@xhulz/nina 0.28.16

package/releases/0.9.0/surfaces/integrations/tree/.claude/router.md

@@ -0,0 +1,6 @@
+<!-- nina:slot integrations.1 -->
+
+### 1b. Integration-tester is a guardrail for integration boundaries
+Invoke **integration-tester** any time the diff touches the boundary module of a declared integration, or adds a call into one. It runs the real dependency, never a mock of it; for a `live-api` it runs the **contract-test suite against BOTH implementations**, so the mock can never pass while the live path is broken. No such change merges without its approval.
+
+The architect's spec MUST carry an **Integration premises** section: every behavior the implementation relies on, each with the evidence its kind requires — `node_modules/.pnpm/<lib>@<version>/...:<line>` for an installed library, a contract case or an observed response for a live API, the local emulator for a platform binding. Never by inference.

package/releases/0.9.0/surfaces/integrations/tree/CLAUDE.md

@@ -0,0 +1,14 @@
+<!-- nina:slot integrations.1 -->
+| **ANY integration surface** (the boundary module of a declared integration, or a new call into one) | architect cites a premise, with the evidence its kind requires, for every dependency behavior the code relies on; **+ integration-tester before reviewer** |
+
+<!-- nina:slot integrations.3 -->
+- **integration-tester** → mandatory gate on any integration boundary; runs the real dependency rather than a mock of it, and for a `live-api` runs the contract-test suite against both implementations so they cannot diverge; verifies every cited premise; keeps `.claude/integrations/<slug>.md` current
+
+<!-- nina:slot integrations.4 -->
+11. **Every integration has one boundary and one doc.** A dependency whose behavior you do not define — an installed library, a live third-party API, a platform binding — is reached through exactly ONE module, and nothing else speaks to it: no raw HTTP, SDK instance or binding handle in a route, service, queue consumer or scheduled handler. Each is declared in `.nina/profile.json` with its `kind` and `boundary`, and documented at `.claude/integrations/<slug>.md`. A `live-api` carries two implementations behind one interface — the real client and a deterministic mock — and one contract-test suite that BOTH must pass; a mock that is green while the real client is not is a lie, and a hard reject.
+
+<!-- nina:slot integrations.5 -->
+12. **A premise about an integration requires a citation, and the form depends on the kind.** The architect MAY NOT state a dependency's behavior as fact without evidence: for an `installed-library`, `node_modules/.pnpm/<lib>@<version>/.../<file>:<line>` from the version actually installed here; for a `live-api`, a contract-test case or a response observed against the service and captured verbatim; for a `platform-binding`, behavior observed under the local emulator. Vendor docs, a README, a changelog and recall are NOT citations. An uncited premise is an assumption, and the spec is rejected by the reviewer.
+
+<!-- nina:slot integrations.6 -->
+13. **Integration boundaries require the integration-tester gate before reviewer.** Any diff touching a boundary module, or adding a call into one, MUST pass the integration-tester before the reviewer can approve. Unit-test mocks honor the spec, not the dependency — a mock is green because we wrote it that way. Only a run against the real thing, or a contract suite both implementations pass, catches drift.

package/releases/0.9.0/surfaces/money/tree/.claude/agents/architect.md

@@ -0,0 +1,12 @@
+<!-- nina:slot money.1 -->
+11. **Money invariants** — if the spec touches distribution, transfer generation, or a send to the payment integration, explicitly confirm the design honors:
+    - Money is integer {{MINOR_UNIT}} end to end; percentages are basis points. Never a floating-point type.
+    - A distribution may NEVER exceed the amount → **block** (reject the operation, do not clamp it).
+    - A distribution **less** than the amount → **allow**, surface the shortfall, leave the remainder **parked** — never silently distributed.
+    - Transfers are **idempotent** — never sent twice. Dedupe happens at the serialization point, via the key, before the side effect.
+    - Every legal state transition writes an audit row (who / when / from → to). Illegal transitions throw.
+
+    If the design cannot satisfy all of these, redesign before submitting the spec.
+
+<!-- nina:slot money.2 -->
+- Design a money movement that can exceed the amount it distributes, silently absorb a shortfall, or send a transfer twice. If the design needs monetary computation, that computation lives in `{{CORE_PKG}}` as a pure function — never inline in a service or route.

