openmerit 0.1.4 → 0.1.6-preview.0

package/dist/terminal/src/project-activity.mjs

@@ -0,0 +1,156 @@
+import { opendir, lstat, open, realpath } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+import { createHash } from 'node:crypto';
+import { StringDecoder } from 'node:string_decoder';
+
+const FILE_BYTES = 512 * 1024, TOTAL_BYTES = 4 * 1024 * 1024;
+const MAX_FILES = 128, MAX_ENTRIES = 2048, MAX_RECORDS = 10000;
+const finite = value => typeof value === 'number' && Number.isFinite(value) && value >= 0;
+const object = value => value && typeof value === 'object' && !Array.isArray(value);
+const id = value => typeof value === 'string' && value.length > 0 && value.length <= 160;
+const hash = value => createHash('sha256').update(value).digest('hex').slice(0, 24);
+
+// Recognize recorded request objects, not arbitrary JSON or a model catalog.
+// No source-code execution, prompt interpretation, or filename-based providers.
+export function projectActivityRecord(value, sourceId, file, normalize) {
+  if (!object(value)) return null;
+  const body = object(value.response) ? value.response : value;
+  const usage = body.usage;
+  const responses = body.object === 'response';
+  const chat = body.object === 'chat.completion';
+  const structured = !responses && !chat && id(value.id) && typeof value.occurredAt === 'string';
+  if (!responses && !chat && !structured) return null;
+  const measured = object(usage) && [usage.input_tokens, usage.output_tokens, usage.prompt_tokens, usage.completion_tokens].some(finite);
+  const terminal = ['completed', 'failed', 'running'].includes(value.status);
+  if (!measured && !(structured && terminal && (finite(value.httpStatus) || value.event === 'inference.request'))) return null;
+  const requestId = structured ? value.requestId : body.id;
+  const recordId = structured ? value.id : body.id;
+  if (!id(recordId) || !id(body.model ?? value.model)) return null;
+  let occurredAt = value.occurredAt;
+  if (!occurredAt && (responses || chat)) {
+    const seconds = responses ? body.created_at : body.created;
+    if (finite(seconds) && seconds < 8640000000000) occurredAt = new Date(seconds * 1000).toISOString();
+  }
+  if (typeof occurredAt !== 'string' || !Number.isFinite(Date.parse(occurredAt))) return null;
+  // An API-compatible response shape doesn't prove which company served it.
+  // Connection, workload, and agent/task fields must be explicitly recorded.
+  const status = structured ? value.status : responses
+    ? ({ completed: 'completed', failed: 'failed', cancelled: 'failed', incomplete: 'failed', in_progress: 'running', queued: 'running' })[body.status]
+    : body.choices?.length && body.choices.every(choice => typeof choice.finish_reason === 'string')
+      ? body.choices.some(choice => ['error', 'content_filter'].includes(choice.finish_reason)) ? 'failed' : 'completed' : null;
+  if (!['completed', 'failed', 'running'].includes(status)) return null;
+  const record = normalize({
+    ...value, id: recordId, requestId, occurredAt, status, model: body.model ?? value.model,
+    provider: value.provider ?? body.provider,
+    workload: value.workload || value.application || file,
+    inputTokens: structured && finite(value.inputTokens) ? value.inputTokens : usage?.input_tokens ?? usage?.prompt_tokens,
+    outputTokens: structured && finite(value.outputTokens) ? value.outputTokens : usage?.output_tokens ?? usage?.completion_tokens,
+    cacheReadTokens: structured && finite(value.cacheReadTokens) ? value.cacheReadTokens : usage?.input_tokens_details?.cached_tokens ?? usage?.prompt_tokens_details?.cached_tokens,
+    cost: finite(value.cost) ? value.cost : usage?.cost,
+  }, sourceId);
+  return record && { ...record, evidenceFormat: responses ? 'responses' : chat ? 'chat-completion' : 'structured-request' };
+}
+
+export function createProjectActivity(root, normalize, { exclude = [] } = {}) {
+  const readers = new Map();
+  return async function collect() {
+    const files = [], issues = []; let visited = 0, omitted = false, budget = TOTAL_BYTES;
+    const canonicalRoot = await realpath(root);
+    const excludedPaths = exclude.map(path => join(canonicalRoot, relative(root, path)));
+    const allowed = path => path.startsWith(canonicalRoot + sep);
+    async function scan(path, depth) {
+      let directory;
+      try {
+        const info = await lstat(path);
+        if (!info.isDirectory() || info.isSymbolicLink() || await realpath(path) !== path) return;
+        directory = await opendir(path);
+        for await (const entry of directory) {
+          if (++visited > MAX_ENTRIES) { omitted = true; break; }
+          if (entry.name.startsWith('.') || entry.isSymbolicLink()) continue;
+          const child = join(path, entry.name);
+          if (entry.isDirectory() && depth > 0) await scan(child, depth - 1);
+          else if (entry.isFile() && /\.jsonl(?:\.\d+)?$/.test(entry.name) && !excludedPaths.includes(child)) {
+            const info = await lstat(child);
+            if (info.isFile() && !info.isSymbolicLink()) files.push({ path: child, info });
+          }
+          if (visited >= MAX_ENTRIES) { omitted = true; break; }
+        }
+      } catch (error) { if (error.code !== 'ENOENT') issues.push(relative(canonicalRoot, path)); }
+    }
+    // Fixed project-local log roots. Never recursively inspect the repository,
+    // home directory, dependency trees, credentials, or arbitrary databases.
