@fluxpointstudios/orynq-sdk-process-trace 0.2.0

package/dist/index.cjs

@@ -0,0 +1,1339 @@
+'use strict';
+
+var utils = require('@fluxpointstudios/orynq-sdk-core/utils');
+
+// src/types.ts
+var DEFAULT_EVENT_VISIBILITY = {
+  command: "public",
+  output: "private",
+  decision: "private",
+  observation: "public",
+  error: "private",
+  custom: "private"
+};
+var HASH_DOMAIN_PREFIXES = {
+  event: "poi-trace:event:v1|",
+  roll: "poi-trace:roll:v1|",
+  span: "poi-trace:span:v1|",
+  leaf: "poi-trace:leaf:v1|",
+  node: "poi-trace:node:v1|",
+  manifest: "poi-trace:manifest:v1|",
+  root: "poi-trace:root:v1|"
+};
+var GENESIS_SEED = "genesis";
+async function computeEventHash(event) {
+  const eventWithoutHash = removeHashField(event);
+  const canonical = utils.canonicalize(eventWithoutHash);
+  const prefixedData = HASH_DOMAIN_PREFIXES.event + canonical;
+  return utils.sha256StringHex(prefixedData);
+}
+function removeHashField(event) {
+  const { hash: _, ...rest } = event;
+  return rest;
+}
+async function initRollingHash() {
+  const genesisInput = HASH_DOMAIN_PREFIXES.roll + GENESIS_SEED;
+  const genesisHash = await utils.sha256StringHex(genesisInput);
+  return {
+    currentHash: genesisHash,
+    itemCount: 0
+  };
+}
+async function updateRollingHash(state, eventHash) {
+  const input = HASH_DOMAIN_PREFIXES.roll + state.currentHash + "|" + eventHash;
+  const newHash = await utils.sha256StringHex(input);
+  return {
+    currentHash: newHash,
+    itemCount: state.itemCount + 1
+  };
+}
+async function computeRollingHash(events) {
+  const sortedEvents = [...events].sort((a, b) => a.seq - b.seq);
+  let state = await initRollingHash();
+  for (const event of sortedEvents) {
+    const eventHash = await computeEventHash(event);
+    state = await updateRollingHash(state, eventHash);
+  }
+  return state.currentHash;
+}
+async function verifyRollingHash(events, expectedHash) {
+  const computedHash = await computeRollingHash(events);
+  return constantTimeCompare(computedHash, expectedHash.toLowerCase());
+}
+function constantTimeCompare(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let result = 0;
+  for (let i = 0; i < a.length; i++) {
+    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return result === 0;
+}
+async function computeRootHash(rollingHash, spans) {
+  const sortedSpans = [...spans].sort((a, b) => a.spanSeq - b.spanSeq);
+  const spanHashes = sortedSpans.map((span) => {
+    if (!span.hash) {
+      throw new Error(`Span ${span.id} is missing hash field`);
+    }
+    return span.hash;
+  });
+  let input = HASH_DOMAIN_PREFIXES.root + rollingHash;
+  if (spanHashes.length > 0) {
+    input += "|" + spanHashes.join("|");
+  }
+  return utils.sha256StringHex(input);
+}
+async function computeEventHashes(events) {
+  const sortedEvents = [...events].sort((a, b) => a.seq - b.seq);
+  const hashPromises = sortedEvents.map((event) => computeEventHash(event));
+  return Promise.all(hashPromises);
+}
+async function getGenesisHash() {
+  const state = await initRollingHash();
+  return state.currentHash;
+}
+async function computeSpanHash(span, eventHashes) {
+  const spanHeader = {
+    id: span.id,
+    spanSeq: span.spanSeq,
+    name: span.name,
+    status: span.status,
+    visibility: span.visibility,
+    startedAt: span.startedAt,
+    eventIds: span.eventIds,
+    childSpanIds: span.childSpanIds
+  };
+  if (span.parentSpanId !== void 0) {
+    spanHeader.parentSpanId = span.parentSpanId;
+  }
+  if (span.endedAt !== void 0) {
+    spanHeader.endedAt = span.endedAt;
+  }
+  if (span.durationMs !== void 0) {
+    spanHeader.durationMs = span.durationMs;
+  }
+  if (span.metadata !== void 0) {
+    spanHeader.metadata = span.metadata;
+  }
+  const canonicalHeader = utils.canonicalize(spanHeader, { removeNulls: true });
+  let hashInput = HASH_DOMAIN_PREFIXES.span + canonicalHeader;
+  if (eventHashes.length > 0) {
+    hashInput += "|" + eventHashes.join("|");
+  }
+  return utils.sha256StringHex(hashInput);
+}
+async function buildSpanMerkleTree(spans, events) {
+  if (spans.length === 0) {
+    return {
+      rootHash: "",
+      leafCount: 0,
+      depth: 0,
+      leafHashes: []
+    };
+  }
+  const sortedSpans = [...spans].sort((a, b) => a.spanSeq - b.spanSeq);
+  const eventMap = /* @__PURE__ */ new Map();
+  for (const event of events) {
+    eventMap.set(event.id, event);
+  }
+  const leafHashes = [];
+  for (const span of sortedSpans) {
+    const spanEvents = span.eventIds.map((id) => eventMap.get(id)).filter((e) => e !== void 0).sort((a, b) => a.seq - b.seq);
+    const eventHashes = spanEvents.map((e) => e.hash ?? "");
+    const spanHash = await computeSpanHash(span, eventHashes);
+    const leafHash = await utils.sha256StringHex(HASH_DOMAIN_PREFIXES.leaf + spanHash);
+    leafHashes.push(leafHash);
+  }
+  const tree = await buildTreeFromLeaves(leafHashes);
+  return {
+    rootHash: tree.rootHash,
+    leafCount: leafHashes.length,
+    depth: tree.depth,
+    leafHashes
+  };
+}
+async function buildTreeFromLeaves(leafHashes) {
+  if (leafHashes.length === 1) {
+    const rootHash = leafHashes[0];
+    if (rootHash === void 0) {
+      throw new Error("Unexpected empty leaf hash array");
+    }
+    return {
+      rootHash,
+      depth: 0
+    };
+  }
+  let currentLevel = [...leafHashes];
+  let depth = 0;
+  while (currentLevel.length > 1) {
+    const nextLevel = [];
+    for (let i = 0; i < currentLevel.length; i += 2) {
+      const left = currentLevel[i];
+      if (left === void 0) {
+        throw new Error("Unexpected undefined hash in tree level");