package/releases/0.9.0/surfaces/money/tree/.claude/agents/dba.md

@@ -0,0 +1,14 @@
+<!-- nina:slot money.1 -->
+7. **No cache on a read that feeds a money write.** Anything that loads an amount or a balance before computing, approving or dispatching a transfer MUST NOT carry a `cacheStrategy`. A stale amount contaminates a real money movement, and that damage is not undone by fixing the cache afterwards. **Hard reject if violated.**
+
+<!-- nina:slot money.2 -->
+9. **Monetary columns are integer.** Money is stored as an integer of the currency's minor unit ({{MINOR_UNIT}}); percentages are basis points. Reject `Decimal`, `Float`, or any type that can hold a fraction of the minor unit.
+
+<!-- nina:slot money.3 -->
+10. **Money-integrity constraints.** When the change touches the record of an outbound transfer, verify the **unique constraint on its idempotency key** exists (`@unique` in the schema → `UNIQUE` in the migration SQL). That constraint is what still holds when the application-level guard fails; a missing or dropped one is a **hard reject**. Verify likewise any uniqueness the ownership model depends on.
+
+<!-- nina:slot money.4 -->
+- Approve a query annotated with `cacheStrategy` if it feeds a money write.
+
+<!-- nina:slot money.5 -->
+- Approve a change to an outbound-transfer record that lacks the unique constraint on its idempotency key.

package/releases/0.9.0/surfaces/money/tree/.claude/agents/implementer.md

@@ -0,0 +1,11 @@
+<!-- nina:slot money.1 -->
+
+## Money invariants you MUST honor
+- **A distribution may NEVER exceed the amount** → block. Implement the reject; never clamp and continue.
+- **A shortfall is parked, not distributed.** Surface it and leave the remainder where it is — never auto-distribute it, never absorb it quietly.
+- **Transfers are idempotent — never sent twice.** Dedupe at the serialization point via the key, *before* the side effect. A retry, a re-delivered message or a double-click must not produce a second transfer.
+- **Every state transition writes an audit row** (entity, from → to, actor). No transition without a trail.
+- The deterministic money logic lives in `{{CORE_PKG}}` — call it as a pure function; never embed the arithmetic in a service.
+
+<!-- nina:slot money.2 -->
+- Embed money arithmetic (sums, deltas, value comparisons, distribution math) inline in a service. Computation lives in `{{CORE_PKG}}`.

package/releases/0.9.0/surfaces/money/tree/.claude/agents/integration-tester.md

@@ -0,0 +1,3 @@
+<!-- nina:slot money.1 -->
+- **Confirm idempotency holds end to end.** Two sends with the same key → one logical transfer, no double send, and the serialization point refuses the second. This is the highest-blast-radius invariant in the system — drive it explicitly against the real service; do not infer it from reading the code.
+- **Confirm money crosses the boundary as an integer of the minor unit**, and that conversion happens only in the module that owns it — never in a service, never through a floating-point type.

package/releases/0.9.0/surfaces/money/tree/.claude/agents/reviewer.md

@@ -0,0 +1,23 @@
+<!-- nina:slot money.1 -->
+- **Enforce the money invariants. Each violation is a HARD REJECT → loop back to architect:**
+  - **A distribution may NEVER exceed the amount.** It is blocked, not clamped. A retention is just another destination — same arithmetic, in integer {{MINOR_UNIT}}.
+  - **A shortfall must be parked, not silently distributed.** The remainder stays where it is, and the shortfall is surfaced to whoever is owed it.
+  - **Transfers must be idempotent — never sent twice.** Every transfer carries a key, and dedupe happens at the serialization point before the side effect. A retry, a re-delivered message or a double-click must never produce a second transfer.
+  - **Every state transition writes an audit row** (entity type, id, from, to, actor) and follows the transitions declared in `.claude/architecture.md`. An undeclared transition, or one missing its audit row, is a hard reject.
+
+<!-- nina:slot money.2 -->
+1. **money-invariants** — a distribution never exceeds the amount; a shortfall is parked, never
+   distributed; transfers idempotent at the serialization point; an audit row on every transition;
+   integer {{MINOR_UNIT}} and basis points; no arithmetic outside `{{CORE_PKG}}`.
+
+<!-- nina:slot money.3 -->
+- `{{CORE_PKG}}` money logic touched (distribution and transfer generation are high-blast-radius)
+
+<!-- nina:slot money.4 -->
+- Approve a change that lets a distribution exceed the amount, silently distributes a shortfall, sends a transfer without idempotent dedupe, or skips an audit row — those are hard rejects, loop back to architect.
+
+<!-- nina:slot money.5 -->
+- **If APPROVED:** ≤300 words. Sections: Verification commands run (typecheck/lint/build only — NEVER vitest), Spec-match (✅/❌ per item), Hard-rule checks (tenant scoping ✅, integer {{MINOR_UNIT}} / bps ✅, dba ✅ if applicable, integration-tester ✅ if applicable, money invariants ✅ — distribution ≤ amount, shortfall parked, idempotent transfer, audit row on transition), QA-attention flags (list any condition from the "stricter audit" list so QA knows what to focus on), Final verdict.
+
+<!-- nina:slot money.6 -->
+- Money invariant violated (distribution exceeds the amount, shortfall silently distributed, non-idempotent transfer, missing audit row) → back to **architect** for redesign.