+    for (const name of ['logs', 'runs', 'results']) {
+      if (visited >= MAX_ENTRIES) break;
+      await scan(join(canonicalRoot, name), 2);
+    }
+    files.sort((a, b) => b.info.mtimeMs - a.info.mtimeMs || a.path.localeCompare(b.path));
+    if (files.length > MAX_FILES) omitted = true;
+    const chosen = files.slice(0, MAX_FILES), active = new Set(chosen.map(file => file.path));
+    for (const path of readers.keys()) if (!active.has(path)) readers.delete(path);
+    const sources = [], records = [];
+    for (const file of chosen) {
+      const name = relative(canonicalRoot, file.path), sourceId = `project-log:${hash(name)}`;
+      const source = { id: sourceId, name: 'Project request log', kind: 'Project activity', detail: name,
+        access: 'Selected project', coverage: ['Recorded requests', 'Reported identities', 'Tokens', 'Reported or estimated cost'],
+        note: 'Supported request metadata read from an existing JSONL log. Names and measurements are copied from recorded fields. Prompts, outputs, headers, and credentials are discarded. No account API or inference call is made.' };
+      try {
+        if (!allowed(file.path) || await realpath(file.path) !== file.path) throw new Error('Outside project or symlink');
+        const handle = await open(file.path, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+        try {
+          const info = await handle.stat();
+          if (!info.isFile()) throw new Error('Not a regular file');
+          let reader = readers.get(file.path);
+          const identity = `${info.dev}:${info.ino}`;
+          if (!reader || reader.identity !== identity || info.size < reader.offset || info.size === reader.offset && info.mtimeMs !== reader.mtime) {
+            reader = { identity, offset: 0, mtime: 0, pending: '', decoder: new StringDecoder('utf8'), records: new Map(), invalid: 0, unsupported: 0, truncated: false };
+          }
+          const limit = Math.min(FILE_BYTES, budget);
+          if (limit === 0 && info.size > reader.offset) { omitted = true; sources.push({ ...source, state: 'partial', records: 0, note: source.note + ' Waiting for the next bounded read.' }); continue; }
+          let skip = false;
+          if (info.size - reader.offset > limit) { reader.offset = info.size - limit; reader.pending = ''; reader.decoder = new StringDecoder('utf8'); reader.records.clear(); reader.truncated = true; skip = true; }
+          const buffer = Buffer.alloc(Math.min(limit, info.size - reader.offset));
+          const { bytesRead } = await handle.read(buffer, 0, buffer.length, reader.offset);
+          reader.offset += bytesRead; reader.mtime = info.mtimeMs; budget -= bytesRead;
+          const lines = (reader.pending + reader.decoder.write(buffer.subarray(0, bytesRead))).split('\n');
+          reader.pending = lines.pop() ?? ''; if (skip) lines.shift();
+          for (const line of lines) {
+            if (!line.trim()) continue;
+            try {
+              const record = projectActivityRecord(JSON.parse(line), sourceId, name, normalize);
+              if (!record) { reader.unsupported++; continue; }
+              reader.records.delete(record.id); reader.records.set(record.id, record);
+            } catch { reader.invalid++; }
+          }
+          if (reader.pending.length > 128 * 1024) { reader.pending = ''; reader.invalid++; }
+          for (const [key, record] of reader.records) if (Date.parse(record.occurredAt) < Date.now() - 86400000) reader.records.delete(key);
+          while (reader.records.size > 1000) { reader.records.delete(reader.records.keys().next().value); reader.truncated = true; }
+          readers.set(file.path, reader);
+          const retained = [...reader.records.values()].filter(record => Date.parse(record.occurredAt) <= Date.now());
+          records.push(...retained);
+          // Even an unsupported log is visible as a coverage gap, never a
+          // silently successful connection with zero fabricated requests.
+          sources.push({ ...source, state: reader.invalid || reader.unsupported || reader.truncated ? 'partial' : 'connected', records: retained.length,
+            updatedAt: new Date().toISOString(), invalid: reader.invalid, unsupported: reader.unsupported, truncated: reader.truncated,
+            note: source.note + (reader.truncated ? ' The bounded reader omitted older records.' : '') + (reader.invalid || reader.unsupported ? ' Some lines were malformed or did not match a supported request format.' : '') });
+        } finally { await handle.close(); }
+      } catch { readers.delete(file.path); sources.push({ ...source, state: 'unavailable', records: 0 }); }
+    }
+    records.sort((a, b) => Date.parse(b.occurredAt) - Date.parse(a.occurredAt));
+    if (records.length > MAX_RECORDS) {
+      omitted = true;
+      const retained = new Set(records.slice(0, MAX_RECORDS));
+      for (const [path, reader] of readers) {
+        let removed = false;
+        for (const [id, record] of reader.records) if (!retained.has(record)) { reader.records.delete(id); removed = true; }
+        if (removed) {
+          reader.truncated = true;
+          const source = sources.find(source => source.detail === relative(canonicalRoot, path));
+          if (source) { source.state = 'partial'; source.records = reader.records.size; source.truncated = true; source.note += ' The shared 10,000-record cache limit omitted older records.'; }
+        }
+      }
+    }
+    if (omitted || issues.length) sources.push({ id: 'project-log-coverage', name: 'Project log coverage', kind: 'Project activity', state: 'partial', detail: 'logs/ · runs/ · results/', note: 'The bounded scan omitted files or records, or a log directory was unreadable. These sources do not establish complete project usage.' });
+    return { records: records.slice(0, MAX_RECORDS), sources };
+  };
+}

package/dist/terminal/src/sample.mjs

@@ -0,0 +1,171 @@
+// Deterministic, deliberately fictional data. Never mixed with local sources.
+// Rates, latencies, allocations, and utilization are illustrative, not benchmarks.
