tokentrace 0.19.0 → 0.19.2

package/CHANGELOG.md

@@ -4,6 +4,77 @@ All notable changes to TokenTrace are documented here.
 
 ## Unreleased
 
+## [0.19.2] - 2026-06-05
+
+### Changed
+
+- **MCP tools now run in-process.** The MCP server calls the same library
+  functions as the CLI and HTTP API instead of spawning a `tokentrace` CLI
+  subprocess per tool call, making tool calls faster and immune to nested
+  process-spawn timeouts. Payload shapes are unchanged. `run_scan` invoked over
+  MCP now records its agent action with surface `mcp` instead of `cli`.
+  `get_report` still shells out to the CLI because its report composition has
+  not yet moved into a shared library function.
+- **Stricter compile-time safety.** TypeScript now runs with
+  `noUncheckedIndexedAccess`, `noImplicitOverride`, and
+  `noFallthroughCasesInSwitch`; ~190 unguarded array/record accesses across the
+  app, library, and tests were given explicit guards. ESLint additionally
+  enforces type-aware promise rules (`no-floating-promises`,
+  `no-misused-promises`, `await-thenable`). No behavior change intended.
+- **Type-safe chart and CSV plumbing.** `RankBarChart` is generic over its row
+  type (chart keys are now checked against the data at compile time) and
+  `toCsv` accepts typed rows, removing all eight `as unknown as` casts from the
+  export route and analytics pages.
+
+### Fixed
+
+- **MCP server reports invalid CLI JSON clearly.** If an underlying
+  `tokentrace` CLI call returns unparseable JSON, the MCP server now raises a
+  descriptive error naming the command instead of a bare `JSON.parse` failure.
+- **`DELETE /api/saved-views/:id` validates the id.** A blank or
+  whitespace-only id now returns `400` instead of attempting a delete.
+- **CSV export keeps caller input out of header syntax.** The
+  `content-disposition` filename for `/api/export` now strips characters
+  outside `[a-z0-9-]` from the `type` parameter instead of interpolating it
+  raw into a quoted string.
+- **Settings scan flow no longer renders an error body as a scan result.**
+  A failed scan previously stored the `{error}` response where the last-scan
+  panel expected scan counts, which could crash the panel.
+
+### Internal
+
+- **CLI wrapper is now strict TypeScript.** `src/cli/*` (≈800 lines,
+  previously plain JS invisible to the type checker) is typed and compiled to
+  `dist/cli/main.mjs` by the runtime build; `bin/tokentrace.js` loads the
+  compiled entry and falls back to `tsx` in dev checkouts.
+- **One report engine.** `/api/reports` and `tokentrace report --type` now
+  share `src/lib/report-service.ts`; outputs verified byte-identical against
+  the previous implementations.
+- **API routes are integration-tested.** 14 new test files (59 tests) cover
+  the previously untested HTTP routes — prices, settings, files, export,
+  import-profile-preview, saved-views, saved-reports items, repair-items,
+  evidence-pack, analytics, data, operating-metadata, reports — exercising
+  real handlers against seeded SQLite databases.
+- **Tests-and-coverage CI.** A new `Tests` workflow runs the suite with v8
+  coverage, typecheck, and lint on every PR and push to main.
+- **Frontend decomposition.** The four largest UI files were split into
+  focused modules with rendering verified byte-identical: guide page
+  (658→148 lines), evidence page (590→200), session explorer (549→149),
+  settings panel (341→123, props drilling reduced 49→12 scalars). A shared
+  `useJsonRequest` hook replaces the per-component fetch/pending/error
+  boilerplate across the client components.
+
+## [0.19.1] - 2026-06-04
+
+### Fixed
+
+- **Leaner npm package.** The published tarball no longer includes a set of
+  non-product brand assets (~350 KB of images) that had been parked in the
+  `public/` directory and were unintentionally swept into the package by the
+  `files` allowlist. They are now excluded from the tarball and ignored by git.
+  No functional change — installs are simply smaller and contain only product
+  files.
+
 ## [0.19.0] - 2026-06-04
 
