@agent-inspect/mcp-server 6.31.10 → 6.31.11

package/dist/index.cjs

@@ -1692,7 +1692,7 @@ function stepMixLine(summary) {
   if (summary.logicSteps > 0) parts.push(`${summary.logicSteps} logic`);
   return parts.length > 0 ? parts.join(", ") : "none";
 }
-function outcomeLine(summary) {
+function executionLine(summary) {
   if (summary.status === "success") {
     return summary.errorSteps > 0 ? "Completed with step errors recorded." : "Completed successfully.";
   }
@@ -1710,7 +1710,7 @@ function outcomeLine(summary) {
   if (summary.status === "running") {
     return "Run is still in progress (no run_completed).";
   }
-  return "Outcome unknown \u2014 inspect events may be incomplete.";
+  return "Execution status unknown \u2014 inspect events may be incomplete.";
 }
 function buildRunWhatSummary(events) {
   const base = buildRunSummary(events);
@@ -1801,7 +1801,7 @@ function renderRunWhat(summary, options = {}) {
       lines.push(`Correlation: ${parts.join(", ")}`);
     }
   }
-  lines.push(`Outcome: ${outcomeLine(summary)}`);
+  lines.push(`Execution: ${executionLine(summary)}`);
   if (summary.longestStep && summary.totalSteps > 0) {
     lines.push(
       `Slowest: ${summary.longestStep.name} (${formatDuration2(summary.longestStep.durationMs)}, ${summary.longestStep.type})`
@@ -1955,6 +1955,369 @@ function findFirstCausalFailure(events, options = {}) {
   );
 }
 
+// packages/core/src/diagnostics/programmatic.ts
+var PROGRAMMATIC_DIAGNOSTIC_SPECS = Object.freeze({
+  AI_TRACE_INPUT_INVALID: {
+    code: "AI_TRACE_INPUT_INVALID",
+    summary: 'Expected { type: "file", path }, { type: "directory", path }, { type: "string", content }, { type: "buffer", content }, or { type: "stdin" }.',
+    remediation: "For a file path, use openTraceFile(path).",
+    relatedCodes: ["invalid_input"]
+  },
+  AI_TRACE_FORMAT_UNSUPPORTED: {
+    code: "AI_TRACE_FORMAT_UNSUPPORTED",
+    summary: "No trace reader could detect the input format.",
+    remediation: "Pass an AgentInspect JSONL file via openTraceFile, or set options.format to a registered reader.",
+    relatedCodes: ["unsupported_format"]
+  },
+  AI_TRACE_FORMAT_AMBIGUOUS: {
+    code: "AI_TRACE_FORMAT_AMBIGUOUS",
+    summary: "Multiple trace readers matched the input with equal confidence.",
+    remediation: "Set options.format explicitly to disambiguate the reader.",
+    relatedCodes: ["ambiguous_format"]
+  },
+  AI_TRACE_FACTS_INPUT_NOT_NORMALIZED: {
+    code: "AI_TRACE_FACTS_INPUT_NOT_NORMALIZED",
+    summary: "TraceFacts requires TraceReadResult or PersistedInspectEvent[].",
+    remediation: "Use openTraceFile() to normalize a JSONL trace first."
+  },
+  AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED: {
+    code: "AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED",
+    summary: "Multiple runs are available; select a run before executing checks.",
+    remediation: "Pass options.runId or TraceCheckInput.selectedRun.",
+    relatedCodes: ["AI_CHECK_RUN_SELECTION_REQUIRED"]
+  },
+  AI_TRACE_RELATIONSHIP_SELF_PARENT: {
+    code: "AI_TRACE_RELATIONSHIP_SELF_PARENT",
+    summary: "A parentId equals its own event/step id.",
+    remediation: "Reject at capture (AI_LANGGRAPH_SELF_PARENT_REJECTED) or drop via logical projection; do not invent replacement parents.",
+    relatedCodes: [
+      "AI_LANGGRAPH_SELF_PARENT_REJECTED",
+      "AI_LOGICAL_SELF_PARENT_REMOVED"
+    ]
+  },
+  AI_TRACE_RELATIONSHIP_CYCLE: {
+    code: "AI_TRACE_RELATIONSHIP_CYCLE",
+    summary: "Trace contains a parentId cycle.",
+    remediation: "Use visibility-first tree linking for legacy fixtures; prefer acyclic capture for new adapter output.",
+    relatedCodes: ["structure.cycle"]
+  },
+  AI_TRACE_CONTRACT_INPUT_INVALID: {
+    code: "AI_TRACE_CONTRACT_INPUT_INVALID",
+    summary: "evaluateTraceContract expects ({ read }, contract) or use evaluateTraceContractRead(read, contract).",
+    remediation: "Pass TraceCheckInput as the first argument: evaluateTraceContract({ read }, contract).",
+    relatedCodes: ["AI_CHECK_INVALID_ARGUMENTS"]
+  },
+  AI_INSPECT_RUN_UNSUPPORTED_OPTION: {
+    code: "AI_INSPECT_RUN_UNSUPPORTED_OPTION",
+    summary: 'inspectRun does not accept a "writer" option.',
+    remediation: "Use createInspector({ writer }) then inspector.run(...). inspectRun persists via the global JSONL path (schema 0.1)."
+  }
+});
+function formatProgrammaticDiagnostic(code, detail) {
+  const spec = PROGRAMMATIC_DIAGNOSTIC_SPECS[code];
+  const summary = detail?.trim() ? detail.trim() : spec.summary;
+  return `${code}: ${summary} Remediation: ${spec.remediation}`;
+}
+
+// packages/core/src/checks/logical-events.ts
+function isRecord6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function legacyEvent(event) {
+  const value = event.attributes?.legacyEvent;
+  return typeof value === "string" ? value : void 0;
+}
+function stepIdOf(event) {
+  const value = event.attributes?.stepId;
+  if (typeof value === "string" && value.trim() !== "") return value;
+  return void 0;
+}
+function cloneEvent(event) {
+  return {
+    ...event,
+    ...event.attributes !== void 0 ? { attributes: { ...event.attributes } } : {},
+    ...event.error !== void 0 ? { error: { ...event.error } } : {},
+    ...event.tokenUsage !== void 0 ? { tokenUsage: { ...event.tokenUsage } } : {},
+    ...event.source !== void 0 ? { source: { ...event.source } } : {}
+  };
+}
+function mergeAttributes(start, complete) {
+  const merged = {
+    ...isRecord6(complete.attributes) ? complete.attributes : {},
+    ...isRecord6(start.attributes) ? start.attributes : {}
+  };
+  merged.legacyEvent = start.attributes?.legacyEvent ?? complete.attributes?.legacyEvent;
+  merged.legacyCompleteEvent = complete.attributes?.legacyEvent;
+  if (complete.attributes?.errorStack !== void 0) {
+    merged.errorStack = complete.attributes.errorStack;
+  }
+  return Object.keys(merged).length > 0 ? merged : void 0;
+}
+function pairStartComplete(start, complete) {
+  const attributes = mergeAttributes(start, complete);
+  const paired = {
+    ...cloneEvent(start),
+    status: complete.status,
+    timestamp: complete.timestamp ?? start.timestamp,
+    ...complete.endedAt !== void 0 ? { endedAt: complete.endedAt } : {},
+    ...complete.durationMs !== void 0 ? { durationMs: complete.durationMs } : {},
+    ...complete.error !== void 0 ? { error: { ...complete.error } } : {},
+    ...complete.tokenUsage !== void 0 && start.tokenUsage === void 0 ? { tokenUsage: { ...complete.tokenUsage } } : {},
+    ...attributes !== void 0 ? { attributes } : {}
+  };