+const GiB = 1024 ** 3;
+const TEAMS = [
+  ['Support', ['billing escalation', 'refund queue', 'onboarding tickets', 'SLA exceptions', 'customer handoff', 'incident follow-up', 'CSAT themes']],
+  ['Engineering', ['checkout regression', 'API migration', 'dependency upgrade', 'flaky test suite', 'release notes', 'auth refactor', 'performance budget']],
+  ['Research', ['competitor landscape', 'market signals', 'customer interviews', 'pricing study', 'industry brief', 'source verification', 'product opportunities']],
+  ['Finance', ['invoice exceptions', 'expense reconciliation', 'renewal forecast', 'vendor spending', 'revenue variance', 'purchase approvals', 'quarterly narrative']],
+  ['Security', ['access review', 'dependency advisory', 'policy exceptions', 'incident timeline', 'threat brief', 'audit evidence', 'service permissions']],
+  ['Operations', ['capacity forecast', 'deployment checklist', 'on-call handoff', 'runbook updates', 'queue anomalies', 'availability report', 'change requests']],
+  ['Sales', ['account research', 'proposal draft', 'pipeline review', 'meeting preparation', 'lead enrichment', 'deal risks', 'renewal outreach']],
+  ['Legal', ['supplier terms', 'contract changes', 'policy updates', 'obligation register', 'clause comparison', 'document redaction', 'agreement summary']],
+  ['Data', ['schema changes', 'quality checks', 'warehouse queries', 'catalog enrichment', 'metric definitions', 'report narrative', 'lineage review']],
+  ['Knowledge', ['document ingestion', 'retrieval quality', 'index refresh', 'duplicate articles', 'citation coverage', 'search relevance', 'content freshness']],
+];
+// name, provider/runtime, location, typical latency, fictional rate multiplier, role
+const MODEL_DEFINITIONS = [
+  ['GPT-5', 'OpenAI', 'cloud', 3600, 2.2, 'generation'],
+  ['Claude Sonnet 4.5', 'Anthropic', 'cloud', 4200, 2.6, 'generation'],
+  ['Gemini 2.5 Flash', 'Google', 'cloud', 900, .3, 'generation'],
+  ['DeepSeek R1', 'Baseten', 'cloud', 14000, .8, 'reasoning'],
+  ['Mistral Medium 3', 'Mistral', 'cloud', 1800, .7, 'generation'],
+  ['GPT-5 mini', 'OpenAI', 'cloud', 1400, .4, 'generation'],
+  ['Claude Opus 4.1', 'Anthropic', 'cloud', 11000, 6, 'reasoning'],
+  ['Gemini 2.5 Pro', 'Google', 'cloud', 7000, 1.8, 'reasoning'],
+  ['GPT-5 nano', 'OpenAI', 'cloud', 480, .08, 'generation'],
+  ['Claude Haiku 3.5', 'Anthropic', 'cloud', 700, .2, 'generation'],
+  ['gpt-oss-120b', 'Groq', 'cloud', 2000, .25, 'generation'],
+  ['qwen-3.8-27b', 'Cerebras', 'cloud', 2400, .65, 'generation'],
+  ['text-embedding-3-large', 'OpenAI', 'cloud', 160, .02, 'embedding'],
+  ['embed-v4', 'Cohere', 'cloud', 190, .025, 'embedding'],
+  ['Qwen3 · 8B', 'Ollama', 'local', 1400, 0, 'generation'],
+  ['Qwen3 · 30B', 'Ollama', 'local', 4200, 0, 'reasoning'],
+  ['Llama 3.3 · 70B', 'vLLM', 'local', 3100, 0, 'generation'],
+  ['Gemma 3 · 27B', 'LM Studio', 'local', 2600, 0, 'generation'],
+  ['DeepSeek R1 · 14B', 'Ollama', 'local', 6200, 0, 'reasoning'],
+  ['nomic-embed-text', 'Ollama', 'local', 90, 0, 'embedding'],
+  ['bge-reranker-v2-m3', 'vLLM', 'local', 75, 0, 'reranking'],
+];
+// Explicit fictional metadata, never inferred from the serving company.
+const MODEL_CREATORS = ['OpenAI', 'Anthropic', 'Google', 'DeepSeek', 'Mistral', 'OpenAI', 'Anthropic', 'Google', 'OpenAI', 'Anthropic', 'OpenAI', 'Qwen', 'OpenAI', 'Cohere', 'Qwen', 'Qwen', 'Meta', 'Google', 'DeepSeek', 'Nomic', 'BAAI'];
+const ROUTERS = ['router.quality', 'router.latency', 'router.cost', 'router.private'];
+const GATEWAYS = ['llm-gateway', 'llm-gateway-eu', 'batch-proxy'];
+const ROLES = ['Intake', 'Research', 'Delivery', 'Review'];
+const MODEL_PATHS = [
+  ['direct', 'router'], ['gateway', 'router'], ['direct', 'gateway'],
+  ['router', 'gateway'], ['direct'], ['direct', 'router', 'gateway'],
+  ['gateway'], ['router'], ['direct'], ['gateway', 'router'],
+  ['gateway', 'direct'], ['gateway'], ['direct'], ['gateway'],
+  ['local', 'router'], ['local', 'router'], ['local', 'gateway'],
+  ['local'], ['router', 'local'], ['local'], ['local', 'gateway'],
+];
+const TEAM_MODELS = [
+  [2, 5, 8, 9, 14], [0, 1, 3, 5, 15, 16], [3, 6, 7, 10, 11],
+  [0, 4, 7, 14, 17], [1, 3, 6, 15, 18], [2, 4, 5, 14, 16, 18],
+  [1, 2, 5, 9, 11], [0, 1, 6, 7, 17], [0, 5, 10, 14, 15, 16],
+  [2, 8, 11, 14, 17],
+];
+
+export function sampleSnapshot(now = Date.now()) {
+  let seed = 41;
+  const random = () => { seed = (seed * 16807) % 2147483647; return (seed - 1) / 2147483646; };
+  const choose = values => values[Math.floor(random() * values.length)];
+  const agents = TEAMS.flatMap(([team], teamIndex) => ROLES.map((role, index) => ({ id: `${team.toLowerCase()}.${role.toLowerCase()}`, name: index === 3 ? null : `${team.toLowerCase()}.${role.toLowerCase()}` })));
+  const tasks = TEAMS.flatMap(([, subjects], teamIndex) => subjects.flatMap((subject, index) => ['Review', 'Prepare'].map((verb, variant) => ({ id: `task-${teamIndex * 14 + index * 2 + variant + 1}`, name: index % 3 === 0 ? null : `${subject.replaceAll(' ', '_').toLowerCase()}.${verb.toLowerCase()}`, teamIndex, agent: agents[teamIndex * 4 + (index * 2 + variant) % 4] }))));
+  let totalTaskWeight = 0;
+  const taskWeights = tasks.map((task, index) => { totalTaskWeight += [1.7, 1.5, .8, .65, 1.1, 1.4, .9, .6, 1.2, 1.8][task.teamIndex] * (.5 + index % 7 * .25); return totalTaskWeight; });
+  const pickTask = () => { const target = random() * totalTaskWeight; return tasks[taskWeights.findIndex(weight => weight > target)]; };
+  const records = [];
+  const weights = Array.from({ length: 96 }, (_, bin) => 30 + 80 * (1 + Math.sin((bin - 24) / 15)) + (bin >= 67 && bin <= 74 ? 170 : 0) + random() * 45);
+  const totalWeight = weights.reduce((sum, value) => sum + value, 0);
+  let cumulative = 0;
+  for (let bin = 0; bin < 96; bin++) {
+    cumulative += weights[bin];
+    const end = Math.round(cumulative / totalWeight * 9600);
+    while (records.length < end) {
+      const index = records.length;
+      const running = index >= 9576;
+      const task = running ? choose(tasks.filter(task => task.agent.id === agents[(index - 9576) * 7 % agents.length].id)) : index < tasks.length ? tasks[index * 53 % tasks.length] : pickTask();
+      // Cover every catalog entry, then vary model mix with retrieval and generation.
