: its own\n\t * assistant messages PLUS every `spawned_usage` report it has rolled up. Single source of\n\t * truth for \"how much did this session and everything it spawned spend\" — used by print-mode\n\t * to emit a child's total so a spawner can roll it up via {@link addSpawnedUsage}.\n\t *\n\t * Including the `spawned_usage` reports is what keeps the single-hop invariant intact: a child\n\t * that itself spawned grandchildren must report own + sub-usage in one number, or the parent\n\t * silently under-counts the grandchildren.\n\t */\n\tgetCumulativeUsage(): Usage {\n\t\tconst total = createEmptyUsage();\n\t\tconst entries = this.deps.getSessionManager().getEntries();\n\t\tfor (const entry of entries) {\n\t\t\tconst usage = getSessionEntryUsage(entry);\n\t\t\tif (usage) addUsage(total, usage);\n\t\t}\n\t\t// Roll up usage this session attributed to its own spawned children (single-hop).\n\t\tconst seenSpawnedReportIds = new Set<string>();\n\t\tfor (const entry of entries) {\n\t\t\tif (entry.type !== \"custom\" || entry.customType !== SPAWNED_USAGE_CUSTOM_TYPE) continue;\n\t\t\tconst data = entry.data as SpawnedUsageReport | undefined;\n\t\t\tif (!data?.usage) continue;\n\t\t\tif (data.reportId) {\n\t\t\t\tif (seenSpawnedReportIds.has(data.reportId)) continue;\n\t\t\t\tseenSpawnedReportIds.add(data.reportId);\n\t\t\t}\n\t\t\taddUsage(total, data.usage);\n\t\t}\n\t\treturn total;\n\t}\n\n\t/**\n\t * Record usage spent by a spawned/subagent session so the footer can roll it into the\n\t * displayed cost. Persisted as a `CustomEntry` (`customType: \"spawned_usage\"`, Model A) so\n\t * it survives reload and is reconstructed exactly like main usage; a new/forked session\n\t * starts fresh because it owns a new log file.\n\t *\n\t * Idempotent on `opts.reportId`: a re-report (retry, duplicate `agent_end`) with a\n\t * previously-seen id is ignored, so cost cannot be double-counted. Honors the single-hop\n\t * invariant documented on {@link SpawnedUsageReport}.\n\t *\n\t * @returns the id of the appended entry, or `undefined` if the report was a duplicate.\n\t */\n\taddSpawnedUsage(\n\t\tusage: Usage,\n\t\topts?: { label?: string; sourceSessionId?: string; reportId?: string },\n\t): string | undefined {\n\t\tconst reportId = opts?.reportId;\n\t\tif (reportId && this.getCurrentSessionCostTotals().seenSubagentReportIds.has(reportId)) {\n\t\t\treturn undefined;\n\t\t}\n\t\tconst report: SpawnedUsageReport = {\n\t\t\tusage,\n\t\t\tlabel: opts?.label,\n\t\t\tsourceSessionId: opts?.sourceSessionId,\n\t\t\treportId,\n\t\t};\n\t\tconst entryId = this.deps.getSessionManager().appendCustomEntry(SPAWNED_USAGE_CUSTOM_TYPE, report);\n\t\tif (reportId) this.getCurrentSessionCostTotals();\n\t\treturn entryId;\n\t}\n\n\tprivate getCurrentSessionCostTotals(): CurrentSessionCostAccumulator {\n\t\tconst sessionManager = this.deps.getSessionManager();\n\t\tconst entryCount = sessionManager.getEntryCount?.() ?? sessionManager.getEntries().length;\n\t\tlet cache = this._currentSessionCostCache;\n\t\tconst getEntriesSince = sessionManager.getEntriesSince?.bind(sessionManager);\n\t\tif (!cache || entryCount < cache.entryCount || !getEntriesSince) {\n\t\t\tcache = {\n\t\t\t\tentryCount,\n\t\t\t\taccumulator: accumulateCurrentSessionCostsFromEntries(\n\t\t\t\t\tcreateCurrentSessionCostAccumulator(),\n\t\t\t\t\tsessionManager.getEntries(),\n\t\t\t\t),\n\t\t\t};\n\t\t\tthis._currentSessionCostCache = cache;\n\t\t} else if (entryCount > cache.entryCount) {\n\t\t\taccumulateCurrentSessionCostsFromEntries(cache.accumulator, getEntriesSince(cache.entryCount));\n\t\t\tcache.entryCount = entryCount;\n\t\t}\n\t\treturn cache.accumulator;\n\t}\n\n\t/**\n\t * Aggregate all recorded spawned-usage reports (see {@link addSpawnedUsage}). The append-ordered\n\t * accumulator processes only new entries, so repeated turns do not rescan the full session.