 ### Security

package/app/api/export/route.ts

@@ -9,19 +9,21 @@ export async function GET(request: Request) {
   const type = url.searchParams.get("type") ?? "sessions";
   const analytics = getAnalyticsData();
   const debug = type.startsWith("scan-") ? getDebugData() : null;
-  let rows: Array<Record<string, unknown>>;
 
-  if (type === "scan-files") rows = (debug?.scanFiles ?? []) as Array<Record<string, unknown>>;
-  else if (type === "scan-runs") rows = (debug?.scanRuns ?? []) as Array<Record<string, unknown>>;
-  else if (type === "projects") rows = analytics.projects as unknown as Array<Record<string, unknown>>;
-  else if (type === "models") rows = analytics.models as unknown as Array<Record<string, unknown>>;
-  else if (type === "tools") rows = analytics.tools as unknown as Array<Record<string, unknown>>;
-  else rows = analytics.sessions as unknown as Array<Record<string, unknown>>;
+  let csv: string;
+  if (type === "scan-files") csv = toCsv(debug?.scanFiles ?? []);
+  else if (type === "scan-runs") csv = toCsv(debug?.scanRuns ?? []);
+  else if (type === "projects") csv = toCsv(analytics.projects);
+  else if (type === "models") csv = toCsv(analytics.models);
+  else if (type === "tools") csv = toCsv(analytics.tools);
+  else csv = toCsv(analytics.sessions);
 
-  return new NextResponse(toCsv(rows), {
+  // Keep the caller-supplied type out of header syntax: quoted-string safe.
+  const filenameType = type.replace(/[^a-z0-9-]/gi, "") || "sessions";
+  return new NextResponse(csv, {
     headers: {
       "content-type": "text/csv; charset=utf-8",
-      "content-disposition": `attachment; filename="tokentrace-${type}.csv"`
+      "content-disposition": `attachment; filename="tokentrace-${filenameType}.csv"`
     }
   });
 }

package/app/api/reports/route.ts

@@ -1,69 +1,32 @@
 import { NextResponse } from "next/server";
-import { getAnalyticsData, getScanTrustData } from "@/src/lib/analytics";
-import { buildSourceCatalog, summarizeSourceCoverage } from "@/src/lib/source-catalog";
-import { buildSavedReportDefinitions, renderSavedReport, type SavedReportFormat } from "@/src/lib/saved-reports";
+import { generateReport } from "@/src/lib/report-service";
+import type { SavedReportFormat } from "@/src/lib/saved-reports";
 
 export const dynamic = "force-dynamic";
 
