@warlock.js/ai-panoptic 5.31.0 → 5.33.0

package/esm/contracts/trace.type.d.mts

@@ -1,5 +1,4 @@
 import { ReportStatus, ReportType, Usage } from "@warlock.js/ai";
-
 //#region ../../packages/ai-panoptic/src/contracts/trace.type.d.ts
 /**
  * A single node in a Panoptic trace tree, derived 1:1 from a core
@@ -31,7 +30,7 @@ import { ReportStatus, ReportType, Usage } from "@warlock.js/ai";
  *   children: [],
  * };
  */
-type TraceSpan = {
+export type TraceSpan = {
   /**
    * Stable id for this span. Mirrors `BaseReport.runId` — one span per
    * execution node.
@@ -54,19 +53,26 @@ type TraceSpan = {
    * Surfaces as a session/thread dimension in backends that model
    * conversations. Absent when the caller didn't supply one.
    */
-  sessionId?: string; /** Executable identity — the tool/agent/workflow/supervisor name. */
+  sessionId?: string;
+  /** Executable identity — the tool/agent/workflow/supervisor name. */
   name: string;
   /**
    * Dev-curated version string mirrored from `BaseReport.version`.
    * Free-form; surfaced as a span attribute so dashboards can slice
    * runs of "agent X v2.1" from "v2.2". Absent when undeclared.
    */
-  version?: string; /** Discriminator for the kind of executable that produced this span. */
-  type: ReportType; /** Terminal status of this execution, mirrored from `BaseReport.status`. */
-  status: ReportStatus; /** ISO-8601 wall-clock timestamp when execution began. */
-  startedAt: string; /** ISO-8601 wall-clock timestamp when execution finished. */
-  endedAt: string; /** Monotonic duration in milliseconds. */
-  duration: number; /** Rolled-up usage for this node (own cost + sum of children). */
+  version?: string;
+  /** Discriminator for the kind of executable that produced this span. */
+  type: ReportType;
+  /** Terminal status of this execution, mirrored from `BaseReport.status`. */
+  status: ReportStatus;
+  /** ISO-8601 wall-clock timestamp when execution began. */
+  startedAt: string;
+  /** ISO-8601 wall-clock timestamp when execution finished. */
+  endedAt: string;
+  /** Monotonic duration in milliseconds. */
+  duration: number;
+  /** Rolled-up usage for this node (own cost + sum of children). */
   usage: Usage;
   /**
    * Normalized error description when `status` is `"failed"` /
@@ -110,9 +116,12 @@ type TraceSpan = {
  * Kept structural (not an `Error` instance) so it survives JSON
  * serialization to a backend collector unchanged.
  */
-type TraceSpanError = {
-  /** Stable error identifier (typed framework error name when available). */type: string; /** Human-readable message — secret-scrubbed before storage (S4). */
-  message: string; /** Optional captured stack trace, secret-scrubbed when present (S4). */
+export type TraceSpanError = {
+  /** Stable error identifier (typed framework error name when available). */
+  type: string;
+  /** Human-readable message — secret-scrubbed before storage (S4). */
+  message: string;
+  /** Optional captured stack trace, secret-scrubbed when present (S4). */
   stack?: string;
   /**
    * Optional redacted view of the error's `cause` (S4) — a raw provider
@@ -128,13 +137,22 @@ type TraceSpanError = {
  * `Trace` corresponds to one outermost `BaseReport` (a single
  * `.execute()` / `.invoke()` call).
  */
-type Trace = {
-  /** Trace id — equals the root span's `traceId` / `rootRunId`. */traceId: string; /** Session grouping id, when the originating run carried one. */
-  sessionId?: string; /** Root span of this trace. */
-  root: TraceSpan; /** Wall-clock start of the trace (root span `startedAt`). */
-  startedAt: string; /** Wall-clock end of the trace (root span `endedAt`). */
-  endedAt: string; /** Total trace duration in milliseconds (root span `duration`). */
-  duration: number; /** Trace-wide usage rollup (root span `usage`). */
+export type Trace = {
+  /** HTTP request correlation supplied by an integration; independent of sessionId. */
+  requestId?: string;
+  /** Trace id — equals the root span's `traceId` / `rootRunId`. */
+  traceId: string;
+  /** Session grouping id, when the originating run carried one. */
+  sessionId?: string;
+  /** Root span of this trace. */
+  root: TraceSpan;
+  /** Wall-clock start of the trace (root span `startedAt`). */
+  startedAt: string;
+  /** Wall-clock end of the trace (root span `endedAt`). */
+  endedAt: string;
+  /** Total trace duration in milliseconds (root span `duration`). */
+  duration: number;
+  /** Trace-wide usage rollup (root span `usage`). */
   usage: Usage;
   /**
    * Wire-format version of the source `BaseReport` shape, mirrored from
@@ -144,5 +162,4 @@ type Trace = {
   reportSchemaVersion?: number;
 };
 //#endregion
-export { Trace, TraceSpan, TraceSpanError };
 //# sourceMappingURL=trace.type.d.mts.map

package/esm/contracts/trace.type.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"trace.type.d.mts","names":[],"sources":["../../../../../../../../packages/ai-panoptic/src/contracts/trace.type.ts"],"mappings":";;;;;AAgCA;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAAY,SAAA;EA2DG;;;;EAtDb,MAAA;EA0EmB;AAAA;AAQrB;;EA7EE,YAAA;EA6EwB;;;;;;EAtExB,OAAA;EA4FU;;;;;EAtFV,SAAA,WA4FA;EA1FA,IAAA;EA4FA;;;;;EAtFA,OAAA,WAkGmB;EAhGnB,IAAA,EAAM,UAAA;EAEN,MAAA,EAAQ,YAAA;EAER,SAAA;EAEA,OAAA;EAEA,QAAA;EAEA,KAAA,EAAO,KAAA;;;;;;EAMP,KAAA,GAAQ,cAAA;;;;;;;;;;EAUR,UAAA,GAAa,MAAA;;;;;;;;EAQb,KAAA;;;;;;EAMA,MAAA;;;;;;EAMA,QAAA,EAAU,SAAA;AAAA;;;;;;KAQA,cAAA;6EAEV,IAAA;EAEA,OAAA;EAEA,KAAA;;;;;;;EAOA,KAAA;AAAA;;;;;;;KASU,KAAA;mEAEV,OAAA;EAEA,SAAA;EAEA,IAAA,EAAM,SAAA;EAEN,SAAA;EAEA,OAAA;EAEA,QAAA;EAEA,KAAA,EAAO,KAAK;;;;;;EAMZ,mBAAA;AAAA"}
+{"version":3,"file":"trace.type.d.mts","names":[],"sources":["../../../../../../../../packages/ai-panoptic/src/contracts/trace.type.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAgCY;;;;;EAKV;;;;;EAKA;;;;;;;EAOA;;;;;;EAMA;;EAEA;;;;;;EAMA;;EAEA,MAAM;;EAEN,QAAQ;;EAER;;EAEA;;EAEA;;EAEA,OAAO;;;;;;EAMP,QAAQ;;;;;;;;;;EAUR,aAAa;;;;;;;;EAQb;;;;;;EAMA;;;;;;EAMA,UAAU;;;;;;;YAQA;;EAEV;;EAEA;;EAEA;;;;;;;EAOA;;;;;;;;YASU;;EAEV;;EAEA;;EAEA;;EAEA,MAAM;;EAEN;;EAEA;;EAEA;;EAEA,OAAO;;;;;;EAMP"}

package/esm/dashboard/dashboard.d.mts

@@ -1,6 +1,5 @@
 import { TraceStoreContract } from "../store/trace-store.contract.mjs";
 import { DashboardHandle, DashboardOptions } from "./dashboard.type.mjs";
-
 //#region ../../packages/ai-panoptic/src/dashboard/dashboard.d.ts
 /**
  * Start the local Panoptic dashboard over a {@link TraceStoreContract} —
@@ -26,7 +25,6 @@ import { DashboardHandle, DashboardOptions } from "./dashboard.type.mjs";
  * // ...later:
  * await handle.close();
  */
-declare function dashboard(store: TraceStoreContract, options?: DashboardOptions): Promise<DashboardHandle>;
+export declare function dashboard(store: TraceStoreContract, options?: DashboardOptions): Promise<DashboardHandle>;
 //#endregion
-export { dashboard };
 //# sourceMappingURL=dashboard.d.mts.map

package/esm/dashboard/dashboard.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard.d.mts","names":[],"sources":["../../../../../../../../packages/ai-panoptic/src/dashboard/dashboard.ts"],"mappings":";;;;;;AAiCA;;;;;;;;;;;;;;;;AAG0B;;;;;;iBAHV,SAAA,CACd,KAAA,EAAO,kBAAA,EACP,OAAA,GAAS,gBAAA,GACR,OAAA,CAAQ,eAAA"}
+{"version":3,"file":"dashboard.d.mts","names":[],"sources":["../../../../../../../../packages/ai-panoptic/src/dashboard/dashboard.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;wBAiCgB,UACd,OAAO,oBACP,UAAS,mBACR,QAAQ"}

package/esm/dashboard/dashboard.mjs

@@ -36,13 +36,14 @@ function dashboard(store, options = {}) {
 	const basePath = normalizeBasePath(options.basePath);
 	if (!isLoopbackHost(host) && !options.authToken) return Promise.reject(/* @__PURE__ */ new Error(`Panoptic dashboard: binding to a non-loopback host ("${host}") requires an \`authToken\` (the dashboard exposes raw prompt content). Pass \`authToken\`, or bind to 127.0.0.1.`));
 	const allowedHosts = (options.allowedHosts ?? defaultAllowedHosts(host)).map((h) => h.toLowerCase());
-	const server = createServer(createRequestHandler(store, {
+	const handler = createRequestHandler(store, {
 		basePath,
 		title,
 		authToken: options.authToken,
 		allowedHosts,
 		evaluate: options.evaluate
-	}));
+	});
+	const server = createServer(handler);
 	return new Promise((resolve, reject) => {
 		const onError = (error) => {
 			server.off("error", onError);

