@aiwg/cli 2026.9.20 → 2026.9.21

package/dist/src/decision/review/store.js

@@ -0,0 +1,219 @@
+import { createHash, createHmac, randomUUID, timingSafeEqual } from 'node:crypto';
+import { link, mkdir, open, readFile, readdir, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { canonicalJson } from '../../security/artifact-trust.js';
+import { assertImmutable, ReviewIntegrityError, validateReview } from './validate.js';
+/**
+ * Revisions live in one directory per (tenant, project) scope, named by a keyed
+ * digest, so reading or listing a scope never opens another scope's files.
+ */
+export class FileDecisionReviewStore {
+    directory;
+    integrityKey;
+    options;
+    constructor(directory, integrityKey, options = {}) {
+        this.directory = directory;
+        this.integrityKey = integrityKey;
+        this.options = options;
+        if (integrityKey.length < 32)
+            throw new Error('Review integrity key must be at least 32 bytes');
+    }
+    prefix(id) { return createHash('sha256').update(id).digest('hex'); }
+    /** Keyed so a directory name cannot be confirmed from guessed tenant or project names. */
+    scopeDirectory(tenantId, projectId) {
+        return join(this.directory, createHmac('sha256', this.integrityKey)
+            .update(`decision-review-scope/v1\0${canonicalJson([tenantId, projectId])}`).digest('hex'));
+    }
+    path(scope, id, revision) { return join(scope, `${this.prefix(id)}.r${revision}.json`); }
+    markerPath(scope, id) { return join(scope, `${this.prefix(id)}.purged.json`); }
+    mac(value) { return createHmac('sha256', this.integrityKey).update(canonicalJson(value)).digest('hex'); }
+    async names(scope) {
+        try {
+            return (await readdir(scope)).sort();
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return [];
+            throw error;
+        }
+    }
+    async marker(scope, idDigest) {
+        let raw;
+        try {
+            raw = await readFile(join(scope, `${idDigest}.purged.json`), 'utf8');
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return null;
+            throw error;
+        }
+        try {
+            const envelope = JSON.parse(raw);
+            const expected = Buffer.from(this.mac(envelope.receipt), 'hex');
+            const actual = Buffer.from(envelope.mac ?? '', 'hex');
+            if (actual.length !== expected.length || !timingSafeEqual(actual, expected) ||
+                envelope.receipt.reviewIdDigest !== `sha256:${idDigest}` ||
+                !Number.isSafeInteger(envelope.receipt.lastRevision) || envelope.receipt.lastRevision < 1)
+                throw new Error();
+            return envelope.receipt;
+        }
+        catch {
+            throw new ReviewIntegrityError('Review purge marker integrity check failed');
+        }
+    }
+    async read(reviewId, tenantId, projectId) {
+        const scope = this.scopeDirectory(tenantId, projectId);
+        const review = await this.readChain(scope, this.prefix(reviewId), await this.names(scope));
+        if (review && review.reviewId !== reviewId)
+            throw new ReviewIntegrityError('Review revision identity mismatch');
+        return review && review.tenantId === tenantId && review.projectId === projectId ? review : null;
+    }
+    /** Verify one review's revision chain using names already listed from its scope directory. */
+    async readChain(scope, idDigest, names) {
+        if (await this.marker(scope, idDigest))
+            return null;
+        const prefix = `${idDigest}.r`;
+        const revisions = names.filter(name => name.startsWith(prefix) && name.endsWith('.json')).map(name => Number(name.slice(prefix.length, -5))).sort((a, b) => a - b);
+        if (!revisions.length)
+            return null;
+        let previous = null;
+        for (let i = 0; i < revisions.length; i += 1) {
+            if (revisions[i] !== i + 1)
+                throw new ReviewIntegrityError('Review revision gap');
+            const envelope = JSON.parse(await readFile(join(scope, `${prefix}${revisions[i]}.json`), 'utf8'));
+            const expected = Buffer.from(this.mac(envelope.review), 'hex');
+            const actual = Buffer.from(envelope.mac ?? '', 'hex');
+            if (actual.length !== expected.length || !timingSafeEqual(actual, expected))
+                throw new ReviewIntegrityError('Review integrity check failed');
+            validateReview(envelope.review);
+            if (envelope.review.revision !== revisions[i] || this.prefix(envelope.review.reviewId) !== idDigest)
+                throw new ReviewIntegrityError('Review revision identity mismatch');
+            if (previous)
+                assertImmutable(previous, envelope.review);
+            previous = envelope.review;
+        }
+        return structuredClone(previous);
+    }
+    async create(review) {
+        validateReview(review);
+        if (await this.marker(this.scopeDirectory(review.tenantId, review.projectId), this.prefix(review.reviewId)))
+            return false;
+        return this.publish(review);
+    }
+    async list(tenantId, projectId) {
+        // Enumerate and open only this scope's directory, in sorted digest order.
