@compaction/cli 0.1.0

package/dist/core/session-aggregate.js

@@ -0,0 +1,490 @@
+/**
+ * Session + multi-session LOCAL aggregate (Strong-MVP Track E).
+ *
+ * Rolls up the per-run artifacts a developer already produced —
+ * `.compaction/runs/<run>/report.json` and (when present) `strong-eval.json` plus an
+ * optional local `run-labels.json` — into:
+ *   - a PER-SESSION summary (a session may contain multiple runs), and
+ *   - a CROSS-SESSION aggregate (totals across every session/run).
+ *
+ * This is the future admin/buyer value WITHOUT a hosted dashboard: everything is LOCAL,
+ * file-based, read-only over existing artifacts. NO network, NO upload, NO telemetry,
+ * NO database, NO auth, NO server.
+ *
+ * EVIDENCE HONESTY (mvp-capability-matrix rows 2/3/10/13/21, README evidence ladder):
+ *   - Token figures carry their per-figure source: provider-reported ONLY when the run's
+ *     token accounting was `measured` (provider usage metadata present); otherwise
+ *     local-estimate (chars/4). The aggregate states how many runs are in each tier and
+ *     NEVER labels an estimate as provider-reported.
+ *   - Cost / savings are ESTIMATED (price-table over the token figures). NEVER
+ *     billing-confirmed, NEVER realized, NEVER extrapolated to a time period.
+ *   - Output tokens are carried only where a run actually recorded them (from
+ *     strong-eval token_accounting); runs without strong-eval contribute `unknown`
+ *     output tokens and are counted separately, never inferred.
+ *   - Verification outcome counts (ready/conditional/not_ready, recoverability /
+ *     commitment / task-check pass/fail) are copied from strong-eval; runs without a
+ *     strong-eval are counted as `not_evaluated`, never as a pass.
+ *
+ * The builders are PURE (no IO) so the rollup math, label tagging, and the content-free
+ * share bundle are unit-testable; the reader (`collectRunRecords`) does the only IO and
+ * touches nothing but local files.
+ */
+import { randomUUID } from "node:crypto";
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { NO_LABEL, parseRunLabels } from "./run-labels.js";
+export const AGGREGATE_ARTIFACT_DIRECTORY = ".compaction/aggregates";
+export const AGGREGATE_EVIDENCE_LABELS = {
+    input_tokens: "input tokens: provider-reported where the run's token accounting was measured (provider usage " +
+        "metadata present), otherwise local estimate (chars/4); see the provider-reported / local-estimate " +
+        "run split. Never billing-confirmed.",
+    output_tokens: "output tokens: shown only for runs that recorded them (strong-eval token accounting); runs without " +
+        "a strong-eval contribute unknown output tokens and are counted separately — never inferred.",
+    estimated_cost: "estimated cost: price-table estimate over the token figures (token-estimated cost / local estimate). " +
+        "NOT a billed figure, NOT billing-confirmed.",
+    estimated_savings: "estimated savings: estimated, summed over the recorded runs only. NOT billing-confirmed, NOT " +
+        "realized, and NOT extrapolated to any time period.",
+    compactions: "compactions: count of recorded local runs rolled up (one compaction per recorded run). No run " +
+        "volume is assumed or projected.",
+    verification: "verification: readiness (ready/conditional/not_ready) and per-axis recoverability / commitment / " +
+        "task-check outcomes copied from each run's strong-eval; runs without a strong-eval are not_evaluated, " +
+        "never counted as a pass. These are DETERMINISTIC recoverability checks, NOT semantic guarantees.",
+    provider_runtime: "provider/runtime: operator-ASSERTED local label (never provider-verified); runs without a provider " +
+        "label are grouped under 'unlabeled'. This label is distinct from the token-evidence tier."
+};
+const STANDARD_LIMITATIONS = [
+    "Aggregated from LOCAL artifacts only (.compaction/runs/*/{report.json,strong-eval.json,run-labels.json}); no provider calls, no upload, no telemetry.",
+    "Estimated cost and savings are price-table local estimates summed over the recorded runs only; never billing-confirmed, never realized, never extrapolated to a time period.",
+    "Token figures are provider-reported only for runs whose token accounting was measured; all other runs contribute local estimates (chars/4). The split is reported, never hidden.",
+    "Output tokens are summed only over runs that recorded them; runs without a strong-eval contribute unknown output tokens and are counted separately, never inferred.",
+    "Verification outcomes are deterministic recoverability checks copied from each run's strong-eval; they are NOT semantic or meaning-preservation guarantees. Runs without a strong-eval are not_evaluated, never a pass.",
+    "Labels (project/workflow/provider/user-label/session) are operator-supplied local tags with no evidence weight; provider here is operator-asserted, not provider-verified.",
+    "This is a LOCAL, file-based rollup. There is no hosted dashboard, database, auth, billing, model routing, or provider integration."