+      }
+      const right = i + 1 < currentLevel.length ? currentLevel[i + 1] ?? left : left;
+      const parentHash = await utils.sha256StringHex(
+        HASH_DOMAIN_PREFIXES.node + left + "|" + right
+      );
+      nextLevel.push(parentHash);
+    }
+    currentLevel = nextLevel;
+    depth++;
+  }
+  const finalRoot = currentLevel[0];
+  if (finalRoot === void 0) {
+    throw new Error("Unexpected empty tree level");
+  }
+  return {
+    rootHash: finalRoot,
+    depth
+  };
+}
+function generateMerkleProof(tree, spanIndex) {
+  if (spanIndex < 0 || spanIndex >= tree.leafCount) {
+    throw new Error(
+      `Span index ${spanIndex} is out of bounds (0-${tree.leafCount - 1})`
+    );
+  }
+  if (tree.leafCount === 1) {
+    const leafHash2 = tree.leafHashes[0];
+    if (leafHash2 === void 0) {
+      throw new Error("Unexpected empty leaf hash array in tree");
+    }
+    return {
+      leafHash: leafHash2,
+      leafIndex: 0,
+      siblings: [],
+      rootHash: tree.rootHash
+    };
+  }
+  const siblings = [];
+  let currentLevel = [...tree.leafHashes];
+  let currentIndex = spanIndex;
+  while (currentLevel.length > 1) {
+    const isLeftChild = currentIndex % 2 === 0;
+    const siblingIndex = isLeftChild ? currentIndex + 1 : currentIndex - 1;
+    let siblingHash;
+    if (siblingIndex >= currentLevel.length) {
+      const currentHash = currentLevel[currentIndex];
+      if (currentHash === void 0) {
+        throw new Error("Unexpected undefined hash at current index");
+      }
+      siblingHash = currentHash;
+    } else {
+      const hash = currentLevel[siblingIndex];
+      if (hash === void 0) {
+        throw new Error("Unexpected undefined hash at sibling index");
+      }
+      siblingHash = hash;
+    }
+    siblings.push({
+      hash: siblingHash,
+      position: isLeftChild ? "right" : "left"
+    });
+    const nextLevel = [];
+    for (let i = 0; i < currentLevel.length; i += 2) {
+      const left = currentLevel[i] ?? "";
+      const right = i + 1 < currentLevel.length ? currentLevel[i + 1] ?? left : left;
+      nextLevel.push(`${left}|${right}`);
+    }
+    currentLevel = nextLevel;
+    currentIndex = Math.floor(currentIndex / 2);
+  }
+  const leafHash = tree.leafHashes[spanIndex];
+  if (leafHash === void 0) {
+    throw new Error(`Unexpected undefined leaf hash at index ${spanIndex}`);
+  }
+  return {
+    leafHash,
+    leafIndex: spanIndex,
+    siblings,
+    rootHash: tree.rootHash
+  };
+}
+async function verifyMerkleProof(proof) {
+  let currentHash = proof.leafHash;
+  for (const sibling of proof.siblings) {
+    let left;
+    let right;
+    if (sibling.position === "left") {
+      left = sibling.hash;
+      right = currentHash;
+    } else {
+      left = currentHash;
+      right = sibling.hash;
+    }
+    currentHash = await utils.sha256StringHex(
+      HASH_DOMAIN_PREFIXES.node + left + "|" + right
+    );
+  }
+  return currentHash === proof.rootHash;
+}
+async function verifySpanInclusion(proof, span, events) {
+  const sortedEvents = [...events].sort((a, b) => a.seq - b.seq);
+  const eventHashes = sortedEvents.map((e) => e.hash ?? "");
+  const spanHash = await computeSpanHash(span, eventHashes);
+  const computedLeafHash = await utils.sha256StringHex(
+    HASH_DOMAIN_PREFIXES.leaf + spanHash
+  );
+  if (computedLeafHash !== proof.leafHash) {
+    return false;
+  }
+  return verifyMerkleProof(proof);
+}
+
+// src/trace-builder.ts
+async function createTrace(opts) {
+  if (!opts.agentId || typeof opts.agentId !== "string") {
+    throw new Error("agentId is required and must be a non-empty string");
+  }
+  const runId = crypto.randomUUID();
+  const hashState = await initRollingHash();
+  const run = {
+    id: runId,
+    schemaVersion: "1.0",
+    agentId: opts.agentId,
+    status: "running",
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    events: [],
+    spans: [],
+    rollingHash: hashState.currentHash,
+    nextSeq: 0,
+    nextSpanSeq: 0
+  };
+  if (opts.metadata !== void 0) {
+    run.metadata = { ...opts.metadata };
+  }
+  if (opts.description !== void 0) {
+    run.metadata = {
+      ...run.metadata,
+      description: opts.description
+    };
+  }
+  return run;
+}
+function addSpan(run, opts) {
+  if (isFinalized(run)) {
+    throw new Error("Cannot add span to a finalized trace run");
+  }
+  if (!opts.name || typeof opts.name !== "string") {
+    throw new Error("name is required and must be a non-empty string");
+  }
+  if (opts.parentSpanId !== void 0) {
+    const parentSpan = getSpan(run, opts.parentSpanId);
+    if (!parentSpan) {
+      throw new Error(`Parent span not found: ${opts.parentSpanId}`);
+    }
+    if (parentSpan.status !== "running") {
+      throw new Error(`Parent span is not running: ${opts.parentSpanId}`);
+    }
+  }
+  const spanId = crypto.randomUUID();
+  const spanSeq = run.nextSpanSeq++;
+  const visibility = opts.visibility ?? "private";
+  const span = {
+    id: spanId,
+    spanSeq,
+    name: opts.name,
+    status: "running",
+    visibility,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    eventIds: [],
+    childSpanIds: []
+  };
+  if (opts.parentSpanId !== void 0) {
+    span.parentSpanId = opts.parentSpanId;
+  }
+  if (opts.metadata !== void 0) {
+    span.metadata = { ...opts.metadata };
+  }
+  run.spans.push(span);
+  if (opts.parentSpanId !== void 0) {
+    const parentSpan = getSpan(run, opts.parentSpanId);
+    if (parentSpan) {
+      parentSpan.childSpanIds.push(spanId);
+    }
+  }
+  return span;
+}
+function getSpan(run, spanId) {