-function reportRows(definitionId: string) {
-  const analytics = getAnalyticsData();
-  const trust = getScanTrustData();
-  const sourceCoverage = summarizeSourceCoverage(trust.scanFiles);
-  if (definitionId === "source-coverage") {
-    return [
-      { label: "Native files", value: sourceCoverage.nativeFiles.toLocaleString(), detail: "First-class adapters" },
-      { label: "Profile-assisted files", value: sourceCoverage.profileAssistedFiles.toLocaleString(), detail: "Import profile or generic parser" },
-      { label: "Fallback files", value: sourceCoverage.fallbackFiles.toLocaleString(), detail: "Low-confidence text or generic fallback" },
-      { label: "Imported records", value: sourceCoverage.importedRecords.toLocaleString(), detail: "Records imported from scan files" }
-    ];
-  }
-  if (definitionId === "guardrail-status") {
-    return [
-      { label: "Cost guardrail", value: analytics.usageGuardrails.cost.status, detail: `${analytics.usageGuardrails.cost.used.toFixed(2)} used` },
-      { label: "Token guardrail", value: analytics.usageGuardrails.tokens.status, detail: `${analytics.usageGuardrails.tokens.used.toLocaleString()} tokens used` },
-      { label: "Scoped guardrails", value: analytics.usageGuardrails.scoped.length.toLocaleString(), detail: "Project/model/tool limits" },
-      { label: "Anomalies", value: analytics.usageGuardrails.anomalies.length.toLocaleString(), detail: "Warning or exceeded scoped guardrails" }
-    ];
-  }
-  return [
-    { label: "Tokens", value: analytics.summary.totalTokens.toLocaleString(), detail: "Selected local data" },
-    { label: "Cost", value: `$${analytics.summary.totalCost.toFixed(2)}`, detail: "Provider estimate or source cost" },
-    { label: "Sessions", value: analytics.summary.sessions.toLocaleString(), detail: "Imported sessions" },
-    { label: "Unknown cost", value: analytics.summary.unknownCostInteractions.toLocaleString(), detail: "Repair queue candidates" },
-    { label: "Source catalog", value: buildSourceCatalog().entries.length.toLocaleString(), detail: "Known import paths" }
-  ];
-}
-
 export async function GET(request: Request) {
   const url = new URL(request.url);
-  const definitions = buildSavedReportDefinitions();
   const definitionId = url.searchParams.get("type") ?? "weekly-usage";
-  const definition = definitions.find((item) => item.id === definitionId);
-  if (!definition) return NextResponse.json({ error: "Unknown report type." }, { status: 400 });
   const format = (url.searchParams.get("format") ?? "json") as SavedReportFormat;
-  if (!definition.formats.includes(format)) {
-    return NextResponse.json({ error: "Unsupported report format." }, { status: 400 });
+  const result = generateReport(definitionId, { format });
+  if (!result.ok) {
+    const error = result.reason === "unknown-type" ? "Unknown report type." : "Unsupported report format.";
+    return NextResponse.json({ error }, { status: 400 });
   }
-  const rendered = renderSavedReport({
-    definitionId,
-    format,
-    generatedAt: new Date().toISOString(),
-    rows: reportRows(definitionId)
-  });
   if (format === "json") {
-    return new NextResponse(rendered, {
+    return new NextResponse(result.content, {
       headers: { "content-type": "application/json; charset=utf-8" }
     });
   }
   if (format === "csv") {
-    return new NextResponse(rendered, {
+    return new NextResponse(result.content, {
       headers: {
         "content-type": "text/csv; charset=utf-8",
         "content-disposition": `attachment; filename="tokentrace-${definitionId}.csv"`
       }
     });
   }
-  return new NextResponse(rendered, {
+  return new NextResponse(result.content, {
     headers: {
       "content-type": "text/markdown; charset=utf-8",
       "content-disposition": `attachment; filename="tokentrace-${definitionId}.md"`

package/app/api/saved-views/[id]/route.ts

@@ -12,5 +12,9 @@ export async function DELETE(
   }
 ) {
   const { id } = await params;
-  return NextResponse.json({ deleted: deleteSavedView(decodeURIComponent(id)) });
+  const viewId = decodeURIComponent(id).trim();
+  if (!viewId) {
+    return NextResponse.json({ error: "view id is required" }, { status: 400 });
+  }
+  return NextResponse.json({ deleted: deleteSavedView(viewId) });
 }