\n\t */\n\tgetSpawnedUsage(): SpawnedUsageTotals {\n\t\tconst current = this.getCurrentSessionCostTotals();\n\t\treturn { cost: current.subagentCost, reports: current.subagentReports };\n\t}\n\n\tgetCostSummary(now = new Date()): SessionCostSummary {\n\t\tconst sessionManager = this.deps.getSessionManager();\n\t\tconst entryCount = sessionManager.getEntryCount?.() ?? sessionManager.getEntries().length;\n\t\tconst window = getLocalDayWindow(now);\n\t\tconst dailyTotals = this.getDailyUsageTotals(now);\n\t\tconst cached = this._costSummaryCache;\n\t\tif (\n\t\t\tcached?.entryCount === entryCount &&\n\t\t\tcached.dailyTotals === dailyTotals &&\n\t\t\tcached.windowStartMs === window.startMs &&\n\t\t\tcached.windowEndMs === window.endMs\n\t\t) {\n\t\t\treturn cached.summary;\n\t\t}\n\t\tconst summary = createSessionCostSummary({\n\t\t\tcurrentTotals: this.getCurrentSessionCostTotals(),\n\t\t\tdailyTotals,\n\t\t\ttodayWindow: window,\n\t\t});\n\t\tthis._costSummaryCache = {\n\t\t\tentryCount,\n\t\t\tdailyTotals,\n\t\t\twindowStartMs: window.startMs,\n\t\t\twindowEndMs: window.endMs,\n\t\t\tsummary,\n\t\t};\n\t\treturn summary;\n\t}\n\n\tgetDailyUsageTotals(now = new Date()): DailyUsageTotals {\n\t\tconst sessionManager = this.deps.getSessionManager();\n\t\tconst sessionDir = sessionManager.getSessionDir();\n\t\tconst scope = sessionManager.usesDefaultSessionDir() ? getSessionsDir() : sessionDir;\n\t\tconst nowMs = now.getTime();\n\t\tconst window = getLocalDayWindow(now);\n\t\tif (\n\t\t\tthis._dailyUsageCache?.sessionDir === scope &&\n\t\t\tthis._dailyUsageCache.windowStartMs === window.startMs &&\n\t\t\tthis._dailyUsageCache.windowEndMs === window.endMs &&\n\t\t\tthis._dailyUsageCache.expiresAt > nowMs\n\t\t) {\n\t\t\treturn this._dailyUsageCache.totals;\n\t\t}\n\t\tconst sessionFile = sessionManager.getSessionFile();\n\t\tconst liveSession = sessionFile ? { filePath: sessionFile, entries: sessionManager.getEntries() } : undefined;\n\t\tconst totals = sessionManager.usesDefaultSessionDir()\n\t\t\t? aggregateDailyUsageFromSessionRoot(scope, window, liveSession)\n\t\t\t: aggregateDailyUsageFromSessionFiles(sessionDir, window, liveSession);\n\t\tthis._dailyUsageCache = {\n\t\t\tsessionDir: scope,\n\t\t\twindowStartMs: window.startMs,\n\t\t\twindowEndMs: window.endMs,\n\t\t\texpiresAt: Math.min(nowMs + 10_000, window.endMs),\n\t\t\ttotals,\n\t\t};\n\t\treturn totals;\n\t}\n\n\tgetDailyUsageBreakdown(formatLabel?: (label: string) => string, now = new Date()): string {\n\t\treturn formatDailyUsageBreakdown(this.getDailyUsageTotals(now), formatLabel);\n\t}\n\n\tprivate getPostCompactionUsageState(): { hasCompaction: boolean; hasPostCompactionUsage: boolean } {\n\t\tconst sessionManager = this.deps.getSessionManager();\n\t\tconst indexedSessionManager = sessionManager as unknown as {\n\t\t\tgetLeafId?: () => string | null;\n\t\t\tgetEntry?: (id: string) => SessionEntry | undefined;\n\t\t};\n\t\tconst getLeafId = indexedSessionManager.getLeafId?.bind(sessionManager);\n\t\tconst getEntry = indexedSessionManager.getEntry?.bind(sessionManager);\n\t\tconst leafId = getLeafId?.();\n\t\tif (getLeafId && getEntry && leafId !== undefined) {\n\t\t\tif (this._postCompactionUsageCache?.leafId === leafId) {\n\t\t\t\treturn { ...this._postCompactionUsageCache };\n\t\t\t}\n\t\t\tconst appended: SessionEntry[] = [];\n\t\t\tconst cachedLeafId = this._postCompactionUsageCache?.leafId;\n\t\t\tlet currentId = leafId;\n\t\t\tconst seen = new Set<string>();\n\t\t\twhile (currentId !== null && currentId !== cachedLeafId && !seen.has(currentId)) {\n\t\t\t\tseen.add(currentId);\n\t\t\t\tconst entry = getEntry(currentId);\n\t\t\t\tif (!entry) break;\n\t\t\t\tappended.push(entry);\n\t\t\t\tcurrentId = entry.parentId;\n\t\t\t}\n\t\t\tconst extendsCachedBranch = this._postCompactionUsageCache !