+        const scope = this.scopeDirectory(tenantId, projectId);
+        const names = await this.names(scope);
+        const digests = [...new Set(names.flatMap(name => /^([0-9a-f]{64})\.r\d+\.json$/.exec(name)?.[1] ?? []))];
+        const reviews = [];
+        for (const digest of digests) {
+            const review = await this.readChain(scope, digest, names);
+            if (review && review.tenantId === tenantId && review.projectId === projectId)
+                reviews.push(review);
+        }
+        return reviews.sort((a, b) => a.reviewId.localeCompare(b.reviewId));
+    }
+    async compareAndSwap(reviewId, tenantId, projectId, expectedRevision, next) {
+        const current = await this.read(reviewId, tenantId, projectId);
+        if (!current)
+            throw new ReviewIntegrityError('Missing review');
+        if (current.revision !== expectedRevision)
+            return false;
+        assertImmutable(current, next);
+        return this.publish(next);
+    }
+    async purgeTombstoned(reviewId, tenantId, projectId) {
+        const scope = this.scopeDirectory(tenantId, projectId);
+        let receipt = await this.marker(scope, this.prefix(reviewId));
+        if (!receipt) {
+            const review = await this.read(reviewId, tenantId, projectId);
+            if (!review || review.status !== 'tombstoned' || review.lifecycle?.legalHold)
+                throw new ReviewIntegrityError('Review purge requires an unheld tombstone');
+            receipt = {
+                reviewIdDigest: `sha256:${this.prefix(reviewId)}`, tenantDigest: `sha256:${this.prefix(tenantId)}`,
+                projectDigest: `sha256:${this.prefix(projectId)}`, lastRevision: review.revision,
+                finalReviewMac: this.mac(review),
+            };
+            const destination = this.markerPath(scope, reviewId);
+            const temporary = `${destination}.${randomUUID()}.tmp`;
+            const file = await open(temporary, 'wx', 0o600);
+            try {
+                await file.writeFile(`${JSON.stringify({ receipt, mac: this.mac(receipt) })}\n`);
+                await file.sync();
+            }
+            finally {
+                await file.close();
+            }
+            try {
+                await link(temporary, destination);
+                const dir = await open(scope, 'r');
+                try {
+                    await dir.sync();
+                }
+                finally {
+                    await dir.close();
+                }
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+                receipt = (await this.marker(scope, this.prefix(reviewId)));
+            }
+            finally {
+                await rm(temporary, { force: true });
+            }
+        }
+        if (receipt.tenantDigest !== `sha256:${this.prefix(tenantId)}` || receipt.projectDigest !== `sha256:${this.prefix(projectId)}`) {
+            throw new ReviewIntegrityError('Review purge scope mismatch');
+        }
+        this.options.fault?.('purge-marker-published');
+        const names = await this.names(scope);
+        for (const name of names.filter(item => new RegExp(`^${this.prefix(reviewId)}\\.r[0-9]+\\.json$`).test(item))) {
+            await rm(join(scope, name));
+        }
+        const dir = await open(scope, 'r');
+        try {
+            await dir.sync();
+        }
+        finally {
+            await dir.close();
+        }
+        return receipt;
+    }
+    async publish(review) {
+        const scope = this.scopeDirectory(review.tenantId, review.projectId);
+        await mkdir(scope, { recursive: true, mode: 0o700 });
+        const destination = this.path(scope, review.reviewId, review.revision);