+];
+function round6(value) {
+    return Number((value + Number.EPSILON).toFixed(6));
+}
+function emptyTotals() {
+    return {
+        run_count: 0,
+        runs_provider_reported: 0,
+        runs_local_estimate: 0,
+        runs_unknown_token_evidence: 0,
+        total_input_tokens_before: 0,
+        total_input_tokens_after: 0,
+        total_input_tokens_saved: 0,
+        total_output_tokens_before: 0,
+        total_output_tokens_after: 0,
+        runs_with_output_tokens: 0,
+        runs_without_output_tokens: 0,
+        total_estimated_cost_before_usd: 0,
+        total_estimated_cost_after_usd: 0,
+        total_estimated_savings_usd: 0,
+        compactions: 0
+    };
+}
+function emptyVerification() {
+    return {
+        ready: 0,
+        conditional: 0,
+        not_ready: 0,
+        not_evaluated: 0,
+        recoverability_pass: 0,
+        recoverability_fail: 0,
+        recoverability_not_evaluated: 0,
+        commitment_pass: 0,
+        commitment_fail: 0,
+        commitment_not_evaluated: 0,
+        task_check_pass: 0,
+        task_check_fail: 0,
+        task_check_unsupported: 0,
+        task_check_not_evaluated: 0
+    };
+}
+function addRunToTotals(totals, run) {
+    totals.run_count += 1;
+    totals.compactions += 1;
+    if (run.token_evidence === "provider_reported")
+        totals.runs_provider_reported += 1;
+    else if (run.token_evidence === "local_estimate")
+        totals.runs_local_estimate += 1;
+    else
+        totals.runs_unknown_token_evidence += 1;
+    totals.total_input_tokens_before += run.input_tokens_before;
+    totals.total_input_tokens_after += run.input_tokens_after;
+    totals.total_input_tokens_saved += run.input_tokens_saved;
+    if (run.output_tokens_before !== "unknown" && run.output_tokens_after !== "unknown") {
+        totals.total_output_tokens_before += run.output_tokens_before;
+        totals.total_output_tokens_after += run.output_tokens_after;
+        totals.runs_with_output_tokens += 1;
+    }
+    else {
+        totals.runs_without_output_tokens += 1;
+    }
+    totals.total_estimated_cost_before_usd += run.estimated_cost_before_usd;
+    totals.total_estimated_cost_after_usd += run.estimated_cost_after_usd;
+    totals.total_estimated_savings_usd += run.estimated_saving_usd;
+}
+function normalizeTotals(totals) {
+    totals.total_estimated_cost_before_usd = round6(totals.total_estimated_cost_before_usd);
+    totals.total_estimated_cost_after_usd = round6(totals.total_estimated_cost_after_usd);
+    totals.total_estimated_savings_usd = round6(totals.total_estimated_savings_usd);
+}
+function addRunToVerification(v, run) {
+    v[run.readiness] += 1;
+    if (run.recoverability === "pass")
+        v.recoverability_pass += 1;
+    else if (run.recoverability === "fail")
+        v.recoverability_fail += 1;
+    else
+        v.recoverability_not_evaluated += 1;
+    if (run.commitment_preservation === "pass")
+        v.commitment_pass += 1;
+    else if (run.commitment_preservation === "fail")
+        v.commitment_fail += 1;
+    else
+        v.commitment_not_evaluated += 1;
+    if (run.task_check === "pass")
+        v.task_check_pass += 1;
+    else if (run.task_check === "fail")
+        v.task_check_fail += 1;
+    else if (run.task_check === "unsupported")
+        v.task_check_unsupported += 1;
+    else
+        v.task_check_not_evaluated += 1;
+}
+function distinct(values) {
+    return [...new Set(values.filter((v) => typeof v === "string" && v.length > 0))].sort();
+}
+function sessionIdFor(run) {
+    if (run.labels.session !== undefined)
+        return { id: run.labels.session, explicit: true };
+    return { id: run.run_id, explicit: false };
+}
+/** True when a run passes every supplied local-label filter (case-sensitive exact match). */
+export function runMatchesFilters(run, filters) {
+    if (filters.project !== undefined && run.labels.project !== filters.project)
+        return false;