package/esm/dashboard/dashboard.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard.mjs","names":[],"sources":["../../../../../../../../packages/ai-panoptic/src/dashboard/dashboard.ts"],"sourcesContent":["import { createServer } from \"node:http\";\nimport type { TraceStoreContract } from \"../store/trace-store.contract\";\nimport type { DashboardHandle, DashboardOptions } from \"./dashboard.type\";\nimport { createRequestHandler } from \"./serve\";\n\nconst DEFAULT_PORT = 4319;\nconst DEFAULT_HOST = \"127.0.0.1\";\nconst DEFAULT_TITLE = \"Panoptic\";\n\n/**\n * Start the local Panoptic dashboard over a {@link TraceStoreContract} —\n * a zero-dependency `node:http` server that serves a read-only JSON API\n * and one self-contained HTML page polling it. The store is the live\n * object the collector fills, so each poll reflects the latest completed\n * traces with no extra wiring.\n *\n * This is a low-level building block. The documented path is\n * `ai.config({ panoptic: { dashboard } })`, which constructs (or reuses)\n * the store and calls this for you. Use it directly only when you manage\n * the store yourself.\n *\n * Binds loopback-only by default (`127.0.0.1`) so prompt content is never\n * exposed to the LAN. Pass `port: 0` for an ephemeral port — the resolved\n * port comes back on the handle. A port already in use rejects with a\n * clear, actionable `Error` rather than the raw `EADDRINUSE`.\n *\n * @example\n * const store = createInMemoryTraceStore();\n * const handle = await dashboard(store, { port: 4319, open: true });\n * console.log(handle.url); // http://127.0.0.1:4319/\n * // ...later:\n * await handle.close();\n */\nexport function dashboard(\n  store: TraceStoreContract,\n  options: DashboardOptions = {},\n): Promise<DashboardHandle> {\n  const port = options.port ?? DEFAULT_PORT;\n  const host = options.host ?? DEFAULT_HOST;\n  const title = options.title ?? DEFAULT_TITLE;\n  const basePath = normalizeBasePath(options.basePath);\n\n  // Secure-by-default off loopback (S4): a non-loopback bind without an\n  // auth token would expose raw prompt content to the network, so refuse\n  // to start rather than silently exposing it.\n  if (!isLoopbackHost(host) && !options.authToken) {\n    return Promise.reject(\n      new Error(\n        `Panoptic dashboard: binding to a non-loopback host (\"${host}\") requires an \\`authToken\\` ` +\n          \"(the dashboard exposes raw prompt content). Pass `authToken`, or bind to 127.0.0.1.\",\n      ),\n    );\n  }\n\n  const allowedHosts = (options.allowedHosts ?? defaultAllowedHosts(host)).map((h) =>\n    h.toLowerCase(),\n  );\n\n  const handler = createRequestHandler(store, {\n    basePath,\n    title,\n    authToken: options.authToken,\n    allowedHosts,\n    evaluate: options.evaluate,\n  });\n  const server = createServer(handler);\n\n  return new Promise<DashboardHandle>((resolve, reject) => {\n    const onError = (error: NodeJS.ErrnoException): void => {\n      server.off(\"error\", onError);\n\n      if (error.code === \"EADDRINUSE\") {\n        reject(\n          new Error(\n            `Panoptic dashboard: port ${port} in use; pass { port: 0 } for an ephemeral port`,\n          ),\n        );\n\n        return;\n      }\n\n      reject(error);\n    };\n\n    server.on(\"error\", onError);\n\n    server.listen(port, host, () => {\n      server.off(\"error\", onError);\n\n      const address = server.address();\n      const resolvedPort = typeof address === \"object\" && address !== null ? address.port : port;\n      const url = `http://${host}:${resolvedPort}${basePath}`;\n\n      if (options.open) {\n        openBrowser(url);\n      }\n\n      resolve({\n        url,\n        port: resolvedPort,\n        close(): Promise<void> {\n          return new Promise<void>((closeResolve, closeReject) => {\n            server.close((closeError) => {\n              if (closeError) {\n                closeReject(closeError);\n\n                return;\n              }\n\n              closeResolve();\n            });\n          });\n        },\n      });\n    });\n  });\n}\n\n/** Loopback hosts the dashboard may bind without an auth token. */\nfunction isLoopbackHost(host: string): boolean {\n  const h = host.toLowerCase();\n  return h === \"127.0.0.1\" || h === \"::1\" || h === \"[::1]\" || h === \"localhost\";\n}\n\n/**\n * Default `Host` allowlist for a given bind host. A loopback bind accepts\n * the loopback names a browser would send; a non-loopback bind defaults to\n * just the bound host (callers can widen via `allowedHosts`).\n */\nfunction defaultAllowedHosts(host: string): string[] {\n  if (isLoopbackHost(host)) {\n    return [\"localhost\", \"127.0.0.1\", \"[::1]\", \"::1\"];\n  }\n  return [host];\n}\n\n/**\n * Normalize a caller `basePath` to a leading-and-trailing-slash form the\n * router can prefix routes with. `undefined` / `\"\"` → `\"/\"`.\n */\nfunction normalizeBasePath(basePath?: string): string {\n  if (basePath === undefined || basePath.length === 0 || basePath === \"/\") {\n    return \"/\";\n  }\n\n  const withLeading = basePath.startsWith(\"/\") ? basePath : `/${basePath}`;\n\n  return withLeading.endsWith(\"/\") ? withLeading : `${withLeading}/`;\n}\n\n/**\n * Best-effort open of the default browser at `url`. Fire-and-forget and\n * fully swallowed — failing to open a browser must never reject the\n * dashboard start. Uses the platform's native opener via a lazy\n * `node:child_process` import so the dependency is paid only when\n * `open: true`.\n */\nfunction openBrowser(url: string): void {\n  void import(\"node:child_process\")\n    .then(({ spawn }) => {\n      const command =\n        process.platform === \"win32\" ? \"cmd\" : process.platform === \"darwin\" ? \"open\" : \"xdg-open\";\n      const args = process.platform === \"win32\" ? [\"/c\", \"start\", \"\", url] : [url];\n\n      const child = spawn(command, args, { stdio: \"ignore\", detached: true });\n      child.on(\"error\", () => {\n        // Swallow — opening a browser is best-effort.\n      });\n      child.unref();\n    })\n    .catch(() => {\n      // Swallow — opening a browser is best-effort.\n    });\n}\n"],"mappings":";;;;AAKA,MAAM,eAAe;AACrB,MAAM,eAAe;AACrB,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;AA0BtB,SAAgB,UACd,OACA,UAA4B,CAAC,GACH;CAC1B,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;CAKnD,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC,QAAQ,WACpC,OAAO,QAAQ,uBACb,IAAI,MACF,wDAAwD,KAAK,mHAE/D,CACF;CAGF,MAAM,gBAAgB,QAAQ,gBAAgB,oBAAoB,IAAI,EAAC,CAAE,KAAK,MAC5E,EAAE,YAAY,CAChB;CASA,MAAM,SAAS,aAPC,qBAAqB,OAAO;EAC1C;EACA;EACA,WAAW,QAAQ;EACnB;EACA,UAAU,QAAQ;CACpB,CACkC,CAAC;CAEnC,OAAO,IAAI,SAA0B,SAAS,WAAW;EACvD,MAAM,WAAW,UAAuC;GACtD,OAAO,IAAI,SAAS,OAAO;GAE3B,IAAI,MAAM,SAAS,cAAc;IAC/B,uBACE,IAAI,MACF,4BAA4B,KAAK,gDACnC,CACF;IAEA;GACF;GAEA,OAAO,KAAK;EACd;EAEA,OAAO,GAAG,SAAS,OAAO;EAE1B,OAAO,OAAO,MAAM,YAAY;GAC9B,OAAO,IAAI,SAAS,OAAO;GAE3B,MAAM,UAAU,OAAO,QAAQ;GAC/B,MAAM,eAAe,OAAO,YAAY,YAAY,YAAY,OAAO,QAAQ,OAAO;GACtF,MAAM,MAAM,UAAU,KAAK,GAAG,eAAe;GAE7C,IAAI,QAAQ,MACV,YAAY,GAAG;GAGjB,QAAQ;IACN;IACA,MAAM;IACN,QAAuB;KACrB,OAAO,IAAI,SAAe,cAAc,gBAAgB;MACtD,OAAO,OAAO,eAAe;OAC3B,IAAI,YAAY;QACd,YAAY,UAAU;QAEtB;OACF;OAEA,aAAa;MACf,CAAC;KACH,CAAC;IACH;GACF,CAAC;EACH,CAAC;CACH,CAAC;AACH;;AAGA,SAAS,eAAe,MAAuB;CAC7C,MAAM,IAAI,KAAK,YAAY;CAC3B,OAAO,MAAM,eAAe,MAAM,SAAS,MAAM,WAAW,MAAM;AACpE;;;;;;AAOA,SAAS,oBAAoB,MAAwB;CACnD,IAAI,eAAe,IAAI,GACrB,OAAO;EAAC;EAAa;EAAa;EAAS;CAAK;CAElD,OAAO,CAAC,IAAI;AACd;;;;;AAMA,SAAS,kBAAkB,UAA2B;CACpD,IAAI,aAAa,UAAa,SAAS,WAAW,KAAK,aAAa,KAClE,OAAO;CAGT,MAAM,cAAc,SAAS,WAAW,GAAG,IAAI,WAAW,IAAI;CAE9D,OAAO,YAAY,SAAS,GAAG,IAAI,cAAc,GAAG,YAAY;AAClE;;;;;;;;AASA,SAAS,YAAY,KAAmB;CACtC,AAAK,OAAO,qBAAqB,CAC9B,MAAM,EAAE,YAAY;EAKnB,MAAM,QAAQ,MAHZ,QAAQ,aAAa,UAAU,QAAQ,QAAQ,aAAa,WAAW,SAAS,YACrE,QAAQ,aAAa,UAAU;GAAC;GAAM;GAAS;GAAI;EAAG,IAAI,CAAC,GAAG,GAExC;GAAE,OAAO;GAAU,UAAU;EAAK,CAAC;EACtE,MAAM,GAAG,eAAe,CAExB,CAAC;EACD,MAAM,MAAM;CACd,CAAC,CAAC,CACD,YAAY,CAEb,CAAC;AACL"}
+{"version":3,"file":"dashboard.mjs","names":[],"sources":["../../../../../../../../packages/ai-panoptic/src/dashboard/dashboard.ts"],"sourcesContent":["import { createServer } from \"node:http\";\nimport type { TraceStoreContract } from \"../store/trace-store.contract\";\nimport type { DashboardHandle, DashboardOptions } from \"./dashboard.type\";\nimport { createRequestHandler } from \"./serve\";\n\nconst DEFAULT_PORT = 4319;\nconst DEFAULT_HOST = \"127.0.0.1\";\nconst DEFAULT_TITLE = \"Panoptic\";\n\n/**\n * Start the local Panoptic dashboard over a {@link TraceStoreContract} —\n * a zero-dependency `node:http` server that serves a read-only JSON API\n * and one self-contained HTML page polling it. The store is the live\n * object the collector fills, so each poll reflects the latest completed\n * traces with no extra wiring.\n *\n * This is a low-level building block. The documented path is\n * `ai.config({ panoptic: { dashboard } })`, which constructs (or reuses)\n * the store and calls this for you. Use it directly only when you manage\n * the store yourself.\n *\n * Binds loopback-only by default (`127.0.0.1`) so prompt content is never\n * exposed to the LAN. Pass `port: 0` for an ephemeral port — the resolved\n * port comes back on the handle. A port already in use rejects with a\n * clear, actionable `Error` rather than the raw `EADDRINUSE`.\n *\n * @example\n * const store = createInMemoryTraceStore();\n * const handle = await dashboard(store, { port: 4319, open: true });\n * console.log(handle.url); // http://127.0.0.1:4319/\n * // ...later:\n * await handle.close();\n */\nexport function dashboard(\n  store: TraceStoreContract,\n  options: DashboardOptions = {},\n): Promise<DashboardHandle> {\n  const port = options.port ?? DEFAULT_PORT;\n  const host = options.host ?? DEFAULT_HOST;\n  const title = options.title ?? DEFAULT_TITLE;\n  const basePath = normalizeBasePath(options.basePath);\n\n  // Secure-by-default off loopback (S4): a non-loopback bind without an\n  // auth token would expose raw prompt content to the network, so refuse\n  // to start rather than silently exposing it.\n  if (!isLoopbackHost(host) && !options.authToken) {\n    return Promise.reject(\n      new Error(\n        `Panoptic dashboard: binding to a non-loopback host (\"${host}\") requires an \\`authToken\\` ` +\n          \"(the dashboard exposes raw prompt content). Pass `authToken`, or bind to 127.0.0.1.\",\n      ),\n    );\n  }\n\n  const allowedHosts = (options.allowedHosts ?? defaultAllowedHosts(host)).map((h) =>\n    h.toLowerCase(),\n  );\n\n  const handler = createRequestHandler(store, {\n    basePath,\n    title,\n    authToken: options.authToken,\n    allowedHosts,\n    evaluate: options.evaluate,\n  });\n  const server = createServer(handler);\n\n  return new Promise<DashboardHandle>((resolve, reject) => {\n    const onError = (error: NodeJS.ErrnoException): void => {\n      server.off(\"error\", onError);\n\n      if (error.code === \"EADDRINUSE\") {\n        reject(\n          new Error(\n            `Panoptic dashboard: port ${port} in use; pass { port: 0 } for an ephemeral port`,\n          ),\n        );\n\n        return;\n      }\n\n      reject(error);\n    };\n\n    server.on(\"error\", onError);\n\n    server.listen(port, host, () => {\n      server.off(\"error\", onError);\n\n      const address = server.address();\n      const resolvedPort = typeof address === \"object\" && address !== null ? address.port : port;\n      const url = `http://${host}:${resolvedPort}${basePath}`;\n\n      if (options.open) {\n        openBrowser(url);\n      }\n\n      resolve({\n        url,\n        port: resolvedPort,\n        close(): Promise<void> {\n          return new Promise<void>((closeResolve, closeReject) => {\n            server.close((closeError) => {\n              if (closeError) {\n                closeReject(closeError);\n\n                return;\n              }\n\n              closeResolve();\n            });\n          });\n        },\n      });\n    });\n  });\n}\n\n/** Loopback hosts the dashboard may bind without an auth token. */\nfunction isLoopbackHost(host: string): boolean {\n  const h = host.toLowerCase();\n  return h === \"127.0.0.1\" || h === \"::1\" || h === \"[::1]\" || h === \"localhost\";\n}\n\n/**\n * Default `Host` allowlist for a given bind host. A loopback bind accepts\n * the loopback names a browser would send; a non-loopback bind defaults to\n * just the bound host (callers can widen via `allowedHosts`).\n */\nfunction defaultAllowedHosts(host: string): string[] {\n  if (isLoopbackHost(host)) {\n    return [\"localhost\", \"127.0.0.1\", \"[::1]\", \"::1\"];\n  }\n  return [host];\n}\n\n/**\n * Normalize a caller `basePath` to a leading-and-trailing-slash form the\n * router can prefix routes with. `undefined` / `\"\"` → `\"/\"`.\n */\nfunction normalizeBasePath(basePath?: string): string {\n  if (basePath === undefined || basePath.length === 0 || basePath === \"/\") {\n    return \"/\";\n  }\n\n  const withLeading = basePath.startsWith(\"/\") ? basePath : `/${basePath}`;\n\n  return withLeading.endsWith(\"/\") ? withLeading : `${withLeading}/`;\n}\n\n/**\n * Best-effort open of the default browser at `url`. Fire-and-forget and\n * fully swallowed — failing to open a browser must never reject the\n * dashboard start. Uses the platform's native opener via a lazy\n * `node:child_process` import so the dependency is paid only when\n * `open: true`.\n */\nfunction openBrowser(url: string): void {\n  void import(\"node:child_process\")\n    .then(({ spawn }) => {\n      const command =\n        process.platform === \"win32\" ? \"cmd\" : process.platform === \"darwin\" ? \"open\" : \"xdg-open\";\n      const args = process.platform === \"win32\" ? [\"/c\", \"start\", \"\", url] : [url];\n\n      const child = spawn(command, args, { stdio: \"ignore\", detached: true });\n      child.on(\"error\", () => {\n        // Swallow — opening a browser is best-effort.\n      });\n      child.unref();\n    })\n    .catch(() => {\n      // Swallow — opening a browser is best-effort.\n    });\n}\n"],"mappings":";;;;AAKA,MAAM,eAAe;AACrB,MAAM,eAAe;AACrB,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;AA0BtB,SAAgB,UACd,OACA,UAA4B,CAAC,GACH;CAC1B,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;CAKnD,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC,QAAQ,WACpC,OAAO,QAAQ,uBACb,IAAI,MACF,wDAAwD,KAAK,mHAE/D,CACF;CAGF,MAAM,gBAAgB,QAAQ,gBAAgB,oBAAoB,IAAI,EAAC,CAAE,KAAK,MAC5E,EAAE,YAAY,CAChB;CAEA,MAAM,UAAU,qBAAqB,OAAO;EAC1C;EACA;EACA,WAAW,QAAQ;EACnB;EACA,UAAU,QAAQ;CACpB,CAAC;CACD,MAAM,SAAS,aAAa,OAAO;CAEnC,OAAO,IAAI,SAA0B,SAAS,WAAW;EACvD,MAAM,WAAW,UAAuC;GACtD,OAAO,IAAI,SAAS,OAAO;GAE3B,IAAI,MAAM,SAAS,cAAc;IAC/B,uBACE,IAAI,MACF,4BAA4B,KAAK,gDACnC,CACF;IAEA;GACF;GAEA,OAAO,KAAK;EACd;EAEA,OAAO,GAAG,SAAS,OAAO;EAE1B,OAAO,OAAO,MAAM,YAAY;GAC9B,OAAO,IAAI,SAAS,OAAO;GAE3B,MAAM,UAAU,OAAO,QAAQ;GAC/B,MAAM,eAAe,OAAO,YAAY,YAAY,YAAY,OAAO,QAAQ,OAAO;GACtF,MAAM,MAAM,UAAU,KAAK,GAAG,eAAe;GAE7C,IAAI,QAAQ,MACV,YAAY,GAAG;GAGjB,QAAQ;IACN;IACA,MAAM;IACN,QAAuB;KACrB,OAAO,IAAI,SAAe,cAAc,gBAAgB;MACtD,OAAO,OAAO,eAAe;OAC3B,IAAI,YAAY;QACd,YAAY,UAAU;QAEtB;OACF;OAEA,aAAa;MACf,CAAC;KACH,CAAC;IACH;GACF,CAAC;EACH,CAAC;CACH,CAAC;AACH;;AAGA,SAAS,eAAe,MAAuB;CAC7C,MAAM,IAAI,KAAK,YAAY;CAC3B,OAAO,MAAM,eAAe,MAAM,SAAS,MAAM,WAAW,MAAM;AACpE;;;;;;AAOA,SAAS,oBAAoB,MAAwB;CACnD,IAAI,eAAe,IAAI,GACrB,OAAO;EAAC;EAAa;EAAa;EAAS;CAAK;CAElD,OAAO,CAAC,IAAI;AACd;;;;;AAMA,SAAS,kBAAkB,UAA2B;CACpD,IAAI,aAAa,UAAa,SAAS,WAAW,KAAK,aAAa,KAClE,OAAO;CAGT,MAAM,cAAc,SAAS,WAAW,GAAG,IAAI,WAAW,IAAI;CAE9D,OAAO,YAAY,SAAS,GAAG,IAAI,cAAc,GAAG,YAAY;AAClE;;;;;;;;AASA,SAAS,YAAY,KAAmB;CACtC,AAAK,OAAO,qBAAqB,CAC9B,MAAM,EAAE,YAAY;EAKnB,MAAM,QAAQ,MAHZ,QAAQ,aAAa,UAAU,QAAQ,QAAQ,aAAa,WAAW,SAAS,YACrE,QAAQ,aAAa,UAAU;GAAC;GAAM;GAAS;GAAI;EAAG,IAAI,CAAC,GAAG,GAExC;GAAE,OAAO;GAAU,UAAU;EAAK,CAAC;EACtE,MAAM,GAAG,eAAe,CAExB,CAAC;EACD,MAAM,MAAM;CACd,CAAC,CAAC,CACD,YAAY,CAEb,CAAC;AACL"}