package/app/evidence/evidence-context-panel.tsx

@@ -0,0 +1,40 @@
+import Link from "next/link";
+import { ArrowRight } from "lucide-react";
+import { Card, CardContent } from "@/components/ui/card";
+import { FieldLabel } from "@/components/ui/typography";
+
+export type EvidenceContextAction = {
+  label: string;
+  detail: string;
+  href: string;
+};
+
+export function EvidenceContextPanel({ actions }: { actions: EvidenceContextAction[] }) {
+  return (
+    <Card>
+      <CardContent className="flex flex-col gap-3 p-3 lg:flex-row lg:items-center lg:justify-between">
+        <div className="max-w-[72ch]">
+          <FieldLabel>Evidence path</FieldLabel>
+          <p className="mt-1 text-sm leading-6 text-muted-foreground">
+            Evidence is a contextual drill-down from Overview, Sessions, Repair, and exported packs. If you opened this page directly, start with processed tokens, then pivot by metric or follow the next action that matches what looks incomplete.
+          </p>
+        </div>
+        <div className="grid min-w-0 gap-2 sm:grid-cols-2 xl:grid-cols-4">
+          {actions.map((action) => (
+            <Link
+              key={action.label}
+              href={action.href}
+              className="group rounded-md border bg-card p-3 text-left transition-colors hover:bg-muted/40 focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2"
+            >
+              <span className="flex items-center gap-1.5 text-xs font-semibold text-foreground">
+                {action.label}
+                <ArrowRight className="h-3.5 w-3.5 text-primary transition-transform group-hover:translate-x-0.5" aria-hidden="true" />
+              </span>
+              <span className="mt-1 block text-xs leading-5 text-muted-foreground">{action.detail}</span>
+            </Link>
+          ))}
+        </div>
+      </CardContent>
+    </Card>
+  );
+}

package/app/evidence/evidence-page-data.ts

@@ -0,0 +1,105 @@
+import { dateRangeQueryParams, mergeHrefParams, resolveDateRange } from "@/src/lib/date-range";
+import { buildEvidenceTrail, parseEvidenceMetric } from "@/src/lib/evidence-trail";
+
+export type EvidencePageSearchParams = Promise<Record<string, string | string[] | undefined>> | undefined;
+
+export type EvidenceDrilldownAction = {
+  label: string;
+  detail: string;
+  href: string;
+};
+
+function firstSearchValue(value: string | string[] | undefined) {
+  return Array.isArray(value) ? value[0] : value;
+}
+
+function openedFromLabel(value: string | undefined) {
+  if (value === "overview") return "Overview";
+  if (value === "sessions") return "Sessions";
+  if (value === "repair") return "Repair";
+  if (value === "export") return "Evidence pack";
+  if (value === "settings") return "Settings";
+  return "Direct link";
+}
+
+function safeReturnTo(value: string | string[] | undefined, fallback: string) {
+  const candidate = firstSearchValue(value);
+  if (!candidate || !candidate.startsWith("/") || candidate.startsWith("//")) return fallback;
+  if (candidate.includes("\n") || candidate.includes("\r")) return fallback;
+  return candidate;
+}
+
+export async function getEvidencePageData(searchParams: EvidencePageSearchParams) {
+  const params = (await searchParams) ?? {};
+  const range = resolveDateRange(params);
+  const metric = parseEvidenceMetric(params?.metric);
+  const trail = buildEvidenceTrail({ metric, filters: range.filters });
+  const rangeLinkParams = dateRangeQueryParams(range);
+  const overviewHref = mergeHrefParams("/", rangeLinkParams);
+  const openedFrom = openedFromLabel(firstSearchValue(params.openedFrom));
+  const fallbackReturnHref =
+    openedFrom === "Sessions"
+      ? mergeHrefParams("/sessions", rangeLinkParams)
+      : openedFrom === "Repair"
+        ? mergeHrefParams("/repair", rangeLinkParams)
+        : overviewHref;
+  const returnHref = safeReturnTo(params.returnTo, fallbackReturnHref);
+  const evidenceContextParams = {
+    ...rangeLinkParams,
+    openedFrom: firstSearchValue(params.openedFrom) ?? "direct",
+    returnTo: returnHref
+  };
+  const currentEvidenceHref = mergeHrefParams(`/evidence?metric=${trail.metric}`, evidenceContextParams);
+  const pricingReturnParams = { returnTo: currentEvidenceHref };
+  const periodPreserveParams = {
+    metric: trail.metric,
+    openedFrom: firstSearchValue(params.openedFrom),
+    returnTo: firstSearchValue(params.returnTo)
+  };
+  const sessionsHref = mergeHrefParams("/sessions", rangeLinkParams);
+  const repairHref = mergeHrefParams("/repair", rangeLinkParams);
+  const modelRatesHref = mergeHrefParams("/pricing", pricingReturnParams);
+  const confidenceTotal = Math.max(1, trail.confidence.exact + trail.confidence.estimated + trail.confidence.unknown);
+  const leadingSource = trail.sourceFiles[0];
+  const leadingSession = trail.sessions[0];
+  const drilldownActions: EvidenceDrilldownAction[] = [
+    {
+      label: "Top source files",
+      detail: "Compare the local files contributing most to this metric.",
+      href: "#top-source-files"
+    },
+    {
+      label: "Largest sessions",
+      detail: "Open the session evidence table and continue into filtered sessions.",
+      href: "#session-evidence"
+    },
+    {
+      label: "Parser confidence",
+      detail: "Check whether parser status affects the imported records.",
+      href: leadingSource ? mergeHrefParams(leadingSource.parserHref, rangeLinkParams) : "/parser-debug"
+    },
+    {
+      label: "Set model rate",
+      detail: "Follow provider model rates or unknown-cost repair when cost needs review.",
+      href: leadingSession?.pricingHref
+        ? mergeHrefParams(leadingSession.pricingHref, pricingReturnParams)
+        : mergeHrefParams("/repair", rangeLinkParams)
+    }
+  ];
+
+  return {
+    range,
+    trail,
+    rangeLinkParams,
+    openedFrom,
+    returnHref,
+    evidenceContextParams,
+    pricingReturnParams,
+    periodPreserveParams,
+    sessionsHref,
+    repairHref,
+    modelRatesHref,
+    confidenceTotal,
+    drilldownActions
+  };
+}