+  return {
+    ...paired,
+    sourceEventIds: Object.freeze([start.eventId, complete.eventId]),
+    projection: {
+      paired: true,
+      absorbedEventIds: Object.freeze([complete.eventId]),
+      parentNormalized: false,
+      ...start.parentId !== void 0 ? { originalParentId: start.parentId } : {}
+    }
+  };
+}
+function asLogical(event, extras) {
+  return {
+    ...cloneEvent(event),
+    sourceEventIds: Object.freeze([event.eventId]),
+    projection: {
+      paired: false,
+      absorbedEventIds: Object.freeze([]),
+      parentNormalized: extras?.parentNormalized === true,
+      ...{}
+    }
+  };
+}
+function projectLogicalEvents(events) {
+  const diagnostics = [];
+  const byRun = /* @__PURE__ */ new Map();
+  for (const event of events) {
+    const list = byRun.get(event.runId) ?? [];
+    list.push(event);
+    byRun.set(event.runId, list);
+  }
+  const absorbedIds = /* @__PURE__ */ new Set();
+  const logicalByRawId = /* @__PURE__ */ new Map();
+  const stepIdToLogicalId = /* @__PURE__ */ new Map();
+  const logical = [];
+  const orderedRuns = [...byRun.keys()].sort((a, b) => a.localeCompare(b));
+  for (const runId of orderedRuns) {
+    const runEvents = byRun.get(runId) ?? [];
+    const starts = [];
+    const completes = [];
+    const others = [];
+    for (const event of runEvents) {
+      const legacy = legacyEvent(event);
+      if (legacy === "step_started" || legacy === "run_started" && event.status === "running") {
+        starts.push(event);
+      } else if (legacy === "step_completed" || legacy === "run_completed") {
+        completes.push(event);
+      } else {
+        others.push(event);
+      }
+    }
+    const usedCompletes = /* @__PURE__ */ new Set();
+    for (const start of starts) {
+      const stepId = stepIdOf(start);
+      let match;
+      if (legacyEvent(start) === "run_started") {
+        const candidates = completes.filter(
+          (c) => !usedCompletes.has(c.eventId) && legacyEvent(c) === "run_completed"
+        );
+        if (candidates.length > 1) {
+          diagnostics.push({
+            code: "AI_LOGICAL_PAIR_AMBIGUOUS",
+            message: `Multiple run_completed rows for run ${runId}; using first by eventId.`,
+            eventIds: candidates.map((c) => c.eventId)
+          });
+          candidates.sort((a, b) => a.eventId.localeCompare(b.eventId));
+        }
+        match = candidates[0];
+      } else if (stepId) {
+        const candidates = completes.filter(
+          (c) => !usedCompletes.has(c.eventId) && legacyEvent(c) === "step_completed" && stepIdOf(c) === stepId
+        );
+        if (candidates.length > 1) {
+          diagnostics.push({
+            code: "AI_LOGICAL_PAIR_AMBIGUOUS",
+            message: `Multiple step_completed rows for stepId ${stepId}; using first by eventId.`,
+            eventIds: candidates.map((c) => c.eventId)
+          });
+          candidates.sort((a, b) => a.eventId.localeCompare(b.eventId));
+        }
+        match = candidates[0];
+      }
+      if (match) {
+        usedCompletes.add(match.eventId);
+        absorbedIds.add(match.eventId);
+        const paired = pairStartComplete(start, match);
+        logical.push(paired);
+        logicalByRawId.set(start.eventId, paired);
+        logicalByRawId.set(match.eventId, paired);
+        if (stepId) stepIdToLogicalId.set(`${runId}:${stepId}`, paired.eventId);
+      } else {
+        diagnostics.push({
+          code: "AI_LOGICAL_PAIR_UNMATCHED_START",
+          message: `No matching complete for start ${start.eventId}.`,
+          eventIds: [start.eventId]
+        });
+        const alone = asLogical(start);
+        logical.push(alone);
+        logicalByRawId.set(start.eventId, alone);
+        if (stepId) stepIdToLogicalId.set(`${runId}:${stepId}`, alone.eventId);
+      }
+    }
+    for (const complete of completes) {
+      if (usedCompletes.has(complete.eventId)) continue;
+      diagnostics.push({
+        code: "AI_LOGICAL_PAIR_UNMATCHED_COMPLETE",
+        message: `No matching start for complete ${complete.eventId}.`,
+        eventIds: [complete.eventId]
+      });
+      const alone = asLogical(complete);
+      logical.push(alone);
+      logicalByRawId.set(complete.eventId, alone);
+      const stepId = stepIdOf(complete);
+      if (stepId && !stepIdToLogicalId.has(`${runId}:${stepId}`)) {
+        stepIdToLogicalId.set(`${runId}:${stepId}`, alone.eventId);
+      }
+    }
+    for (const event of others) {
+      const alone = asLogical(event);
+      logical.push(alone);
+      logicalByRawId.set(event.eventId, alone);
+      const stepId = stepIdOf(event);
+      if (stepId && !stepIdToLogicalId.has(`${runId}:${stepId}`)) {
+        stepIdToLogicalId.set(`${runId}:${stepId}`, alone.eventId);
+      }
+    }
+  }
+  const logicalById = new Map(logical.map((e) => [e.eventId, e]));
+  const normalized = [];
+  for (const event of logical) {
+    const originalParentId = event.parentId;
+    if (!originalParentId) {
+      normalized.push(event);
+      continue;
+    }
+    let nextParent = originalParentId;
+    let remapped = false;
+    const viaAbsorbed = logicalByRawId.get(originalParentId);
+    if (viaAbsorbed && viaAbsorbed.eventId !== originalParentId) {
+      nextParent = viaAbsorbed.eventId;
+      remapped = true;
+    } else if (!logicalById.has(originalParentId)) {
+      const viaStep = stepIdToLogicalId.get(`${event.runId}:${originalParentId}`);
+      if (viaStep) {
+        nextParent = viaStep;
+        remapped = true;
+      }
+    }
+    if (!remapped) {
+      if (originalParentId === event.eventId) {
+        diagnostics.push({
+          code: "AI_LOGICAL_SELF_PARENT_REMOVED",
+          message: formatProgrammaticDiagnostic(
+            "AI_TRACE_RELATIONSHIP_SELF_PARENT",
+            `Removed self-parent edge on ${event.eventId}.`
+          ),
+          eventIds: [event.eventId]
+        });
+        const { parentId: _drop, ...rest } = event;
+        normalized.push({
+          ...rest,
+          projection: {
+            ...event.projection,
+            parentNormalized: true,
+            originalParentId
+          }
+        });
+        continue;
+      }
+      if (!logicalById.has(originalParentId) && !logicalByRawId.has(originalParentId)) {
+        const mapping = event.attributes?.parentMapping;
+        const unresolved = mapping === "unresolved" || event.attributes?.parentUnresolved === true || event.attributes?.unresolvedParent === true || // LangGraph/framework scaffolding sentinel labels are not event ids.