package/esm/dashboard/dashboard.type.d.mts

@@ -1,5 +1,4 @@
 import { EvaluateConfig } from "../evaluate/evaluate.type.mjs";
-
 //#region ../../packages/ai-panoptic/src/dashboard/dashboard.type.d.ts
 /**
  * Options for the local Panoptic {@link dashboard} server.
@@ -12,7 +11,7 @@ import { EvaluateConfig } from "../evaluate/evaluate.type.mjs";
  * {@link DashboardOptions.evaluate} enables. There is no auth or persistence
  * by default either.
  */
-type DashboardOptions = {
+export type DashboardOptions = {
   /**
    * TCP port to listen on. Default `4319`. Pass `0` for an ephemeral
    * port — the OS-assigned port is then returned on
@@ -35,7 +34,8 @@ type DashboardOptions = {
    * Open the default browser at the resolved URL once the server is
    * listening. Default `false`.
    */
-  open?: boolean; /** Title shown in the dashboard header. Default `"Panoptic"`. */
+  open?: boolean;
+  /** Title shown in the dashboard header. Default `"Panoptic"`. */
   title?: string;
   /**
    * Bearer token required on every request (S4). When set, a request must
@@ -66,11 +66,13 @@ type DashboardOptions = {
  * Carries the resolved URL + port (useful when `port: 0` requested an
  * ephemeral one) and a `close()` to release the port.
  */
-type DashboardHandle = {
-  /** Resolved URL the UI is served at (`http://host:port{basePath}`). */readonly url: string; /** Resolved port — the real OS-assigned port when `port: 0` was passed. */
-  readonly port: number; /** Stop the server and release the port. Resolves once fully closed. */
+export type DashboardHandle = {
+  /** Resolved URL the UI is served at (`http://host:port{basePath}`). */
+  readonly url: string;
+  /** Resolved port — the real OS-assigned port when `port: 0` was passed. */
+  readonly port: number;
+  /** Stop the server and release the port. Resolves once fully closed. */
   close(): Promise<void>;
 };
 //#endregion
-export { DashboardHandle, DashboardOptions };
 //# sourceMappingURL=dashboard.type.d.mts.map

package/esm/dashboard/dashboard.type.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard.type.d.mts","names":[],"sources":["../../../../../../../../packages/ai-panoptic/src/dashboard/dashboard.type.ts"],"mappings":";;;;;AAaA;;;;;;;;;KAAY,gBAAA;EAuCV;;;;AASyB;EA1CzB,IAAA;EAkDyB;;;;;EA5CzB,IAAA;EAkDS;;AAAO;;;EA5ChB,QAAA;;;;;EAKA,IAAA;EAEA,KAAA;;;;;;;EAOA,SAAA;;;;;;;EAOA,YAAA;;;;;;;;;EASA,QAAA,GAAW,cAAc;AAAA;;;;;;KAQf,eAAA;kFAED,GAAA;WAEA,IAAA;EAET,KAAA,IAAS,OAAO;AAAA"}
+{"version":3,"file":"dashboard.type.d.mts","names":[],"sources":["../../../../../../../../packages/ai-panoptic/src/dashboard/dashboard.type.ts"],"mappings":";;;;;;;;;;;;;YAaY;;;;;;EAMV;;;;;;EAMA;;;;;;EAMA;;;;;EAKA;;EAEA;;;;;;;EAOA;;;;;;;EAOA;;;;;;;;;EASA,WAAW;;;;;;;YAQD;;WAED;;WAEA;;EAET,SAAS"}

package/esm/dashboard/index.d.mts

@@ -1,3 +1,6 @@
 import { DashboardHandle, DashboardOptions } from "./dashboard.type.mjs";
 import { dashboard } from "./dashboard.mjs";
-import { NO_PROMPT_KEY, NO_SESSION_KEY, NO_TYPE_KEY, PromptGroup, SessionGroup, TraceFilter, TypeGroup, TypeStat, aggregateByType, filterTraces, groupByPrompt, groupBySession, groupByType, heatIntensity, matchesFilter, maxNodeCost, percentile, rollupCost, traceCost, tracePromptKey } from "./trace-filter.mjs";
+import "./serve.mjs";
+import "./parse-query.mjs";
+import { NO_PROMPT_KEY, NO_SESSION_KEY, NO_TYPE_KEY, PromptGroup, SessionGroup, TraceFilter, TypeGroup, TypeStat, aggregateByType, filterTraces, groupByPrompt, groupBySession, groupByType, heatIntensity, matchesFilter, maxNodeCost, percentile, rollupCost, traceCost, tracePromptKey } from "./trace-filter.mjs";
+export { type DashboardHandle, type DashboardOptions, dashboard };

package/esm/dashboard/index.mjs

@@ -4,4 +4,4 @@ import { createRequestHandler } from "./serve.mjs";
 import { dashboard } from "./dashboard.mjs";
 import { NO_PROMPT_KEY, NO_SESSION_KEY, NO_TYPE_KEY, aggregateByType, filterTraces, groupByPrompt, groupBySession, groupByType, heatIntensity, matchesFilter, maxNodeCost, percentile, rollupCost, traceCost, tracePromptKey } from "./trace-filter.mjs";
 
-export {  };
+export { dashboard };

package/esm/dashboard/parse-query.d.mts

@@ -1 +1 @@
-export { };
+import "../store/trace-query.type.mjs";

package/esm/dashboard/serve.d.mts

@@ -1 +1,2 @@
-export { };
+import "../store/trace-store.contract.mjs";
+import "../evaluate/evaluate.type.mjs";

package/esm/dashboard/serve.mjs

@@ -7,7 +7,7 @@ import { timingSafeEqual } from "node:crypto";
 