+    if (filters.workflow !== undefined && run.labels.workflow !== filters.workflow)
+        return false;
+    if (filters.provider !== undefined && run.labels.provider !== filters.provider)
+        return false;
+    if (filters.user_label !== undefined && run.labels.user_label !== filters.user_label)
+        return false;
+    if (filters.session !== undefined && run.labels.session !== filters.session)
+        return false;
+    return true;
+}
+function buildBreakdown(runs, keyOf) {
+    const buckets = new Map();
+    for (const run of runs) {
+        const key = keyOf(run);
+        let bucket = buckets.get(key);
+        if (!bucket) {
+            bucket = { totals: emptyTotals(), verification: emptyVerification() };
+            buckets.set(key, bucket);
+        }
+        addRunToTotals(bucket.totals, run);
+        addRunToVerification(bucket.verification, run);
+    }
+    return [...buckets.entries()]
+        .map(([key, bucket]) => {
+        normalizeTotals(bucket.totals);
+        return { key, totals: bucket.totals, verification: bucket.verification };
+    })
+        .sort((a, b) => b.totals.total_input_tokens_saved - a.totals.total_input_tokens_saved || a.key.localeCompare(b.key));
+}
+function buildSessions(runs) {
+    const sessions = new Map();
+    for (const run of runs) {
+        const { id, explicit } = sessionIdFor(run);
+        let session = sessions.get(id);
+        if (!session) {
+            session = { explicit, runs: [] };
+            sessions.set(id, session);
+        }
+        // An explicit label anywhere marks the session explicit.
+        session.explicit = session.explicit || explicit;
+        session.runs.push(run);
+    }
+    return [...sessions.entries()]
+        .map(([sessionId, { explicit, runs: sessionRuns }]) => {
+        const totals = emptyTotals();
+        const verification = emptyVerification();
+        for (const run of sessionRuns) {
+            addRunToTotals(totals, run);
+            addRunToVerification(verification, run);
+        }
+        normalizeTotals(totals);
+        return {
+            session_id: sessionId,
+            explicit_session_label: explicit,
+            run_ids: sessionRuns.map((r) => r.run_id).sort(),
+            labels: {
+                projects: distinct(sessionRuns.map((r) => r.labels.project)),
+                workflows: distinct(sessionRuns.map((r) => r.labels.workflow)),
+                providers: distinct(sessionRuns.map((r) => r.labels.provider)),
+                user_labels: distinct(sessionRuns.map((r) => r.labels.user_label))
+            },
+            totals,
+            verification
+        };
+    })
+        .sort((a, b) => b.totals.total_input_tokens_saved - a.totals.total_input_tokens_saved ||
+        a.session_id.localeCompare(b.session_id));
+}
+/**
+ * Build the aggregate id (which also becomes the output DIRECTORY name in `aggregate.ts`).
+ *
+ * Truncating `generatedAt` to second granularity (`YYYYMMDDHHMMSS`) made two rollups generated in
+ * the SAME second — e.g. a filtered then an unfiltered run back-to-back — collide on the same id,
+ * so the second silently OVERWROTE the first's directory (data loss). Include sub-second entropy so
+ * concurrent / back-to-back rollups get DISTINCT ids and paths:
+ *  - the FULL timestamp digits (keeps milliseconds), and
+ *  - a short random suffix, so even two rollups in the same millisecond (a reused explicit
+ *    `generatedAt`, or sub-millisecond synchronous calls) still differ.
+ * The id stays stably sortable by time because the timestamp digits lead.
+ */
+function aggregateIdFromGeneratedAt(generatedAt) {
+    const timestampDigits = generatedAt.replace(/[^0-9]/g, "");
+    const entropy = randomUUID().slice(0, 8);
+    return `aggregate-${timestampDigits}-${entropy}`;
+}
+/**
+ * PURE rollup: fold a set of normalized run records into the per-session + cross-session
+ * aggregate report. No IO. Applies the supplied local-label filters first.