+        /^LangGraph$/i.test(originalParentId) || originalParentId.startsWith("unresolved:");
+        if (!unresolved) {
+          diagnostics.push({
+            code: "AI_LOGICAL_PARENT_UNRESOLVED",
+            message: `Parent ${originalParentId} unresolved for ${event.eventId}.`,
+            eventIds: [event.eventId]
+          });
+        }
+      }
+      normalized.push(event);
+      continue;
+    }
+    if (nextParent === event.eventId) {
+      diagnostics.push({
+        code: "AI_LOGICAL_SELF_PARENT_REMOVED",
+        message: formatProgrammaticDiagnostic(
+          "AI_TRACE_RELATIONSHIP_SELF_PARENT",
+          `Removed self-parent edge on ${event.eventId} (was ${originalParentId}).`
+        ),
+        eventIds: [event.eventId]
+      });
+      const { parentId: _drop, ...rest } = event;
+      normalized.push({
+        ...rest,
+        projection: {
+          ...event.projection,
+          parentNormalized: true,
+          originalParentId
+        }
+      });
+      continue;
+    }
+    diagnostics.push({
+      code: "AI_LOGICAL_PARENT_REMAPPED",
+      message: `Remapped parent ${originalParentId} \u2192 ${nextParent} for ${event.eventId}.`,
+      eventIds: [event.eventId]
+    });
+    normalized.push({
+      ...event,
+      parentId: nextParent,
+      projection: {
+        ...event.projection,
+        parentNormalized: true,
+        originalParentId
+      }
+    });
+  }
+  const rawIndex = new Map(events.map((e, i) => [e.eventId, i]));
+  normalized.sort((a, b) => {
+    const ai = rawIndex.get(a.sourceEventIds[0]) ?? 0;
+    const bi = rawIndex.get(b.sourceEventIds[0]) ?? 0;
+    return ai - bi || a.eventId.localeCompare(b.eventId);
+  });
+  return {
+    logicalEvents: Object.freeze(normalized),
+    diagnostics: Object.freeze(diagnostics)
+  };
+}
+function resolveCanonicalToolName(event) {
+  const attrs2 = event.attributes;
+  const direct = pickString(attrs2, ["toolName", "tool"]);
+  if (direct) return direct;
+  const metadata = attrs2?.metadata;
+  if (isRecord6(metadata)) {
+    const nested = pickString(metadata, ["toolName", "tool"]);
+    if (nested) return nested;
+  }
+  for (const prefix of ["tool:", "function:", "mcp-tools:"]) {
+    if (event.name.startsWith(prefix)) return event.name.slice(prefix.length);
+  }
+  return event.name;
+}
+function pickString(record, keys) {
+  if (!record) return void 0;
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "string" && value.trim() !== "") return value.trim();
+  }
+  return void 0;
+}
+
 // packages/core/src/search.ts
 function parseDurationFilter(expr) {
   const raw = expr.trim();
@@ -2065,708 +2428,346 @@ async function searchTraces(metas, options) {
           stepName: outcome.name,
           timestamp: outcome.observedAt,
           matchReason: `observation status=${outcome.status}`,
-          matchedFields: ["outcome.status", "outcome.name"],
-          filePath: m.filePath
-        });
-      }
-    }
-  }
-  results.sort((a, b) => {
-    const ta = a.timestamp ?? 0;
-    const tb = b.timestamp ?? 0;
-    if (ta !== tb) return tb - ta;
-    const runCmp = a.runId.localeCompare(b.runId);
-    if (runCmp !== 0) return runCmp;
-    return (a.stepName ?? "").localeCompare(b.stepName ?? "");
-  });
-  return results.slice(0, limit);
-}
-function matchRunLevel(m, opts) {
-  if (opts.stepTypeFilter || opts.toolQuery) return [];
-  if (opts.statusFilter && m.status !== opts.statusFilter) return [];
-  if (opts.nameQuery && !nameMatches(m.name ?? m.runId, opts.nameQuery)) {
-    return [];
-  }
-  if (opts.durationFilter && !durationMatches(m.durationMs, opts.durationFilter)) {
-    return [];
-  }
-  const fields = [];
-  if (opts.statusFilter) fields.push("run.status");
-  if (opts.nameQuery) fields.push("run.name");
-  if (opts.durationFilter) fields.push("run.durationMs");
-  if (fields.length === 0) return [];
-  return [
-    {
-      runId: m.runId,
-      runName: m.name,
-      runStatus: m.status,
-      timestamp: m.startedAt,
-      durationMs: m.durationMs,
-      matchReason: `run match: ${fields.join(", ")}`,
-      matchedFields: fields,
-      filePath: m.filePath
-    }
-  ];
-}
-function matchStepLevel(m, events, opts) {
-  const out = [];
-  const started = /* @__PURE__ */ new Map();
-  for (const e of events) {
-    if (e.event === "step_started") {
-      started.set(e.stepId, e);
-    }
-  }
-  for (const e of events) {
-    if (e.event !== "step_completed") continue;
-    const c = e;
-    const s = started.get(c.stepId);
-    if (!s) continue;
-    const fields = [];
-    const stepType = s.type;
-    if (opts.stepTypeFilter && stepType !== opts.stepTypeFilter) {
-      continue;
-    }
-    const hasStepFilters = opts.stepTypeFilter || opts.nameQuery || opts.toolQuery || opts.durationFilter || opts.statusFilter === "error" || opts.statusFilter === "success";
-    if (!hasStepFilters) continue;
-    if (opts.statusFilter === "error" && c.status === "error") {
-      fields.push("step.status");
-    } else if (opts.statusFilter === "success" && c.status === "success") {
-      fields.push("step.status");
-    } else if (opts.statusFilter === "error" || opts.statusFilter === "success") {
-      continue;
-    }
-    if (opts.nameQuery) {
-      if (!nameMatches(s.name, opts.nameQuery)) continue;
-      fields.push("step.name");
-    }
-    if (opts.toolQuery) {
-      const toolName = typeof s.metadata?.toolName === "string" ? s.metadata.toolName : s.name;
-      if (!nameMatches(toolName, opts.toolQuery)) continue;
-      fields.push("step.tool");
-    }
-    if (opts.durationFilter) {
-      if (!durationMatches(c.durationMs, opts.durationFilter)) continue;
-      fields.push("step.durationMs");
-    }
-    if (opts.stepTypeFilter) {
-      fields.push("step.type");
-    }
-    if (fields.length === 0) continue;
-    out.push({
-      runId: m.runId,
-      runName: m.name,
-      runStatus: m.status,
-      stepId: c.stepId,
-      stepName: s.name,
-      stepType,
-      timestamp: s.startTime ?? s.timestamp,
-      durationMs: c.durationMs,
-      matchReason: `step match: ${fields.join(", ")}`,
-      matchedFields: fields,
-      filePath: m.filePath
-    });
-  }
-  return out;
-}
-async function loadTraceMetadataList(_traceDir, fileNames, getPath) {
-  const metas = [];
-  for (const fileName of fileNames) {
-    try {
-      const filePath = getPath(fileName);
-      const meta = await extractMetadata(filePath);
-      metas.push(meta);
-    } catch {
-    }
-  }
-  return metas;
-}
-
-// packages/core/src/sessions/metadata.ts
-function isNonEmptyString3(value) {
-  return typeof value === "string" && value.trim() !== "";
-}
-function finitePositiveInt(value) {
-  if (typeof value !== "number" || !Number.isFinite(value) || value < 1) {
-    return void 0;
-  }
-  return Math.trunc(value);
-}
-function extractSessionWorkflowMetadata(record) {
-  if (!record) return void 0;
-  const out = {};
-  let found = false;
-  const assignString = (key, value) => {
-    if (isNonEmptyString3(value)) {
-      out[key] = value.trim();
-      found = true;
-    }