+  return run.spans.find((s) => s.id === spanId);
+}
+function getSpanEvents(run, spanId) {
+  const span = getSpan(run, spanId);
+  if (!span) {
+    return [];
+  }
+  const eventMap = new Map(run.events.map((e) => [e.id, e]));
+  const spanEvents = span.eventIds.map((id) => eventMap.get(id)).filter((e) => e !== void 0);
+  return spanEvents.sort((a, b) => a.seq - b.seq);
+}
+async function addEvent(run, spanId, event) {
+  if (isFinalized(run)) {
+    throw new Error("Cannot add event to a finalized trace run");
+  }
+  const span = getSpan(run, spanId);
+  if (!span) {
+    throw new Error(`Span not found: ${spanId}`);
+  }
+  if (span.status !== "running") {
+    throw new Error(`Cannot add event to closed span: ${spanId} (status: ${span.status})`);
+  }
+  if (!event.kind || typeof event.kind !== "string") {
+    throw new Error("Event kind is required and must be a non-empty string");
+  }
+  const eventId = crypto.randomUUID();
+  const seq = run.nextSeq++;
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  const visibility = event.visibility ?? DEFAULT_EVENT_VISIBILITY[event.kind] ?? "private";
+  const completeEvent = {
+    ...event,
+    id: eventId,
+    seq,
+    timestamp,
+    visibility
+  };
+  const eventHash = await computeEventHash(completeEvent);
+  completeEvent.hash = eventHash;
+  const currentState = {
+    currentHash: run.rollingHash,
+    itemCount: run.events.length
+  };
+  const newState = await updateRollingHash(currentState, eventHash);
+  run.rollingHash = newState.currentHash;
+  span.eventIds.push(eventId);
+  run.events.push(completeEvent);
+  return completeEvent;
+}
+async function closeSpan(run, spanId, status = "completed") {
+  const span = getSpan(run, spanId);
+  if (!span) {
+    throw new Error(`Span not found: ${spanId}`);
+  }
+  if (span.status !== "running") {
+    throw new Error(`Span already closed: ${spanId} (status: ${span.status})`);
+  }
+  span.status = status;
+  const endedAt = (/* @__PURE__ */ new Date()).toISOString();
+  span.endedAt = endedAt;
+  const startTime = new Date(span.startedAt).getTime();
+  const endTime = new Date(endedAt).getTime();
+  span.durationMs = endTime - startTime;
+  const spanEvents = getSpanEvents(run, spanId);
+  const eventHashes = spanEvents.map((e) => e.hash ?? "");
+  span.hash = await computeSpanHash(span, eventHashes);
+}
+function isFinalized(run) {
+  return run.rootHash !== void 0;
+}
+async function finalizeTrace(run) {
+  if (isFinalized(run)) {
+    throw new Error("Trace run is already finalized");
+  }
+  for (const span of run.spans) {
+    if (span.status === "running") {
+      await closeSpan(run, span.id, "completed");
+    }
+  }
+  run.status = "completed";
+  const endedAt = (/* @__PURE__ */ new Date()).toISOString();
+  run.endedAt = endedAt;
+  const startTime = new Date(run.startedAt).getTime();
+  const endTime = new Date(endedAt).getTime();
+  run.durationMs = endTime - startTime;
+  const merkleTree = await buildSpanMerkleTree(run.spans, run.events);
+  const rootHash = await computeRootHash(run.rollingHash, run.spans);
+  run.rootHash = rootHash;
+  const publicView = createPublicView(run, merkleTree.rootHash);
+  const bundle = {
+    formatVersion: "1.0",
+    publicView,
+    privateRun: run,
+    merkleRoot: merkleTree.rootHash,
+    rootHash
+  };
+  return bundle;
+}
+function createPublicView(run, merkleRoot) {
+  const eventMap = new Map(run.events.map((e) => [e.id, e]));
+  const publicSpans = [];
+  const redactedSpanHashes = [];
+  for (const span of run.spans) {
+    if (span.visibility === "public") {
+      const spanEvents = span.eventIds.map((id) => eventMap.get(id)).filter((e) => e !== void 0).filter((e) => e.visibility === "public").sort((a, b) => a.seq - b.seq);
+      const annotatedSpan = {
+        ...span,
+        events: spanEvents
+      };
+      publicSpans.push(annotatedSpan);
+    } else {
+      if (span.hash) {
+        redactedSpanHashes.push({
+          spanId: span.id,
+          hash: span.hash
+        });
+      }
+    }
+  }
+  publicSpans.sort((a, b) => a.spanSeq - b.spanSeq);
+  redactedSpanHashes.sort((a, b) => a.spanId.localeCompare(b.spanId));
+  const publicView = {
+    runId: run.id,
+    agentId: run.agentId,
+    schemaVersion: run.schemaVersion,
+    startedAt: run.startedAt,
+    endedAt: run.endedAt ?? run.startedAt,
+    // Fallback for safety
+    durationMs: run.durationMs ?? 0,
+    status: run.status,
+    totalEvents: run.events.length,
+    totalSpans: run.spans.length,
+    rootHash: run.rootHash ?? "",
+    merkleRoot,
+    publicSpans,
+    redactedSpanHashes
+  };
+  return publicView;
+}
+function getEventCount(run) {
+  return run.events.length;
+}
+function getSpanCount(run) {
+  return run.spans.length;
+}
+function getRootSpans(run) {
+  return run.spans.filter((s) => s.parentSpanId === void 0);
+}
+function getChildSpans(run, parentSpanId) {
+  return run.spans.filter((s) => s.parentSpanId === parentSpanId);
+}
+function getEvent(run, eventId) {
+  return run.events.find((e) => e.id === eventId);
+}
+function getEventsByKind(run, kind) {
+  return run.events.filter(
+    (e) => e.kind === kind
+  );
+}
+function isPublicSpan(span) {
+  return span.visibility === "public";
+}
+function isPublicEvent(event) {
+  return event.visibility === "public";
+}
+function filterPublicEvents(events) {
+  return events.filter(isPublicEvent);
+}
+async function createBundle(run) {
+  if (!run.rootHash) {
+    throw new Error(
+      "Cannot create bundle from non-finalized run: rootHash is missing. Call finalizeTraceRun() before creating a bundle."