== undefined && currentId === cachedLeafId;\n\t\t\tconst state = extendsCachedBranch\n\t\t\t\t? { ...this._postCompactionUsageCache! }\n\t\t\t\t: { leafId: null, hasCompaction: false, hasPostCompactionUsage: false };\n\t\t\tif (!extendsCachedBranch && currentId !== null) {\n\t\t\t\twhile (currentId !== null && !seen.has(currentId)) {\n\t\t\t\t\tseen.add(currentId);\n\t\t\t\t\tconst entry = getEntry(currentId);\n\t\t\t\t\tif (!entry) break;\n\t\t\t\t\tappended.push(entry);\n\t\t\t\t\tcurrentId = entry.parentId;\n\t\t\t\t}\n\t\t\t}\n\t\t\tfor (let index = appended.length - 1; index >= 0; index--) {\n\t\t\t\tconst entry = appended[index];\n\t\t\t\tif (entry.type === \"compaction\") {\n\t\t\t\t\tstate.hasCompaction = true;\n\t\t\t\t\tstate.hasPostCompactionUsage = false;\n\t\t\t\t} else if (entry.type === \"message\" && entry.message.role === \"assistant\") {\n\t\t\t\t\tconst assistant = entry.message;\n\t\t\t\t\tif (assistant.stopReason !== \"aborted\" && assistant.stopReason !== \"error\" && state.hasCompaction) {\n\t\t\t\t\t\tstate.hasPostCompactionUsage = calculateContextTokens(assistant.usage) > 0;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\tstate.leafId = leafId;\n\t\t\tthis._postCompactionUsageCache = state;\n\t\t\treturn { ...state };\n\t\t}\n\n\t\tconst branchEntries = sessionManager.getBranch();\n\t\tconst latestCompaction = getLatestCompactionEntry(branchEntries);\n\t\tif (!latestCompaction) return { hasCompaction: false, hasPostCompactionUsage: false };\n\t\tconst compactionIndex = branchEntries.lastIndexOf(latestCompaction);\n\t\tfor (let index = branchEntries.length - 1; index > compactionIndex; index--) {\n\t\t\tconst entry = branchEntries[index];\n\t\t\tif (entry.type !== \"message\" || entry.message.role !== \"assistant\") continue;\n\t\t\tconst assistant = entry.message;\n\t\t\tif (assistant.stopReason === \"aborted\" || assistant.stopReason === \"error\") continue;\n\t\t\treturn { hasCompaction: true, hasPostCompactionUsage: calculateContextTokens(assistant.usage) > 0 };\n\t\t}\n\t\treturn { hasCompaction: true, hasPostCompactionUsage: false };\n\t}\n\n\tgetContextUsage(): ContextUsage | undefined {\n\t\tconst model = this.deps.getModel();\n\t\tif (!model) return undefined;\n\n\t\tconst contextWindow = model.contextWindow ?? 0;\n\t\tif (contextWindow <= 0) return undefined;\n\n\t\t// After compaction, the last assistant usage reflects pre-compaction context size.\n\t\t// Walk backward only to the nearest compaction instead of rebuilding the whole branch on\n\t\t// every footer invalidation; the distance is bounded by the live post-compaction context.\n\t\tconst compactionState = this.getPostCompactionUsageState();\n\t\tif (compactionState.hasCompaction && !compactionState.hasPostCompactionUsage) {\n\t\t\treturn { tokens: null, contextWindow, percent: null };\n\t\t}\n\n\t\tconst estimate = estimateContextTokens(this.deps.getMessages());\n\t\tconst percent = (estimate.tokens / contextWindow) * 100;\n\n\t\treturn {\n\t\t\ttokens: estimate.tokens,\n\t\t\tcontextWindow,\n\t\t\tpercent,\n\t\t};\n\t}\n\n\t/**\n\t * Export session to HTML.\n\t * @param outputPath Optional output path (defaults to session directory)\n\t * @returns Path to exported file\n\t */\n\tasync exportToHtml(outputPath?: string): Promise<string> {\n\t\tconst sessionManager = this.deps.getSessionManager();\n\t\tconst themeName = this.deps.getSettingsManager().getTheme();\n\n\t\t// Create tool renderer if we have an extension runner (for custom tool HTML rendering)\n\t\tconst toolRenderer: ToolHtmlRenderer = createToolHtmlRenderer({\n\t\t\tgetToolDefinition: (name) => this.deps.getToolDefinition(name),\n\t\t\ttheme,\n\t\t\tcwd: sessionManager.getCwd(),\n\t\t});\n\n\t\treturn await exportSessionToHtml(sessionManager, this.deps.getState(), {\n\t\t\toutputPath,\n\t\t\tthemeName,\n\t\t\ttoolRenderer,\n\t\t});\n\t}\n\n\t/**\n\t * Export the current session branch to a JSONL file.\n\t * Writes the session header followed by all entries on the current branch path.