-  };
-  assignString("sessionId", record.sessionId);
-  assignString("conversationId", record.conversationId);
-  assignString("groupId", record.groupId);
-  assignString("parentGroupId", record.parentGroupId);
-  assignString("retryOf", record.retryOf);
-  assignString("retryReason", record.retryReason);
-  assignString("handoffFrom", record.handoffFrom);
-  assignString("handoffTo", record.handoffTo);
-  assignString("subAgentId", record.subAgentId);
-  assignString("subAgentName", record.subAgentName);
-  assignString("jobId", record.jobId);
-  assignString("queueName", record.queueName);
-  assignString("workflowName", record.workflowName);
-  assignString("workflowStep", record.workflowStep);
-  assignString("toolCallId", record.toolCallId);
-  assignString("mcpToolCallId", record.mcpToolCallId);
-  assignString("linkedStepId", record.linkedStepId);
-  assignString("operationId", record.operationId);
-  assignString("attemptId", record.attemptId);
-  assignString("fallbackOf", record.fallbackOf);
-  assignString("idempotencyKey", record.idempotencyKey);
-  assignString("correlationId", record.correlationId);
-  assignString("requestId", record.requestId);
-  assignString("decisionId", record.decisionId);
-  const attempt = finitePositiveInt(record.attempt);
-  if (attempt !== void 0) {
-    out.attempt = attempt;
-    found = true;
-  }
-  const attemptNumber = finitePositiveInt(record.attemptNumber);
-  if (attemptNumber !== void 0) {
-    out.attemptNumber = attemptNumber;
-    found = true;
-  }
-  return found ? out : void 0;
-}
-
-// packages/core/src/bundle/safety-status.ts
-function aggregateBundleSafeStatus(statuses) {
-  if (statuses.length === 0) return "UNKNOWN";
-  if (statuses.some((status) => status === "UNSAFE")) return "UNSAFE";
-  if (statuses.some((status) => status === "UNKNOWN")) return "UNKNOWN";
-  if (statuses.some((status) => status === "SAFE WITH WARNINGS")) return "SAFE WITH WARNINGS";
-  return "SAFE";
-}
-function toMetadataSafeStatus(status) {
-  if (status === "SAFE WITH WARNINGS") return "SAFE_WITH_WARNINGS";
-  return status;
-}
-function bundleFailsOnSafety(status, allowUnsafe) {
-  return status === "UNSAFE" || status === "UNKNOWN";
-}
-
-// packages/core/src/bundle/manifest.ts
-var BUNDLE_NOTE = "Generated locally by AgentInspect. Bundles are derived copies for review \u2014 not compliance or security certification. Review before sharing.";
-function buildBundleMetadata(parts) {
-  const aggregate = aggregateBundleSafeStatus(
-    parts.checks.runs.map((run) => run.status)
-  );
-  return {
-    createdAt: parts.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-    agentInspectVersion: parts.agentInspectVersion,
-    redactionProfile: parts.profile,
-    sourceTraceCount: parts.resolve.runIds.length,
-    runIds: [...parts.resolve.runIds],
-    safeStatus: toMetadataSafeStatus(aggregate),
-    files: [...parts.files].sort((a, b) => a.localeCompare(b)),
-    note: BUNDLE_NOTE,
-    ...parts.resolve.sessionId !== void 0 ? { sessionId: parts.resolve.sessionId } : {},
-    ...parts.resolve.since !== void 0 ? { since: parts.resolve.since } : {}
-  };
-}
-
-// packages/core/src/evidence/types.ts
-var EVIDENCE_FORMAT_VERSION = "1.0";
-var EVIDENCE_ASSESSMENT_NOTE = "Best-effort local safety verification only; not a compliance certification.";
-var EVIDENCE_MANIFEST_FILENAME = "evidence.json";
-function sha256Hex(data) {
-  const hash = crypto.createHash("sha256");
-  if (typeof data === "string") {
-    hash.update(data, "utf8");
-  } else {
-    hash.update(data);
+          matchedFields: ["outcome.status", "outcome.name"],
+          filePath: m.filePath
+        });
+      }
+    }
   }
-  return hash.digest("hex");
+  results.sort((a, b) => {
+    const ta = a.timestamp ?? 0;
+    const tb = b.timestamp ?? 0;
+    if (ta !== tb) return tb - ta;
+    const runCmp = a.runId.localeCompare(b.runId);
+    if (runCmp !== 0) return runCmp;
+    return (a.stepName ?? "").localeCompare(b.stepName ?? "");
+  });
+  return results.slice(0, limit);
 }
-function assertEvidenceRelativePath(relativePath) {
-  if (typeof relativePath !== "string" || relativePath.trim() === "") {
-    throw new Error("Evidence file path must be a non-empty relative path.");
-  }
-  const trimmed = relativePath.trim().replaceAll("\\", "/");
-  if (path14__default.default.isAbsolute(trimmed) || trimmed.startsWith("/")) {
-    throw new Error(`Evidence file path must be relative: ${relativePath}`);
+function matchRunLevel(m, opts) {
+  if (opts.stepTypeFilter || opts.toolQuery) return [];
+  if (opts.statusFilter && m.status !== opts.statusFilter) return [];
+  if (opts.nameQuery && !nameMatches(m.name ?? m.runId, opts.nameQuery)) {
+    return [];
   }
-  const parts = trimmed.split("/").filter((part) => part !== "");
-  if (parts.length === 0) {
-    throw new Error(`Evidence file path must be relative: ${relativePath}`);
+  if (opts.durationFilter && !durationMatches(m.durationMs, opts.durationFilter)) {
+    return [];
   }
-  for (const part of parts) {
-    if (part === "." || part === "..") {
-      throw new Error(`Evidence file path must not contain "." or "..": ${relativePath}`);
+  const fields = [];
+  if (opts.statusFilter) fields.push("run.status");
+  if (opts.nameQuery) fields.push("run.name");
+  if (opts.durationFilter) fields.push("run.durationMs");
+  if (fields.length === 0) return [];
+  return [
+    {
+      runId: m.runId,
+      runName: m.name,
+      runStatus: m.status,
+      timestamp: m.startedAt,
+      durationMs: m.durationMs,
+      matchReason: `run match: ${fields.join(", ")}`,
+      matchedFields: fields,
+      filePath: m.filePath
     }
-  }
-  return parts.join("/");
-}
-
-// packages/core/src/evidence/manifest.ts
-function stable(value) {
-  if (Array.isArray(value)) return value.map(stable);
-  if (value === null || typeof value !== "object") return value;
-  const record = value;
-  return Object.fromEntries(
-    Object.keys(record).sort((a, b) => a.localeCompare(b)).map((key) => [key, stable(record[key])])
-  );
-}
-function serializeEvidenceManifest(manifest) {
-  return `${JSON.stringify(stable(manifest), null, 2)}
-`;
+  ];
 }
-function inferEvidenceFileRole(relativePath) {
-  const normalized = assertEvidenceRelativePath(relativePath);
-  const base = normalized.includes("/") ? normalized.slice(normalized.lastIndexOf("/") + 1) : normalized;
-  if (base === "evidence.html" || base === "trace.html" || base.endsWith(".html")) {
-    return "report";
-  }
-  if (base === "trace.jsonl" || base.endsWith(".jsonl")) {
-    return "redacted-trace";
-  }
-  if (base === "check-results.json") {
-    return "checks";
-  }
-  if (base === "contract.resolved.json") {
-    return "contract";
-  }
-  if (base === "redaction-report.json") {
-    return "redaction-report";
-  }
-  if (base === "summary.md") {
-    return "summary";
+function matchStepLevel(m, events, opts) {
+  const out = [];
+  const started = /* @__PURE__ */ new Map();
+  for (const e of events) {
+    if (e.event === "step_started") {
+      started.set(e.stepId, e);
+    }
   }