+        const temporary = `${destination}.${randomUUID()}.tmp`;
+        const file = await open(temporary, 'wx', 0o600);
+        try {
+            await file.writeFile(`${JSON.stringify({ review, mac: this.mac(review) })}\n`);
+            await file.sync();
+        }
+        finally {
+            await file.close();
+        }
+        try {
+            this.options.fault?.('review-before-publication');
+            await link(temporary, destination);
+            const dir = await open(scope, 'r');
+            try {
+                await dir.sync();
+            }
+            finally {
+                await dir.close();
+            }
+            this.options.fault?.('review-after-publication');
+            return true;
+        }
+        catch (error) {
+            if (error.code === 'EEXIST')
+                return false;
+            throw error;
+        }
+        finally {
+            await rm(temporary, { force: true });
+        }
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/src/decision/review/types.js

@@ -0,0 +1,2 @@
+export const DECISION_REVIEW_API_VERSION = 'decision.aiwg.io/v1alpha1';
+//# sourceMappingURL=types.js.map

package/dist/src/decision/review/validate.js

@@ -0,0 +1,205 @@
+import { createHash } from 'node:crypto';
+import { canonicalJson } from '../../security/artifact-trust.js';
+export class ReviewIntegrityError extends Error {
+}
+export class ReviewAccessError extends Error {
+}
+export class ReviewConflictError extends Error {
+}
+export function reviewDigest(value) {
+    return `sha256:${createHash('sha256').update(canonicalJson(value)).digest('hex')}`;
+}
+export function reviewOperatorEventId(reviewId, sequence) {
+    return reviewDigest({ reviewId, sequence, schema: 'operator-decision.aiwg.io/v1' });
+}
+const digestPattern = /^sha256:[a-f0-9]{64}$/;
+const restrictedKey = /(?:password|credential|api.?key|secret|private.?reasoning|provider.?body|raw.?state|vault.?locator)/i;
+const restrictedValue = /(?:vault:\/\/|\b(?:sk-(?:test-)?[a-z0-9_-]{12,}|ghp_[a-z0-9]{12,})\b)/i;
+/** Enforce reference-only default review payloads; do not echo rejected material. */
+export function assertReviewProjection(value) {
+    if (typeof value === 'string') {
+        if (restrictedValue.test(value))
+            throw new ReviewIntegrityError('Restricted review payload');
+    }
+    else if (Array.isArray(value)) {
+        value.forEach(assertReviewProjection);
+    }
+    else if (value && typeof value === 'object') {
+        for (const [key, child] of Object.entries(value)) {
+            if (restrictedKey.test(key))
+                throw new ReviewIntegrityError('Restricted review payload');
+            assertReviewProjection(child);
+        }
+    }
+}
+const legalEvents = new Set(['created', 'claimed', 'approved', 'rejected', 'edited', 'expired', 'escalated', 'canceled', 'resumed', 'execution-completed', 'execution-failed', 'legal-hold-placed', 'legal-hold-released', 'tombstoned', 'authorization-denied', 'sensitive-view-accessed']);
+export function currentProposal(review) {
+    const proposal = review.proposals.at(-1);
+    if (!proposal)
+        throw new ReviewIntegrityError('Review has no proposal');
+    return proposal;
+}
+export function validateReview(review) {
+    if (!review || review.apiVersion !== 'decision.aiwg.io/v1alpha1' || review.kind !== 'DecisionReview' || review.schema !== 'decision-review/v1'
+        || !Number.isSafeInteger(review.revision) || review.revision < 1 || !review.reviewId || !review.tenantId || !review.projectId
+        || !digestPattern.test(review.sourceReceipt.digest) || !digestPattern.test(review.continuation.tokenDigest)