+      const modelIndex = index < 21 ? index : [2, 8, 9].includes(task.teamIndex) && index % 9 === 0 ? 20 : index % 11 === 0 ? [12, 13, 19][task.teamIndex % 3] : choose(TEAM_MODELS[task.teamIndex]);
+      const [model, provider, location, baseLatency, rate, role] = MODEL_DEFINITIONS[modelIndex];
+      const pick = random();
+      const routeKind = pick < .09 && [4, 11, 13, 20].includes(modelIndex) ? 'unknown' : choose(MODEL_PATHS[modelIndex]);
+      const route = routeKind === 'unknown' ? 'Unattributed route' : routeKind === 'local' ? provider : routeKind === 'direct' ? `${provider} API` : routeKind === 'router' ? location === 'local' ? 'router.private' : choose(ROUTERS.slice(0, 3)) : choose(GATEWAYS);
+      const failed = !running && random() < (bin >= 68 && bin <= 73 ? .085 : .012);
+      const inputTokens = Math.round(320 + random() ** 2 * (role === 'embedding' ? 32000 : 24000));
+      const outputTokens = running ? null : failed || role === 'embedding' || role === 'reranking' ? 0 : Math.round(60 + random() ** 2 * (role === 'reasoning' ? 6500 : 2400));
+      const cacheReadTokens = role === 'embedding' || role === 'reranking' ? 0 : Math.round(inputTokens * (index % 5 === 0 ? .7 : random() * .35));
+      const cost = location === 'local' || running || index % 19 === 0 ? null : ((inputTokens - cacheReadTokens * .8) + outputTokens * 4) * rate / 1_000_000;
+      const occurredAt = running ? now - (9600 - index) * 2300 : now - (96 - bin) * 900000 + random() * 900000;
+      records.push({ id: `sample-request-${index + 1}`, sourceId: 'sample-activity', requestId: `req-${String(index + 1).padStart(5, '0')}`, occurredAt: new Date(occurredAt).toISOString(), model, modelCreator: MODEL_CREATORS[modelIndex], provider, location, workload: `services/${TEAMS[task.teamIndex][0].toLowerCase()}`, scope: 'agent', agentId: task.agent.id, agent: task.agent.name, taskId: task.id, task: task.name, route, routeKind, status: running ? 'running' : failed ? 'failed' : 'completed', inputTokens, outputTokens, cacheReadTokens, durationMs: running || index % 43 === 0 ? null : Math.round(baseLatency * (.4 + random() * 1.4) * (index % 71 === 0 ? 5 : 1)), cost, currency: 'USD', costKind: index % 9 === 0 ? 'estimated' : 'reported' });
+    }
+  }
+  const time = new Date(now).toISOString();
+  const localMemory = [5.2, 18.6, 42.4, 16.8, 9.1, .27, 1.2];
+  const runningModels = new Set(records.filter(item => item.status === 'running').map(item => item.model));
+  const models = MODEL_DEFINITIONS.map(([name, provider, location], index) => {
+    const loaded = location === 'local' && (index !== 15 && index !== 18 || runningModels.has(name));
+    return { id: `sample-model-${index}`, name, modelCreator: MODEL_CREATORS[index], creatorSources: ['sample-activity'], provider, location, state: location === 'cloud' ? 'observed' : loaded ? 'loaded' : 'installed', sourceId: location === 'cloud' ? 'sample-activity' : provider === 'Ollama' ? 'ollama' : provider === 'vLLM' ? 'runtime-vllm' : 'runtime-studio', memoryBytes: loaded ? localMemory[index - 14] * GiB : null, parameters: index >= 14 ? ['8B', '30B', '70B', '27B', '14B', '137M', '568M'][index - 14] : null, quantization: index >= 14 ? index >= 19 ? 'F16' : 'Q4_K_M' : null };
+  });
+  const modelCounts = new Map();
+  for (const record of records) modelCounts.set(`${record.provider}:${record.model}`, (modelCounts.get(`${record.provider}:${record.model}`) ?? 0) + 1);
+  models.sort((a, b) => modelCounts.get(`${b.provider}:${b.name}`) - modelCounts.get(`${a.provider}:${a.name}`));
+  const history = Array.from({ length: 240 }, (_, index) => ({ at: new Date(now - (239 - index) * 15000).toISOString(), cpuPercent: Math.min(97, 46 + Math.sin(index / 13) * 15 + (index > 155 && index < 184 ? 24 : 0) + random() * 12), memoryUsed: (110 + Math.sin(index / 32) * 12 + (index > 155 ? 18 : 0) + random() * 2) * GiB }));
+  const providers = [...new Set(models.filter(model => model.location === 'cloud').map(model => model.provider))];
+  const poolId = name => `pool-${name.toLowerCase().replaceAll(' ', '-')}`;
+  const deployments = MODEL_DEFINITIONS.flatMap(([model, provider, location], index) => Array.from({ length: index < 6 ? 2 : 1 }, (_, variant) => ({ id: `deployment-${index}-${variant}`, name: location === 'local' ? `${provider.toLowerCase().replaceAll(' ', '-')}-local` : `${provider.toLowerCase()}-${variant ? 'eu-1' : 'us-1'}`, model, modelCreator: MODEL_CREATORS[index], servingMode: location === 'local' ? 'self-hosted' : provider === 'Baseten' ? 'dedicated' : 'shared', provider, location, state: location === 'local' ? models.find(item => item.name === model).state : 'configured', sourceId: location === 'cloud' ? 'inventory' : models.find(item => item.name === model).sourceId, poolIds: [poolId(provider)] })));
