@pensar/apex 2.5.0 → 2.6.1-canary.0cc77dcc

package/build/cli-xcy2vxj2.js

@@ -0,0 +1,1732 @@
+import {
+  toJsonValue,
+  stringifyCanonicalJson,
+  JsonValueSchema,
+  NATIVE_EVIDENCE_AVAILABILITY_STATES,
+  parseNativeRolloutEvidence,
+  init_native_rollout_evidence
+} from "./cli-se8ae8z3.js";
+import {
+  init_zod
+} from "./cli-3qznjsnr.js";
+import {
+  string,
+  number,
+  boolean,
+  array,
+  strictObject,
+  union,
+  discriminatedUnion,
+  record,
+  _enum,
+  literal,
+  lazy
+} from "./cli-mz5pk30x.js";
+
+// src/core/api/trajectoryExport.ts
+import { createHash as createHash3, randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import {
+  link,
+  mkdir,
+  open,
+  readFile,
+  rm
+} from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
+
+// src/core/atif/convert.ts
+init_native_rollout_evidence();
+import { createHash } from "node:crypto";
+import { posix } from "node:path";
+
+// src/core/atif/schema.ts
+init_zod();
+init_native_rollout_evidence();
+var ATIF_SCHEMA_VERSION = "ATIF-v1.8";
+var ATIF_REFERENCE_REVISION = "88fdbc9d42e907c0414654f041ece5eaf798f538";
+var TRAJECTORY_BUNDLE_TYPE = "evalgate.trajectory-bundle";
+var TRAJECTORY_BUNDLE_VERSION = 1;
+var TRAJECTORY_BUNDLE_FILENAME = "trajectory-bundle.json";
+var TRAJECTORY_BUNDLE_LIMITS = {
+  files: 512,
+  fileBytes: 16 * 1024 * 1024,
+  totalBytes: 64 * 1024 * 1024
+};
+var APEX_ATIF_EXPORTER_VERSION = "1";
+var ATIF_EXPORT_SOURCE_LIMITS = {
+  maxSources: 512,
+  maxTotalSourceBytes: 64 * 1024 * 1024
+};
+var JsonObjectSchema = JsonValueSchema.refine((value) => typeof value === "object" && value !== null && !Array.isArray(value), { message: "expected a JSON object" });
+var AtifTextContentPartSchema = strictObject({
+  type: literal("text"),
+  text: string()
+});
+var AtifImageSourceSchema = strictObject({
+  media_type: _enum(["image/jpeg", "image/png", "image/gif", "image/webp"]),
+  path: string().min(1)
+});
+var AtifAudioSourceSchema = strictObject({
+  media_type: _enum([
+    "audio/wav",
+    "audio/mpeg",
+    "audio/mp4",
+    "audio/aac",
+    "audio/ogg",
+    "audio/flac",
+    "audio/webm",
+    "audio/aiff"
+  ]),
+  path: string().min(1),
+  duration_sec: number().finite().nonnegative().optional()
+});
+var AtifContentPartSchema = discriminatedUnion("type", [
+  AtifTextContentPartSchema,
+  strictObject({
+    type: literal("image"),
+    source: AtifImageSourceSchema
+  }),
+  strictObject({
+    type: literal("audio"),
+    source: AtifAudioSourceSchema
+  })
+]);
+var AtifToolDefinitionSchema = strictObject({
+  type: literal("function"),
+  function: strictObject({
+    name: string().min(1),
+    description: string().optional(),
+    parameters: JsonObjectSchema
+  })
+});
+var AtifAgentSchema = strictObject({
+  name: string().min(1),
+  version: string().min(1),
+  model_name: string().min(1).optional(),
+  tool_definitions: array(AtifToolDefinitionSchema).optional(),
+  extra: JsonObjectSchema.optional()
+});
+var AtifToolCallSchema = strictObject({
+  tool_call_id: string().min(1),
+  function_name: string().min(1),
+  arguments: JsonObjectSchema,
+  extra: JsonObjectSchema.optional()
+});
+var AtifSubagentTrajectoryRefSchema = strictObject({
+  trajectory_id: string().min(1).optional(),
+  trajectory_path: string().min(1).optional(),
+  session_id: string().min(1).optional(),
+  extra: JsonObjectSchema.optional()
+}).refine((value) => value.trajectory_id !== undefined || value.trajectory_path !== undefined, { message: "a subagent reference needs trajectory_id or trajectory_path" });
+var AtifObservationResultSchema = strictObject({
+  source_call_id: string().min(1).optional(),
+  content: union([string(), array(AtifContentPartSchema)]).optional(),
+  subagent_trajectory_ref: array(AtifSubagentTrajectoryRefSchema).optional(),
+  extra: JsonObjectSchema.optional()
+}).refine((value) => value.content !== undefined || (value.subagent_trajectory_ref?.length ?? 0) > 0, { message: "an observation result needs content or a subagent reference" });
+var AtifMetricsSchema = strictObject({
+  prompt_tokens: number().int().nonnegative().optional(),
+  completion_tokens: number().int().nonnegative().optional(),
+  cached_tokens: number().int().nonnegative().optional(),
+  cost_usd: number().finite().nonnegative().optional(),