package/releases/0.9.0/surfaces/money/tree/.claude/agents/secops.md

@@ -0,0 +1,5 @@
+<!-- nina:slot money.1 -->
+- **Money-movement abuse (Hard Rules #3, #4, #5)** — **the money path reaches a real service; this is not a stub audit.** Is the idempotency contract actually enforced at the seam — the unique key, the serialization point, and the dedupe happening *before* the side effect? Can a replay, a double-click, a queue redelivery, or a manual reset of processed state cause a double send? Can a distribution exceed the amount, or a shortfall be silently distributed? Is whatever authorizes money OUT forgeable — a webhook without a verified signature, a callback trusted on its word? Is every state transition forced through an audit write? Flag any seam that is structurally unable to enforce its invariant, even where nothing has exploited it yet.
+
+<!-- nina:slot money.2 -->
+- **Idempotency-key & replay surface** — keys unguessable and collision-resistant where it matters; dedup enforced before the side effect, not after.

package/releases/0.9.0/surfaces/money/tree/.claude/agents/solidity-auditor.md

@@ -0,0 +1,4 @@
+<!-- nina:slot money.1 -->
+- **The conservation property, asserted rather than argued.** Find the test that proves in equals
+  out plus retained, and check it holds on the adversarial paths too, not only the intended one.
+  Rounding that always favours the same party is a finding; so is a fee path with no upper bound.

package/releases/0.9.0/surfaces/money/tree/.claude/agents/solidity-dev.md

@@ -0,0 +1,4 @@
+<!-- nina:slot money.1 -->
+- **State the conservation property and assert it in the suite.** A contract that holds or routes an
+  amount has one — what goes in equals what goes out plus what is retained — and it belongs in a
+  test, not in a comment. Rounding is part of it: say which way it goes and who it favours.

package/releases/0.9.0/surfaces/money/tree/.claude/patterns.md

@@ -0,0 +1,49 @@
+<!-- nina:slot money.1 -->
+
+---
+
+## Monetary values & percentages
+
+- **Money is an integer of the currency's minor unit**, end to end — {{MINOR_UNIT}}, never a float, never a type that can hold a fraction of one. Source of precision: `{{MONEY_MODULE}}`.
+- **Percentages are basis points** (`40% → 4000`, `100% → 10000`) so a distribution is exact without floating point.
+- **Parsing, formatting and percentage arithmetic live in one module and nowhere else.** A second place that turns a string into money is a second rounding rule, and the two will disagree on a value somebody is owed.
+- **Never** convert to a floating-point type before formatting, and never let a display format round a stored value.
+- Monetary database columns are integer. JSON responses serialize them as **strings**, not numbers, so no client parses them into a float. The service owns the conversion.
+
+<!-- nina:slot money.2 -->
+
+---
+
+## Distribution invariants (enforced by reviewer + unit tests)
+
+The distribution engine lives in `{{CORE_PKG}}`. It is pure and total over integer {{MINOR_UNIT}}:
+
+- A destination is either a percentage (basis points of the amount) or a fixed value.
+- `total = Σ destinations`, computed in {{MINOR_UNIT}}.
+- `total > amount` → **reject.** Never clamp, never distribute what is not there.
+- `total < amount` → **allow**, surface the shortfall, and leave the remainder **parked**. Silence is the defect here: an unexplained remainder is indistinguishable from a bug.
+- `total = amount` → OK.
+- A retention is just another destination — the same arithmetic applies to it, with no special case.
+
+<!-- nina:slot money.3 -->
+
+---
+
+## State machines & idempotency (enforced by reviewer)
+
+- **Every money-moving entity is a state machine.** Its states and legal transitions are declared in `.claude/architecture.md`; the code follows the declaration, not the other way round. Illegal transitions throw; they are never silently coerced.
+- **Every transition writes an audit row** (entity type, entity id, from, to, actor). No transition without a trail — the trail is what makes a money bug diagnosable after the money has moved.
+- **Outbound transfers are idempotent.** Each carries a unique key, and dedupe happens before the side effect, at the serialization point.
+- **One serialization point per balance.** Whatever computes and dispatches against a single balance never runs concurrently with itself. Two concurrent runs over one balance is how a double send happens even when every individual write is correct.
+
+<!-- nina:slot money.4 -->
+6. **Money computation and dispatch go through the serialization point.** Routes, queue consumers and tools never run a distribution or a transfer synchronously in the request path.
+
+<!-- nina:slot money.5 -->
+7. **The distribution engine lives in `{{CORE_PKG}}`.** Services call it as a pure function; they do not embed money logic inline.
+
+<!-- nina:slot money.6 -->
+- Idempotency on money-moving writes: the record carries an idempotency key, and the serialization point refuses the second attempt *before* the side effect.
+
+<!-- nina:slot money.7 -->
+- `{{CORE_PKG}}` is the most-tested package — pure functions over fixtures. Cover the distribution invariants exhaustively: over, under, exact, mixed percentage and fixed, and rounding.