 //#region ../../packages/ai-panoptic/src/dashboard/serve.ts
 /** Hard cap on the evaluate route's request body — well beyond a real instructions string. */
-const MAX_EVALUATE_BODY_BYTES = 64 * 1024;
+const MAX_EVALUATE_BODY_BYTES = 65536;
 /**
 * Security response headers added to every dashboard response (S4):
 * block MIME-sniffing, framing, referrer leakage, and lock the page's

package/esm/dashboard/serve.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"serve.mjs","names":[],"sources":["../../../../../../../../packages/ai-panoptic/src/dashboard/serve.ts"],"sourcesContent":["import { timingSafeEqual } from \"node:crypto\";\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { EvaluateConfig } from \"../evaluate/evaluate.type\";\nimport { evaluateSystemPrompt } from \"../evaluate/evaluate-system-prompt\";\nimport { extractLastSystemPrompt } from \"../evaluate/extract-last-system-prompt\";\nimport { findSpanById } from \"../evaluate/find-span-by-id\";\nimport type { TraceStoreContract } from \"../store/trace-store.contract\";\nimport { parseQuery } from \"./parse-query\";\nimport { dashboardHtml } from \"./ui.html\";\n\n/** Fully-resolved routing config the request handler closes over. */\nexport type ServeConfig = {\n  /** Normalized mount path, always ending in `/` (e.g. `\"/\"`). */\n  basePath: string;\n  /** Header title baked into the served page. */\n  title: string;\n  /** Bearer token required on every request when set (S4). */\n  authToken?: string;\n  /** `Host` header allowlist — defends against DNS-rebinding (S4). */\n  allowedHosts: string[];\n  /**\n   * Enables the one write route: `POST\n   * {basePath}api/traces/:traceId/spans/:spanId/evaluate`. Absent ⇒ the\n   * route 405s (POST isn't accepted by any route) and the served page never\n   * renders the Evaluate button.\n   */\n  evaluate?: EvaluateConfig;\n};\n\n/** Request body accepted by the evaluate route — everything optional. */\ntype EvaluateRequestBody = {\n  /** Per-run instructions override; falls back to `config.evaluate.instructions`. */\n  instructions?: string;\n};\n\n/** Hard cap on the evaluate route's request body — well beyond a real instructions string. */\nconst MAX_EVALUATE_BODY_BYTES = 64 * 1024;\n\n/**\n * Security response headers added to every dashboard response (S4):\n * block MIME-sniffing, framing, referrer leakage, and lock the page's\n * content sources down to itself (the UI is fully self-contained — no CDN).\n */\nconst SECURITY_HEADERS: Record<string, string> = {\n  \"x-content-type-options\": \"nosniff\",\n  \"x-frame-options\": \"DENY\",\n  \"referrer-policy\": \"no-referrer\",\n  \"content-security-policy\":\n    \"default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'\",\n};\n\n/** Extract the host (no port) from a `Host` header value. */\nfunction hostHeaderName(hostHeader: string | undefined): string | undefined {\n  if (!hostHeader) return undefined;\n  // IPv6 literal `[::1]:4319` → `[::1]`; otherwise strip `:port`.\n  if (hostHeader.startsWith(\"[\")) {\n    return hostHeader.slice(0, hostHeader.indexOf(\"]\") + 1);\n  }\n  const colon = hostHeader.indexOf(\":\");\n  return colon === -1 ? hostHeader : hostHeader.slice(0, colon);\n}\n\n/**\n * Constant-time string equality (S4) — guards against a timing\n * side-channel that could otherwise let a network-adjacent attacker\n * recover the token byte-by-byte via repeated timed guesses. Plain `===`\n * short-circuits on the first differing byte, so response latency leaks\n * how many leading bytes matched; `timingSafeEqual` does not. Lengths are\n * compared first (a length mismatch is not secret and `timingSafeEqual`\n * requires equal-length buffers anyway).\n */\nfunction constantTimeEqual(a: string, b: string): boolean {\n  const bufA = Buffer.from(a);\n  const bufB = Buffer.from(b);\n\n  if (bufA.length !== bufB.length) return false;\n\n  return timingSafeEqual(bufA, bufB);\n}\n\n/**\n * Bearer-token check (S4): `Authorization: Bearer <token>` header, or\n * (only when `allowQueryToken`) a `?token=` query param.\n *\n * The query-string form only exists for the one request that structurally\n * cannot carry a custom header — the initial browser navigation that\n * loads the HTML shell (a typed/clicked/bookmarked URL). Every other\n * request the served page makes is same-origin `fetch()`, which can and\n * does set `Authorization` (see `ui.html.ts`'s `fetchAuthed`), so the API\n * routes never need to accept a query-string token. Restricting the\n * fallback to just the page route minimizes the token's exposure in\n * server access logs, proxy logs, and browser history to a single route\n * instead of every poll.\n */\nfunction isAuthorized(\n  req: IncomingMessage,\n  url: URL,\n  token: string,\n  allowQueryToken: boolean,\n): boolean {\n  const header = req.headers.authorization;\n  if (header && constantTimeEqual(header, `Bearer ${token}`)) return true;\n  if (!allowQueryToken) return false;\n  const queryToken = url.searchParams.get(\"token\");\n  return queryToken !== null && constantTimeEqual(queryToken, token);\n}\n\n/**\n * Build the `node:http` request handler for the dashboard over a given\n * trace store. Kept separate from the server lifecycle so it can be unit\n * tested by feeding it a fake `req`/`res` without binding a port.\n *\n * Routes (all under `config.basePath`):\n *\n * - `GET api/traces`        → `store.query(parseQuery(searchParams))`\n * - `GET api/traces/:id`    → `store.get(id)` or `404`\n * - `GET api/aggregate`     → `store.aggregate(parseQuery(searchParams))`\n * - `GET {basePath}`        → the self-contained HTML page\n * - `POST api/traces/:traceId/spans/:spanId/evaluate` → ONLY when\n *   `config.evaluate` is set; grades the span's last captured system\n *   prompt and returns a {@link EvaluateVerdict}. The dashboard's one\n *   write route — absent config, POST 405s like it would against any\n *   other route (the path is never even pattern-matched).\n *\n * Anything else → `404`. A method the matched route doesn't accept → `405`.\n * Host allowlist + bearer-token auth (S4) are checked for EVERY request,\n * regardless of method, before any routing. The store shapes\n * ({@link Trace}/{@link TraceSpan}) are already JSON-safe, so GET responses\n * are a plain `JSON.stringify` with no serializer.\n *\n * @example\n * const handler = createRequestHandler(store, { basePath: \"/\", title: \"Panoptic\" });\n * http.createServer(handler).listen(4319, \"127.0.0.1\");\n */\nexport function createRequestHandler(\n  store: TraceStoreContract,\n  config: ServeConfig,\n): (req: IncomingMessage, res: ServerResponse) => void {\n  const base = config.basePath;\n  const apiPrefix = `${base}api`;\n\n  return function handle(req: IncomingMessage, res: ServerResponse): void {\n    // `req.url` is path + query only; a dummy origin lets URL parse it.\n    const url = new URL(req.url ?? \"/\", \"http://localhost\");\n    const pathname = url.pathname;\n\n    // Host-header allowlist — blocks DNS-rebinding attacks that point a\n    // hostile domain at this loopback port (S4). Checked for every method.\n    const host = hostHeaderName(req.headers.host);\n    if (!host || !config.allowedHosts.includes(host.toLowerCase())) {\n      sendJson(res, 403, { error: \"host_not_allowed\" });\n\n      return;\n    }\n\n    // Bearer-token auth when configured (always required off loopback, S4).\n    // `?token=` is only honored on the HTML page route — see `isAuthorized`.\n    const isPageRoute = pathname === base || pathname === base.replace(/\\/$/, \"\");\n    if (config.authToken && !isAuthorized(req, url, config.authToken, isPageRoute)) {\n      sendJson(res, 401, { error: \"unauthorized\" });\n\n      return;\n    }\n\n    // The one write route — opt-in via `config.evaluate`, so it must be\n    // checked before the blanket GET-only gate below.\n    if (req.method === \"POST\" && config.evaluate) {\n      const match = matchEvaluatePath(pathname, apiPrefix);\n\n      if (match) {\n        void handleEvaluate(store, config.evaluate, match.traceId, match.spanId, req, res);\n\n        return;\n      }\n    }\n\n    if (req.method !== \"GET\") {\n      sendJson(res, 405, { error: \"method_not_allowed\" });\n\n      return;\n    }\n\n    if (pathname === `${apiPrefix}/traces`) {\n      sendJson(res, 200, store.query(parseQuery(url.searchParams)));\n\n      return;\n    }\n\n    if (pathname.startsWith(`${apiPrefix}/traces/`)) {\n      const traceId = decodeURIComponent(pathname.slice(`${apiPrefix}/traces/`.length));\n      const trace = traceId.length > 0 ? store.get(traceId) : undefined;\n\n      if (trace === undefined) {\n        sendJson(res, 404, { error: \"trace_not_found\", traceId });\n\n        return;\n      }\n\n      sendJson(res, 200, trace);\n\n      return;\n    }\n\n    if (pathname === `${apiPrefix}/aggregate`) {\n      sendJson(res, 200, store.aggregate(parseQuery(url.searchParams)));\n\n      return;\n    }\n\n    if (pathname === base || pathname === base.replace(/\\/$/, \"\")) {\n      res.writeHead(200, {\n        \"content-type\": \"text/html; charset=utf-8\",\n        ...SECURITY_HEADERS,\n      });\n      res.end(\n        dashboardHtml(\n          base,\n          config.title,\n          Boolean(config.evaluate),\n          config.evaluate?.instructions ?? \"\",\n        ),\n      );\n\n      return;\n    }\n\n    sendJson(res, 404, { error: \"not_found\" });\n  };\n}\n\n/** Write a JSON response with the given status code and security headers. */\nfunction sendJson(res: ServerResponse, status: number, body: unknown): void {\n  res.writeHead(status, {\n    \"content-type\": \"application/json; charset=utf-8\",\n    ...SECURITY_HEADERS,\n  });\n  res.end(JSON.stringify(body));\n}\n\n/**\n * Match `{apiPrefix}/traces/:traceId/spans/:spanId/evaluate` — the one\n * write route. Returns `undefined` for anything else, including the plain\n * `{apiPrefix}/traces/:id` read route (no `/spans/.../evaluate` suffix),\n * so the two never collide.\n */\nfunction matchEvaluatePath(\n  pathname: string,\n  apiPrefix: string,\n): { traceId: string; spanId: string } | undefined {\n  const prefix = `${apiPrefix}/traces/`;\n\n  if (!pathname.startsWith(prefix)) {\n    return undefined;\n  }\n\n  const match = /^([^/]+)\\/spans\\/([^/]+)\\/evaluate$/.exec(pathname.slice(prefix.length));\n\n  if (!match) {\n    return undefined;\n  }\n\n  return {\n    traceId: decodeURIComponent(match[1]),\n    spanId: decodeURIComponent(match[2]),\n  };\n}\n\n/**\n * Collect and JSON-parse a request body, capped at\n * {@link MAX_EVALUATE_BODY_BYTES} so an oversized body can't hold the\n * connection open indefinitely. An empty body resolves to `undefined` —\n * the evaluate route treats that as \"no per-run override\".