+    );
+  }
+  if (run.status === "running") {
+    throw new Error(
+      "Cannot create bundle from running trace. The trace must be completed, failed, or cancelled."
+    );
+  }
+  for (const event of run.events) {
+    if (!event.hash) {
+      throw new Error(
+        `Event ${event.id} (seq ${event.seq}) is missing hash. All events must have hashes computed before creating a bundle.`
+      );
+    }
+  }
+  for (const span of run.spans) {
+    if (!span.hash) {
+      throw new Error(
+        `Span ${span.id} (spanSeq ${span.spanSeq}) is missing hash. All spans must have hashes computed before creating a bundle.`
+      );
+    }
+  }
+  const merkleTree = await buildSpanMerkleTree(run.spans, run.events);
+  const publicView = createPublicView2(run, merkleTree.rootHash);
+  const bundle = {
+    formatVersion: run.schemaVersion,
+    publicView,
+    privateRun: run,
+    merkleRoot: merkleTree.rootHash,
+    rootHash: run.rootHash
+  };
+  return bundle;
+}
+function createPublicView2(run, merkleRoot) {
+  const eventMap = /* @__PURE__ */ new Map();
+  for (const event of run.events) {
+    eventMap.set(event.id, event);
+  }
+  const publicSpans = [];
+  const redactedSpanHashes = [];
+  for (const span of run.spans) {
+    if (isPublicSpan(span)) {
+      const spanEvents = span.eventIds.map((id) => eventMap.get(id)).filter((e) => e !== void 0).filter(isPublicEvent).sort((a, b) => a.seq - b.seq);
+      const annotatedSpan = {
+        ...span,
+        events: spanEvents
+      };
+      publicSpans.push(annotatedSpan);
+    } else {
+      redactedSpanHashes.push({
+        spanId: span.id,
+        hash: span.hash ?? ""
+      });
+    }
+  }
+  publicSpans.sort((a, b) => a.spanSeq - b.spanSeq);
+  redactedSpanHashes.sort((a, b) => a.spanId.localeCompare(b.spanId));
+  return {
+    runId: run.id,
+    agentId: run.agentId,
+    schemaVersion: run.schemaVersion,
+    startedAt: run.startedAt,
+    endedAt: run.endedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    durationMs: run.durationMs ?? 0,
+    status: run.status,
+    totalEvents: run.events.length,
+    totalSpans: run.spans.length,
+    rootHash: run.rootHash ?? "",
+    merkleRoot,
+    publicSpans,
+    redactedSpanHashes
+  };
+}
+function extractPublicView(bundle) {
+  return bundle.publicView;
+}
+async function verifyBundle(bundle) {
+  const errors = [];
+  const warnings = [];
+  const checks = {
+    rollingHashValid: false,
+    rootHashValid: false,
+    merkleRootValid: false,
+    spanHashesValid: false,
+    eventHashesValid: false,
+    sequenceValid: false
+  };
+  const run = bundle.privateRun;
+  const sequenceErrors = verifySequences(run);
+  if (sequenceErrors.length === 0) {
+    checks.sequenceValid = true;
+  } else {
+    errors.push(...sequenceErrors);
+  }
+  const eventHashErrors = await verifyEventHashes(run.events);
+  if (eventHashErrors.length === 0) {
+    checks.eventHashesValid = true;
+  } else {
+    errors.push(...eventHashErrors);
+  }
+  const spanHashErrors = await verifySpanHashes(run.spans, run.events);
+  if (spanHashErrors.length === 0) {
+    checks.spanHashesValid = true;
+  } else {
+    errors.push(...spanHashErrors);
+  }
+  try {
+    const computedRollingHash = await computeRollingHash(run.events);
+    if (computedRollingHash === run.rollingHash) {
+      checks.rollingHashValid = true;
+    } else {
+      errors.push(
+        `Rolling hash mismatch: expected ${run.rollingHash}, computed ${computedRollingHash}`
+      );
+    }
+  } catch (error) {
+    errors.push(
+      `Failed to compute rolling hash: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  try {
+    const computedRootHash = await computeRootHash(run.rollingHash, run.spans);
+    if (computedRootHash === bundle.rootHash) {
+      checks.rootHashValid = true;
+    } else {
+      errors.push(
+        `Root hash mismatch: expected ${bundle.rootHash}, computed ${computedRootHash}`
+      );
+    }
+  } catch (error) {
+    errors.push(
+      `Failed to compute root hash: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  try {
+    const merkleTree = await buildSpanMerkleTree(run.spans, run.events);
+    if (merkleTree.rootHash === bundle.merkleRoot) {
+      checks.merkleRootValid = true;
+    } else {
+      errors.push(
+        `Merkle root mismatch: expected ${bundle.merkleRoot}, computed ${merkleTree.rootHash}`
+      );
+    }
+  } catch (error) {
+    errors.push(
+      `Failed to compute Merkle root: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (bundle.publicView.publicSpans.length === 0 && run.spans.length > 0) {
+    warnings.push(
+      "No public spans in bundle. The public view will be empty. Consider marking some spans as public for transparency."