+  records.forEach((record, index) => {
+    const modelIndex = MODEL_DEFINITIONS.findIndex(([model]) => model === record.model);
+    record.deploymentId = record.routeKind === 'unknown' ? null : `deployment-${modelIndex}-${modelIndex < 6 && index % 4 === 0 ? 1 : 0}`;
+    record.path = record.routeKind === 'unknown' ? [] : [{ name: record.route, kind: record.routeKind }];
+    if (record.routeKind === 'router') record.path.push(record.location === 'local' ? { name: record.provider, kind: 'local' } : { name: index % 4 === 0 ? 'llm-gateway-eu' : 'llm-gateway', kind: 'gateway' });
+    if (['router', 'gateway'].includes(record.routeKind) && record.location === 'cloud') record.path.push({ name: `${record.provider} API`, kind: 'direct' });
+    if (record.routeKind === 'gateway' && record.location === 'local') record.path.push({ name: record.provider, kind: 'local' });
+  });
+  const capacityPools = [
+    ...providers.map((name, index) => ({ id: poolId(name), name: `${name.toLowerCase()}-project-01`, kind: 'quota', sourceId: 'sample-capacity', windowSeconds: 60, observedAt: name === 'Cohere' ? null : new Date(now - (name === 'Baseten' ? 180000 : 12000)).toISOString(), resetAt: new Date(now + 28000).toISOString(), metrics: name === 'Cohere' ? {} : { requestsUsed: [842, 318, 126, 427, 193, 256][index % 6], requestsLimit: 1000, tokensUsed: name === 'Anthropic' ? 882000 : 180000 + index * 71000, tokensLimit: 1000000, running: 8 + index * 3, concurrencyLimit: 80 } })),
+    ...['Ollama', 'vLLM', 'LM Studio'].map((name, index) => ({ id: poolId(name), name: `${name} / host unspecified`, kind: 'runtime', sourceId: 'sample-capacity', observedAt: new Date(now - 8000).toISOString(), metrics: { running: [8, 18, 3][index], waiting: [2, 7, 0][index], ...(index < 2 ? { concurrencyLimit: [12, 24][index], cachePercent: [54, 86][index] } : {}), memoryUsedBytes: [33.2, 43.6, 16.8][index] * GiB, memoryTotalBytes: [64, 64, 24][index] * GiB } })),
+    ...GATEWAYS.map((name, index) => ({ id: poolId(name), name, kind: 'gateway', sourceId: 'sample-capacity', observedAt: new Date(now - 11000).toISOString(), metrics: { running: [46, 14, 6][index], concurrencyLimit: [50, 40, 20][index], waiting: [4, 0, 0][index] } })),
+  ];
+  const hostDefinitions = [
+    ['this-machine', 'devbox-01', '', '', 'AMD EPYC · 32 cores', 32, 256, ['RTX 4090', 24, 1], ['LM Studio']],
+    ['gpu-01', 'gpu-01', 'dc-01', 'rack-07', 'AMD EPYC · 64 cores', 64, 256, ['NVIDIA L40S', 48, 2], ['Ollama']],
+    ['gpu-02', 'gpu-02', 'dc-01', 'rack-07', 'AMD EPYC · 96 cores', 96, 512, ['NVIDIA H100', 80, 2], ['vLLM']],
+    ['gpu-03', 'gpu-03', 'dc-01', 'rack-07', 'AMD EPYC · 64 cores', 64, 256, ['NVIDIA L40S', 48, 2], []],
+    ['gpu-04', 'gpu-04', 'dc-02', 'rack-03', 'Intel Xeon · 48 cores', 48, 256, ['NVIDIA A100', 80, 2], []],
+    ['gpu-05', 'gpu-05', 'dc-02', 'rack-03', 'Intel Xeon · 48 cores', 48, 256, ['NVIDIA A100', 80, 2], []],
+  ];
+  const hosts = hostDefinitions.map(([id, name, site, rack, chip, cores, ram, [gpu, vram, count], runtimes], index) => {
+    const observedAt = index === 5 ? null : new Date(now - (index === 4 ? 180000 : 0)).toISOString();
+    const hostHistory = observedAt ? history.map((point, i) => ({ at: new Date(Date.parse(point.at) - (index === 4 ? 180000 : 0)).toISOString(), cpuPercent: Math.max(0, Math.min(100, point.cpuPercent * [.55, 1, 1.2, .12, .4][index] + Math.sin(i / (11 + index)) * 4)), memoryUsed: point.memoryUsed * [.65, 1, 1.6, .15, .8][index] })) : [];
+    const loadedModels = models.filter(model => model.state === 'loaded' && runtimes.includes(model.provider)).map(model => ({ ...model, runtime: model.provider, memoryKind: 'accelerator', deploymentId: deployments.find(deployment => deployment.model === model.name)?.id }));
+    return { id, name, hostname: name, nameField: 'hostname', site, rack, chip, cores, platform: 'linux', arch: 'x64', sourceId: id === 'this-machine' ? 'machine' : 'hardware', observedAt, memoryTotal: ram * GiB, memoryUsed: hostHistory.at(-1)?.memoryUsed ?? null, cpuPercent: hostHistory.at(-1)?.cpuPercent ?? null, history: hostHistory, loadedModels, residencyReported: Boolean(observedAt),
+      accelerators: Array.from({ length: count }, (_, device) => ({ id: `gpu-${device}`, name: gpu, memoryTotal: vram * GiB, memoryUsed: observedAt ? ([17.8, 35.2, 52.6, 1.2, 12][index] / count) * GiB : null, utilization: observedAt ? [32, 68, 84, 0, 21][index] + device : null })) };
+  });
+  for (const deployment of deployments.filter(item => item.location === 'local')) {