package/app/evidence/evidence-summary-cards.tsx

@@ -0,0 +1,74 @@
+import { Badge } from "@/components/ui/badge";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { DataValue, FieldLabel } from "@/components/ui/typography";
+import type { EvidenceTrail } from "@/src/lib/evidence-trail";
+import { formatCurrency, formatExactTokens } from "@/src/lib/format";
+
+export function MetricTotalsCard({ totals }: { totals: EvidenceTrail["totals"] }) {
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Metric Totals</CardTitle>
+        <CardDescription>
+          Totals use the same filtered metric definition as the session evidence below.
+        </CardDescription>
+      </CardHeader>
+      <CardContent className="p-0">
+        <div className="grid divide-y border-t sm:grid-cols-2 sm:divide-x sm:divide-y-0 lg:grid-cols-5">
+          <div className="p-3">
+            <FieldLabel>Tokens</FieldLabel>
+            <DataValue className="mt-1" size="md">{formatExactTokens(totals.tokens)}</DataValue>
+          </div>
+          <div className="p-3">
+            <FieldLabel>Cost</FieldLabel>
+            <DataValue className="mt-1" size="md">{formatCurrency(totals.cost)}</DataValue>
+          </div>
+          <div className="p-3">
+            <FieldLabel>Sessions</FieldLabel>
+            <DataValue className="mt-1" size="md">{totals.sessions.toLocaleString()}</DataValue>
+          </div>
+          <div className="p-3">
+            <FieldLabel>Interactions</FieldLabel>
+            <DataValue className="mt-1" size="md">{totals.interactions.toLocaleString()}</DataValue>
+          </div>
+          <div className="p-3">
+            <FieldLabel>Unknown Cost</FieldLabel>
+            <DataValue className="mt-1" size="md">{totals.unknownCostInteractions.toLocaleString()}</DataValue>
+          </div>
+        </div>
+      </CardContent>
+    </Card>
+  );
+}
+
+export function ConfidenceSplitCard({
+  confidence,
+  confidenceTotal
+}: {
+  confidence: EvidenceTrail["confidence"];
+  confidenceTotal: number;
+}) {
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Confidence Split</CardTitle>
+        <CardDescription>Interaction-level token confidence for this metric and period.</CardDescription>
+      </CardHeader>
+      <CardContent className="space-y-3">
+        {[
+          { label: "Exact", value: confidence.exact, variant: "success" as const },
+          { label: "Estimated", value: confidence.estimated, variant: "secondary" as const },
+          { label: "Unknown", value: confidence.unknown, variant: "warning" as const }
+        ].map((item) => (
+          <div key={item.label} className="grid grid-cols-[5.5rem_minmax(0,1fr)_4rem] items-center gap-3 text-sm">
+            <Badge variant={item.variant}>{item.label}</Badge>
+            <div className="h-2 overflow-hidden rounded-full bg-muted">
+              <div className="h-full rounded-full bg-primary" style={{ width: `${(item.value / confidenceTotal) * 100}%` }} />
+            </div>
+            <div className="text-right tabular-nums text-muted-foreground">{item.value.toLocaleString()}</div>
+          </div>
+        ))}
+      </CardContent>
+    </Card>
+  );
+}