-  return "other";
-}
-function buildEvidenceFileEntries(files) {
-  const byPath = /* @__PURE__ */ new Map();
-  for (const file of files) {
-    const relativePath = assertEvidenceRelativePath(file.path);
-    if (relativePath === EVIDENCE_MANIFEST_FILENAME) {
-      throw new Error(
-        `Do not include ${EVIDENCE_MANIFEST_FILENAME} in packaged file hashes (self-hash is undefined).`
-      );
+  for (const e of events) {
+    if (e.event !== "step_completed") continue;
+    const c = e;
+    const s = started.get(c.stepId);
+    if (!s) continue;
+    const fields = [];
+    const stepType = s.type;
+    if (opts.stepTypeFilter && stepType !== opts.stepTypeFilter) {
+      continue;
     }
-    if (byPath.has(relativePath)) {
-      throw new Error(`Duplicate evidence file path: ${relativePath}`);
+    const hasStepFilters = opts.stepTypeFilter || opts.nameQuery || opts.toolQuery || opts.durationFilter || opts.statusFilter === "error" || opts.statusFilter === "success";
+    if (!hasStepFilters) continue;
+    if (opts.statusFilter === "error" && c.status === "error") {
+      fields.push("step.status");
+    } else if (opts.statusFilter === "success" && c.status === "success") {
+      fields.push("step.status");
+    } else if (opts.statusFilter === "error" || opts.statusFilter === "success") {
+      continue;
     }
-    byPath.set(relativePath, {
-      path: relativePath,
-      sha256: sha256Hex(file.content),
-      role: file.role ?? inferEvidenceFileRole(relativePath)
-    });
-  }
-  return [...byPath.values()].sort((a, b) => a.path.localeCompare(b.path));
-}
-function buildEvidenceManifest(parts) {
-  const runIds = [...parts.runIds];
-  if (runIds.length === 0) {
-    throw new Error("Evidence manifest requires at least one run id.");
-  }
-  for (const item of parts.sourceHashes) {
-    if (!runIds.includes(item.runId)) {
-      throw new Error(`sourceHashes runId "${item.runId}" is not listed in source.runIds.`);
+    if (opts.nameQuery) {
+      if (!nameMatches(s.name, opts.nameQuery)) continue;
+      fields.push("step.name");
     }
-    if (item.algorithm !== "sha256") {
-      throw new Error(`Unsupported source hash algorithm: ${item.algorithm}`);
+    if (opts.toolQuery) {
+      const toolName = typeof s.metadata?.toolName === "string" ? s.metadata.toolName : s.name;
+      if (!nameMatches(toolName, opts.toolQuery)) continue;
+      fields.push("step.tool");
     }
+    if (opts.durationFilter) {
+      if (!durationMatches(c.durationMs, opts.durationFilter)) continue;
+      fields.push("step.durationMs");
+    }
+    if (opts.stepTypeFilter) {
+      fields.push("step.type");
+    }
+    if (fields.length === 0) continue;
+    out.push({
+      runId: m.runId,
+      runName: m.name,
+      runStatus: m.status,
+      stepId: c.stepId,
+      stepName: s.name,
+      stepType,
+      timestamp: s.startTime ?? s.timestamp,
+      durationMs: c.durationMs,
+      matchReason: `step match: ${fields.join(", ")}`,
+      matchedFields: fields,
+      filePath: m.filePath
+    });
   }
-  const assessment = {
-    status: parts.assessmentStatus,
-    note: parts.note ?? EVIDENCE_ASSESSMENT_NOTE
-  };
-  if (parts.sourceStatus !== void 0) {
-    assessment.sourceStatus = parts.sourceStatus;
-  }
-  return {
-    evidenceFormatVersion: EVIDENCE_FORMAT_VERSION,
-    generator: {
-      name: parts.generatorName ?? "agent-inspect",
-      version: parts.generatorVersion
-    },
-    createdAt: parts.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-    source: {
-      runIds,
-      traceSchemaVersions: [...parts.traceSchemaVersions].sort((a, b) => a.localeCompare(b)),
-      sourceHashes: [...parts.sourceHashes].sort((a, b) => a.runId.localeCompare(b.runId))
-    },
-    policy: {
-      redactionProfile: parts.redactionProfile,
-      verificationPolicy: parts.verificationPolicy ?? parts.redactionProfile
-    },
-    assessment,
-    ...parts.semantics !== void 0 ? { semantics: { ...parts.semantics } } : {},
-    ...parts.contract !== void 0 ? { contract: { ...parts.contract } } : {},
-    files: buildEvidenceFileEntries(parts.files)
-  };
-}
-
-// packages/core/src/diagnostics/programmatic.ts
-var PROGRAMMATIC_DIAGNOSTIC_SPECS = Object.freeze({
-  AI_TRACE_INPUT_INVALID: {
-    code: "AI_TRACE_INPUT_INVALID",
-    summary: 'Expected { type: "file", path }, { type: "directory", path }, { type: "string", content }, { type: "buffer", content }, or { type: "stdin" }.',
-    remediation: "For a file path, use openTraceFile(path).",
-    relatedCodes: ["invalid_input"]
-  },
-  AI_TRACE_FORMAT_UNSUPPORTED: {
-    code: "AI_TRACE_FORMAT_UNSUPPORTED",
-    summary: "No trace reader could detect the input format.",
-    remediation: "Pass an AgentInspect JSONL file via openTraceFile, or set options.format to a registered reader.",
-    relatedCodes: ["unsupported_format"]
-  },
-  AI_TRACE_FORMAT_AMBIGUOUS: {
-    code: "AI_TRACE_FORMAT_AMBIGUOUS",
-    summary: "Multiple trace readers matched the input with equal confidence.",
-    remediation: "Set options.format explicitly to disambiguate the reader.",
-    relatedCodes: ["ambiguous_format"]
-  },
-  AI_TRACE_FACTS_INPUT_NOT_NORMALIZED: {
-    code: "AI_TRACE_FACTS_INPUT_NOT_NORMALIZED",
-    summary: "TraceFacts requires TraceReadResult or PersistedInspectEvent[].",
-    remediation: "Use openTraceFile() to normalize a JSONL trace first."
-  },
-  AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED: {
-    code: "AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED",
-    summary: "Multiple runs are available; select a run before executing checks.",
-    remediation: "Pass options.runId or TraceCheckInput.selectedRun.",
-    relatedCodes: ["AI_CHECK_RUN_SELECTION_REQUIRED"]
-  },
-  AI_TRACE_RELATIONSHIP_SELF_PARENT: {
-    code: "AI_TRACE_RELATIONSHIP_SELF_PARENT",
-    summary: "A parentId equals its own event/step id.",
-    remediation: "Reject at capture (AI_LANGGRAPH_SELF_PARENT_REJECTED) or drop via logical projection; do not invent replacement parents.",
-    relatedCodes: [
-      "AI_LANGGRAPH_SELF_PARENT_REJECTED",
-      "AI_LOGICAL_SELF_PARENT_REMOVED"
-    ]
-  },
-  AI_TRACE_RELATIONSHIP_CYCLE: {
-    code: "AI_TRACE_RELATIONSHIP_CYCLE",
-    summary: "Trace contains a parentId cycle.",
-    remediation: "Use visibility-first tree linking for legacy fixtures; prefer acyclic capture for new adapter output.",
-    relatedCodes: ["structure.cycle"]
-  },
-  AI_TRACE_CONTRACT_INPUT_INVALID: {
-    code: "AI_TRACE_CONTRACT_INPUT_INVALID",
-    summary: "evaluateTraceContract expects ({ read }, contract) or use evaluateTraceContractRead(read, contract).",
-    remediation: "Pass TraceCheckInput as the first argument: evaluateTraceContract({ read }, contract).",
-    relatedCodes: ["AI_CHECK_INVALID_ARGUMENTS"]
-  },
-  AI_INSPECT_RUN_UNSUPPORTED_OPTION: {
-    code: "AI_INSPECT_RUN_UNSUPPORTED_OPTION",
-    summary: 'inspectRun does not accept a "writer" option.',
-    remediation: "Use createInspector({ writer }) then inspector.run(...). inspectRun persists via the global JSONL path (schema 0.1)."