\n\t * @param outputPath Target file path. If omitted, generates a timestamped file in cwd.\n\t * @returns The resolved output file path.\n\t */\n\texportToJsonl(outputPath?: string): string {\n\t\tconst sessionManager = this.deps.getSessionManager();\n\t\tconst filePath = resolvePath(\n\t\t\toutputPath ?? `session-${new Date().toISOString().replace(/[:.]/g, \"-\")}.jsonl`,\n\t\t\tprocess.cwd(),\n\t\t);\n\t\tconst dir = dirname(filePath);\n\t\tif (!existsSync(dir)) {\n\t\t\tmkdirSync(dir, { recursive: true });\n\t\t}\n\n\t\tconst header: SessionHeader = {\n\t\t\ttype: \"session\",\n\t\t\tversion: CURRENT_SESSION_VERSION,\n\t\t\tid: sessionManager.getSessionId(),\n\t\t\ttimestamp: new Date().toISOString(),\n\t\t\tcwd: sessionManager.getCwd(),\n\t\t};\n\n\t\tconst branchEntries = sessionManager.getBranch();\n\t\tconst lines = [JSON.stringify(header)];\n\n\t\t// Re-chain parentIds to form a linear sequence\n\t\tlet prevId: string | null = null;\n\t\tfor (const entry of branchEntries) {\n\t\t\tconst linear = { ...entry, parentId: prevId };\n\t\t\tlines.push(JSON.stringify(linear));\n\t\t\tprevId = entry.id;\n\t\t}\n\n\t\twriteFileSync(filePath, `${lines.join(\"\\n\")}\\n`);\n\t\treturn filePath;\n\t}\n\n\t/**\n\t * Get text content of last assistant message.\n\t * Useful for /copy command.\n\t * @returns Text content, or undefined if no assistant message exists\n\t */\n\tgetLastAssistantText(): string | undefined {\n\t\tconst lastAssistant = this.deps\n\t\t\t.getMessages()\n\t\t\t.slice()\n\t\t\t.reverse()\n\t\t\t.find((m) => {\n\t\t\t\tif (m.role !== \"assistant\") return false;\n\t\t\t\tconst msg = m as AssistantMessage;\n\t\t\t\t// Skip aborted messages with no content\n\t\t\t\tif (msg.stopReason === \"aborted\" && msg.content.length === 0) return false;\n\t\t\t\treturn true;\n\t\t\t});\n\n\t\tif (!lastAssistant) return undefined;\n\n\t\tlet text = \"\";\n\t\tfor (const content of (lastAssistant as AssistantMessage).content) {\n\t\t\tif (content.type === \"text\") {\n\t\t\t\ttext += content.text;\n\t\t\t}\n\t\t}\n\n\t\treturn text.trim() || undefined;\n\t}\n}\n"]}

package/dist/core/session-analytics.js

@@ -9,11 +9,12 @@
  */
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
+import { addUsage, createEmptyUsage, getSessionEntryUsage, } from "@caupulican/pi-agent-core";
 import { CURRENT_SESSION_VERSION, calculateContextTokens, estimateContextTokens, getLatestCompactionEntry, } from "@caupulican/pi-agent-core/node";
 import { getSessionsDir } from "../config.js";
 import { theme } from "../modes/interactive/theme/theme.js";
 import { resolvePath } from "../utils/paths.js";
-import { SPAWNED_USAGE_CUSTOM_TYPE, } from "./agent-session.js";
+import { SPAWNED_USAGE_CUSTOM_TYPE, } from "./agent-session-contracts.js";
 import { accumulateCurrentSessionCostsFromEntries, createCurrentSessionCostAccumulator, createSessionCostSummary, } from "./cost/cost-summary.js";
 import { aggregateDailyUsageFromSessionFiles, aggregateDailyUsageFromSessionRoot, formatDailyUsageBreakdown, getLocalDayWindow, } from "./cost/daily-usage.js";
 import { exportSessionToHtml } from "./export-html/index.js";
@@ -38,25 +39,30 @@ export class SessionAnalytics {
         this.deps = deps;
     }
     getSessionStats() {
-        const state = this.deps.getState();
-        const userMessages = state.messages.filter((m) => m.role === "user").length;
-        const assistantMessages = state.messages.filter((m) => m.role === "assistant").length;
-        const toolResults = state.messages.filter((m) => m.role === "toolResult").length;
+        let userMessages = 0;
+        let assistantMessages = 0;
+        let toolResults = 0;
+        let totalMessages = 0;
         let toolCalls = 0;
-        let totalInput = 0;
-        let totalOutput = 0;
-        let totalCacheRead = 0;
-        let totalCacheWrite = 0;
-        let totalCost = 0;
-        for (const message of state.messages) {