package/releases/0.9.0/surfaces/money/tree/.claude/pipeline.md

@@ -0,0 +1,5 @@
+<!-- nina:slot money.1 -->
+  - **Money invariants respected** — a distribution never exceeds the amount; a shortfall is parked, not distributed; transfers idempotent; every transition audited.
+
+<!-- nina:slot money.2 -->
+- **Reviewer flags a money invariant violation** (distribution exceeds the amount, shortfall silently distributed, non-idempotent transfer, missing audit row) → loop back to architect.

package/releases/0.9.0/surfaces/money/tree/.claude/retrieval.md

@@ -0,0 +1,2 @@
+<!-- nina:slot money.1 -->
+| New distribution / transfer logic | `.claude/architecture.md` § *Money*, `.claude/patterns.md` § *Distribution invariants*, `{{CORE_PKG}}/` | architect → implementer → reviewer → qa |

package/releases/0.9.0/surfaces/money/tree/CLAUDE.md

@@ -0,0 +1,8 @@
+<!-- nina:slot money.1 -->
+3. **An outbound transfer is idempotent — it is NEVER sent twice.** Every transfer carries an idempotency key, and deduplication happens at a single serialization point **before** the side effect, never after it. A retry, a re-delivered queue message, a double-click and a replayed webhook must all collapse to one transfer. This is the highest-blast-radius invariant in the system: almost everything else can be corrected afterwards, and a duplicated transfer cannot.
+
+<!-- nina:slot money.2 -->
+4. **Conservation — what comes in equals what goes out plus what is retained.** A distribution may NEVER exceed the amount it distributes → **block**. If it is **less**, **alert** and leave the remainder **parked** and visible — never silently distributed, never silently absorbed. All arithmetic is integer {{MINOR_UNIT}}; percentages are basis points. The LLM never computes a monetary value.
+
+<!-- nina:slot money.3 -->
+5. **State-machine integrity.** Every money-moving entity has an explicit set of states and legal transitions, declared in `.claude/architecture.md` § *State machines* — not inferred from whatever code happens to exist. Only declared transitions are legal; an illegal one throws and is never silently coerced. **Every transition writes an audit row** (entity, id, from → to, actor, when). Skipping a state, inventing one, or landing a transition with no audit row is a hard reject.

package/releases/0.9.0/surfaces/pii/tree/.claude/agents/dba.md

@@ -0,0 +1,2 @@
+<!-- nina:slot pii.1 -->
+11. **Privacy.** No sensitive value in clear text where it must not be. The categories are declared in `.claude/architecture.md` § *Privacy* — they are not decided per query, and not decided by you. **Document bytes live only in the object store, referenced by key: the column holds the key, never the bytes.** Any column the architect's spec flagged for masking must be encrypted at rest. Reject a schema that widens what is stored in the clear.