-  }
-});
-function formatProgrammaticDiagnostic(code, detail) {
-  const spec = PROGRAMMATIC_DIAGNOSTIC_SPECS[code];
-  const summary = detail?.trim() ? detail.trim() : spec.summary;
-  return `${code}: ${summary} Remediation: ${spec.remediation}`;
-}
-
-// packages/core/src/checks/logical-events.ts
-function isRecord6(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function legacyEvent(event) {
-  const value = event.attributes?.legacyEvent;
-  return typeof value === "string" ? value : void 0;
+  return out;
 }
-function stepIdOf(event) {
-  const value = event.attributes?.stepId;
-  if (typeof value === "string" && value.trim() !== "") return value;
-  return void 0;
+async function loadTraceMetadataList(_traceDir, fileNames, getPath) {
+  const metas = [];
+  for (const fileName of fileNames) {
+    try {
+      const filePath = getPath(fileName);
+      const meta = await extractMetadata(filePath);
+      metas.push(meta);
+    } catch {
+    }
+  }
+  return metas;
 }
-function cloneEvent(event) {
-  return {
-    ...event,
-    ...event.attributes !== void 0 ? { attributes: { ...event.attributes } } : {},
-    ...event.error !== void 0 ? { error: { ...event.error } } : {},
-    ...event.tokenUsage !== void 0 ? { tokenUsage: { ...event.tokenUsage } } : {},
-    ...event.source !== void 0 ? { source: { ...event.source } } : {}
-  };
+
+// packages/core/src/sessions/metadata.ts
+function isNonEmptyString3(value) {
+  return typeof value === "string" && value.trim() !== "";
 }
-function mergeAttributes(start, complete) {
-  const merged = {
-    ...isRecord6(complete.attributes) ? complete.attributes : {},
-    ...isRecord6(start.attributes) ? start.attributes : {}
-  };
-  merged.legacyEvent = start.attributes?.legacyEvent ?? complete.attributes?.legacyEvent;
-  merged.legacyCompleteEvent = complete.attributes?.legacyEvent;
-  if (complete.attributes?.errorStack !== void 0) {
-    merged.errorStack = complete.attributes.errorStack;
+function finitePositiveInt(value) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 1) {
+    return void 0;
   }
-  return Object.keys(merged).length > 0 ? merged : void 0;
+  return Math.trunc(value);
 }
-function pairStartComplete(start, complete) {
-  const attributes = mergeAttributes(start, complete);
-  const paired = {
-    ...cloneEvent(start),
-    status: complete.status,
-    timestamp: complete.timestamp ?? start.timestamp,
-    ...complete.endedAt !== void 0 ? { endedAt: complete.endedAt } : {},
-    ...complete.durationMs !== void 0 ? { durationMs: complete.durationMs } : {},
-    ...complete.error !== void 0 ? { error: { ...complete.error } } : {},
-    ...complete.tokenUsage !== void 0 && start.tokenUsage === void 0 ? { tokenUsage: { ...complete.tokenUsage } } : {},
-    ...attributes !== void 0 ? { attributes } : {}
-  };
-  return {
-    ...paired,
-    sourceEventIds: Object.freeze([start.eventId, complete.eventId]),
-    projection: {
-      paired: true,
-      absorbedEventIds: Object.freeze([complete.eventId]),
-      parentNormalized: false,
-      ...start.parentId !== void 0 ? { originalParentId: start.parentId } : {}
+function extractSessionWorkflowMetadata(record) {
+  if (!record) return void 0;
+  const out = {};
+  let found = false;
+  const assignString = (key, value) => {
+    if (isNonEmptyString3(value)) {
+      out[key] = value.trim();
+      found = true;
     }
   };
+  assignString("sessionId", record.sessionId);
+  assignString("conversationId", record.conversationId);
+  assignString("groupId", record.groupId);
+  assignString("parentGroupId", record.parentGroupId);
+  assignString("retryOf", record.retryOf);
+  assignString("retryReason", record.retryReason);
+  assignString("handoffFrom", record.handoffFrom);
+  assignString("handoffTo", record.handoffTo);
+  assignString("subAgentId", record.subAgentId);
+  assignString("subAgentName", record.subAgentName);
+  assignString("jobId", record.jobId);
+  assignString("queueName", record.queueName);
+  assignString("workflowName", record.workflowName);
+  assignString("workflowStep", record.workflowStep);
+  assignString("toolCallId", record.toolCallId);
+  assignString("mcpToolCallId", record.mcpToolCallId);
+  assignString("linkedStepId", record.linkedStepId);
+  assignString("operationId", record.operationId);
+  assignString("attemptId", record.attemptId);
+  assignString("fallbackOf", record.fallbackOf);
+  assignString("idempotencyKey", record.idempotencyKey);
+  assignString("correlationId", record.correlationId);
+  assignString("requestId", record.requestId);
+  assignString("decisionId", record.decisionId);
+  const attempt = finitePositiveInt(record.attempt);
+  if (attempt !== void 0) {
+    out.attempt = attempt;
+    found = true;
+  }
+  const attemptNumber = finitePositiveInt(record.attemptNumber);
+  if (attemptNumber !== void 0) {
+    out.attemptNumber = attemptNumber;
+    found = true;
+  }
+  return found ? out : void 0;
 }
-function asLogical(event, extras) {
-  return {
-    ...cloneEvent(event),
-    sourceEventIds: Object.freeze([event.eventId]),
-    projection: {
-      paired: false,
-      absorbedEventIds: Object.freeze([]),
-      parentNormalized: extras?.parentNormalized === true,
-      ...{}
-    }
-  };
+
+// packages/core/src/bundle/safety-status.ts
+function aggregateBundleSafeStatus(statuses) {
+  if (statuses.length === 0) return "UNKNOWN";
+  if (statuses.some((status) => status === "UNSAFE")) return "UNSAFE";
+  if (statuses.some((status) => status === "UNKNOWN")) return "UNKNOWN";
+  if (statuses.some((status) => status === "SAFE WITH WARNINGS")) return "SAFE WITH WARNINGS";
+  return "SAFE";
 }
-function projectLogicalEvents(events) {
-  const diagnostics = [];
-  const byRun = /* @__PURE__ */ new Map();
-  for (const event of events) {
-    const list = byRun.get(event.runId) ?? [];
-    list.push(event);
-    byRun.set(event.runId, list);
-  }
-  const absorbedIds = /* @__PURE__ */ new Set();
-  const logicalByRawId = /* @__PURE__ */ new Map();
-  const stepIdToLogicalId = /* @__PURE__ */ new Map();
-  const logical = [];
-  const orderedRuns = [...byRun.keys()].sort((a, b) => a.localeCompare(b));
-  for (const runId of orderedRuns) {
-    const runEvents = byRun.get(runId) ?? [];
-    const starts = [];
-    const completes = [];
-    const others = [];
-    for (const event of runEvents) {
-      const legacy = legacyEvent(event);
-      if (legacy === "step_started" || legacy === "run_started" && event.status === "running") {
-        starts.push(event);
-      } else if (legacy === "step_completed" || legacy === "run_completed") {
-        completes.push(event);
-      } else {
-        others.push(event);
-      }
-    }
-    const usedCompletes = /* @__PURE__ */ new Set();
-    for (const start of starts) {
-      const stepId = stepIdOf(start);
-      let match;
-      if (legacyEvent(start) === "run_started") {
-        const candidates = completes.filter(
-          (c) => !usedCompletes.has(c.eventId) && legacyEvent(c) === "run_completed"
-        );
-        if (candidates.length > 1) {
-          diagnostics.push({
-            code: "AI_LOGICAL_PAIR_AMBIGUOUS",
-            message: `Multiple run_completed rows for run ${runId}; using first by eventId.`,
-            eventIds: candidates.map((c) => c.eventId)
-          });
-          candidates.sort((a, b) => a.eventId.localeCompare(b.eventId));
-        }
-        match = candidates[0];
-      } else if (stepId) {
-        const candidates = completes.filter(
-          (c) => !usedCompletes.has(c.eventId) && legacyEvent(c) === "step_completed" && stepIdOf(c) === stepId
-        );
-        if (candidates.length > 1) {
-          diagnostics.push({
-            code: "AI_LOGICAL_PAIR_AMBIGUOUS",
-            message: `Multiple step_completed rows for stepId ${stepId}; using first by eventId.`,
-            eventIds: candidates.map((c) => c.eventId)
-          });