package/app/evidence/evidence-tables.tsx

@@ -0,0 +1,185 @@
+import Link from "next/link";
+import { ArrowRight } from "lucide-react";
+import { Badge } from "@/components/ui/badge";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table";
+import { MonoText } from "@/components/ui/typography";
+import { mergeHrefParams } from "@/src/lib/date-range";
+import type { EvidenceTrail, EvidenceTrailSession } from "@/src/lib/evidence-trail";
+import { formatCurrency, formatExactTokens, percent } from "@/src/lib/format";
+
+function confidenceVariant(value: string) {
+  if (value === "exact") return "success";
+  if (value === "unknown") return "warning";
+  return "secondary";
+}
+
+function parserStatusVariant(value: string | null) {
+  if (value === "imported") return "success";
+  if (value === "imported_with_errors") return "warning";
+  if (!value) return "secondary";
+  return "outline";
+}
+
+export function TopSourceFilesCard({
+  sourceFiles,
+  rangeLinkParams
+}: {
+  sourceFiles: EvidenceTrail["sourceFiles"];
+  rangeLinkParams: Record<string, string | undefined>;
+}) {
+  return (
+    <Card id="top-source-files">
+      <CardHeader>
+        <CardTitle>Top Source Files</CardTitle>
+        <CardDescription>Largest contributing local files for the same metric definition.</CardDescription>
+      </CardHeader>
+      <CardContent className="table-scroll">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Source</TableHead>
+              <TableHead>Tokens</TableHead>
+              <TableHead>Interactions</TableHead>
+              <TableHead>Unknown cost</TableHead>
+              <TableHead>Actions</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {sourceFiles.length ? (
+              sourceFiles.map((source) => (
+                <TableRow key={source.sourceFile}>
+                  <TableCell className="max-w-96">
+                    <Link href={mergeHrefParams(source.sourceHref, rangeLinkParams)} title={source.sourceFile}>
+                      <MonoText className="block truncate text-muted-foreground underline-offset-4 hover:underline">
+                        {source.sourceFile}
+                      </MonoText>
+                    </Link>
+                  </TableCell>
+                  <TableCell>{formatExactTokens(source.tokens)}</TableCell>
+                  <TableCell>{source.interactions.toLocaleString()}</TableCell>
+                  <TableCell>{source.unknownCostInteractions.toLocaleString()}</TableCell>
+                  <TableCell>
+                    <div className="flex flex-wrap gap-2">
+                      <Link href={mergeHrefParams(source.sourceHref, rangeLinkParams)} className="font-medium text-primary underline-offset-4 hover:underline">
+                        Open Sessions
+                      </Link>
+                      <Link href={mergeHrefParams(source.parserHref, rangeLinkParams)} className="font-medium text-muted-foreground underline-offset-4 hover:underline">
+                        Review parser
+                      </Link>
+                    </div>
+                  </TableCell>
+                </TableRow>
+              ))
+            ) : (
+              <TableRow>
+                <TableCell colSpan={5} className="h-20 text-center text-muted-foreground">
+                  No source-file evidence is available for this metric yet.
+                </TableCell>
+              </TableRow>
+            )}
+          </TableBody>
+        </Table>
+      </CardContent>
+    </Card>
+  );
+}
+
+export function SessionEvidenceCard({
+  sessions,
+  rangeLinkParams,
+  pricingReturnParams
+}: {
+  sessions: EvidenceTrailSession[];
+  rangeLinkParams: Record<string, string | undefined>;
+  pricingReturnParams: Record<string, string | undefined>;
+}) {
+  return (
+    <Card id="session-evidence">
+      <CardHeader>
+        <CardTitle>Session, Source, Parser, And Model Rate Evidence</CardTitle>
+        <CardDescription>
+          The table is capped at the top 100 contributing sessions; totals above include the full metric set.