\n */\nfunction readJsonBody<T>(req: IncomingMessage): Promise<T | undefined> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n\n    req.on(\"data\", (chunk: Buffer) => {\n      size += chunk.length;\n\n      if (size > MAX_EVALUATE_BODY_BYTES) {\n        req.destroy();\n        reject(new Error(\"payload_too_large\"));\n\n        return;\n      }\n\n      chunks.push(chunk);\n    });\n\n    req.on(\"end\", () => {\n      if (chunks.length === 0) {\n        resolve(undefined);\n\n        return;\n      }\n\n      try {\n        resolve(JSON.parse(Buffer.concat(chunks).toString(\"utf-8\")) as T);\n      } catch {\n        reject(new Error(\"invalid_json\"));\n      }\n    });\n\n    req.on(\"error\", reject);\n  });\n}\n\n/**\n * Handle `POST {apiPrefix}/traces/:traceId/spans/:spanId/evaluate`. Looks\n * up the trace + span, extracts its last captured system prompt, and\n * grades it via {@link evaluateSystemPrompt}. `judgePromptBody` itself\n * never throws (a broken judge degrades to an issues-only outcome) — the\n * try/catch here only guards `config.evaluate.model` resolution, the one\n * step that CAN throw (e.g. a factory constructing an SDK client).\n */\nasync function handleEvaluate(\n  store: TraceStoreContract,\n  evaluate: EvaluateConfig,\n  traceId: string,\n  spanId: string,\n  req: IncomingMessage,\n  res: ServerResponse,\n): Promise<void> {\n  const trace = store.get(traceId);\n\n  if (trace === undefined) {\n    sendJson(res, 404, { error: \"trace_not_found\", traceId });\n\n    return;\n  }\n\n  const span = findSpanById(trace.root, spanId);\n\n  if (span === undefined) {\n    sendJson(res, 404, { error: \"span_not_found\", spanId });\n\n    return;\n  }\n\n  const systemPrompt = extractLastSystemPrompt(span);\n\n  if (systemPrompt === undefined) {\n    sendJson(res, 422, { error: \"no_system_prompt\" });\n\n    return;\n  }\n\n  let body: EvaluateRequestBody | undefined;\n\n  try {\n    body = await readJsonBody<EvaluateRequestBody>(req);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : \"invalid_json\";\n    sendJson(res, message === \"payload_too_large\" ? 413 : 400, { error: message });\n\n    return;\n  }\n\n  try {\n    const verdict = await evaluateSystemPrompt(systemPrompt, evaluate, body?.instructions);\n    sendJson(res, 200, verdict);\n  } catch (error) {\n    sendJson(res, 502, {\n      error: \"evaluate_failed\",\n      message: error instanceof Error ? error.message : String(error),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;AAoCA,MAAM,0BAA0B,KAAK;;;;;;AAOrC,MAAM,mBAA2C;CAC/C,0BAA0B;CAC1B,mBAAmB;CACnB,mBAAmB;CACnB,2BACE;AACJ;;AAGA,SAAS,eAAe,YAAoD;CAC1E,IAAI,CAAC,YAAY,OAAO;CAExB,IAAI,WAAW,WAAW,GAAG,GAC3B,OAAO,WAAW,MAAM,GAAG,WAAW,QAAQ,GAAG,IAAI,CAAC;CAExD,MAAM,QAAQ,WAAW,QAAQ,GAAG;CACpC,OAAO,UAAU,KAAK,aAAa,WAAW,MAAM,GAAG,KAAK;AAC9D;;;;;;;;;;AAWA,SAAS,kBAAkB,GAAW,GAAoB;CACxD,MAAM,OAAO,OAAO,KAAK,CAAC;CAC1B,MAAM,OAAO,OAAO,KAAK,CAAC;CAE1B,IAAI,KAAK,WAAW,KAAK,QAAQ,OAAO;CAExC,OAAO,gBAAgB,MAAM,IAAI;AACnC;;;;;;;;;;;;;;;AAgBA,SAAS,aACP,KACA,KACA,OACA,iBACS;CACT,MAAM,SAAS,IAAI,QAAQ;CAC3B,IAAI,UAAU,kBAAkB,QAAQ,UAAU,OAAO,GAAG,OAAO;CACnE,IAAI,CAAC,iBAAiB,OAAO;CAC7B,MAAM,aAAa,IAAI,aAAa,IAAI,OAAO;CAC/C,OAAO,eAAe,QAAQ,kBAAkB,YAAY,KAAK;AACnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAgB,qBACd,OACA,QACqD;CACrD,MAAM,OAAO,OAAO;CACpB,MAAM,YAAY,GAAG,KAAK;CAE1B,OAAO,SAAS,OAAO,KAAsB,KAA2B;EAEtE,MAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;EACtD,MAAM,WAAW,IAAI;EAIrB,MAAM,OAAO,eAAe,IAAI,QAAQ,IAAI;EAC5C,IAAI,CAAC,QAAQ,CAAC,OAAO,aAAa,SAAS,KAAK,YAAY,CAAC,GAAG;GAC9D,SAAS,KAAK,KAAK,EAAE,OAAO,mBAAmB,CAAC;GAEhD;EACF;EAIA,MAAM,cAAc,aAAa,QAAQ,aAAa,KAAK,QAAQ,OAAO,EAAE;EAC5E,IAAI,OAAO,aAAa,CAAC,aAAa,KAAK,KAAK,OAAO,WAAW,WAAW,GAAG;GAC9E,SAAS,KAAK,KAAK,EAAE,OAAO,eAAe,CAAC;GAE5C;EACF;EAIA,IAAI,IAAI,WAAW,UAAU,OAAO,UAAU;GAC5C,MAAM,QAAQ,kBAAkB,UAAU,SAAS;GAEnD,IAAI,OAAO;IACT,AAAK,eAAe,OAAO,OAAO,UAAU,MAAM,SAAS,MAAM,QAAQ,KAAK,GAAG;IAEjF;GACF;EACF;EAEA,IAAI,IAAI,WAAW,OAAO;GACxB,SAAS,KAAK,KAAK,EAAE,OAAO,qBAAqB,CAAC;GAElD;EACF;EAEA,IAAI,aAAa,GAAG,UAAU,UAAU;GACtC,SAAS,KAAK,KAAK,MAAM,MAAM,WAAW,IAAI,YAAY,CAAC,CAAC;GAE5D;EACF;EAEA,IAAI,SAAS,WAAW,GAAG,UAAU,SAAS,GAAG;GAC/C,MAAM,UAAU,mBAAmB,SAAS,MAAM,GAAG,UAAU,UAAU,MAAM,CAAC;GAChF,MAAM,QAAQ,QAAQ,SAAS,IAAI,MAAM,IAAI,OAAO,IAAI;GAExD,IAAI,UAAU,QAAW;IACvB,SAAS,KAAK,KAAK;KAAE,OAAO;KAAmB;IAAQ,CAAC;IAExD;GACF;GAEA,SAAS,KAAK,KAAK,KAAK;GAExB;EACF;EAEA,IAAI,aAAa,GAAG,UAAU,aAAa;GACzC,SAAS,KAAK,KAAK,MAAM,UAAU,WAAW,IAAI,YAAY,CAAC,CAAC;GAEhE;EACF;EAEA,IAAI,aAAa,QAAQ,aAAa,KAAK,QAAQ,OAAO,EAAE,GAAG;GAC7D,IAAI,UAAU,KAAK;IACjB,gBAAgB;IAChB,GAAG;GACL,CAAC;GACD,IAAI,IACF,cACE,MACA,OAAO,OACP,QAAQ,OAAO,QAAQ,GACvB,OAAO,UAAU,gBAAgB,EACnC,CACF;GAEA;EACF;EAEA,SAAS,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;CAC3C;AACF;;AAGA,SAAS,SAAS,KAAqB,QAAgB,MAAqB;CAC1E,IAAI,UAAU,QAAQ;EACpB,gBAAgB;EAChB,GAAG;CACL,CAAC;CACD,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC;AAC9B;;;;;;;AAQA,SAAS,kBACP,UACA,WACiD;CACjD,MAAM,SAAS,GAAG,UAAU;CAE5B,IAAI,CAAC,SAAS,WAAW,MAAM,GAC7B;CAGF,MAAM,QAAQ,sCAAsC,KAAK,SAAS,MAAM,OAAO,MAAM,CAAC;CAEtF,IAAI,CAAC,OACH;CAGF,OAAO;EACL,SAAS,mBAAmB,MAAM,EAAE;EACpC,QAAQ,mBAAmB,MAAM,EAAE;CACrC;AACF;;;;;;;AAQA,SAAS,aAAgB,KAA8C;CACrE,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,SAAmB,CAAC;EAC1B,IAAI,OAAO;EAEX,IAAI,GAAG,SAAS,UAAkB;GAChC,QAAQ,MAAM;GAEd,IAAI,OAAO,yBAAyB;IAClC,IAAI,QAAQ;IACZ,uBAAO,IAAI,MAAM,mBAAmB,CAAC;IAErC;GACF;GAEA,OAAO,KAAK,KAAK;EACnB,CAAC;EAED,IAAI,GAAG,aAAa;GAClB,IAAI,OAAO,WAAW,GAAG;IACvB,QAAQ,MAAS;IAEjB;GACF;GAEA,IAAI;IACF,QAAQ,KAAK,MAAM,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,OAAO,CAAC,CAAM;GAClE,QAAQ;IACN,uBAAO,IAAI,MAAM,cAAc,CAAC;GAClC;EACF,CAAC;EAED,IAAI,GAAG,SAAS,MAAM;CACxB,CAAC;AACH;;;;;;;;;AAUA,eAAe,eACb,OACA,UACA,SACA,QACA,KACA,KACe;CACf,MAAM,QAAQ,MAAM,IAAI,OAAO;CAE/B,IAAI,UAAU,QAAW;EACvB,SAAS,KAAK,KAAK;GAAE,OAAO;GAAmB;EAAQ,CAAC;EAExD;CACF;CAEA,MAAM,OAAO,aAAa,MAAM,MAAM,MAAM;CAE5C,IAAI,SAAS,QAAW;EACtB,SAAS,KAAK,KAAK;GAAE,OAAO;GAAkB;EAAO,CAAC;EAEtD;CACF;CAEA,MAAM,eAAe,wBAAwB,IAAI;CAEjD,IAAI,iBAAiB,QAAW;EAC9B,SAAS,KAAK,KAAK,EAAE,OAAO,mBAAmB,CAAC;EAEhD;CACF;CAEA,IAAI;CAEJ,IAAI;EACF,OAAO,MAAM,aAAkC,GAAG;CACpD,SAAS,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;EACzD,SAAS,KAAK,YAAY,sBAAsB,MAAM,KAAK,EAAE,OAAO,QAAQ,CAAC;EAE7E;CACF;CAEA,IAAI;EAEF,SAAS,KAAK,KAAK,MADG,qBAAqB,cAAc,UAAU,MAAM,YAAY,CAC3D;CAC5B,SAAS,OAAO;EACd,SAAS,KAAK,KAAK;GACjB,OAAO;GACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAChE,CAAC;CACH;AACF"}
+{"version":3,"file":"serve.mjs","names":[],"sources":["../../../../../../../../packages/ai-panoptic/src/dashboard/serve.ts"],"sourcesContent":["import { timingSafeEqual } from \"node:crypto\";\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { EvaluateConfig } from \"../evaluate/evaluate.type\";\nimport { evaluateSystemPrompt } from \"../evaluate/evaluate-system-prompt\";\nimport { extractLastSystemPrompt } from \"../evaluate/extract-last-system-prompt\";\nimport { findSpanById } from \"../evaluate/find-span-by-id\";\nimport type { TraceStoreContract } from \"../store/trace-store.contract\";\nimport { parseQuery } from \"./parse-query\";\nimport { dashboardHtml } from \"./ui.html\";\n\n/** Fully-resolved routing config the request handler closes over. */\nexport type ServeConfig = {\n  /** Normalized mount path, always ending in `/` (e.g. `\"/\"`). */\n  basePath: string;\n  /** Header title baked into the served page. */\n  title: string;\n  /** Bearer token required on every request when set (S4). */\n  authToken?: string;\n  /** `Host` header allowlist — defends against DNS-rebinding (S4). */\n  allowedHosts: string[];\n  /**\n   * Enables the one write route: `POST\n   * {basePath}api/traces/:traceId/spans/:spanId/evaluate`. Absent ⇒ the\n   * route 405s (POST isn't accepted by any route) and the served page never\n   * renders the Evaluate button.\n   */\n  evaluate?: EvaluateConfig;\n};\n\n/** Request body accepted by the evaluate route — everything optional. */\ntype EvaluateRequestBody = {\n  /** Per-run instructions override; falls back to `config.evaluate.instructions`. */\n  instructions?: string;\n};\n\n/** Hard cap on the evaluate route's request body — well beyond a real instructions string. */\nconst MAX_EVALUATE_BODY_BYTES = 64 * 1024;\n\n/**\n * Security response headers added to every dashboard response (S4):\n * block MIME-sniffing, framing, referrer leakage, and lock the page's\n * content sources down to itself (the UI is fully self-contained — no CDN).\n */\nconst SECURITY_HEADERS: Record<string, string> = {\n  \"x-content-type-options\": \"nosniff\",\n  \"x-frame-options\": \"DENY\",\n  \"referrer-policy\": \"no-referrer\",\n  \"content-security-policy\":\n    \"default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'\",\n};\n\n/** Extract the host (no port) from a `Host` header value. */\nfunction hostHeaderName(hostHeader: string | undefined): string | undefined {\n  if (!hostHeader) return undefined;\n  // IPv6 literal `[::1]:4319` → `[::1]`; otherwise strip `:port`.\n  if (hostHeader.startsWith(\"[\")) {\n    return hostHeader.slice(0, hostHeader.indexOf(\"]\") + 1);\n  }\n  const colon = hostHeader.indexOf(\":\");\n  return colon === -1 ? hostHeader : hostHeader.slice(0, colon);\n}\n\n/**\n * Constant-time string equality (S4) — guards against a timing\n * side-channel that could otherwise let a network-adjacent attacker\n * recover the token byte-by-byte via repeated timed guesses. Plain `===`\n * short-circuits on the first differing byte, so response latency leaks\n * how many leading bytes matched; `timingSafeEqual` does not. Lengths are\n * compared first (a length mismatch is not secret and `timingSafeEqual`\n * requires equal-length buffers anyway).\n */\nfunction constantTimeEqual(a: string, b: string): boolean {\n  const bufA = Buffer.from(a);\n  const bufB = Buffer.from(b);\n\n  if (bufA.length !== bufB.length) return false;\n\n  return timingSafeEqual(bufA, bufB);\n}\n\n/**\n * Bearer-token check (S4): `Authorization: Bearer <token>` header, or\n * (only when `allowQueryToken`) a `?token=` query param.\n *\n * The query-string form only exists for the one request that structurally\n * cannot carry a custom header — the initial browser navigation that\n * loads the HTML shell (a typed/clicked/bookmarked URL). Every other\n * request the served page makes is same-origin `fetch()`, which can and\n * does set `Authorization` (see `ui.html.ts`'s `fetchAuthed`), so the API\n * routes never need to accept a query-string token. Restricting the\n * fallback to just the page route minimizes the token's exposure in\n * server access logs, proxy logs, and browser history to a single route\n * instead of every poll.\n */\nfunction isAuthorized(\n  req: IncomingMessage,\n  url: URL,\n  token: string,\n  allowQueryToken: boolean,\n): boolean {\n  const header = req.headers.authorization;\n  if (header && constantTimeEqual(header, `Bearer ${token}`)) return true;\n  if (!allowQueryToken) return false;\n  const queryToken = url.searchParams.get(\"token\");\n  return queryToken !== null && constantTimeEqual(queryToken, token);\n}\n\n/**\n * Build the `node:http` request handler for the dashboard over a given\n * trace store. Kept separate from the server lifecycle so it can be unit\n * tested by feeding it a fake `req`/`res` without binding a port.\n *\n * Routes (all under `config.basePath`):\n *\n * - `GET api/traces`        → `store.query(parseQuery(searchParams))`\n * - `GET api/traces/:id`    → `store.get(id)` or `404`\n * - `GET api/aggregate`     → `store.aggregate(parseQuery(searchParams))`\n * - `GET {basePath}`        → the self-contained HTML page\n * - `POST api/traces/:traceId/spans/:spanId/evaluate` → ONLY when\n *   `config.evaluate` is set; grades the span's last captured system\n *   prompt and returns a {@link EvaluateVerdict}. The dashboard's one\n *   write route — absent config, POST 405s like it would against any\n *   other route (the path is never even pattern-matched).