+    );
+  }
+  if (bundle.publicView.status !== run.status) {
+    warnings.push(
+      `Status mismatch between publicView (${bundle.publicView.status}) and privateRun (${run.status})`
+    );
+  }
+  const valid = checks.rollingHashValid && checks.rootHashValid && checks.merkleRootValid && checks.spanHashesValid && checks.eventHashesValid && checks.sequenceValid;
+  return {
+    valid,
+    errors,
+    warnings,
+    checks
+  };
+}
+function verifySequences(run) {
+  const errors = [];
+  const sortedEvents = [...run.events].sort((a, b) => a.seq - b.seq);
+  for (let i = 0; i < sortedEvents.length; i++) {
+    const event = sortedEvents[i];
+    if (event !== void 0 && event.seq !== i) {
+      errors.push(
+        `Event sequence gap: expected seq ${i}, found ${event.seq} for event ${event.id}`
+      );
+    }
+  }
+  const sortedSpans = [...run.spans].sort((a, b) => a.spanSeq - b.spanSeq);
+  for (let i = 0; i < sortedSpans.length; i++) {
+    const span = sortedSpans[i];
+    if (span !== void 0 && span.spanSeq !== i) {
+      errors.push(
+        `Span sequence gap: expected spanSeq ${i}, found ${span.spanSeq} for span ${span.id}`
+      );
+    }
+  }
+  return errors;
+}
+async function verifyEventHashes(events) {
+  const errors = [];
+  for (const event of events) {
+    if (!event.hash) {
+      errors.push(`Event ${event.id} (seq ${event.seq}) is missing hash`);
+      continue;
+    }
+    try {
+      const computedHash = await computeEventHash(event);
+      if (computedHash !== event.hash) {
+        errors.push(
+          `Event hash mismatch for ${event.id} (seq ${event.seq}): expected ${event.hash}, computed ${computedHash}`
+        );
+      }
+    } catch (error) {
+      errors.push(
+        `Failed to compute hash for event ${event.id}: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+  return errors;
+}
+async function verifySpanHashes(spans, events) {
+  const errors = [];
+  const eventMap = /* @__PURE__ */ new Map();
+  for (const event of events) {
+    eventMap.set(event.id, event);
+  }
+  for (const span of spans) {
+    if (!span.hash) {
+      errors.push(
+        `Span ${span.id} (spanSeq ${span.spanSeq}) is missing hash`
+      );
+      continue;
+    }
+    try {
+      const spanEvents = span.eventIds.map((id) => eventMap.get(id)).filter((e) => e !== void 0).sort((a, b) => a.seq - b.seq);
+      const eventHashes = spanEvents.map((e) => e.hash ?? "");
+      const computedHash = await computeSpanHash(span, eventHashes);
+      if (computedHash !== span.hash) {
+        errors.push(
+          `Span hash mismatch for ${span.id} (spanSeq ${span.spanSeq}): expected ${span.hash}, computed ${computedHash}`
+        );
+      }
+    } catch (error) {
+      errors.push(
+        `Failed to compute hash for span ${span.id}: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+  return errors;
+}
+async function signBundle(bundle, provider) {
+  const signingPayload = {
+    rootHash: bundle.rootHash,
+    merkleRoot: bundle.merkleRoot
+  };
+  if (bundle.manifestHash) {
+    signingPayload.manifestHash = bundle.manifestHash;
+  }
+  const canonicalPayload = utils.canonicalize(signingPayload);
+  const payloadBytes = new TextEncoder().encode(canonicalPayload);
+  const signatureBytes = await provider.sign(payloadBytes);
+  const signatureHex = utils.bytesToHex(signatureBytes);
+  return {
+    ...bundle,
+    signerId: provider.signerId,
+    signature: signatureHex
+  };
+}
+async function verifyBundleSignature(bundle, provider) {
+  if (!bundle.signature) {
+    return false;
+  }
+  if (!bundle.signerId) {
+    return false;
+  }
+  try {
+    const signingPayload = {
+      rootHash: bundle.rootHash,
+      merkleRoot: bundle.merkleRoot
+    };
+    if (bundle.manifestHash) {
+      signingPayload.manifestHash = bundle.manifestHash;
+    }
+    const canonicalPayload = utils.canonicalize(signingPayload);
+    const payloadBytes = new TextEncoder().encode(canonicalPayload);
+    const signatureBytes = utils.hexToBytes(bundle.signature);
+    return await provider.verify(payloadBytes, signatureBytes, bundle.signerId);
+  } catch (error) {
+    return false;
+  }
+}
+function getSpanEvents2(span, events) {
+  const eventMap = /* @__PURE__ */ new Map();
+  for (const event of events) {
+    eventMap.set(event.id, event);
+  }
+  return span.eventIds.map((id) => eventMap.get(id)).filter((e) => e !== void 0).sort((a, b) => a.seq - b.seq);
+}
+function countEventsByVisibility(run) {
+  const counts = {
+    public: 0,
+    private: 0,
+    secret: 0
+  };
+  for (const event of run.events) {
+    counts[event.visibility]++;
+  }
+  return counts;
+}
+function countSpansByVisibility(run) {
+  const counts = {
+    public: 0,
+    private: 0,
+    secret: 0
+  };
+  for (const span of run.spans) {
+    counts[span.visibility]++;
+  }
+  return counts;
+}
+function canDisclose(bundle, spanId) {
+  return bundle.privateRun.spans.some((span) => span.id === spanId);
+}
+function getSpanIndex(bundle, spanId) {
+  const sortedSpans = [...bundle.privateRun.spans].sort(
+    (a, b) => a.spanSeq - b.spanSeq
+  );
+  const index = sortedSpans.findIndex((span) => span.id === spanId);
+  if (index === -1) {
+    throw new Error(
+      `Span with ID "${spanId}" not found in bundle. Available span IDs: ${sortedSpans.map((s) => s.id).join(", ")}`
+    );
+  }
+  return index;
+}
+function getSpanEventsFromBundle(bundle, span) {
+  const eventMap = /* @__PURE__ */ new Map();