+        || !Number.isSafeInteger(review.quorum) || review.quorum < 1 || review.quorum > 16
+        || !Number.isSafeInteger(review.createdAtEpochMs) || review.updatedAtEpochMs < review.createdAtEpochMs
+        || review.expiresAtEpochMs <= review.createdAtEpochMs ||
+        (review.retentionUntilEpochMs !== undefined && (!Number.isSafeInteger(review.retentionUntilEpochMs) || review.retentionUntilEpochMs < review.expiresAtEpochMs)) ||
+        !Array.isArray(review.proposals) || !review.proposals.length
+        || !Array.isArray(review.events) || !review.events.length)
+        throw new ReviewIntegrityError('Invalid review envelope');
+    if (review.lifecycle && (typeof review.lifecycle.legalHold !== 'boolean'
+        || (review.lifecycle.tombstonedAtEpochMs !== undefined && !Number.isSafeInteger(review.lifecycle.tombstonedAtEpochMs)))) {
+        throw new ReviewIntegrityError('Invalid review lifecycle');
+    }
+    assertReviewProjection(review.presentation);
+    assertReviewProjection(review.reviewId);
+    assertReviewProjection(review.requesterId);
+    assertReviewProjection(review.sourceReceipt.id);
+    assertReviewProjection(review.evidencePins);
+    assertReviewProjection(review.policyPins);
+    review.proposals.forEach((proposal, index) => {
+        assertReviewProjection(proposal.editor);
+        assertReviewProjection(proposal.action);
+        assertReviewProjection(proposal.rationale);
+        if (proposal.version !== index + 1 || proposal.actionDigest !== reviewDigest(proposal.action))
+            throw new ReviewIntegrityError('Invalid proposal lineage');
+    });
+    review.decisions.forEach(decision => { assertReviewProjection(decision.reviewer); assertReviewProjection(decision.rationale); });
+    review.events.forEach(event => { assertReviewProjection(event.actor); assertReviewProjection(event.rationale); });
+    if (review.effectReceipt)
+        assertReviewProjection(review.effectReceipt.result);
+    review.events.forEach((event, index) => {
+        if (event.sequence !== index + 1 || !legalEvents.has(event.type) || event.proposalVersion < 1 || event.proposalVersion > review.proposals.length ||
+            (event.operatorDecisionEventId && event.operatorDecisionEventId !== reviewOperatorEventId(review.reviewId, event.sequence))) {
+            throw new ReviewIntegrityError('Invalid event lineage');
+        }
+        if (index && event.atEpochMs < review.events[index - 1].atEpochMs)
+            throw new ReviewIntegrityError('Event time reordered');
+    });
+    if (review.revision !== review.events.length || review.events[0]?.type !== 'created' ||
+        review.events[0]?.proposalVersion !== 1 || review.events[0]?.atEpochMs !== review.createdAtEpochMs ||
+        review.events.at(-1)?.atEpochMs !== review.updatedAtEpochMs)
+        throw new ReviewIntegrityError('Review event envelope mismatch');
+    let state = 'pending';
+    let version = 1;
+    let legalHold = false;
+    let decisionIndex = 0;
+    for (const event of review.events.slice(1)) {
+        if (event.type === 'edited') {
+            if (!['pending', 'claimed'].includes(state) || event.proposalVersion !== ++version)
+                throw new ReviewIntegrityError('Illegal proposal edit');
+            state = 'pending';
+        }
+        else {
+            if (event.proposalVersion !== version)
+                throw new ReviewIntegrityError('Event refers to wrong proposal');
+            switch (event.type) {
+                case 'claimed':
+                    if (!['pending', 'claimed'].includes(state))
+                        throw new ReviewIntegrityError('Illegal claim');
+                    state = 'claimed';
+                    break;