+    const host = hosts.find(item => item.loadedModels.some(model => model.name === deployment.model));
+    if (host) { deployment.hostId = host.id; deployment.name = `${host.name} / ${deployment.provider}`; deployment.location = host.id === 'this-machine' ? 'local' : 'private'; }
+  }
+  const privateModels = new Set(deployments.filter(item => item.location === 'private').map(item => `${item.provider}:${item.model}`));
+  for (const model of models) if (privateModels.has(`${model.provider}:${model.name}`)) model.location = 'private';
+  for (const record of records) if (privateModels.has(`${record.provider}:${record.model}`)) record.location = 'private';
+  for (const pool of capacityPools.filter(item => item.kind === 'runtime')) {
+    const host = hosts.find(item => item.loadedModels.some(model => pool.id === poolId(model.provider)));
+    if (host) pool.name = `${pool.name.split(' / ')[0]} / ${host.name}`;
+  }
+  return { schemaVersion: 1, mode: 'sample', observedAt: time, interval: 15, project: { name: 'inference-sample', scope: 'Enterprise sample environment' }, models, deployments, capacityPools, hosts,
+    runtimeStats: [{ name: 'vLLM', sourceId: 'runtime-vllm', hostId: 'gpu-02', running: 18, waiting: 7, inputTokens: 48200000, outputTokens: 9400000, finished: 74620 }],
+    inventory: [
+      ...['Baseten', 'Groq', 'Cerebras'].map(name => ({ name, kind: 'provider', location: 'cloud', state: 'configured', sourceId: 'environment', evidence: [{ field: `${name.toUpperCase()}_API_KEY`, basis: 'credential-name' }] })),
+      ...ROUTERS.map(name => ({ name, kind: 'router', location: name === 'router.private' ? 'local' : 'cloud', state: 'observed' })),
+      ...GATEWAYS.map(name => ({ name, kind: 'gateway', location: 'cloud', state: 'observed', poolIds: [poolId(name)] })),
+      ...['Ollama', 'vLLM', 'LM Studio'].map(name => ({ name, kind: 'runtime', location: name === 'LM Studio' ? 'local' : 'private', state: 'observed' })),
+    ], records,
+    sources: [
+      { id: 'environment', name: 'Service configuration', kind: 'Process environment', state: 'connected', updatedAt: time, detail: 'BASETEN_API_KEY · GROQ_API_KEY · CEREBRAS_API_KEY', note: 'Fictional examples of environment-variable evidence. No credentials were read for this sample. Configuration alone does not establish usage, deployments, or hardware.' },
+      { id: 'hardware', name: 'Hardware export', kind: 'Local file', state: 'partial', updatedAt: time, detail: '.openmerit/hosts.json', note: 'Fictional fleet across two racks and a workstation. gpu-04 has stale readings; gpu-05 has not reported a reading.' },
+      { id: 'sample-capacity', name: 'Capacity export', kind: 'Local file', state: 'partial', updatedAt: time, detail: '.openmerit/capacity.json', note: 'Fictional shared quotas and runtime readings. Baseten is stale; Cohere has no reading. Pool measurements cover all consumers, including work outside this project.' },
+      { id: 'sample-activity', name: 'Inference activity', kind: 'Local file', state: 'connected', updatedAt: time, detail: '.openmerit/inference.jsonl', note: 'Fictional metadata for 40 agent IDs and 140 task IDs. Names represent exported fields, not discovered code. Some display names are absent. Measurements and prices are illustrative.', records: records.length },
+      { id: 'ollama', name: 'Ollama', kind: 'Runtime export', state: 'connected', updatedAt: time, detail: 'gpu-01 / Ollama', note: 'Fictional private-runtime inventory and resident allocations from existing exports.' },
+      { id: 'runtime-studio', name: 'LM Studio', kind: 'Local runtime', state: 'connected', updatedAt: time, detail: '127.0.0.1:1234', note: 'Fictional compatible runtime inventory.' },
+      { id: 'runtime-vllm', name: 'vLLM', kind: 'Runtime export', state: 'connected', updatedAt: time, detail: 'gpu-02 / vLLM', note: 'Fictional runtime and host exports. Remote endpoints are not queried by this terminal.' },
+      { id: 'machine', name: 'This machine', kind: 'Operating system', state: 'connected', updatedAt: time, detail: 'Linux · x64', note: 'Fictional whole-machine CPU and memory samples. These are not attributed to individual requests.' },
+      { id: 'openmerit', name: 'OpenMerit', kind: 'Project evidence', state: 'connected', updatedAt: time, detail: '.openmerit/events.jsonl', note: 'Fictional audit source. The activity export takes precedence; request totals are not added together.', records: 140 },
+      { id: 'inventory', name: 'Declared inventory', kind: 'Project configuration', state: 'connected', updatedAt: time, detail: '.openmerit/terminal.json', note: 'Fictional configuration keys for four routers, three gateways, and three local runtimes. llm-gateway is an example service name, not a built-in gateway.' },