\n *\n * Anything else → `404`. A method the matched route doesn't accept → `405`.\n * Host allowlist + bearer-token auth (S4) are checked for EVERY request,\n * regardless of method, before any routing. The store shapes\n * ({@link Trace}/{@link TraceSpan}) are already JSON-safe, so GET responses\n * are a plain `JSON.stringify` with no serializer.\n *\n * @example\n * const handler = createRequestHandler(store, { basePath: \"/\", title: \"Panoptic\" });\n * http.createServer(handler).listen(4319, \"127.0.0.1\");\n */\nexport function createRequestHandler(\n  store: TraceStoreContract,\n  config: ServeConfig,\n): (req: IncomingMessage, res: ServerResponse) => void {\n  const base = config.basePath;\n  const apiPrefix = `${base}api`;\n\n  return function handle(req: IncomingMessage, res: ServerResponse): void {\n    // `req.url` is path + query only; a dummy origin lets URL parse it.\n    const url = new URL(req.url ?? \"/\", \"http://localhost\");\n    const pathname = url.pathname;\n\n    // Host-header allowlist — blocks DNS-rebinding attacks that point a\n    // hostile domain at this loopback port (S4). Checked for every method.\n    const host = hostHeaderName(req.headers.host);\n    if (!host || !config.allowedHosts.includes(host.toLowerCase())) {\n      sendJson(res, 403, { error: \"host_not_allowed\" });\n\n      return;\n    }\n\n    // Bearer-token auth when configured (always required off loopback, S4).\n    // `?token=` is only honored on the HTML page route — see `isAuthorized`.\n    const isPageRoute = pathname === base || pathname === base.replace(/\\/$/, \"\");\n    if (config.authToken && !isAuthorized(req, url, config.authToken, isPageRoute)) {\n      sendJson(res, 401, { error: \"unauthorized\" });\n\n      return;\n    }\n\n    // The one write route — opt-in via `config.evaluate`, so it must be\n    // checked before the blanket GET-only gate below.\n    if (req.method === \"POST\" && config.evaluate) {\n      const match = matchEvaluatePath(pathname, apiPrefix);\n\n      if (match) {\n        void handleEvaluate(store, config.evaluate, match.traceId, match.spanId, req, res);\n\n        return;\n      }\n    }\n\n    if (req.method !== \"GET\") {\n      sendJson(res, 405, { error: \"method_not_allowed\" });\n\n      return;\n    }\n\n    if (pathname === `${apiPrefix}/traces`) {\n      sendJson(res, 200, store.query(parseQuery(url.searchParams)));\n\n      return;\n    }\n\n    if (pathname.startsWith(`${apiPrefix}/traces/`)) {\n      const traceId = decodeURIComponent(pathname.slice(`${apiPrefix}/traces/`.length));\n      const trace = traceId.length > 0 ? store.get(traceId) : undefined;\n\n      if (trace === undefined) {\n        sendJson(res, 404, { error: \"trace_not_found\", traceId });\n\n        return;\n      }\n\n      sendJson(res, 200, trace);\n\n      return;\n    }\n\n    if (pathname === `${apiPrefix}/aggregate`) {\n      sendJson(res, 200, store.aggregate(parseQuery(url.searchParams)));\n\n      return;\n    }\n\n    if (pathname === base || pathname === base.replace(/\\/$/, \"\")) {\n      res.writeHead(200, {\n        \"content-type\": \"text/html; charset=utf-8\",\n        ...SECURITY_HEADERS,\n      });\n      res.end(\n        dashboardHtml(\n          base,\n          config.title,\n          Boolean(config.evaluate),\n          config.evaluate?.instructions ?? \"\",\n        ),\n      );\n\n      return;\n    }\n\n    sendJson(res, 404, { error: \"not_found\" });\n  };\n}\n\n/** Write a JSON response with the given status code and security headers. */\nfunction sendJson(res: ServerResponse, status: number, body: unknown): void {\n  res.writeHead(status, {\n    \"content-type\": \"application/json; charset=utf-8\",\n    ...SECURITY_HEADERS,\n  });\n  res.end(JSON.stringify(body));\n}\n\n/**\n * Match `{apiPrefix}/traces/:traceId/spans/:spanId/evaluate` — the one\n * write route. Returns `undefined` for anything else, including the plain\n * `{apiPrefix}/traces/:id` read route (no `/spans/.../evaluate` suffix),\n * so the two never collide.\n */\nfunction matchEvaluatePath(\n  pathname: string,\n  apiPrefix: string,\n): { traceId: string; spanId: string } | undefined {\n  const prefix = `${apiPrefix}/traces/`;\n\n  if (!pathname.startsWith(prefix)) {\n    return undefined;\n  }\n\n  const match = /^([^/]+)\\/spans\\/([^/]+)\\/evaluate$/.exec(pathname.slice(prefix.length));\n\n  if (!match) {\n    return undefined;\n  }\n\n  return {\n    traceId: decodeURIComponent(match[1]),\n    spanId: decodeURIComponent(match[2]),\n  };\n}\n\n/**\n * Collect and JSON-parse a request body, capped at\n * {@link MAX_EVALUATE_BODY_BYTES} so an oversized body can't hold the\n * connection open indefinitely. An empty body resolves to `undefined` —\n * the evaluate route treats that as \"no per-run override\".\n */\nfunction readJsonBody<T>(req: IncomingMessage): Promise<T | undefined> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n\n    req.on(\"data\", (chunk: Buffer) => {\n      size += chunk.length;\n\n      if (size > MAX_EVALUATE_BODY_BYTES) {\n        req.destroy();\n        reject(new Error(\"payload_too_large\"));\n\n        return;\n      }\n\n      chunks.push(chunk);\n    });\n\n    req.on(\"end\", () => {\n      if (chunks.length === 0) {\n        resolve(undefined);\n\n        return;\n      }\n\n      try {\n        resolve(JSON.parse(Buffer.concat(chunks).toString(\"utf-8\")) as T);\n      } catch {\n        reject(new Error(\"invalid_json\"));\n      }\n    });\n\n    req.on(\"error\", reject);\n  });\n}\n\n/**\n * Handle `POST {apiPrefix}/traces/:traceId/spans/:spanId/evaluate`. Looks\n * up the trace + span, extracts its last captured system prompt, and\n * grades it via {@link evaluateSystemPrompt}. `judgePromptBody` itself\n * never throws (a broken judge degrades to an issues-only outcome) — the\n * try/catch here only guards `config.evaluate.model` resolution, the one\n * step that CAN throw (e.g. a factory constructing an SDK client).\n */\nasync function handleEvaluate(\n  store: TraceStoreContract,\n  evaluate: EvaluateConfig,\n  traceId: string,\n  spanId: string,\n  req: IncomingMessage,\n  res: ServerResponse,\n): Promise<void> {\n  const trace = store.get(traceId);\n\n  if (trace === undefined) {\n    sendJson(res, 404, { error: \"trace_not_found\", traceId });\n\n    return;\n  }\n\n  const span = findSpanById(trace.root, spanId);\n\n  if (span === undefined) {\n    sendJson(res, 404, { error: \"span_not_found\", spanId });\n\n    return;\n  }\n\n  const systemPrompt = extractLastSystemPrompt(span);\n\n  if (systemPrompt === undefined) {\n    sendJson(res, 422, { error: \"no_system_prompt\" });\n\n    return;\n  }\n\n  let body: EvaluateRequestBody | undefined;\n\n  try {\n    body = await readJsonBody<EvaluateRequestBody>(req);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : \"invalid_json\";\n    sendJson(res, message === \"payload_too_large\" ? 413 : 400, { error: message });\n\n    return;\n  }\n\n  try {\n    const verdict = await evaluateSystemPrompt(systemPrompt, evaluate, body?.instructions);\n    sendJson(res, 200, verdict);\n  } catch (error) {\n    sendJson(res, 502, {\n      error: \"evaluate_failed\",\n      message: error instanceof Error ? error.message : String(error),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;AAoCA,MAAM,0BAA0B;;;;;;AAOhC,MAAM,mBAA2C;CAC/C,0BAA0B;CAC1B,mBAAmB;CACnB,mBAAmB;CACnB,2BACE;AACJ;;AAGA,SAAS,eAAe,YAAoD;CAC1E,IAAI,CAAC,YAAY,OAAO;CAExB,IAAI,WAAW,WAAW,GAAG,GAC3B,OAAO,WAAW,MAAM,GAAG,WAAW,QAAQ,GAAG,IAAI,CAAC;CAExD,MAAM,QAAQ,WAAW,QAAQ,GAAG;CACpC,OAAO,UAAU,KAAK,aAAa,WAAW,MAAM,GAAG,KAAK;AAC9D;;;;;;;;;;AAWA,SAAS,kBAAkB,GAAW,GAAoB;CACxD,MAAM,OAAO,OAAO,KAAK,CAAC;CAC1B,MAAM,OAAO,OAAO,KAAK,CAAC;CAE1B,IAAI,KAAK,WAAW,KAAK,QAAQ,OAAO;CAExC,OAAO,gBAAgB,MAAM,IAAI;AACnC;;;;;;;;;;;;;;;AAgBA,SAAS,aACP,KACA,KACA,OACA,iBACS;CACT,MAAM,SAAS,IAAI,QAAQ;CAC3B,IAAI,UAAU,kBAAkB,QAAQ,UAAU,OAAO,GAAG,OAAO;CACnE,IAAI,CAAC,iBAAiB,OAAO;CAC7B,MAAM,aAAa,IAAI,aAAa,IAAI,OAAO;CAC/C,OAAO,eAAe,QAAQ,kBAAkB,YAAY,KAAK;AACnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAgB,qBACd,OACA,QACqD;CACrD,MAAM,OAAO,OAAO;CACpB,MAAM,YAAY,GAAG,KAAK;CAE1B,OAAO,SAAS,OAAO,KAAsB,KAA2B;EAEtE,MAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;EACtD,MAAM,WAAW,IAAI;EAIrB,MAAM,OAAO,eAAe,IAAI,QAAQ,IAAI;EAC5C,IAAI,CAAC,QAAQ,CAAC,OAAO,aAAa,SAAS,KAAK,YAAY,CAAC,GAAG;GAC9D,SAAS,KAAK,KAAK,EAAE,OAAO,mBAAmB,CAAC;GAEhD;EACF;EAIA,MAAM,cAAc,aAAa,QAAQ,aAAa,KAAK,QAAQ,OAAO,EAAE;EAC5E,IAAI,OAAO,aAAa,CAAC,aAAa,KAAK,KAAK,OAAO,WAAW,WAAW,GAAG;GAC9E,SAAS,KAAK,KAAK,EAAE,OAAO,eAAe,CAAC;GAE5C;EACF;EAIA,IAAI,IAAI,WAAW,UAAU,OAAO,UAAU;GAC5C,MAAM,QAAQ,kBAAkB,UAAU,SAAS;GAEnD,IAAI,OAAO;IACT,AAAK,eAAe,OAAO,OAAO,UAAU,MAAM,SAAS,MAAM,QAAQ,KAAK,GAAG;IAEjF;GACF;EACF;EAEA,IAAI,IAAI,WAAW,OAAO;GACxB,SAAS,KAAK,KAAK,EAAE,OAAO,qBAAqB,CAAC;GAElD;EACF;EAEA,IAAI,aAAa,GAAG,UAAU,UAAU;GACtC,SAAS,KAAK,KAAK,MAAM,MAAM,WAAW,IAAI,YAAY,CAAC,CAAC;GAE5D;EACF;EAEA,IAAI,SAAS,WAAW,GAAG,UAAU,SAAS,GAAG;GAC/C,MAAM,UAAU,mBAAmB,SAAS,MAAM,GAAG,UAAU,UAAU,MAAM,CAAC;GAChF,MAAM,QAAQ,QAAQ,SAAS,IAAI,MAAM,IAAI,OAAO,IAAI;GAExD,IAAI,UAAU,QAAW;IACvB,SAAS,KAAK,KAAK;KAAE,OAAO;KAAmB;IAAQ,CAAC;IAExD;GACF;GAEA,SAAS,KAAK,KAAK,KAAK;GAExB;EACF;EAEA,IAAI,aAAa,GAAG,UAAU,aAAa;GACzC,SAAS,KAAK,KAAK,MAAM,UAAU,WAAW,IAAI,YAAY,CAAC,CAAC;GAEhE;EACF;EAEA,IAAI,aAAa,QAAQ,aAAa,KAAK,QAAQ,OAAO,EAAE,GAAG;GAC7D,IAAI,UAAU,KAAK;IACjB,gBAAgB;IAChB,GAAG;GACL,CAAC;GACD,IAAI,IACF,cACE,MACA,OAAO,OACP,QAAQ,OAAO,QAAQ,GACvB,OAAO,UAAU,gBAAgB,EACnC,CACF;GAEA;EACF;EAEA,SAAS,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;CAC3C;AACF;;AAGA,SAAS,SAAS,KAAqB,QAAgB,MAAqB;CAC1E,IAAI,UAAU,QAAQ;EACpB,gBAAgB;EAChB,GAAG;CACL,CAAC;CACD,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC;AAC9B;;;;;;;AAQA,SAAS,kBACP,UACA,WACiD;CACjD,MAAM,SAAS,GAAG,UAAU;CAE5B,IAAI,CAAC,SAAS,WAAW,MAAM,GAC7B;CAGF,MAAM,QAAQ,sCAAsC,KAAK,SAAS,MAAM,OAAO,MAAM,CAAC;CAEtF,IAAI,CAAC,OACH;CAGF,OAAO;EACL,SAAS,mBAAmB,MAAM,EAAE;EACpC,QAAQ,mBAAmB,MAAM,EAAE;CACrC;AACF;;;;;;;AAQA,SAAS,aAAgB,KAA8C;CACrE,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,SAAmB,CAAC;EAC1B,IAAI,OAAO;EAEX,IAAI,GAAG,SAAS,UAAkB;GAChC,QAAQ,MAAM;GAEd,IAAI,OAAO,yBAAyB;IAClC,IAAI,QAAQ;IACZ,uBAAO,IAAI,MAAM,mBAAmB,CAAC;IAErC;GACF;GAEA,OAAO,KAAK,KAAK;EACnB,CAAC;EAED,IAAI,GAAG,aAAa;GAClB,IAAI,OAAO,WAAW,GAAG;IACvB,QAAQ,MAAS;IAEjB;GACF;GAEA,IAAI;IACF,QAAQ,KAAK,MAAM,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,OAAO,CAAC,CAAM;GAClE,QAAQ;IACN,uBAAO,IAAI,MAAM,cAAc,CAAC;GAClC;EACF,CAAC;EAED,IAAI,GAAG,SAAS,MAAM;CACxB,CAAC;AACH;;;;;;;;;AAUA,eAAe,eACb,OACA,UACA,SACA,QACA,KACA,KACe;CACf,MAAM,QAAQ,MAAM,IAAI,OAAO;CAE/B,IAAI,UAAU,QAAW;EACvB,SAAS,KAAK,KAAK;GAAE,OAAO;GAAmB;EAAQ,CAAC;EAExD;CACF;CAEA,MAAM,OAAO,aAAa,MAAM,MAAM,MAAM;CAE5C,IAAI,SAAS,QAAW;EACtB,SAAS,KAAK,KAAK;GAAE,OAAO;GAAkB;EAAO,CAAC;EAEtD;CACF;CAEA,MAAM,eAAe,wBAAwB,IAAI;CAEjD,IAAI,iBAAiB,QAAW;EAC9B,SAAS,KAAK,KAAK,EAAE,OAAO,mBAAmB,CAAC;EAEhD;CACF;CAEA,IAAI;CAEJ,IAAI;EACF,OAAO,MAAM,aAAkC,GAAG;CACpD,SAAS,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;EACzD,SAAS,KAAK,YAAY,sBAAsB,MAAM,KAAK,EAAE,OAAO,QAAQ,CAAC;EAE7E;CACF;CAEA,IAAI;EAEF,SAAS,KAAK,KAAK,MADG,qBAAqB,cAAc,UAAU,MAAM,YAAY,CAC3D;CAC5B,SAAS,OAAO;EACd,SAAS,KAAK,KAAK;GACjB,OAAO;GACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAChE,CAAC;CACH;AACF"}