-          candidates.sort((a, b) => a.eventId.localeCompare(b.eventId));
-        }
-        match = candidates[0];
-      }
-      if (match) {
-        usedCompletes.add(match.eventId);
-        absorbedIds.add(match.eventId);
-        const paired = pairStartComplete(start, match);
-        logical.push(paired);
-        logicalByRawId.set(start.eventId, paired);
-        logicalByRawId.set(match.eventId, paired);
-        if (stepId) stepIdToLogicalId.set(`${runId}:${stepId}`, paired.eventId);
-      } else {
-        diagnostics.push({
-          code: "AI_LOGICAL_PAIR_UNMATCHED_START",
-          message: `No matching complete for start ${start.eventId}.`,
-          eventIds: [start.eventId]
-        });
-        const alone = asLogical(start);
-        logical.push(alone);
-        logicalByRawId.set(start.eventId, alone);
-        if (stepId) stepIdToLogicalId.set(`${runId}:${stepId}`, alone.eventId);
-      }
-    }
-    for (const complete of completes) {
-      if (usedCompletes.has(complete.eventId)) continue;
-      diagnostics.push({
-        code: "AI_LOGICAL_PAIR_UNMATCHED_COMPLETE",
-        message: `No matching start for complete ${complete.eventId}.`,
-        eventIds: [complete.eventId]
-      });
-      const alone = asLogical(complete);
-      logical.push(alone);
-      logicalByRawId.set(complete.eventId, alone);
-      const stepId = stepIdOf(complete);
-      if (stepId && !stepIdToLogicalId.has(`${runId}:${stepId}`)) {
-        stepIdToLogicalId.set(`${runId}:${stepId}`, alone.eventId);
-      }
-    }
-    for (const event of others) {
-      const alone = asLogical(event);
-      logical.push(alone);
-      logicalByRawId.set(event.eventId, alone);
-      const stepId = stepIdOf(event);
-      if (stepId && !stepIdToLogicalId.has(`${runId}:${stepId}`)) {
-        stepIdToLogicalId.set(`${runId}:${stepId}`, alone.eventId);
-      }
-    }
+function toMetadataSafeStatus(status) {
+  if (status === "SAFE WITH WARNINGS") return "SAFE_WITH_WARNINGS";
+  return status;
+}
+function bundleFailsOnSafety(status, allowUnsafe) {
+  return status === "UNSAFE" || status === "UNKNOWN";
+}
+
+// packages/core/src/bundle/manifest.ts
+var BUNDLE_NOTE = "Generated locally by AgentInspect. Bundles are derived copies for review \u2014 not compliance or security certification. Review before sharing.";
+function buildBundleMetadata(parts) {
+  const aggregate = aggregateBundleSafeStatus(
+    parts.checks.runs.map((run) => run.status)
+  );
+  return {
+    createdAt: parts.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    agentInspectVersion: parts.agentInspectVersion,
+    redactionProfile: parts.profile,
+    sourceTraceCount: parts.resolve.runIds.length,
+    runIds: [...parts.resolve.runIds],
+    safeStatus: toMetadataSafeStatus(aggregate),
+    files: [...parts.files].sort((a, b) => a.localeCompare(b)),
+    note: BUNDLE_NOTE,
+    ...parts.resolve.sessionId !== void 0 ? { sessionId: parts.resolve.sessionId } : {},
+    ...parts.resolve.since !== void 0 ? { since: parts.resolve.since } : {}
+  };
+}
+
+// packages/core/src/evidence/types.ts
+var EVIDENCE_FORMAT_VERSION = "1.0";
+var EVIDENCE_ASSESSMENT_NOTE = "Best-effort local safety verification only; not a compliance certification.";
+var EVIDENCE_MANIFEST_FILENAME = "evidence.json";
+function sha256Hex(data) {
+  const hash = crypto.createHash("sha256");
+  if (typeof data === "string") {
+    hash.update(data, "utf8");
+  } else {
+    hash.update(data);
   }
-  const logicalById = new Map(logical.map((e) => [e.eventId, e]));
-  const normalized = [];
-  for (const event of logical) {
-    const originalParentId = event.parentId;
-    if (!originalParentId) {
-      normalized.push(event);
-      continue;
-    }
-    let nextParent = originalParentId;
-    let remapped = false;
-    const viaAbsorbed = logicalByRawId.get(originalParentId);
-    if (viaAbsorbed && viaAbsorbed.eventId !== originalParentId) {
-      nextParent = viaAbsorbed.eventId;
-      remapped = true;
-    } else if (!logicalById.has(originalParentId)) {
-      const viaStep = stepIdToLogicalId.get(`${event.runId}:${originalParentId}`);
-      if (viaStep) {
-        nextParent = viaStep;
-        remapped = true;
-      }
+  return hash.digest("hex");
+}
+function assertEvidenceRelativePath(relativePath) {
+  if (typeof relativePath !== "string" || relativePath.trim() === "") {
+    throw new Error("Evidence file path must be a non-empty relative path.");
+  }
+  const trimmed = relativePath.trim().replaceAll("\\", "/");
+  if (path14__default.default.isAbsolute(trimmed) || trimmed.startsWith("/")) {
+    throw new Error(`Evidence file path must be relative: ${relativePath}`);
+  }
+  const parts = trimmed.split("/").filter((part) => part !== "");
+  if (parts.length === 0) {
+    throw new Error(`Evidence file path must be relative: ${relativePath}`);
+  }
+  for (const part of parts) {
+    if (part === "." || part === "..") {
+      throw new Error(`Evidence file path must not contain "." or "..": ${relativePath}`);
     }
-    if (!remapped) {
-      if (originalParentId === event.eventId) {
-        diagnostics.push({
-          code: "AI_LOGICAL_SELF_PARENT_REMOVED",
-          message: formatProgrammaticDiagnostic(
-            "AI_TRACE_RELATIONSHIP_SELF_PARENT",
-            `Removed self-parent edge on ${event.eventId}.`
-          ),
-          eventIds: [event.eventId]
-        });
-        const { parentId: _drop, ...rest } = event;
-        normalized.push({
-          ...rest,
-          projection: {
-            ...event.projection,
-            parentNormalized: true,
-            originalParentId
-          }
-        });
-        continue;
-      }
-      if (!logicalById.has(originalParentId) && !logicalByRawId.has(originalParentId)) {
-        const mapping = event.attributes?.parentMapping;
-        const unresolved = mapping === "unresolved" || event.attributes?.parentUnresolved === true || event.attributes?.unresolvedParent === true || // LangGraph/framework scaffolding sentinel labels are not event ids.
-        /^LangGraph$/i.test(originalParentId) || originalParentId.startsWith("unresolved:");
-        if (!unresolved) {
-          diagnostics.push({
-            code: "AI_LOGICAL_PARENT_UNRESOLVED",
-            message: `Parent ${originalParentId} unresolved for ${event.eventId}.`,
-            eventIds: [event.eventId]
-          });
-        }
-      }
-      normalized.push(event);
-      continue;
+  }
+  return parts.join("/");
+}
+
+// packages/core/src/evidence/manifest.ts
+function stable(value) {
+  if (Array.isArray(value)) return value.map(stable);
+  if (value === null || typeof value !== "object") return value;
+  const record = value;
+  return Object.fromEntries(
+    Object.keys(record).sort((a, b) => a.localeCompare(b)).map((key) => [key, stable(record[key])])
+  );
+}
+function serializeEvidenceManifest(manifest) {
+  return `${JSON.stringify(stable(manifest), null, 2)}
+`;
+}
+function inferEvidenceFileRole(relativePath) {
+  const normalized = assertEvidenceRelativePath(relativePath);
+  const base = normalized.includes("/") ? normalized.slice(normalized.lastIndexOf("/") + 1) : normalized;
+  if (base === "evidence.html" || base === "trace.html" || base.endsWith(".html")) {
+    return "report";
+  }
+  if (base === "trace.jsonl" || base.endsWith(".jsonl")) {
+    return "redacted-trace";
+  }
+  if (base === "check-results.json") {
+    return "checks";
+  }
+  if (base === "contract.resolved.json") {
+    return "contract";
+  }
+  if (base === "redaction-report.json") {
+    return "redaction-report";
+  }
+  if (base === "summary.md") {
+    return "summary";
+  }
+  return "other";
+}
+function buildEvidenceFileEntries(files) {
+  const byPath = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const relativePath = assertEvidenceRelativePath(file.path);
+    if (relativePath === EVIDENCE_MANIFEST_FILENAME) {
+      throw new Error(