+        </CardDescription>
+      </CardHeader>
+      <CardContent className="table-scroll p-0">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Session</TableHead>
+              <TableHead>Metric Total</TableHead>
+              <TableHead>Cost</TableHead>
+              <TableHead>Source</TableHead>
+              <TableHead>Parser</TableHead>
+              <TableHead>Model rates</TableHead>
+              <TableHead>Confidence</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {sessions.length ? (
+              sessions.map((session) => (
+                <TableRow key={session.id}>
+                  <TableCell className="min-w-64">
+                    <Link href={mergeHrefParams(session.sessionHref, rangeLinkParams)} className="font-medium text-primary underline-offset-4 hover:underline">
+                      {session.title}
+                    </Link>
+                    <div className="mt-1 text-xs text-muted-foreground">
+                      {session.tool} / {session.provider} / {session.project}
+                    </div>
+                  </TableCell>
+                  <TableCell>{formatExactTokens(session.totalTokens)}</TableCell>
+                  <TableCell>{formatCurrency(session.cost)}</TableCell>
+                  <TableCell className="max-w-80">
+                    <Link href={mergeHrefParams(session.sourceHref, rangeLinkParams)} title={session.sourceFile}>
+                      <MonoText className="block truncate text-muted-foreground underline-offset-4 hover:underline">
+                        {session.sourceFile}
+                      </MonoText>
+                    </Link>
+                  </TableCell>
+                  <TableCell className="min-w-44">
+                    <div className="flex flex-wrap items-center gap-2">
+                      <Badge variant={parserStatusVariant(session.parserStatus)}>
+                        {session.parserStatus ?? "not scanned"}
+                      </Badge>
+                      <Link href={mergeHrefParams(session.parserHref, rangeLinkParams)} className="text-xs font-medium text-primary underline-offset-4 hover:underline">
+                        Parser <ArrowRight className="inline h-3.5 w-3.5" />
+                      </Link>
+                    </div>
+                    <div className="mt-1 text-xs text-muted-foreground">
+                      {session.parser ?? "No parser"} / {session.parserConfidence == null ? "confidence unknown" : percent(session.parserConfidence)}
+                    </div>
+                  </TableCell>
+                  <TableCell className="min-w-44">
+                    {session.pricingHref ? (
+                      <Link href={mergeHrefParams(session.pricingHref, pricingReturnParams)} className="font-medium text-primary underline-offset-4 hover:underline">
+                        {session.model}
+                      </Link>
+                    ) : (
+                      <span>{session.model}</span>
+                    )}
+                  </TableCell>
+                  <TableCell>
+                    <div className="flex flex-col items-start gap-1">
+                      <Badge variant={confidenceVariant(session.tokenConfidence)}>
+                        {session.tokenConfidence}
+                      </Badge>
+                      <span className="text-xs text-muted-foreground">
+                        {session.interactions.toLocaleString()} interactions
+                      </span>
+                    </div>
+                  </TableCell>
+                </TableRow>
+              ))
+            ) : (
+              <TableRow>
+                <TableCell colSpan={7} className="h-24 text-center text-muted-foreground">
+                  No evidence is available for this metric yet.
+                </TableCell>
+              </TableRow>
+            )}
+          </TableBody>
+        </Table>
+      </CardContent>
+    </Card>
+  );
+}