+                case 'approved':
+                case 'rejected': {
+                    if (!['pending', 'claimed'].includes(state))
+                        throw new ReviewIntegrityError('Illegal decision');
+                    const decision = review.decisions[decisionIndex++];
+                    if (!decision || decision.proposalVersion !== version || decision.decision !== (event.type === 'approved' ? 'approve' : 'reject') ||
+                        canonicalJson(decision.reviewer) !== canonicalJson(event.actor) || decision.rationale !== event.rationale || decision.atEpochMs !== event.atEpochMs) {
+                        throw new ReviewIntegrityError('Decision event mismatch');
+                    }
+                    if (event.type === 'rejected')
+                        state = 'rejected';
+                    else
+                        state = review.decisions.slice(0, decisionIndex).filter(item => item.proposalVersion === version && item.decision === 'approve').length >= review.quorum
+                            ? 'approved' : 'claimed';
+                    break;
+                }
+                case 'resumed':
+                    if (state !== 'approved' && state !== 'resuming')
+                        throw new ReviewIntegrityError('Action before approval');
+                    if (event.data?.effectId !== reviewDigest({ reviewId: review.reviewId, continuationId: review.continuation.id, proposalVersion: version }))
+                        throw new ReviewIntegrityError('Effect identity mismatch');
+                    state = 'resuming';
+                    break;
+                case 'execution-completed':
+                    if (state !== 'resuming' || event.data?.effectId !== review.effectReceipt?.effectId)
+                        throw new ReviewIntegrityError('Completion without effect receipt');
+                    state = 'completed';
+                    break;
+                case 'execution-failed':
+                    if (state !== 'resuming')
+                        throw new ReviewIntegrityError('Failure without dispatch');
+                    state = 'execution-failed';
+                    break;
+                case 'expired':
+                case 'escalated':
+                case 'canceled':
+                    if (!['pending', 'claimed', 'approved', 'escalated'].includes(state))
+                        throw new ReviewIntegrityError('Illegal terminal transition');
+                    if (event.type === 'escalated' && !['pending', 'claimed'].includes(state))
+                        throw new ReviewIntegrityError('Illegal escalation');
+                    state = event.type;
+                    break;
+                case 'tombstoned':
+                    if (state === 'tombstoned' || legalHold)
+                        throw new ReviewIntegrityError('Illegal tombstone');
+                    state = 'tombstoned';
+                    break;
+                case 'legal-hold-placed':
+                case 'legal-hold-released':
+                    if (state === 'tombstoned' || legalHold === (event.type === 'legal-hold-placed'))
+                        throw new ReviewIntegrityError('Illegal legal-hold change');
+                    legalHold = event.type === 'legal-hold-placed';
+                    break;
+                case 'authorization-denied':
+                    if (state !== 'approved' && state !== 'resuming')
+                        throw new ReviewIntegrityError('Illegal authorization denial');
+                    break;
+                case 'sensitive-view-accessed':
+                    // Audit-only event: it never changes review state and is illegal after tombstoning.
