Local API and Report Routes#

Decant exposes two report endpoints — one API route (downloads a file) and one UI route (renders a preview in the React app) for each report type 1. All routes are served by decant serve on http://127.0.0.1:3000 by default 1.

Route Summary#

The UI routes (/reports/*) are mapped to the React bundle 2 and render a light, print-ready preview with Back, Download HTML, and Save as PDF controls. The API routes (/api/reports/*.html) return the same HTML directly as a file attachment 1.

Query Parameters and Validation#

GET /api/reports/analytics.html accepts optional from and to query parameters 3:

• Format: YYYY-MM-DD
• Both are optional; omitting them returns an unfiltered report
• Parsed by dateFilterFromSearch(), which discards any value that doesn't match the ISO date pattern or represents an invalid calendar date
• The resulting DateFilter is applied via sessionDatePredicate(), which compares the first 10 characters of started_at against the bounds using >= / <=

GET /api/reports/session/{id}.html takes a numeric session ID in the URL path 4. The server validates it with isValidSessionId() and returns 400 invalid_session_id for non-integer or negative values 5. A valid but non-existent ID returns 404 6.

Response Format and Headers#

Both API routes return text/html with 7:

• Content-Disposition: attachment; filename="decant-analytics-report.html" (analytics) or decant-session-{id}-{slug}.html (session)
• Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; font-src data:; frame-ancestors 'none'
• Zero external dependencies — no JavaScript, no remote resources; charts are inline SVG

Session report filenames slugify the session title to at most 64 ASCII characters 8.

Report Data Pipeline#

Each report type is assembled then rendered in two distinct steps:

Analytics report 9:

1. assembleAnalyticsReport(db, { filter }) — queries totals, sessions-by-day, by-model, by-project, activity, token economics, and insights; omits insights when a date filter is active 10
2. renderAnalyticsReport(data) — renders static markup via renderToStaticMarkup()

Session report 11:

1. assembleSessionReport(db, id) — queries session summary, reply count, tool calls, context window timeline, token economics, tool stats, and hot files; loads at most 1 message to intentionally omit transcript content 12
2. renderSessionReport(data) — renders static markup

The AnalyticsReportData and SessionReportData interfaces define the full shape passed between assembly and rendering.

Key Source Files#

The full OpenAPI contract is also available at runtime via GET /api/openapi.json 1.