package/releases/0.9.0/surfaces/pii/tree/.claude/agents/devops.md

@@ -0,0 +1,8 @@
+<!-- nina:slot pii.1 -->
+
+**Point it at an UNAUTHENTICATED route — a sign-in page is the right one.** Never sign in, and never
+screenshot a signed-in page. Accounts on deployed environments hold real personal data, and a
+screenshot or a console dump pulls it into agent transcripts and logs, where it persists and nobody
+ever looks for it again. That is a privacy leak with no upside here: the sign-in page proves
+everything this check is for. It renders from the same bundle, it exercises the same build-time env
+inlining (a missing variable blanks it identically), and it needs no session.

package/releases/0.9.0/surfaces/pii/tree/.claude/agents/reviewer.md

@@ -0,0 +1,2 @@
+<!-- nina:slot pii.1 -->
+- Check for privacy regressions: **no sensitive value in a log, an error message, a URL or a test fixture**, per the categories in `.claude/architecture.md` § *Privacy*; document bytes only in the object store, never plaintext in the database; no leaked secret.

package/releases/0.9.0/surfaces/pii/tree/.claude/agents/secops.md

@@ -0,0 +1,2 @@
+<!-- nina:slot pii.1 -->
+- **Privacy (Hard Rule #8)** — the categories declared in `.claude/architecture.md` § *Privacy* must never appear in logs, in responses that do not need them, in error paths, or in the database in clear text. Check every endpoint that returns a person's record for fields it includes by accident: a `select` that quietly grew a column is the usual way this leaks. Check the error paths too — they are written last and reviewed least.

package/releases/0.9.0/surfaces/pii/tree/.claude/agents/solidity-auditor.md

@@ -0,0 +1,5 @@
+<!-- nina:slot pii.1 -->
+- **Nothing personal reaches the chain.** What is written on-chain is public, permanent, and beyond
+  deletion by anyone — including by you, and including after a subject asks. A hash of a personal
+  identifier is not a protection: it is a lookup table for whoever holds the input set. Reject a
+  personal datum stored in state, emitted in an event, or passed as calldata.

package/releases/0.9.0/surfaces/pii/tree/CLAUDE.md

@@ -0,0 +1,2 @@
+<!-- nina:slot pii.1 -->
+8. **Sensitive personal data is classified, and the classification is enforced.** What counts as sensitive here — identity documents, financial identifiers, anything a person would not expect to be readable by whoever can read a log — is declared in `.claude/architecture.md` § *Privacy*, along with the regime that governs it ({{PRIVACY_REGIME}}). Encrypted at rest. **No sensitive value in a log, an error message, a URL, an analytics event, or an agent transcript** — the places nobody thinks about are exactly the ones that persist. Document bytes live only in the object store, referenced by key, never in the database in clear text.