+      { id: 'batch-archive', name: 'Batch archive', kind: 'Local file', state: 'unavailable', updatedAt: null, detail: '.openmerit/archive/inference.jsonl', note: 'Fictional unavailable source. No requests from this archive are included.' },
+    ],
+    machine: hosts[0],
+  };
+}

package/dist/terminal/src/server.mjs

@@ -0,0 +1,56 @@
+import { createServer } from 'node:http';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { createCollector, loadConfig } from './collect.mjs';
+import { sampleSnapshot } from './sample.mjs';
+
+const assets = new Map([['/', ['index.html', 'text/html']], ['/app.js', ['app.js', 'text/javascript']], ['/flow.js', ['flow.js', 'text/javascript']], ['/flow.css', ['flow.css', 'text/css']], ['/styles.css', ['styles.css', 'text/css']], ['/favicon.svg', ['favicon.svg', 'image/svg+xml']]]);
+for (const file of ['baseten.png', 'groq.ico', 'cerebras.png', 'qwen.png', 'meta.ico', 'nomic.png', 'baai.png', 'ollama.png', 'lm-studio.png', 'vllm.png', 'anthropic.png', 'google.png', 'deepseek.ico', 'cohere.png', 'openai.png', 'mistral.png', 'openrouter.png']) assets.set(`/brands/${file}`, [`brands/${file}`, file.endsWith('.svg') ? 'image/svg+xml' : file.endsWith('.ico') ? 'image/x-icon' : 'image/png']);
+
+export async function startTerminal({ root = process.cwd(), port = 4310, interval = 15, demo = false, collect: customCollect, config, fallbackPort = false } = {}) {
+  const collect = customCollect ?? (demo ? async () => sampleSnapshot() : createCollector(root, config ?? await loadConfig(root), interval));
+  let snapshot = await collect();
+  let busy = false;
+  const timer = setInterval(async () => {
+    if (busy) return;
+    busy = true;
+    try { snapshot = await collect(); } catch { /* Keep timestamp: the interface marks stale data. */ }
+    finally { busy = false; }
+  }, interval * 1000);
+  timer.unref();
+  const server = createServer(async (request, response) => {
+    const address = server.address();
+    const validHosts = [`127.0.0.1:${address.port}`, `localhost:${address.port}`];
+    const host = request.headers.host;
+    const headers = { 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff', 'Referrer-Policy': 'no-referrer', 'Content-Security-Policy': "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; font-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'" };
+    const send = (code, body, type = 'application/json') => { response.writeHead(code, { ...headers, 'Content-Type': `${type}; charset=utf-8` }); response.end(body); };
+    if (!validHosts.includes(host) || (request.headers.origin && request.headers.origin !== `http://${host}`) || request.headers['sec-fetch-site'] === 'cross-site') return send(403, '{"error":"Local access only"}');
+    if (request.method !== 'GET') return send(405, '{"error":"Read-only terminal"}');
+    let path;
+    try { path = new URL(request.url, `http://${host}`).pathname; }
+    catch { return send(400, '{"error":"Invalid request URL"}'); }
+    if (path === '/api/snapshot') return send(200, JSON.stringify(snapshot));
+    if (path === '/api/sample') return send(200, JSON.stringify(sampleSnapshot()));
+    if (path === '/api/info') return send(200, JSON.stringify({ version: 1, defaultMode: demo ? 'sample' : 'live', interval }));
+    const asset = assets.get(path);
+    if (!asset) return send(404, '{"error":"Not found"}');
+    try { return send(200, await readFile(fileURLToPath(new URL(`../public/${asset[0]}`, import.meta.url))), asset[1]); }
+    catch { return send(500, '{"error":"Terminal assets unavailable. Run npm run build."}'); }
+  });
+  server.on('close', () => clearInterval(timer));
+  const listen = selectedPort => new Promise((resolve, reject) => {
+    const onError = error => { server.off('listening', onListening); reject(error); };
+    const onListening = () => { server.off('error', onError); resolve(); };
+    server.once('error', onError); server.once('listening', onListening);
+    server.listen(selectedPort, '127.0.0.1');
+  });
+  try {
+    try { await listen(port); }
+    catch (error) {
+      if (!fallbackPort || error.code !== 'EADDRINUSE') throw error;
+      await listen(0);
+    }
+  }
+  catch (error) { clearInterval(timer); throw error; }
+  return { server, url: `http://127.0.0.1:${server.address().port}`, close: () => new Promise(resolve => { clearInterval(timer); server.close(resolve); server.closeIdleConnections(); }) };
+}

package/dist/terminal/src/services.mjs

@@ -0,0 +1,62 @@
+// Configuration evidence only. Never call these services or return credentials,
+// endpoint paths, queries, or user-supplied URLs to the browser.