-            if (message.role === "assistant") {
+        const usage = createEmptyUsage();
+        for (const entry of this.deps.getSessionManager().getEntries()) {
+            const entryUsage = getSessionEntryUsage(entry);
+            if (entryUsage)
+                addUsage(usage, entryUsage);
+            if (entry.type !== "message")
+                continue;
+            totalMessages++;
+            const message = entry.message;
+            if (message.role === "user") {
+                userMessages++;
+            }
+            else if (message.role === "toolResult") {
+                toolResults++;
+            }
+            else if (message.role === "assistant") {
+                assistantMessages++;
                 const assistantMsg = message;
                 toolCalls += assistantMsg.content.filter((c) => c.type === "toolCall").length;
-                totalInput += assistantMsg.usage.input;
-                totalOutput += assistantMsg.usage.output;
-                totalCacheRead += assistantMsg.usage.cacheRead;
-                totalCacheWrite += assistantMsg.usage.cacheWrite;
-                totalCost += assistantMsg.usage.cost.total;
             }
         }
         const toolArgumentValidation = this.getToolArgumentValidationStats();
@@ -68,15 +74,15 @@ export class SessionAnalytics {
             assistantMessages,
             toolCalls,
             toolResults,
-            totalMessages: state.messages.length,
+            totalMessages,
             tokens: {
-                input: totalInput,
-                output: totalOutput,
-                cacheRead: totalCacheRead,
-                cacheWrite: totalCacheWrite,
-                total: totalInput + totalOutput + totalCacheRead + totalCacheWrite,
+                input: usage.input,
+                output: usage.output,
+                cacheRead: usage.cacheRead,
+                cacheWrite: usage.cacheWrite,
+                total: usage.input + usage.output + usage.cacheRead + usage.cacheWrite,
             },
-            cost: totalCost,
+            cost: usage.cost.total,
             contextUsage: this.getContextUsage(),
             toolArgumentValidation,
             compactionGates,
@@ -86,6 +92,7 @@ export class SessionAnalytics {
         let gateFailures = 0;
         let deterministicGapFills = 0;
         let compactionsWithGateFailures = 0;
+        const checks = new Map();
         for (const entry of this.deps.getSessionManager().getEntries()) {
             if (entry.type !== "compaction")
                 continue;
@@ -94,14 +101,40 @@ export class SessionAnalytics {
                 continue;
             const rawGateFailures = details.verificationGateFailures;
             const rawGapFills = details.deterministicGapFills;
+            const rawChecks = details.verificationGateChecks;
             const entryGateFailures = typeof rawGateFailures === "number" && Number.isFinite(rawGateFailures) ? rawGateFailures : 0;
             const entryGapFills = typeof rawGapFills === "number" && Number.isFinite(rawGapFills) ? rawGapFills : 0;
             gateFailures += entryGateFailures;
             deterministicGapFills += entryGapFills;
             if (entryGateFailures > 0)
                 compactionsWithGateFailures++;
+            if (rawChecks && typeof rawChecks === "object" && !Array.isArray(rawChecks)) {
+                for (const [check, rawStats] of Object.entries(rawChecks)) {
+                    if (!rawStats || typeof rawStats !== "object" || Array.isArray(rawStats))
+                        continue;
+                    const stats = rawStats;
+                    const failures = stats.failures;
+                    if (typeof failures !== "number" || !Number.isFinite(failures) || failures <= 0)
+                        continue;
+                    const current = checks.get(check) ?? { failures: 0 };