+        `Do not include ${EVIDENCE_MANIFEST_FILENAME} in packaged file hashes (self-hash is undefined).`
+      );
     }
-    if (nextParent === event.eventId) {
-      diagnostics.push({
-        code: "AI_LOGICAL_SELF_PARENT_REMOVED",
-        message: formatProgrammaticDiagnostic(
-          "AI_TRACE_RELATIONSHIP_SELF_PARENT",
-          `Removed self-parent edge on ${event.eventId} (was ${originalParentId}).`
-        ),
-        eventIds: [event.eventId]
-      });
-      const { parentId: _drop, ...rest } = event;
-      normalized.push({
-        ...rest,
-        projection: {
-          ...event.projection,
-          parentNormalized: true,
-          originalParentId
-        }
-      });
-      continue;
+    if (byPath.has(relativePath)) {
+      throw new Error(`Duplicate evidence file path: ${relativePath}`);
     }
-    diagnostics.push({
-      code: "AI_LOGICAL_PARENT_REMAPPED",
-      message: `Remapped parent ${originalParentId} \u2192 ${nextParent} for ${event.eventId}.`,
-      eventIds: [event.eventId]
-    });
-    normalized.push({
-      ...event,
-      parentId: nextParent,
-      projection: {
-        ...event.projection,
-        parentNormalized: true,
-        originalParentId
-      }
+    byPath.set(relativePath, {
+      path: relativePath,
+      sha256: sha256Hex(file.content),
+      role: file.role ?? inferEvidenceFileRole(relativePath)
     });
   }
-  const rawIndex = new Map(events.map((e, i) => [e.eventId, i]));
-  normalized.sort((a, b) => {
-    const ai = rawIndex.get(a.sourceEventIds[0]) ?? 0;
-    const bi = rawIndex.get(b.sourceEventIds[0]) ?? 0;
-    return ai - bi || a.eventId.localeCompare(b.eventId);
-  });
-  return {
-    logicalEvents: Object.freeze(normalized),
-    diagnostics: Object.freeze(diagnostics)
-  };
+  return [...byPath.values()].sort((a, b) => a.path.localeCompare(b.path));
 }
-function resolveCanonicalToolName(event) {
-  const attrs2 = event.attributes;
-  const direct = pickString(attrs2, ["toolName", "tool"]);
-  if (direct) return direct;
-  const metadata = attrs2?.metadata;
-  if (isRecord6(metadata)) {
-    const nested = pickString(metadata, ["toolName", "tool"]);
-    if (nested) return nested;
+function buildEvidenceManifest(parts) {
+  const runIds = [...parts.runIds];
+  if (runIds.length === 0) {
+    throw new Error("Evidence manifest requires at least one run id.");
   }
-  for (const prefix of ["tool:", "function:", "mcp-tools:"]) {
-    if (event.name.startsWith(prefix)) return event.name.slice(prefix.length);
+  for (const item of parts.sourceHashes) {
+    if (!runIds.includes(item.runId)) {
+      throw new Error(`sourceHashes runId "${item.runId}" is not listed in source.runIds.`);
+    }
+    if (item.algorithm !== "sha256") {
+      throw new Error(`Unsupported source hash algorithm: ${item.algorithm}`);
+    }
   }
-  return event.name;
-}
-function pickString(record, keys) {
-  if (!record) return void 0;
-  for (const key of keys) {
-    const value = record[key];
-    if (typeof value === "string" && value.trim() !== "") return value.trim();
+  const assessment = {
+    status: parts.assessmentStatus,
+    note: parts.note ?? EVIDENCE_ASSESSMENT_NOTE
+  };
+  if (parts.sourceStatus !== void 0) {
+    assessment.sourceStatus = parts.sourceStatus;
   }
-  return void 0;
+  return {
+    evidenceFormatVersion: EVIDENCE_FORMAT_VERSION,
+    generator: {
+      name: parts.generatorName ?? "agent-inspect",
+      version: parts.generatorVersion
+    },
+    createdAt: parts.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    source: {
+      runIds,
+      traceSchemaVersions: [...parts.traceSchemaVersions].sort((a, b) => a.localeCompare(b)),
+      sourceHashes: [...parts.sourceHashes].sort((a, b) => a.runId.localeCompare(b.runId))
+    },
+    policy: {
+      redactionProfile: parts.redactionProfile,
+      verificationPolicy: parts.verificationPolicy ?? parts.redactionProfile
+    },
+    assessment,
+    ...parts.semantics !== void 0 ? { semantics: { ...parts.semantics } } : {},
+    ...parts.contract !== void 0 ? { contract: { ...parts.contract } } : {},
+    ...parts.inputs !== void 0 ? { inputs: { ...parts.inputs } } : {},
+    files: buildEvidenceFileEntries(parts.files)
+  };
 }
 
 // packages/core/src/checks/derived-failure.ts
@@ -3440,7 +3441,11 @@ function emptySummary() {
     failed: 0,
     warnings: 0,
     errors: 0,
-    rulesEvaluated: 0
+    rulesEvaluated: 0,
+    rulesPassed: 0,
+    rulesWarning: 0,
+    rulesFailed: 0,
+    rulesError: 0
   };
 }
 function errorResult(input, diagnostics, selectedRun, ruleExecutions = []) {
@@ -3452,7 +3457,11 @@ function errorResult(input, diagnostics, selectedRun, ruleExecutions = []) {
     summary: {
       ...emptySummary(),
       errors: diagnostics.filter((item) => item.severity === "error").length,
-      rulesEvaluated: ruleExecutions.length
+      rulesEvaluated: ruleExecutions.length,
+      rulesPassed: ruleExecutions.filter((item) => item.status === "pass").length,
+      rulesWarning: ruleExecutions.filter((item) => item.status === "warning").length,
+      rulesFailed: ruleExecutions.filter((item) => item.status === "fail").length,
+      rulesError: ruleExecutions.filter((item) => item.status === "error").length
     },
     findings: [],
     diagnostics: [...diagnostics],
@@ -3612,7 +3621,7 @@ function normalizeFinding(rule, finding) {
     ...finding.action !== void 0 ? { action: finding.action } : {}
   };
 }
-function summarize(findings, diagnostics, rulesEvaluated) {
+function summarize(findings, diagnostics, ruleExecutions) {
   return {
     passed: findings.filter((finding) => finding.status === "pass").length,
     failed: findings.filter(
@@ -3622,7 +3631,11 @@ function summarize(findings, diagnostics, rulesEvaluated) {
       (finding) => finding.status === "warning" || finding.severity === "warning"
     ).length,
     errors: diagnostics.filter((item) => item.severity === "error").length,
-    rulesEvaluated
+    rulesEvaluated: ruleExecutions.length,
+    rulesPassed: ruleExecutions.filter((item) => item.status === "pass").length,
+    rulesWarning: ruleExecutions.filter((item) => item.status === "warning").length,
+    rulesFailed: ruleExecutions.filter((item) => item.status === "fail").length,
+    rulesError: ruleExecutions.filter((item) => item.status === "error").length
   };
 }
 function classifyRuleExecution(findings, threw) {
@@ -4063,7 +4076,7 @@ function runTraceChecks(input, options = {}) {
   }
   const eventById = new Map(input.read.events.map((event) => [event.eventId, event]));
   const sortedFindings = findings.sort(compareFindings(eventById));
-  const summary = summarize(sortedFindings, diagnostics, ruleExecutions.length);
+  const summary = summarize(sortedFindings, diagnostics, ruleExecutions);
   const status = summary.failed > 0 ? "fail" : "pass";
   return {
     ok: status === "pass",
@@ -8206,6 +8219,15 @@ function actionForRule(rule) {
   if (rule.strategy === "full") return "replace";
   return rule.strategy;
 }
+function isCompleteRedactionMarker(value, replacement = "[REDACTED]") {
+  if (typeof value !== "string") return false;
+  const trimmed = value.trim();
+  if (trimmed.length === 0) return false;
+  if (trimmed === replacement) return true;
+  if (/^\[HASH:[A-Za-z0-9_-]+\]$/.test(trimmed)) return true;
+  if (/^\[REDACTED:[^\]]*\]$/.test(trimmed)) return true;
+  return false;
+}
 function applyRule(rule, value, replacement) {
   if (rule.strategy === "full") return replacement;
   const asString = stringifyScalar(value);
@@ -8320,6 +8342,9 @@ var Redactor2 = class {
     if (key !== void 0) {
       const rule = findCompiledKeyRule(key, this.#rules);
       if (rule) {
+        if (isCompleteRedactionMarker(value, this.#replacement)) {
+          return value;
+        }
         this.#recordFinding(
           state,
           makeFinding(path16, `key.${rule.key}`, actionForRule(rule), "key", "warning")