+const groups = [
+  ['OpenAI', ['OPENAI_API_KEY'], ['OPENAI_BASE_URL', 'OPENAI_API_BASE']],
+  ['Anthropic', ['ANTHROPIC_API_KEY'], ['ANTHROPIC_BASE_URL']],
+  ['OpenRouter', ['OPENROUTER_API_KEY'], []],
+  ['Google', ['GOOGLE_GENERATIVE_AI_API_KEY', 'GEMINI_API_KEY'], []],
+  ['Groq', ['GROQ_API_KEY'], ['GROQ_BASE_URL']],
+  ['Cerebras', ['CEREBRAS_API_KEY'], ['CEREBRAS_BASE_URL']],
+  ['Baseten', ['BASETEN_API_KEY'], ['BASETEN_BASE_URL']],
+];
+const hosts = new Map([
+  ['api.openai.com', 'OpenAI'], ['api.anthropic.com', 'Anthropic'],
+  ['openrouter.ai', 'OpenRouter'], ['api.groq.com', 'Groq'],
+  ['api.cerebras.ai', 'Cerebras'], ['inference.baseten.co', 'Baseten'],
+]);
+export function serviceFromEndpoint(value) {
+  if (typeof value !== 'string' || value.length > 2048) return null;
+  try {
+    const url = new URL(value);
+    if (url.protocol !== 'https:' || url.username || url.password || url.port) return null;
+    return hosts.get(url.hostname) ?? (/^model-[a-z0-9-]+\.api\.baseten\.co$/.test(url.hostname) ? 'Baseten' : null);
+  } catch { return null; }
+}
+export function configuredServices(env = process.env) {
+  const found = new Map(), unrecognizedEndpoints = [];
+  const present = key => typeof env[key] === 'string' && env[key].trim().length > 0;
+  const add = (name, field, basis) => {
+    const item = found.get(name) ?? { name, kind: name === 'OpenRouter' ? 'gateway' : 'provider', location: 'cloud', state: 'configured', sourceId: 'environment', evidence: [] };
+    item.evidence.push({ field, basis, ...(basis === 'endpoint-host' ? { endpointHost: new URL(env[field]).hostname.replace(/^model-[a-z0-9-]+(?=\.api\.baseten\.co$)/, 'model-…') } : {}) }); found.set(name, item);
+  };
+  for (const [name, credentials, endpoints] of groups) {
+    const overrides = endpoints.filter(present);
+    if (overrides.length) {
+      for (const field of overrides) {
+        const service = serviceFromEndpoint(env[field]);
+        if (service) add(service, field, 'endpoint-host');
+        else unrecognizedEndpoints.push(field);
+      }
+      // A custom base URL can repurpose the SDK's credential variable. Its name
+      // alone must not establish the SDK vendor as a configured service.
+    } else for (const field of credentials.filter(present)) add(name, field, 'credential-name');
+  }
+  return { services: [...found.values()], unrecognizedEndpoints };
+}
+
+// Multiple reports for one model/service may disagree. Preserve the gap rather
+// than choosing whichever file or record happened to be processed first.
+export function modelCreators(models, reports) {
+  const evidence = new Map();
+  for (const item of [...models, ...reports]) {
+    if (!item.modelCreator) continue;
+    const key = JSON.stringify([item.provider, item.model ?? item.name]);
+    const entry = evidence.get(key) ?? { names: new Set(), sources: new Set() };
+    entry.names.add(item.modelCreator); if (item.sourceId) entry.sources.add(item.sourceId);
+    evidence.set(key, entry);
+  }
+  return models.map(model => {
+    const entry = evidence.get(JSON.stringify([model.provider, model.name]));
+    return { ...model, modelCreator: entry?.names.size === 1 ? [...entry.names][0] : null, creatorConflict: (entry?.names.size ?? 0) > 1, creatorSources: [...(entry?.sources ?? [])] };
+  });
+}

package/dist/terminal/src/topology.mjs

@@ -0,0 +1,30 @@
+// Bounded metadata contracts. Never retain endpoints, credentials, or payloads.
+const label = value => typeof value === 'string' ? value.slice(0, 160).replace(/[\x00-\x1f]/g, '') : '';
+const count = value => typeof value === 'number' && Number.isFinite(value) && value >= 0 ? value : null;
+const timestamp = value => typeof value === 'string' && Number.isFinite(Date.parse(value)) ? new Date(value).toISOString() : null;
+const list = (value, limit) => Array.isArray(value) ? value.slice(0, limit).filter(item => item && typeof item === 'object') : [];
+export const poolIds = value => Array.isArray(value) ? [...new Set(value.slice(0, 16).map(label).filter(Boolean))] : [];
+export function normalizePath(value) {
+  // Do not turn a broken path into an apparently complete chain by dropping hops.
+  if (!Array.isArray(value) || !value.length || value.length > 8 || value.some(hop => !hop || !label(hop.name))) return [];
+  return value.map(hop => ({ name: label(hop.name), kind: ['direct', 'local', 'router', 'gateway'].includes(hop.kind) ? hop.kind : 'unknown' }));
+}
+function unique(items) {
+  const counts = new Map();
+  for (const item of items) counts.set(item.id, (counts.get(item.id) ?? 0) + 1);
+  return items.filter(item => item.id && counts.get(item.id) === 1);
+}
+export function normalizeDeployments(value) {
+  return unique(list(value, 200).map(item => ({ id: label(item.id), name: label(item.name) || label(item.id), model: label(item.model), modelCreator: label(item.modelCreator) || null, servingMode: ['shared', 'dedicated', 'self-hosted'].includes(item.servingMode) ? item.servingMode : 'unknown', provider: label(item.provider) || 'Unattributed', location: ['local', 'private', 'cloud'].includes(item.location) ? item.location : 'unknown', poolIds: poolIds(item.poolIds), hostId: label(item.hostId) || null, sourceId: 'inventory', state: 'configured' })).filter(item => item.model && !item.id.startsWith('runtime:')));
+}
+export function normalizePools(value) {
+  return unique(list(value, 100).map(item => ({ id: label(item.id), name: label(item.name) || label(item.id), kind: ['quota', 'runtime', 'gateway'].includes(item.kind) ? item.kind : 'unknown', windowSeconds: count(item.windowSeconds), sourceId: 'capacity', observedAt: null, metrics: {} })).filter(item => !item.id.startsWith('runtime:')));
+}
+export function normalizeCapacity(value, now = Date.now()) {
+  return unique(list(value?.pools, 100).map(item => {
+    const observedAt = timestamp(item.observedAt);
+    const metrics = Object.fromEntries(['running', 'waiting', 'concurrencyLimit', 'requestsUsed', 'requestsLimit', 'tokensUsed', 'tokensLimit', 'cachePercent', 'memoryUsedBytes', 'memoryTotalBytes'].map(key => [key, count(item.metrics?.[key])]).filter(([, value]) => value !== null));
+    if (metrics.cachePercent > 100) delete metrics.cachePercent;
+    return { id: label(item.id), observedAt, resetAt: timestamp(item.resetAt), metrics };
+  }).filter(item => item.observedAt && Date.parse(item.observedAt) <= now));
+}