+                    current.failures += failures;
+                    if (typeof stats.minScore === "number" && Number.isFinite(stats.minScore)) {
+                        current.minScore = Math.min(current.minScore ?? stats.minScore, stats.minScore);
+                    }
+                    if (typeof stats.maxScore === "number" && Number.isFinite(stats.maxScore)) {
+                        current.maxScore = Math.max(current.maxScore ?? stats.maxScore, stats.maxScore);
+                    }
+                    if (typeof stats.threshold === "number" && Number.isFinite(stats.threshold)) {
+                        current.threshold = stats.threshold;
+                    }
+                    if (stats.comparator === "minimum" || stats.comparator === "maximum") {
+                        current.comparator = stats.comparator;
+                    }
+                    checks.set(check, current);
+                }
+            }
         }
-        return { gateFailures, deterministicGapFills, compactionsWithGateFailures };
+        return { gateFailures, deterministicGapFills, compactionsWithGateFailures, checks: Object.fromEntries(checks) };
     }
     recordToolArgumentValidation(record) {
         const stats = this.getToolArgumentValidationStats();
@@ -173,39 +206,16 @@ export class SessionAnalytics {
      * silently under-counts the grandchildren.
      */
     getCumulativeUsage() {
-        let input = 0;
-        let output = 0;
-        let cacheRead = 0;
-        let cacheWrite = 0;
-        let totalTokens = 0;
-        let costInput = 0;
-        let costOutput = 0;
-        let costCacheRead = 0;
-        let costCacheWrite = 0;
-        let costTotal = 0;
-        const add = (usage) => {
-            input += usage.input;
-            output += usage.output;
-            cacheRead += usage.cacheRead;
-            cacheWrite += usage.cacheWrite;
-            totalTokens += usage.totalTokens;
-            costInput += usage.cost.input;
-            costOutput += usage.cost.output;
-            costCacheRead += usage.cost.cacheRead;
-            costCacheWrite += usage.cost.cacheWrite;
-            costTotal += usage.cost.total;
-        };
-        for (const message of this.deps.getState().messages) {
-            if (message.role !== "assistant")
-                continue;
-            const usage = message.usage;
-            if (!usage)
-                continue;
-            add(usage);
+        const total = createEmptyUsage();
+        const entries = this.deps.getSessionManager().getEntries();
+        for (const entry of entries) {
+            const usage = getSessionEntryUsage(entry);
+            if (usage)
+                addUsage(total, usage);
         }
         // Roll up usage this session attributed to its own spawned children (single-hop).
         const seenSpawnedReportIds = new Set();
-        for (const entry of this.deps.getSessionManager().getEntries()) {
+        for (const entry of entries) {
             if (entry.type !== "custom" || entry.customType !== SPAWNED_USAGE_CUSTOM_TYPE)
                 continue;
             const data = entry.data;
@@ -216,22 +226,9 @@ export class SessionAnalytics {
                     continue;
                 seenSpawnedReportIds.add(data.reportId);
             }
-            add(data.usage);
+            addUsage(total, data.usage);
         }
-        return {
-            input,
-            output,
-            cacheRead,
-            cacheWrite,
-            totalTokens,
-            cost: {
-                input: costInput,
-                output: costOutput,
-                cacheRead: costCacheRead,
-                cacheWrite: costCacheWrite,
-                total: costTotal,
-            },
-        };
+        return total;
     }
     /**
      * Record usage spent by a spawned/subagent session so the footer can roll it into the