+                    if (state === 'tombstoned')
+                        throw new ReviewIntegrityError('Illegal sensitive view');
+                    break;
+                default: throw new ReviewIntegrityError('Unexpected review event');
+            }
+        }
+    }
+    if (version !== review.proposals.length || decisionIndex !== review.decisions.length || state !== review.status ||
+        legalHold !== (review.lifecycle?.legalHold ?? false))
+        throw new ReviewIntegrityError('Review history does not match state');
+    if ((review.status === 'completed' && !review.effectReceipt) ||
+        (review.effectReceipt && (review.status !== 'completed' && review.status !== 'tombstoned' ||
+            review.effectReceipt.proposalVersion !== version || review.effectReceipt.continuationId !== review.continuation.id ||
+            review.effectReceipt.effectId !== reviewDigest({ reviewId: review.reviewId, continuationId: review.continuation.id, proposalVersion: version })))) {
+        throw new ReviewIntegrityError('Effect receipt does not match continuation');
+    }
+}
+export function assertImmutable(previous, next) {
+    const fixed = ['reviewId', 'tenantId', 'projectId', 'requesterId', 'sourceReceipt', 'evidencePins', 'policyPins',
+        'reasonCodes', 'riskTier', 'presentation', 'createdAtEpochMs', 'expiresAtEpochMs', 'retentionUntilEpochMs', 'escalationAtEpochMs', 'quorum'];
+    for (const key of fixed)
+        if (canonicalJson(previous[key] ?? null) !== canonicalJson(next[key] ?? null))
+            throw new ReviewIntegrityError(`Immutable review field changed: ${key}`);
+    if (previous.continuation.id !== next.continuation.id ||
+        (next.events.at(-1)?.type === 'edited') !== (previous.continuation.tokenDigest !== next.continuation.tokenDigest)) {
+        throw new ReviewIntegrityError('Continuation token must rotate only on proposal edit');
+    }
+    if (previous.effectReceipt && canonicalJson(previous.effectReceipt) !== canonicalJson(next.effectReceipt ?? null)) {
+        throw new ReviewIntegrityError('Completed effect receipt changed');
+    }
+    if (canonicalJson(next.decisions.slice(0, previous.decisions.length)) !== canonicalJson(previous.decisions)) {
+        throw new ReviewIntegrityError('Review decision history changed');
+    }
+    if (next.revision !== previous.revision + 1 || next.events.length !== previous.events.length + 1
+        || canonicalJson(next.events.slice(0, -1)) !== canonicalJson(previous.events)
+        || next.proposals.length < previous.proposals.length
+        || canonicalJson(next.proposals.slice(0, previous.proposals.length)) !== canonicalJson(previous.proposals)) {
+        throw new ReviewIntegrityError('Review append-only lineage changed');
+    }
+    validateReview(next);
+}
+//# sourceMappingURL=validate.js.map

package/dist/src/decision/scheduler.js

@@ -0,0 +1,115 @@
+export class SchedulerWaitError extends Error {
+    reason;
+    constructor(reason) {
+        super(`scheduler wait ${reason}`);
+        this.reason = reason;
+    }
+}
+/**
+ * Deterministic-output, round-robin scheduler. Work may complete in any order,
+ * but returned slots always match input order. A lane can consume at most one
+ * newly assigned permit per round, preventing a busy lane from draining the
+ * queue ahead of other eligible lanes.
+ */
+export async function runBoundedFair(work, concurrency, worker, options = {}) {
+    if (!Number.isInteger(concurrency) || concurrency < 1)
+        throw new TypeError('scheduler concurrency must be a positive integer');
+    const now = options.now ?? Date.now;
+    const results = new Array(work.length);
+    const lanes = new Map();
+    const order = [];
+    work.forEach((item, index) => {
+        let queue = lanes.get(item.lane);
+        if (!queue) {
+            queue = [];
+            lanes.set(item.lane, queue);
+            order.push(item.lane);
+        }
+        queue.push(index);
+    });
+    let cursor = 0;
+    let active = 0;
+    let remaining = work.length;
+    const resuming = [];
+    if (!remaining)
+        return results;
+    return await new Promise((resolve, reject) => {
+        const take = () => {
+            if (!order.length)
+                return undefined;
+            for (let checked = 0; checked < order.length; checked += 1) {
+                const position = cursor % order.length;
+                cursor = (position + 1) % order.length;
+                const queue = lanes.get(order[position]);
+                const index = queue.shift();
+                if (index !== undefined)
+                    return index;
+            }
+            return undefined;
+        };
+        const finishWaiting = () => {
+            const reason = options.signal?.aborted ? 'cancelled' : 'deadline-exceeded';
+            let index;
+            while ((index = take()) !== undefined) {
+                results[index] = new SchedulerWaitError(reason);
+                remaining -= 1;
+            }
+        };
+        const slot = {
+            suspend: async (during) => {
+                active -= 1;
+                pump();
+                try {
+                    return await during();
+                }
+                finally {
+                    // Suspended work re-enters before unstarted work so a backoff cannot be
+                    // starved. After cancellation or deadline it resumes at once; the worker
+                    // then observes the interruption and starts no new adapter call.