package/esm/dashboard/trace-filter.d.mts

@@ -1,6 +1,5 @@
 import { Trace, TraceSpan } from "../contracts/trace.type.mjs";
 import { ReportStatus, ReportType } from "@warlock.js/ai";
-
 //#region ../../packages/ai-panoptic/src/dashboard/trace-filter.d.ts
 /**
  * Client-side trace-list filter criteria. The dashboard polls the full
@@ -13,7 +12,7 @@ import { ReportStatus, ReportType } from "@warlock.js/ai";
  * Every field is optional — an absent field is "don't care". An empty
  * filter therefore matches every trace.
  */
-type TraceFilter = {
+export type TraceFilter = {
   /**
    * Free-text needle matched case-insensitively against a trace's root
    * span name and session id. Whitespace-trimmed; an empty/blank string
@@ -60,24 +59,26 @@ type TraceFilter = {
  * versions are distinct keys — that is the whole point of the linkage: to
  * group / filter by the *exact* prompt revision that produced a run.
  */
-declare function tracePromptKey(trace: Trace): string | undefined;
+export declare function tracePromptKey(trace: Trace): string | undefined;
 /**
  * Does a single trace pass the given filter? Pure predicate — all
  * conditions are ANDed; an unset field never excludes. Used by
  * {@link filterTraces} and mirrored by the dashboard's inlined JS.
  */
-declare function matchesFilter(trace: Trace, filter: TraceFilter): boolean;
+export declare function matchesFilter(trace: Trace, filter: TraceFilter): boolean;
 /** Narrow a trace list to those matching the filter, order preserved. */
-declare function filterTraces(traces: Trace[], filter: TraceFilter): Trace[];
+export declare function filterTraces(traces: Trace[], filter: TraceFilter): Trace[];
 /**
  * The grouping key a trace falls under when the list is grouped by
  * session. Traces without a `sessionId` collapse into one synthetic
  * "(no session)" bucket so they remain visible.
  */
-declare const NO_SESSION_KEY = "(no session)";
+export declare const NO_SESSION_KEY = "(no session)";
 /** One session bucket — its key plus the traces under it, order preserved. */
-type SessionGroup = {
-  /** The `sessionId`, or {@link NO_SESSION_KEY} for sessionless traces. */sessionId: string; /** Traces in this group, in the order they appeared in the input. */
+export type SessionGroup = {
+  /** The `sessionId`, or {@link NO_SESSION_KEY} for sessionless traces. */
+  sessionId: string;
+  /** Traces in this group, in the order they appeared in the input. */
   traces: Trace[];
 };
 /**
@@ -85,16 +86,18 @@ type SessionGroup = {
  * preserving first-seen order of both the groups and the traces within
  * each. Sessionless traces bucket under {@link NO_SESSION_KEY}.
  */
-declare function groupBySession(traces: Trace[]): SessionGroup[];
+export declare function groupBySession(traces: Trace[]): SessionGroup[];
 /**
  * The grouping key a trace falls under when the list is grouped by prompt
  * version. Runs that resolved no named prompt collapse into one synthetic
  * "(no prompt)" bucket so they remain visible.
  */
-declare const NO_PROMPT_KEY = "(no prompt)";
+export declare const NO_PROMPT_KEY = "(no prompt)";
 /** One prompt-version bucket — its `name@version` key plus its traces. */
-type PromptGroup = {
-  /** The `name@version` key, or {@link NO_PROMPT_KEY} for unlinked traces. */promptKey: string; /** Traces in this group, in the order they appeared in the input. */
+export type PromptGroup = {
+  /** The `name@version` key, or {@link NO_PROMPT_KEY} for unlinked traces. */
+  promptKey: string;
+  /** Traces in this group, in the order they appeared in the input. */
   traces: Trace[];
 };
 /**
@@ -108,16 +111,18 @@ type PromptGroup = {
  * so a reviewer can see every run of "support@2" together and compare its
  * cost / failure rate against "support@3".
  */
-declare function groupByPrompt(traces: Trace[]): PromptGroup[];
+export declare function groupByPrompt(traces: Trace[]): PromptGroup[];
 /**
  * The grouping key a trace falls under when the list is grouped by root
  * type. `root.type` is always present, so this is only a defensive
  * fallback for a malformed trace with no typed root.
  */
-declare const NO_TYPE_KEY = "(no type)";
+export declare const NO_TYPE_KEY = "(no type)";
 /** One root-type bucket — its type discriminator plus its traces. */
-type TypeGroup = {
-  /** The root span's `type` (e.g. `agent` / `workflow` / `planner`), or {@link NO_TYPE_KEY}. */type: string; /** Traces in this group, in the order they appeared in the input. */
+export type TypeGroup = {
+  /** The root span's `type` (e.g. `agent` / `workflow` / `planner`), or {@link NO_TYPE_KEY}. */
+  type: string;
+  /** Traces in this group, in the order they appeared in the input. */
   traces: Trace[];
 };
 /**
@@ -132,29 +137,37 @@ type TypeGroup = {
  * behind a per-type header so the structural primitives (the lone planner,
  * the team, the supervisors) are one click away instead of a scroll past.
  */
-declare function groupByType(traces: Trace[]): TypeGroup[];
+export declare function groupByType(traces: Trace[]): TypeGroup[];
 /** One row of the per-type aggregate-stats panel. */
-type TypeStat = {
-  /** Root type discriminator, or {@link NO_TYPE_KEY}. */type: string; /** Number of traces of this type. */
-  count: number; /** Traces whose status is `failed` / `cancelled`. */
-  failed: number; /** `failed / count` in `[0, 1]`. */
-  failRate: number; /** Median (p50) root duration in ms. */
-  p50: number; /** p95 root duration in ms. */
-  p95: number; /** Summed `usage.total` tokens across the bucket. */
-  tokens: number; /** Summed per-trace USD cost across the bucket. */
+export type TypeStat = {
+  /** Root type discriminator, or {@link NO_TYPE_KEY}. */
+  type: string;
+  /** Number of traces of this type. */
+  count: number;
+  /** Traces whose status is `failed` / `cancelled`. */
+  failed: number;
+  /** `failed / count` in `[0, 1]`. */
+  failRate: number;
+  /** Median (p50) root duration in ms. */
+  p50: number;
+  /** p95 root duration in ms. */
+  p95: number;
+  /** Summed `usage.total` tokens across the bucket. */
+  tokens: number;
+  /** Summed per-trace USD cost across the bucket. */
   cost: number;
 };
 /**
  * Nearest-rank percentile of `values` at `p` (0–100). Returns 0 for an
  * empty input and sorts a copy so the caller's array is left untouched.
  */
-declare function percentile(values: number[], p: number): number;
+export declare function percentile(values: number[], p: number): number;
 /**
  * One trace's total USD cost: its explicit root-usage cost when priced,
  * else the rollup of its subtree. Mirrors the dashboard's `traceCost` so the
  * stats panel and the trace rows agree to the cent.
  */
-declare function traceCost(trace: Trace): number;
+export declare function traceCost(trace: Trace): number;
 /**
  * Aggregate an (already filtered) trace list into one {@link TypeStat} row
  * per root type — count, failure rate, p50/p95 latency, total tokens, total
@@ -162,26 +175,25 @@ declare function traceCost(trace: Trace): number;
  * stats panel; computed over the same filtered list the trace view shows, so
  * the panel always reflects the active filters.
  */
-declare function aggregateByType(traces: Trace[]): TypeStat[];
+export declare function aggregateByType(traces: Trace[]): TypeStat[];
 /**
  * Rollup-aware subtree cost: a node's own cost when it carries one
  * (it already rolls up its trips), otherwise the sum of its children.
  * Avoids double-counting wrapper nodes (workflow/supervisor roots carry
  * tokens but no cost). Mirrors the dashboard's `rollupCost`.
  */
-declare function rollupCost(span: TraceSpan): number;
+export declare function rollupCost(span: TraceSpan): number;
 /**
  * Heatmap intensity in `[0, 1]` for a node's `rollupCost` relative to the
  * trace's most-expensive node. The dashboard tints each tree node's left
  * accent by this. `max <= 0` (a free trace) yields `0` for every node so
  * the heatmap simply stays cold rather than dividing by zero.
  */
-declare function heatIntensity(nodeCost: number, maxCost: number): number;
+export declare function heatIntensity(nodeCost: number, maxCost: number): number;
 /**
  * The largest single-node {@link rollupCost} anywhere in a span tree —
  * the denominator for {@link heatIntensity}. Walks the whole subtree.
  */
-declare function maxNodeCost(root: TraceSpan): number;
+export declare function maxNodeCost(root: TraceSpan): number;
 //#endregion
-export { NO_PROMPT_KEY, NO_SESSION_KEY, NO_TYPE_KEY, PromptGroup, SessionGroup, TraceFilter, TypeGroup, TypeStat, aggregateByType, filterTraces, groupByPrompt, groupBySession, groupByType, heatIntensity, matchesFilter, maxNodeCost, percentile, rollupCost, traceCost, tracePromptKey };
 //# sourceMappingURL=trace-filter.d.mts.map