+ */
+export function buildAggregateReport(runs, options = {}) {
+    const generatedAt = options.generatedAt ?? new Date().toISOString();
+    const filters = options.filters ?? {};
+    const matched = runs.filter((run) => runMatchesFilters(run, filters));
+    const totals = emptyTotals();
+    const verification = emptyVerification();
+    for (const run of matched) {
+        addRunToTotals(totals, run);
+        addRunToVerification(verification, run);
+    }
+    normalizeTotals(totals);
+    const sessions = buildSessions(matched);
+    return {
+        aggregate_id: aggregateIdFromGeneratedAt(generatedAt),
+        generated_at: generatedAt,
+        source_glob: options.sourceGlob ?? ".compaction/runs/*/report.json",
+        applied_filters: filters,
+        rollup_labels: options.rollupLabels ?? {},
+        session_count: sessions.length,
+        totals,
+        verification,
+        sessions,
+        by_provider: buildBreakdown(matched, (run) => run.labels.provider ?? NO_LABEL),
+        by_project: buildBreakdown(matched, (run) => run.labels.project ?? NO_LABEL),
+        by_workflow: buildBreakdown(matched, (run) => run.labels.workflow ?? NO_LABEL),
+        skipped_run_directories: options.skippedRunDirectories ?? [],
+        evidence_labels: AGGREGATE_EVIDENCE_LABELS,
+        limitations: STANDARD_LIMITATIONS
+    };
+}
+// ----------------------------------------------------------------------------------
+// IO: read run records from the local .compaction/runs tree. The ONLY IO in this file.
+// ----------------------------------------------------------------------------------
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function num(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+/** Map a strong-eval token-accounting "measured" flag to a token-evidence tier. */
+function tokenEvidenceFrom(measured) {
+    return measured === true ? "provider_reported" : "local_estimate";
+}
+function checkOutcomeFromStatus(status, kind) {
+    if (status === "passed")
+        return "pass";
+    if (status === "failed")
+        return "fail";
+    if (kind === "task" && status === "unsupported")
+        return "unsupported";
+    // recoverability "not_computed" / commitment "not_computed" / anything else → not_evaluated.
+    return "not_evaluated";
+}
+function readinessFrom(status) {
+    if (status === "ready" || status === "conditional" || status === "not_ready")
+        return status;
+    return "not_evaluated";
+}
+/**
+ * Assemble a normalized RunRecord from a run directory's local artifacts. report.json is
+ * REQUIRED (skipped otherwise). strong-eval.json and run-labels.json are OPTIONAL: absence
+ * is recorded honestly (not_evaluated verification, unknown output tokens), never inferred.
+ */
+export function assembleRunRecord(input) {
+    const { report, strongEval } = input;
+    const notes = [];
+    let tokenEvidence = "local_estimate";
+    let inputBefore = report.original_input_tokens;
+    let inputAfter = report.compacted_input_tokens;
+    let inputSaved = report.tokens_saved;
+    let outputBefore = "unknown";
+    let outputAfter = "unknown";
+    let costBefore = report.cost_before_per_run;
+    let costAfter = report.cost_after_per_run;
+    let saving = report.saving_per_run;
+    let readiness = "not_evaluated";
+    let recoverability = "not_evaluated";
+    let commitment = "not_evaluated";
+    let taskCheck = "not_evaluated";
+    let strongEvalPresent = false;
+    let model = report.model;
+    if (isRecord(strongEval)) {
+        strongEvalPresent = true;
+        const tokenAccounting = isRecord(strongEval.token_accounting) ? strongEval.token_accounting : undefined;
+        if (tokenAccounting) {
+            tokenEvidence = tokenEvidenceFrom(tokenAccounting.measured);
+            if (typeof tokenAccounting.model === "string" && tokenAccounting.model.length > 0) {
+                model = tokenAccounting.model;
+            }
+            const ib = isRecord(tokenAccounting.input_tokens_before) ? num(tokenAccounting.input_tokens_before.value) : null;
+            const ia = isRecord(tokenAccounting.input_tokens_after) ? num(tokenAccounting.input_tokens_after.value) : null;