+  for (const event of bundle.privateRun.events) {
+    eventMap.set(event.id, event);
+  }
+  return span.eventIds.map((id) => eventMap.get(id)).filter((e) => e !== void 0).sort((a, b) => a.seq - b.seq);
+}
+function createDisclosureRequest(bundle, spanIds, mode) {
+  return {
+    bundleRootHash: bundle.rootHash,
+    bundleMerkleRoot: bundle.merkleRoot,
+    spanIds: [...spanIds],
+    // Create a copy to prevent external mutation
+    mode
+  };
+}
+async function selectiveDisclose(bundle, spanIds, mode) {
+  const missingSpanIds = [];
+  for (const spanId of spanIds) {
+    if (!canDisclose(bundle, spanId)) {
+      missingSpanIds.push(spanId);
+    }
+  }
+  if (missingSpanIds.length > 0) {
+    throw new Error(
+      `Cannot disclose spans that do not exist in bundle: ${missingSpanIds.join(", ")}`
+    );
+  }
+  const merkleTree = await buildSpanMerkleTree(
+    bundle.privateRun.spans,
+    bundle.privateRun.events
+  );
+  const sortedSpans = [...bundle.privateRun.spans].sort(
+    (a, b) => a.spanSeq - b.spanSeq
+  );
+  const spanMap = /* @__PURE__ */ new Map();
+  for (const span of sortedSpans) {
+    spanMap.set(span.id, span);
+  }
+  const disclosedSpans = [];
+  for (const spanId of spanIds) {
+    const span = spanMap.get(spanId);
+    if (!span) {
+      throw new Error(`Span "${spanId}" not found after validation`);
+    }
+    const spanIndex = getSpanIndex(bundle, spanId);
+    const proof = generateMerkleProof(merkleTree, spanIndex);
+    if (mode === "full") {
+      const events = getSpanEventsFromBundle(bundle, span);
+      disclosedSpans.push({
+        spanId,
+        proof,
+        span: { ...span },
+        // Clone to prevent external mutation
+        events: events.map((e) => ({ ...e }))
+        // Clone events
+      });
+    } else {
+      disclosedSpans.push({
+        spanId,
+        proof
+        // span and events are undefined in membership mode
+      });
+    }
+  }
+  return {
+    mode,
+    rootHash: bundle.rootHash,
+    merkleRoot: bundle.merkleRoot,
+    disclosedSpans
+  };
+}
+async function verifyDisclosure(disclosure, expectedRootHash, expectedMerkleRoot) {
+  const errors = [];
+  if (disclosure.rootHash !== expectedRootHash) {
+    errors.push(
+      `Root hash mismatch: disclosure has "${disclosure.rootHash}", expected "${expectedRootHash}"`
+    );
+  }
+  if (disclosure.merkleRoot !== expectedMerkleRoot) {
+    errors.push(
+      `Merkle root mismatch: disclosure has "${disclosure.merkleRoot}", expected "${expectedMerkleRoot}"`
+    );
+  }
+  for (const disclosed of disclosure.disclosedSpans) {
+    const proofValid = await verifyMerkleProof(disclosed.proof);
+    if (!proofValid) {
+      errors.push(
+        `Merkle proof verification failed for span "${disclosed.spanId}"`
+      );
+      continue;
+    }
+    if (disclosed.proof.rootHash !== expectedMerkleRoot) {
+      errors.push(
+        `Proof root hash mismatch for span "${disclosed.spanId}": proof has "${disclosed.proof.rootHash}", expected "${expectedMerkleRoot}"`
+      );
+    }
+    if (disclosure.mode === "full" && disclosed.span && disclosed.events) {
+      const spanVerification = await verifySpanDisclosure(
+        {
+          spanId: disclosed.spanId,
+          proof: disclosed.proof,
+          span: disclosed.span,
+          events: disclosed.events
+        },
+        expectedMerkleRoot
+      );
+      if (!spanVerification.valid) {
+        errors.push(...spanVerification.errors);
+      }
+    }
+  }
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+async function verifySpanDisclosure(disclosed, expectedMerkleRoot) {
+  const errors = [];
+  const sortedEvents = [...disclosed.events].sort((a, b) => a.seq - b.seq);
+  const eventHashes = sortedEvents.map((e) => e.hash ?? "");
+  const computedSpanHash = await computeSpanHash(disclosed.span, eventHashes);
+  const computedLeafHash = await utils.sha256StringHex(
+    HASH_DOMAIN_PREFIXES.leaf + computedSpanHash
+  );
+  if (computedLeafHash !== disclosed.proof.leafHash) {
+    errors.push(
+      `Span hash verification failed for "${disclosed.spanId}": computed leaf hash "${computedLeafHash}" does not match proof leaf hash "${disclosed.proof.leafHash}". The span data may have been modified.`
+    );
+  }
+  const proofValid = await verifyMerkleProof(disclosed.proof);
+  if (!proofValid) {
+    errors.push(
+      `Merkle proof verification failed for span "${disclosed.spanId}"`
+    );
+  }
+  if (disclosed.proof.rootHash !== expectedMerkleRoot) {
+    errors.push(
+      `Proof root hash mismatch for span "${disclosed.spanId}": proof has "${disclosed.proof.rootHash}", expected "${expectedMerkleRoot}"`
+    );
+  }
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+var DEFAULT_CHUNK_SIZE = 1e6;
+async function createManifest(bundle, options) {
+  const chunkSize = options?.chunkSize ?? DEFAULT_CHUNK_SIZE;
+  const compression = options?.compression ?? "none";
+  const run = bundle.privateRun;
+  const eventMap = /* @__PURE__ */ new Map();
+  for (const event of run.events) {
+    eventMap.set(event.id, event);
+  }
+  const chunks = [];
+  let currentChunkSpans = [];
+  let currentChunkEvents = [];
+  let currentChunkSize = 0;
+  let chunkIndex = 0;
+  const sortedSpans = [...run.spans].sort((a, b) => a.spanSeq - b.spanSeq);
+  for (const span of sortedSpans) {
+    const spanEvents = span.eventIds.map((id) => eventMap.get(id)).filter((e) => e !== void 0).sort((a, b) => a.seq - b.seq);