+                    await new Promise(resume => {
+                        if (active < concurrency || interrupted()) {
+                            active += 1;
+                            resume();
+                        }
+                        else
+                            resuming.push(() => { active += 1; resume(); });
+                    });
+                }
+            },
+        };
+        const interrupted = () => Boolean(options.signal?.aborted)
+            || (options.deadlineEpochMs !== undefined && now() >= options.deadlineEpochMs);
+        const pump = () => {
+            if (interrupted()) {
+                finishWaiting();
+                while (resuming.length)
+                    resuming.shift()();
+            }
+            while (active < concurrency && resuming.length)
+                resuming.shift()();
+            while (active < concurrency) {
+                const index = take();
+                if (index === undefined)
+                    break;
+                active += 1;
+                void worker(work[index].value, index, slot).then(value => { results[index] = value; }, error => {
+                    if (error instanceof SchedulerWaitError)
+                        results[index] = error;
+                    else
+                        reject(error);
+                }).finally(() => {
+                    active -= 1;
+                    remaining -= 1;
+                    if (remaining === 0)
+                        resolve(results);
+                    else
+                        pump();
+                });
+            }
+            if (remaining === 0)
+                resolve(results);
+        };
+        pump();
+    });
+}
+//# sourceMappingURL=scheduler.js.map

package/dist/src/decision/telemetry/context.js

@@ -0,0 +1,42 @@
+import { randomBytes } from 'node:crypto';
+const TRACEPARENT = /^00-([0-9a-f]{32})-([0-9a-f]{16})-(0[01])$/;
+export const randomTelemetryIds = {
+    traceId: () => randomBytes(16).toString('hex'),
+    spanId: () => randomBytes(8).toString('hex'),
+};
+function validNonZero(value) {
+    return !/^0+$/.test(value);
+}
+export function createTelemetryContext(ids = randomTelemetryIds, parent) {
+    const traceId = parent?.traceId ?? ids.traceId();
+    const spanId = ids.spanId();
+    if (!/^[0-9a-f]{32}$/.test(traceId) || !validNonZero(traceId)
+        || !/^[0-9a-f]{16}$/.test(spanId) || !validNonZero(spanId)) {
+        throw new Error('Telemetry ID source returned an invalid W3C identifier');
+    }
+    return { traceId, spanId, traceFlags: parent?.traceFlags ?? '01', ...(parent?.traceState ? { traceState: parent.traceState } : {}) };
+}
+export function injectTraceContext(context) {
+    return {
+        traceparent: `00-${context.traceId}-${context.spanId}-${context.traceFlags}`,
+        ...(context.traceState ? { tracestate: context.traceState.slice(0, 512) } : {}),
+    };
+}
+/** Provider-bound propagation: `traceparent` only, never vendor `tracestate`. */
+export function transportTraceContext(context) {
+    return { traceparent: injectTraceContext(context).traceparent };
+}
+export function isTraceparent(value) {
+    return typeof value === 'string' && extractTraceContext({ traceparent: value }) !== null && value === value.trim().toLowerCase();
+}
+export function extractTraceContext(headers) {
+    const match = TRACEPARENT.exec(headers.traceparent?.trim().toLowerCase() ?? '');
+    if (!match || !validNonZero(match[1]) || !validNonZero(match[2]))
+        return null;
+    const traceState = headers.tracestate?.trim();
+    return {
+        traceId: match[1], spanId: match[2], traceFlags: match[3],
+        ...(traceState && traceState.length <= 512 ? { traceState } : {}),
+    };
+}
+//# sourceMappingURL=context.js.map