package/src/agentrun.mjs

@@ -0,0 +1,137 @@
+/**
+ * What one stage did, read from its own transcript: the prompt it was given, each message it wrote with
+ * the tokens it spent, each tool it called with what came back, and the report it handed back.
+ *
+ * It exists for one reader — a project that sends its stages' context to Langfuse (`nina langfuse on
+ * --content`) — and it is read at the moment of sending, never kept: the snapshot stays metadata only.
+ *
+ * What it reads is what the stage read, which is the project's code and anything else on disk it opened.
+ * Obvious secrets are masked on the way out (`redact`), and that is a floor, not a promise: a secret that
+ * looks like none of them goes as it is. That is why sending context is a switch per project.
+ */
+
+import { createReadStream, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { createInterface } from 'node:readline';
+import { tokensOf } from './transcripts.mjs';
+
+/** How much of a prompt, a report or a message's text is sent, and of a tool call's input or result. */
+export const TEXT_CHARS = 20_000;
+export const TOOL_CHARS = 8_000;
+
+/** Where a run's transcript is, from its record. */
+export const runFile = (projectDir, record) =>
+  record.agent_id && record.session ? join(projectDir, record.session, 'subagents', `agent-${record.agent_id}.jsonl`) : null;
+
+/** Text cut to a length, saying how much was left out. */
+export function clip(text, chars) {
+  const value = String(text ?? '');
+  return value.length > chars ? `${value.slice(0, chars)}… [${value.length - chars} more characters]` : value;
+}
+
+/** Names whose value is a credential when they are assigned one. */
+const SECRET_NAME = /(?:secret|token|passw(?:or)?d|api_?key|private_?key|access_?key|credential)/i;
+
+/** Token formats that are credentials on sight. */
+const SECRET_TOKEN = /\b(?:sk-(?:ant-|lf-|proj-)?[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{30,}|xox[abprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35})/g;
+
+/** `NAME=value`, `NAME: value`, `"name": "value"` — the name bounded, so the match cannot run away. */
+const ASSIGNMENT = /\b([A-Za-z0-9_]{0,40})(["']?\s{0,3}[:=]\s{0,3}["']?)([^\s"'`,;]{6,})/g;
+
+/**
+ * Text with the secrets it obviously carries masked: private keys, the token formats of the common
+ * providers, an `Authorization` value, and anything assigned to a name that says it is a secret. A value
+ * of digits only is left: `max_tokens: 100000` is not a credential.
+ *
+ * @param {string} text
+ * @returns {string}
+ */
+export function redact(text) {
+  let out = String(text ?? '');
+  // Private keys by position rather than by a pattern spanning lines, which is where a regex goes slow.
+  for (let start = out.indexOf('-----BEGIN '); start !== -1; start = out.indexOf('-----BEGIN ', start + 1)) {
+    const head = out.indexOf('-----', start + 11);
+    if (head === -1 || !out.slice(start, head).includes('PRIVATE KEY')) continue;
+    const end = out.indexOf('-----END ', head);
+    const close = end === -1 ? -1 : out.indexOf('-----', end + 9);
+    out = `${out.slice(0, start)}[redacted private key]${close === -1 ? '' : out.slice(close + 5)}`;
+  }
+  out = out.replace(SECRET_TOKEN, '[redacted]');
+  out = out.replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{16,}/g, '$1 [redacted]');
+  return out.replace(ASSIGNMENT, (whole, name, sep, value) =>
+    SECRET_NAME.test(name) && !/^\d+$/.test(value) && value !== '[redacted]' ? `${name}${sep}[redacted]` : whole,
+  );
+}
+
+/** A tool result's text: a string, or the text blocks of a list, with images named rather than sent. */
+function resultText(content) {
+  if (typeof content === 'string') return content;
+  if (!Array.isArray(content)) return '';
+  return content.map((b) => (b?.type === 'text' ? b.text : b?.type === 'image' ? '[image]' : '')).filter(Boolean).join('\n');
+}
+
+/**
+ * Reads a stage's transcript.
+ *
+ * @param {string} file - `agent-<id>.jsonl` under its session.
+ * @returns {Promise<{prompt: string|null, report: string|null, messages: object[], tools: object[]}|null>}
+ *   Null when the transcript is gone — Claude Code prunes them after a while.
+ */
+export async function readRun(file) {
+  if (!file || !existsSync(file)) return null;
+  let prompt = null;
+  let handback = null;
+  let lastText = null;
+  /** @type {Map<string, {id: string, model: string|null, usage: object|null, start: string, end: string, text: string[]}>} */
+  const messages = new Map();
+  /** @type {Map<string, {id: string, name: string, input: unknown, start: string, end: string|null, output: string, error: boolean}>} */
+  const tools = new Map();
+  const rl = createInterface({ input: createReadStream(file), crlfDelay: Infinity });
+  for await (const line of rl) {
+    let row;
+    try {
+      row = JSON.parse(line);
+    } catch {
+      continue; // A torn line loses one entry, not the run.
+    }
+    const at = row.timestamp ?? null;
+    const content = row.message?.content;
+    if (row.type === 'user' && !row.isMeta && typeof content === 'string' && prompt === null) prompt = content;
+    if (row.type === 'user' && Array.isArray(content)) {
+      for (const block of content) {
+        const call = block?.type === 'tool_result' ? tools.get(block.tool_use_id) : null;
+        if (!call) continue;
+        call.output = resultText(block.content);
+        call.error = block.is_error === true;
+        call.end = at;
+      }
+    }
+    if (row.type !== 'assistant' || !Array.isArray(content)) continue;
+    // A streamed message is written once per content block under one id; its last row has its final usage.
+    const id = row.message.id ?? row.uuid;
+    const message = messages.get(id) ?? { id, model: row.message.model ?? null, usage: null, start: at, end: at, text: [] };
+    message.end = at;
+    if (row.message.usage) message.usage = row.message.usage;
+    for (const block of content) {
+      if (block?.type === 'text' && block.text.trim()) {
+        message.text.push(block.text);
+        lastText = block.text;
+      }
+      if (block?.type === 'tool_use') {
+        if (block.name === 'SubagentHandback' && typeof block.input?.message === 'string') handback = block.input.message;
+        tools.set(block.id, { id: block.id, name: block.name, input: block.input, start: at, end: null, output: '', error: false });
+      }
+    }
+    messages.set(id, message);
+  }
+  return {
+    prompt,
+    report: handback ?? lastText,
+    // `priced` is the model its tokens are priced at, which a fast-mode or fallback message has none of.
+    messages: [...messages.values()].map((m) => {
+      const { tokens, model: priced } = tokensOf(new Map([[m.id, { usage: m.usage ?? {}, model: m.model }]]));
+      return { ...m, tokens, priced };
+    }),
+    tools: [...tools.values()],
+  };
+}