+    const spanJson = JSON.stringify(span);
+    const eventsJson = spanEvents.map((e) => JSON.stringify(e)).join("");
+    const spanSize = spanJson.length + eventsJson.length;
+    if (currentChunkSize + spanSize > chunkSize && currentChunkSpans.length > 0) {
+      const chunk = await createChunk(
+        chunkIndex,
+        currentChunkSpans,
+        currentChunkEvents,
+        compression
+      );
+      chunks.push(chunk);
+      chunkIndex++;
+      currentChunkSpans = [];
+      currentChunkEvents = [];
+      currentChunkSize = 0;
+    }
+    currentChunkSpans.push(span);
+    currentChunkEvents.push(...spanEvents);
+    currentChunkSize += spanSize;
+  }
+  if (currentChunkSpans.length > 0) {
+    const chunk = await createChunk(
+      chunkIndex,
+      currentChunkSpans,
+      currentChunkEvents,
+      compression
+    );
+    chunks.push(chunk);
+  }
+  const manifestWithoutHash = {
+    formatVersion: bundle.formatVersion,
+    runId: run.id,
+    agentId: run.agentId,
+    rootHash: bundle.rootHash,
+    merkleRoot: bundle.merkleRoot,
+    totalEvents: run.events.length,
+    totalSpans: run.spans.length,
+    startedAt: run.startedAt,
+    endedAt: run.endedAt ?? run.startedAt,
+    durationMs: run.durationMs ?? 0,
+    chunks: chunks.map((c) => c.info),
+    publicView: bundle.publicView
+  };
+  const manifestHash = await computeManifestHash(manifestWithoutHash);
+  const manifest = {
+    ...manifestWithoutHash,
+    manifestHash
+  };
+  return { manifest, chunks };
+}
+async function createChunk(index, spans, events, compression) {
+  const content = {
+    spans,
+    events
+  };
+  const contentJson = utils.canonicalize(content);
+  const hash = await utils.sha256StringHex(contentJson);
+  const spanIds = spans.map((s) => s.id);
+  const info = {
+    index,
+    hash,
+    size: contentJson.length,
+    compression,
+    spanIds
+  };
+  return {
+    info,
+    content: contentJson
+  };
+}
+async function computeManifestHash(manifest) {
+  const canonical = utils.canonicalize(manifest);
+  const prefixedData = HASH_DOMAIN_PREFIXES.manifest + canonical;
+  return utils.sha256StringHex(prefixedData);
+}
+async function verifyManifest(manifest, chunks) {
+  const errors = [];
+  const warnings = [];
+  const checks = {
+    manifestHashValid: false,
+    chunkHashesValid: false,
+    rootHashMatches: false,
+    merkleRootMatches: false
+  };
+  try {
+    const manifestWithoutHash = {
+      formatVersion: manifest.formatVersion,
+      runId: manifest.runId,
+      agentId: manifest.agentId,
+      rootHash: manifest.rootHash,
+      merkleRoot: manifest.merkleRoot,
+      totalEvents: manifest.totalEvents,
+      totalSpans: manifest.totalSpans,
+      startedAt: manifest.startedAt,
+      endedAt: manifest.endedAt,
+      durationMs: manifest.durationMs,
+      chunks: manifest.chunks,
+      publicView: manifest.publicView
+    };
+    const computedHash = await computeManifestHash(manifestWithoutHash);
+    if (manifest.manifestHash === computedHash) {
+      checks.manifestHashValid = true;
+    } else {
+      errors.push(
+        `Manifest hash mismatch: expected ${manifest.manifestHash}, computed ${computedHash}`
+      );
+    }
+  } catch (error) {
+    errors.push(
+      `Failed to compute manifest hash: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  const chunkByIndex = /* @__PURE__ */ new Map();
+  for (const chunk of chunks) {
+    chunkByIndex.set(chunk.info.index, chunk);
+  }
+  let allChunkHashesValid = true;
+  for (const chunkInfo of manifest.chunks) {
+    const chunk = chunkByIndex.get(chunkInfo.index);
+    if (!chunk) {
+      errors.push(`Missing chunk at index ${chunkInfo.index}`);
+      allChunkHashesValid = false;
+      continue;
+    }
+    try {
+      const computedHash = await utils.sha256StringHex(chunk.content);
+      if (computedHash !== chunkInfo.hash) {
+        errors.push(
+          `Chunk ${chunkInfo.index} hash mismatch: expected ${chunkInfo.hash}, computed ${computedHash}`
+        );
+        allChunkHashesValid = false;
+      }
+      if (chunk.content.length !== chunkInfo.size) {
+        errors.push(
+          `Chunk ${chunkInfo.index} size mismatch: expected ${chunkInfo.size}, got ${chunk.content.length}`
+        );
+        allChunkHashesValid = false;
+      }
+    } catch (error) {
+      errors.push(
+        `Failed to verify chunk ${chunkInfo.index}: ${error instanceof Error ? error.message : String(error)}`
+      );
+      allChunkHashesValid = false;
+    }
+  }
+  for (const chunk of chunks) {
+    const inManifest = manifest.chunks.some((c) => c.index === chunk.info.index);
+    if (!inManifest) {
+      warnings.push(`Extra chunk at index ${chunk.info.index} not referenced in manifest`);
+    }
+  }
+  checks.chunkHashesValid = allChunkHashesValid;
+  if (manifest.rootHash && manifest.rootHash.length > 0) {
+    checks.rootHashMatches = true;
+  } else {
+    errors.push("Manifest is missing rootHash");
+  }
+  if (manifest.merkleRoot && manifest.merkleRoot.length > 0) {
+    checks.merkleRootMatches = true;
+  } else {
+    errors.push("Manifest is missing merkleRoot");
+  }
+  if (manifest.chunks.length === 0) {
+    warnings.push("Manifest has no chunks - trace data may be empty");
+  }
+  if (manifest.totalSpans === 0 && manifest.chunks.length > 0) {
+    warnings.push("Manifest reports 0 spans but has chunks");
+  }
+  const valid = checks.manifestHashValid && checks.chunkHashesValid && checks.rootHashMatches && checks.merkleRootMatches;