+            const ob = isRecord(tokenAccounting.output_tokens_before) ? num(tokenAccounting.output_tokens_before.value) : null;
+            const oa = isRecord(tokenAccounting.output_tokens_after) ? num(tokenAccounting.output_tokens_after.value) : null;
+            const cb = num(tokenAccounting.estimated_cost_before_usd);
+            const ca = num(tokenAccounting.estimated_cost_after_usd);
+            const sv = num(tokenAccounting.estimated_saving_per_run_usd);
+            const saved = num(tokenAccounting.input_tokens_saved);
+            if (ib !== null)
+                inputBefore = ib;
+            if (ia !== null)
+                inputAfter = ia;
+            if (saved !== null)
+                inputSaved = saved;
+            if (ob !== null)
+                outputBefore = ob;
+            if (oa !== null)
+                outputAfter = oa;
+            if (cb !== null)
+                costBefore = cb;
+            if (ca !== null)
+                costAfter = ca;
+            if (sv !== null)
+                saving = sv;
+        }
+        else {
+            notes.push("strong-eval.json present but token_accounting was missing; used report.json token/cost figures.");
+        }
+        const readinessBlock = isRecord(strongEval.readiness) ? strongEval.readiness : undefined;
+        readiness = readinessFrom(readinessBlock?.readiness);
+        const recovEval = isRecord(strongEval.recoverability_eval) ? strongEval.recoverability_eval : undefined;
+        recoverability = checkOutcomeFromStatus(recovEval?.recoverability, "recoverability");
+        const commitmentBlock = isRecord(strongEval.commitment_preservation) ? strongEval.commitment_preservation : undefined;
+        commitment = checkOutcomeFromStatus(commitmentBlock?.status, "commitment");
+        const taskBlock = isRecord(strongEval.task_check) ? strongEval.task_check : undefined;
+        taskCheck = checkOutcomeFromStatus(taskBlock?.status, "task");
+    }
+    else {
+        tokenEvidence = "local_estimate";
+        notes.push("No strong-eval.json: verification outcomes are not_evaluated and output tokens are unknown for this run.");
+    }
+    return {
+        run_id: input.runId,
+        run_directory: input.runDirectory,
+        report_path: input.reportPath,
+        model,
+        token_evidence: tokenEvidence,
+        input_tokens_before: inputBefore,
+        input_tokens_after: inputAfter,
+        input_tokens_saved: inputSaved,
+        output_tokens_before: outputBefore,
+        output_tokens_after: outputAfter,
+        estimated_cost_before_usd: costBefore,
+        estimated_cost_after_usd: costAfter,
+        estimated_saving_usd: saving,
+        readiness,
+        recoverability,
+        commitment_preservation: commitment,
+        task_check: taskCheck,
+        strong_eval_present: strongEvalPresent,
+        labels: input.labels,
+        notes
+    };
+}
+async function readJsonIfPresent(path) {
+    try {
+        return { value: JSON.parse(await readFile(path, "utf8")) };
+    }
+    catch (error) {
+        const code = typeof error === "object" && error !== null && "code" in error ? String(error.code) : null;
+        if (code === "ENOENT")
+            return {};
+        if (error instanceof SyntaxError)
+            return { reason: "invalid JSON" };
+        return { reason: "could not read file" };
+    }
+}
+function validReport(value) {
+    if (!isRecord(value))
+        return false;
+    return (typeof value.run_id === "string" &&
+        num(value.original_input_tokens) !== null &&
+        num(value.compacted_input_tokens) !== null &&
+        num(value.tokens_saved) !== null &&
+        num(value.cost_before_per_run) !== null &&
+        num(value.cost_after_per_run) !== null &&
+        num(value.saving_per_run) !== null);
+}
+/**
+ * Read every run directory under `runsDirectory`, assembling one RunRecord per directory that
+ * carries a valid report.json. The ONLY IO path. Reads exclusively local files; makes NO
+ * network call. Directories without a valid report.json are recorded as skipped, never dropped
+ * silently.