package/esm/dashboard/trace-filter.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"trace-filter.d.mts","names":[],"sources":["../../../../../../../../packages/ai-panoptic/src/dashboard/trace-filter.ts"],"mappings":";;;;;;AAcA;;;;;;;;;KAAY,WAAA;EA6BV;;;AAKU;AAyBZ;EArDE,IAAA;;;AAqDyC;AAwB3C;EAxEE,QAAA,GAAW,YAAA;;;;;EAKX,KAAA,GAAQ,UAAU;EAmEwB;;AAAmB;AA2C/D;;EAxGE,SAAA;EAwGmC;;;;;;EAjGnC,SAAA;EAiGoD;;;;EA5FpD,UAAA;AAAA;;;;AAqGyB;AAG3B;;;;;;;iBA/EgB,cAAA,CAAe,KAAY,EAAL,KAAK;AAmF5B;AAQf;;;;AARe,iBA3DC,aAAA,CAAc,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,WAAW;;iBA2C/C,YAAA,CAAa,MAAA,EAAQ,KAAA,IAAS,MAAA,EAAQ,WAAA,GAAc,KAAA;;AAwBP;AAyB7D;;;cAxCa,cAAA;AAwCa;AAAA,KArCd,YAAA;EAwCW,yEAtCrB,SAAA,UA0Ca;EAxCb,MAAA,EAAQ,KAAK;AAAA;;;AAwCA;AAcf;;iBA9CgB,cAAA,CAAe,MAAA,EAAQ,KAAA,KAAU,YAAY;;;;;;cAyBhD,aAAA;AA8Cb;AAAA,KA3CY,WAAA;8EAEV,SAAA,UAyCsB;EAvCtB,MAAA,EAAQ,KAAK;AAAA;;;;;;;AA8CA;AAef;;;;iBA/CgB,aAAA,CAAc,MAAA,EAAQ,KAAA,KAAU,WAAW;;;;AA+CJ;AAqBvD;cA3Ca,WAAA;;KAGD,SAAA;EA0CV,8FAxCA,IAAA,UA4CA;EA1CA,MAAA,EAAQ,KAAK;AAAA;;;;;AAoDT;AAON;;;;AAAsD;AAiBtD;;iBA7DgB,WAAA,CAAY,MAAA,EAAQ,KAAA,KAAU,SAAS;;KAqB3C,QAAA;EAoDI,uDAlDd,IAAA;EAEA,KAAA,UAgDsC;EA9CtC,MAAA,UA8CgD;EA5ChD,QAAA,UA4CwD;EA1CxD,GAAA,UAkHwB;EAhHxB,GAAA,UAgH+B;EA9G/B,MAAA,UAkIc;EAhId,IAAA;AAAA;;AAgI6D;AAc/D;;iBAvIgB,UAAA,CAAW,MAAA,YAAkB,CAAS;;AAuIX;;;;iBAtH3B,SAAA,CAAU,KAAY,EAAL,KAAK;;;;;;;;iBAYtB,eAAA,CAAgB,MAAA,EAAQ,KAAA,KAAU,QAAQ;;;;;;;iBAwE1C,UAAA,CAAW,IAAe,EAAT,SAAS;;;;;;;iBAoB1B,aAAA,CAAc,QAAA,UAAkB,OAAe;;;;;iBAc/C,WAAA,CAAY,IAAe,EAAT,SAAS"}
+{"version":3,"file":"trace-filter.d.mts","names":[],"sources":["../../../../../../../../packages/ai-panoptic/src/dashboard/trace-filter.ts"],"mappings":";;;;;;;;;;;;;;YAcY;;;;;;EAMV;;;;;EAKA,WAAW;;;;;EAKX,QAAQ;;;;;;EAMR;;;;;;;EAOA;;;;;EAKA;;;;;;;;;;;;;wBAyBc,eAAe,OAAO;;;;;;wBAwBtB,cAAc,OAAO,OAAO,QAAQ;;wBA2CpC,aAAa,QAAQ,SAAS,QAAQ,cAAc;;;;;;qBASvD;;YAGD;;EAEV;;EAEA,QAAQ;;;;;;;wBAQM,eAAe,QAAQ,UAAU;;;;;;qBAyBpC;;YAGD;;EAEV;;EAEA,QAAQ;;;;;;;;;;;;;wBAcM,cAAc,QAAQ,UAAU;;;;;;qBAyBnC;;YAGD;;EAEV;;EAEA,QAAQ;;;;;;;;;;;;;;wBAeM,YAAY,QAAQ,UAAU;;YAqBlC;;EAEV;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;;;;;wBAOc,WAAW,kBAAkB;;;;;;wBAiB7B,UAAU,OAAO;;;;;;;;wBAYjB,gBAAgB,QAAQ,UAAU;;;;;;;wBAwElC,WAAW,MAAM;;;;;;;wBAoBjB,cAAc,kBAAkB;;;;;wBAchC,YAAY,MAAM"}

package/esm/evaluate/evaluate-system-prompt.d.mts

@@ -1,5 +1,4 @@
 import { EvaluateConfig, EvaluateVerdict } from "./evaluate.type.mjs";
-
 //#region ../../packages/ai-panoptic/src/evaluate/evaluate-system-prompt.d.ts
 /**
  * Grade `systemPrompt` with the configured judge model, reusing
@@ -13,7 +12,6 @@ import { EvaluateConfig, EvaluateVerdict } from "./evaluate.type.mjs";
  * resolving `config.model` (a factory constructing an SDK client), which
  * the caller (the dashboard route) is expected to catch.
  */
-declare function evaluateSystemPrompt(systemPrompt: string, config: EvaluateConfig, instructionsOverride?: string): Promise<EvaluateVerdict>;
+export declare function evaluateSystemPrompt(systemPrompt: string, config: EvaluateConfig, instructionsOverride?: string): Promise<EvaluateVerdict>;
 //#endregion
-export { evaluateSystemPrompt };
 //# sourceMappingURL=evaluate-system-prompt.d.mts.map

package/esm/evaluate/evaluate-system-prompt.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate-system-prompt.d.mts","names":[],"sources":["../../../../../../../../packages/ai-panoptic/src/evaluate/evaluate-system-prompt.ts"],"mappings":";;;;;AAeA;;;;;;;;;;iBAAsB,oBAAA,CACpB,YAAA,UACA,MAAA,EAAQ,cAAA,EACR,oBAAA,YACC,OAAA,CAAQ,eAAA"}
+{"version":3,"file":"evaluate-system-prompt.d.mts","names":[],"sources":["../../../../../../../../packages/ai-panoptic/src/evaluate/evaluate-system-prompt.ts"],"mappings":";;;;;;;;;;;;;;wBAesB,qBACpB,sBACA,QAAQ,gBACR,gCACC,QAAQ"}

package/esm/evaluate/evaluate-system-prompt.mjs

@@ -14,7 +14,9 @@ import { judgePromptBody } from "@warlock.js/ai";
 * the caller (the dashboard route) is expected to catch.
 */
 async function evaluateSystemPrompt(systemPrompt, config, instructionsOverride) {
-	return judgePromptBody(systemPrompt, typeof config.model === "function" ? await config.model() : config.model, instructionsOverride?.trim() || config.instructions);
+	const model = typeof config.model === "function" ? await config.model() : config.model;
+	const instructions = instructionsOverride?.trim() || config.instructions;
+	return judgePromptBody(systemPrompt, model, instructions);
 }
 
 //#endregion

package/esm/evaluate/evaluate-system-prompt.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate-system-prompt.mjs","names":[],"sources":["../../../../../../../../packages/ai-panoptic/src/evaluate/evaluate-system-prompt.ts"],"sourcesContent":["import { judgePromptBody } from \"@warlock.js/ai\";\nimport type { EvaluateConfig, EvaluateVerdict } from \"./evaluate.type\";\n\n/**\n * Grade `systemPrompt` with the configured judge model, reusing\n * `ai.prompts().validate()`'s own `judgePromptBody` — never a second\n * judging implementation. `instructionsOverride` (the dashboard's\n * per-run textarea) wins over `config.instructions`; with neither, the\n * judge falls back to `judgePromptBody`'s built-in prompt-quality rubric.\n *\n * The judge itself never throws (`judgePromptBody` degrades to an\n * issues-only outcome on failure) — the only thing that CAN throw here is\n * resolving `config.model` (a factory constructing an SDK client), which\n * the caller (the dashboard route) is expected to catch.\n */\nexport async function evaluateSystemPrompt(\n  systemPrompt: string,\n  config: EvaluateConfig,\n  instructionsOverride?: string,\n): Promise<EvaluateVerdict> {\n  const model = typeof config.model === \"function\" ? await config.model() : config.model;\n  const instructions = instructionsOverride?.trim() || config.instructions;\n\n  return judgePromptBody(systemPrompt, model, instructions);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAeA,eAAsB,qBACpB,cACA,QACA,sBAC0B;CAI1B,OAAO,gBAAgB,cAHT,OAAO,OAAO,UAAU,aAAa,MAAM,OAAO,MAAM,IAAI,OAAO,OAC5D,sBAAsB,KAAK,KAAK,OAAO,YAEJ;AAC1D"}
+{"version":3,"file":"evaluate-system-prompt.mjs","names":[],"sources":["../../../../../../../../packages/ai-panoptic/src/evaluate/evaluate-system-prompt.ts"],"sourcesContent":["import { judgePromptBody } from \"@warlock.js/ai\";\nimport type { EvaluateConfig, EvaluateVerdict } from \"./evaluate.type\";\n\n/**\n * Grade `systemPrompt` with the configured judge model, reusing\n * `ai.prompts().validate()`'s own `judgePromptBody` — never a second\n * judging implementation. `instructionsOverride` (the dashboard's\n * per-run textarea) wins over `config.instructions`; with neither, the\n * judge falls back to `judgePromptBody`'s built-in prompt-quality rubric.\n *\n * The judge itself never throws (`judgePromptBody` degrades to an\n * issues-only outcome on failure) — the only thing that CAN throw here is\n * resolving `config.model` (a factory constructing an SDK client), which\n * the caller (the dashboard route) is expected to catch.\n */\nexport async function evaluateSystemPrompt(\n  systemPrompt: string,\n  config: EvaluateConfig,\n  instructionsOverride?: string,\n): Promise<EvaluateVerdict> {\n  const model = typeof config.model === \"function\" ? await config.model() : config.model;\n  const instructions = instructionsOverride?.trim() || config.instructions;\n\n  return judgePromptBody(systemPrompt, model, instructions);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAeA,eAAsB,qBACpB,cACA,QACA,sBAC0B;CAC1B,MAAM,QAAQ,OAAO,OAAO,UAAU,aAAa,MAAM,OAAO,MAAM,IAAI,OAAO;CACjF,MAAM,eAAe,sBAAsB,KAAK,KAAK,OAAO;CAE5D,OAAO,gBAAgB,cAAc,OAAO,YAAY;AAC1D"}

package/esm/evaluate/evaluate.type.d.mts

@@ -1,5 +1,4 @@
 import { JudgeOutcome, ModelContract } from "@warlock.js/ai";
-
 //#region ../../packages/ai-panoptic/src/evaluate/evaluate.type.d.ts
 /**
  * Enables the dashboard's per-trace "Evaluate system prompt" action — the
@@ -22,7 +21,7 @@ import { JudgeOutcome, ModelContract } from "@warlock.js/ai";
  *   },
  * });
  */
-type EvaluateConfig = {
+export type EvaluateConfig = {
   /**
    * The judge model, or a (possibly async) factory resolved on first use —
    * the factory form defers construction (e.g. an SDK client) until the
@@ -41,7 +40,6 @@ type EvaluateConfig = {
   instructions?: string;
 };
 /** The judge verdict returned by the evaluate endpoint — `{@link JudgeOutcome}` verbatim. */
-type EvaluateVerdict = JudgeOutcome;
+export type EvaluateVerdict = JudgeOutcome;
 //#endregion
-export { EvaluateConfig, EvaluateVerdict };
 //# sourceMappingURL=evaluate.type.d.mts.map