+  return {
+    valid,
+    errors,
+    warnings,
+    checks
+  };
+}
+async function reconstructBundleFromManifest(manifest, chunks) {
+  const chunkByIndex = /* @__PURE__ */ new Map();
+  for (const chunk of chunks) {
+    chunkByIndex.set(chunk.info.index, chunk);
+  }
+  const allSpans = [];
+  const allEvents = [];
+  const sortedChunkInfos = [...manifest.chunks].sort((a, b) => a.index - b.index);
+  for (const chunkInfo of sortedChunkInfos) {
+    const chunk = chunkByIndex.get(chunkInfo.index);
+    if (!chunk) {
+      throw new Error(`Missing chunk at index ${chunkInfo.index}`);
+    }
+    const { spans, events } = parseChunkContent(chunk.content);
+    allSpans.push(...spans);
+    allEvents.push(...events);
+  }
+  allSpans.sort((a, b) => a.spanSeq - b.spanSeq);
+  allEvents.sort((a, b) => a.seq - b.seq);
+  const nextSeq = allEvents.length > 0 ? Math.max(...allEvents.map((e) => e.seq)) + 1 : 0;
+  const nextSpanSeq = allSpans.length > 0 ? Math.max(...allSpans.map((s) => s.spanSeq)) + 1 : 0;
+  const privateRun = {
+    id: manifest.runId,
+    schemaVersion: manifest.formatVersion,
+    agentId: manifest.agentId,
+    status: manifest.publicView.status,
+    startedAt: manifest.startedAt,
+    endedAt: manifest.endedAt,
+    durationMs: manifest.durationMs,
+    events: allEvents,
+    spans: allSpans,
+    rollingHash: "",
+    // Would need to be recomputed for full verification
+    rootHash: manifest.rootHash,
+    nextSeq,
+    nextSpanSeq
+  };
+  const bundle = {
+    formatVersion: manifest.formatVersion,
+    publicView: manifest.publicView,
+    privateRun,
+    merkleRoot: manifest.merkleRoot,
+    rootHash: manifest.rootHash
+  };
+  if (manifest.manifestHash !== void 0) {
+    bundle.manifestHash = manifest.manifestHash;
+  }
+  return bundle;
+}
+function getChunkPath(chunkInfo) {
+  return `chunks/${chunkInfo.hash}.json`;
+}
+function parseChunkContent(content) {
+  try {
+    const parsed = JSON.parse(content);
+    if (typeof parsed !== "object" || parsed === null) {
+      throw new Error("Chunk content must be an object");
+    }
+    const obj = parsed;
+    if (!Array.isArray(obj.spans)) {
+      throw new Error("Chunk content must have a 'spans' array");
+    }
+    if (!Array.isArray(obj.events)) {
+      throw new Error("Chunk content must have an 'events' array");
+    }
+    const spans = obj.spans;
+    const events = obj.events;
+    for (const span of spans) {
+      if (typeof span.id !== "string" || typeof span.spanSeq !== "number") {
+        throw new Error("Invalid span structure in chunk content");
+      }
+    }
+    for (const event of events) {
+      if (typeof event.id !== "string" || typeof event.seq !== "number") {
+        throw new Error("Invalid event structure in chunk content");
+      }
+    }
+    return { spans, events };
+  } catch (error) {
+    if (error instanceof SyntaxError) {
+      throw new Error(`Invalid JSON in chunk content: ${error.message}`);
+    }
+    throw error;
+  }
+}
+
+// src/index.ts
+var VERSION = "0.1.0";
+
+exports.DEFAULT_EVENT_VISIBILITY = DEFAULT_EVENT_VISIBILITY;
+exports.HASH_DOMAIN_PREFIXES = HASH_DOMAIN_PREFIXES;
+exports.VERSION = VERSION;
+exports.addEvent = addEvent;
+exports.addSpan = addSpan;
+exports.buildSpanMerkleTree = buildSpanMerkleTree;
+exports.canDisclose = canDisclose;
+exports.closeSpan = closeSpan;
+exports.computeEventHash = computeEventHash;
+exports.computeEventHashes = computeEventHashes;
+exports.computeManifestHash = computeManifestHash;
+exports.computeRollingHash = computeRollingHash;
+exports.computeRootHash = computeRootHash;
+exports.computeSpanHash = computeSpanHash;
+exports.countEventsByVisibility = countEventsByVisibility;
+exports.countSpansByVisibility = countSpansByVisibility;
+exports.createBundle = createBundle;
+exports.createDisclosureRequest = createDisclosureRequest;
+exports.createManifest = createManifest;
+exports.createTrace = createTrace;
+exports.extractPublicView = extractPublicView;
+exports.filterPublicEvents = filterPublicEvents;
+exports.finalizeTrace = finalizeTrace;
+exports.generateMerkleProof = generateMerkleProof;
+exports.getBundleSpanEvents = getSpanEvents2;
+exports.getChildSpans = getChildSpans;
+exports.getChunkPath = getChunkPath;
+exports.getEvent = getEvent;
+exports.getEventCount = getEventCount;
+exports.getEventsByKind = getEventsByKind;
+exports.getGenesisHash = getGenesisHash;
+exports.getRootSpans = getRootSpans;
+exports.getSpan = getSpan;
+exports.getSpanCount = getSpanCount;
+exports.getSpanEvents = getSpanEvents;
+exports.getSpanIndex = getSpanIndex;
+exports.initRollingHash = initRollingHash;
+exports.isFinalized = isFinalized;
+exports.isPublicEvent = isPublicEvent;
+exports.isPublicSpan = isPublicSpan;
+exports.parseChunkContent = parseChunkContent;
+exports.reconstructBundleFromManifest = reconstructBundleFromManifest;
+exports.selectiveDisclose = selectiveDisclose;
+exports.signBundle = signBundle;
+exports.updateRollingHash = updateRollingHash;
+exports.verifyBundle = verifyBundle;
+exports.verifyBundleSignature = verifyBundleSignature;
+exports.verifyDisclosure = verifyDisclosure;
+exports.verifyManifest = verifyManifest;
+exports.verifyMerkleProof = verifyMerkleProof;
+exports.verifyRollingHash = verifyRollingHash;
+exports.verifySpanDisclosure = verifySpanDisclosure;
+exports.verifySpanInclusion = verifySpanInclusion;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map