+ */
+export async function collectRunRecords(runsDirectory = ".compaction/runs") {
+    let runDirs;
+    try {
+        const entries = await readdir(runsDirectory, { withFileTypes: true });
+        runDirs = entries.filter((e) => e.isDirectory()).map((e) => e.name).sort();
+    }
+    catch (error) {
+        const code = typeof error === "object" && error !== null && "code" in error ? String(error.code) : "unknown";
+        if (code === "ENOENT")
+            return { runs: [], skipped: [] };
+        throw error;
+    }
+    const runs = [];
+    const skipped = [];
+    for (const dirName of runDirs) {
+        const runDirectory = join(runsDirectory, dirName);
+        const reportPath = join(runDirectory, "report.json");
+        const reportRead = await readJsonIfPresent(reportPath);
+        if (reportRead.value === undefined) {
+            skipped.push({ run_directory: runDirectory, reason: reportRead.reason ?? "report.json not found" });
+            continue;
+        }
+        if (!validReport(reportRead.value)) {
+            skipped.push({ run_directory: runDirectory, reason: "report.json missing required fields" });
+            continue;
+        }
+        const report = reportRead.value;
+        const strongRead = await readJsonIfPresent(join(runDirectory, "strong-eval.json"));
+        const labelsRead = await readJsonIfPresent(join(runDirectory, "run-labels.json"));
+        const labels = parseRunLabels(labelsRead.value);
+        runs.push(assembleRunRecord({
+            runId: report.run_id,
+            runDirectory,
+            reportPath,
+            report,
+            strongEval: strongRead.value,
+            labels
+        }));
+    }
+    return { runs, skipped };
+}
+/** Read records + build the report in one call (local IO + pure rollup). */
+export async function createAggregateReport(runsDirectory = ".compaction/runs", options = {}) {
+    const { runs, skipped } = await collectRunRecords(runsDirectory);
+    return buildAggregateReport(runs, {
+        ...options,
+        sourceGlob: options.sourceGlob ?? `${runsDirectory}/*/report.json`,
+        skippedRunDirectories: skipped
+    });
+}
+//# sourceMappingURL=session-aggregate.js.map

package/dist/core/skill-injection-detector.d.ts

@@ -0,0 +1,51 @@
+import type { AgentTrace, TraceMessage, WasteFinding } from "./types.js";
+export interface SkillInjectionFinding extends WasteFinding {
+    category: "repeated_skill_injection";
+    skillName: string;
+    /** The first (retained) copy's message id. Never compacted. */
+    firstCopyMessageId: string;
+    /** The later byte-identical copy's message id (the redundant, reportable volume). */
+    redundantCopyMessageId: string;
+}
+export interface SkillInjectionSkillAttribution {
+    skill_name: string;
+    /** Number of redundant byte-identical copies (second-and-later occurrences). */
+    redundant_byte_identical_copies: number;
+    /** Estimated (chars/4) trace tokens carried by the redundant copies — NOT realized savings. */
+    estimated_tokens: number;
+    redundant_copy_message_ids: string[];
+}
+export interface SkillInjectionAdvisory {
+    /** Report-only advisory. Nothing was compacted; these are detection-only figures. */
+    report_only: true;
+    /** Distinct skills that have at least one redundant byte-identical copy. */
+    skills: SkillInjectionSkillAttribution[];
+    /** Total redundant byte-identical copies across all skills. */
+    total_redundant_byte_identical_copies: number;
+    /** Total addressable est trace-token volume (chars/4) the policy COULD unlock if applied later. */
+    total_addressable_estimated_tokens: number;
+    /** Number of first/unique injection copies that are retained (never candidates). */
+    first_copy_count: number;
+    estimate_label: string;
+    recommendation: string;
+}
+export declare function parseSkillName(content: string): string | null;
+export declare function isSkillInjection(message: TraceMessage): boolean;
+/**
+ * Detect repeated byte-identical, same-skill skill injections.
+ *
+ * Key = `${skillName}:${normalizeExactContent(content)}` — exact, NOT a prefix, NOT fuzzy.
+ * First occurrence of each key is retained; each later exact-key copy is a redundant
+ * byte-identical candidate (the reportable volume). Different normalized content (e.g.
+ * divergent ARGUMENTS) ⇒ different key ⇒ never grouped (near-identical excluded by
+ * construction). Two different skills can never share a key because the key is prefixed
+ * with the parsed skill name.
+ *
+ * REPORT-ONLY: returns findings; never mutates the trace.
+ */
+export declare function detectSkillInjectionRepetition(trace: AgentTrace): SkillInjectionFinding[];
+/**
+ * Build the report-only advisory (per-skill spend attribution + total addressable est).
+ * Pure: derived from the detector findings; nothing is compacted.
+ */
+export declare function buildSkillInjectionAdvisory(trace: AgentTrace): SkillInjectionAdvisory;