package/src/banner.mjs

@@ -0,0 +1,78 @@
+/**
+ * The NINA banner.
+ *
+ * Printed on every invocation, and once at the top of a `nina` session, whose commands run under it.
+ * This is not decoration and is not a candidate for "quiet mode" trimming — see the project memory
+ * `nina-cli`.
+ */
+
+/** ANSI-Shadow block lettering for the CLI name — six lines, by design. */
+const ART = [
+  String.raw` ███╗   ██╗ ██╗ ███╗   ██╗  █████╗`,
+  String.raw` ████╗  ██║ ██║ ████╗  ██║ ██╔══██╗`,
+  String.raw` ██╔██╗ ██║ ██║ ██╔██╗ ██║ ███████║`,
+  String.raw` ██║╚██╗██║ ██║ ██║╚██╗██║ ██╔══██║`,
+  String.raw` ██║ ╚████║ ██║ ██║ ╚████║ ██║  ██║`,
+  String.raw` ╚═╝  ╚═══╝ ╚═╝ ╚═╝  ╚═══╝ ╚═╝  ╚═╝`,
+];
+
+/** The one pink — the deepest tone of the gradient this replaced. */
+export const PINK = [225, 45, 130];
+
+/**
+ * Palettes, one color per line of the art.
+ *
+ * `pink` is the default: one hue deepening down the block. `pink-flat` is the same hue
+ * held at its deepest for every line. `rainbow` is the 1977 Apple logo, top to bottom —
+ * six stripes for six lines; handsome, but six hues cut across the glyphs and the word
+ * gets harder to read.
+ */
+const PALETTES = {
+  'pink-flat': Array.from({ length: 6 }, () => PINK),
+  rainbow: [
+    [97, 187, 70], // green
+    [253, 184, 39], // yellow
+    [245, 130, 31], // orange
+    [224, 58, 62], // red
+    [150, 61, 151], // purple
+    [0, 157, 220], // blue
+  ],
+  pink: [
+    [255, 196, 224],
+    [255, 166, 209],
+    [255, 133, 191],
+    [255, 100, 173],
+    [247, 70, 152],
+    [225, 45, 130],
+  ],
+};
+
+/** True when the terminal should be given escape codes at all. */
+export const useColor = () => Boolean(process.stdout.isTTY) && !process.env.NO_COLOR;
+
+/**
+ * Wraps text in a 24-bit foreground color.
+ *
+ * @param {[number, number, number]} rgb - The color.
+ * @param {string} text - The text to wrap.
+ * @returns {string} The text, colored if the terminal takes color.
+ */
+const paint = ([r, g, b], text) =>
+  useColor() ? `\x1b[38;2;${r};${g};${b}m${text}\x1b[0m` : text;
+
+/** The subtitle, in the same pink held back so it sits under the name. */
+const subtitle = (s) =>
+  useColor() ? `\x1b[2m\x1b[38;2;${PINK.join(';')}m${s}\x1b[0m` : s;
+
+/**
+ * Prints the banner to stdout.
+ *
+ * @param {string} version - The CLI version, shown under the art.
+ * @param {string} [theme] - Palette name; defaults to `NINA_THEME`, else `pink`.
+ */
+export function printBanner(version, theme = process.env.NINA_THEME ?? 'pink') {
+  const palette = PALETTES[theme];
+  const lines = palette ? ART.map((line, i) => paint(palette[i], line)) : ART;
+  process.stdout.write(`\n${lines.join('\n')}\n`);
+  process.stdout.write(subtitle(`  harness orchestration · v${version}\n\n`));
+}