+  prompt_token_ids: array(number().int().nonnegative()).optional(),
+  completion_token_ids: array(number().int().nonnegative()).optional(),
+  logprobs: array(number().finite()).optional(),
+  extra: JsonObjectSchema.optional()
+});
+var AtifStepSchema = strictObject({
+  step_id: number().int().positive(),
+  timestamp: string().min(1).optional(),
+  source: _enum(["system", "user", "agent"]),
+  model_name: string().min(1).optional(),
+  reasoning_effort: union([string(), number().finite()]).optional(),
+  message: union([string(), array(AtifContentPartSchema)]),
+  reasoning_content: string().optional(),
+  tool_calls: array(AtifToolCallSchema).optional(),
+  observation: strictObject({ results: array(AtifObservationResultSchema) }).optional(),
+  metrics: AtifMetricsSchema.optional(),
+  extra: JsonObjectSchema.optional(),
+  llm_call_count: number().int().nonnegative().optional(),
+  is_copied_context: boolean().optional()
+});
+var AtifFinalMetricsSchema = strictObject({
+  total_prompt_tokens: number().int().nonnegative().optional(),
+  total_completion_tokens: number().int().nonnegative().optional(),
+  total_cached_tokens: number().int().nonnegative().optional(),
+  total_cost_usd: number().finite().nonnegative().optional(),
+  total_steps: number().int().nonnegative().optional(),
+  extra: JsonObjectSchema.optional()
+});
+var AtifTrajectorySchema = lazy(() => strictObject({
+  schema_version: literal(ATIF_SCHEMA_VERSION),
+  session_id: string().min(1).optional(),
+  trajectory_id: string().min(1).optional(),
+  agent: AtifAgentSchema,
+  steps: array(AtifStepSchema).min(1),
+  notes: string().optional(),
+  final_metrics: AtifFinalMetricsSchema.optional(),
+  continued_trajectory_ref: string().min(1).optional(),
+  extra: JsonObjectSchema.optional(),
+  subagent_trajectories: array(AtifTrajectorySchema).optional()
+}));
+var AtifDiagnosticSchema = strictObject({
+  code: string().min(1).max(1024),
+  severity: _enum(["error", "warning"]),
+  message: string().min(1).max(4000),
+  path: string().min(1).max(2048).optional(),
+  sourceId: string().min(1).max(1024).optional()
+});
+var bundleIdentifier = string().min(1).max(1024);
+var bundlePath = bundleIdentifier.refine((path) => /^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(path) && path.split("/").every((part) => part !== "" && part !== "." && part !== ".."), "Expected a normalized, relative bundle path");
+var bundleDiagnostics = array(AtifDiagnosticSchema).max(1000);
+var bundleFileEntrySchema = strictObject({
+  path: bundlePath,
+  sha256: string().regex(/^[a-f0-9]{64}$/),
+  sizeBytes: number().int().nonnegative().max(TRAJECTORY_BUNDLE_LIMITS.fileBytes)
+});
+var TrajectoryBundleManifestSchema = strictObject({
+  type: literal(TRAJECTORY_BUNDLE_TYPE),
+  version: literal(TRAJECTORY_BUNDLE_VERSION),
+  rootTrajectoryId: bundleIdentifier,
+  atif: strictObject({
+    schemaVersion: literal(ATIF_SCHEMA_VERSION),
+    referenceRevision: literal(ATIF_REFERENCE_REVISION)
+  }),
+  exporter: strictObject({
+    name: bundleIdentifier,
+    version: bundleIdentifier
+  }),
+  documents: array(bundleFileEntrySchema.extend({ trajectoryId: bundleIdentifier })).min(1).max(TRAJECTORY_BUNDLE_LIMITS.files - 1),
+  assets: array(bundleFileEntrySchema.extend({
+    mediaType: bundleIdentifier,
+    required: boolean()
+  })).max(TRAJECTORY_BUNDLE_LIMITS.files - 1),
+  sources: array(bundleFileEntrySchema.extend({ id: bundleIdentifier })).min(1).max(TRAJECTORY_BUNDLE_LIMITS.files - 1),
+  validation: strictObject({
+    status: _enum(["valid", "invalid", "unvalidated"]),
+    validator: strictObject({
+      name: literal("apex-atif-v1.8"),
+      version: literal(APEX_ATIF_EXPORTER_VERSION)
+    }),
+    independent: strictObject({
+      status: _enum(["not_run", "passed", "failed"]),
+      detail: string().min(1).max(4000)
+    }),
+    diagnostics: bundleDiagnostics
+  }),
+  completeness: strictObject({
+    status: _enum(["complete", "partial", "unknown"]),
+    sftEligibility: _enum(["eligible", "ineligible"]),
+    rlEligibility: _enum(["eligible", "ineligible"]),
+    diagnostics: bundleDiagnostics
+  }),
+  nativeSampling: strictObject({
+    status: _enum(["available", "partial", "unavailable", "unknown"]),
+    artifactPaths: array(bundlePath).max(TRAJECTORY_BUNDLE_LIMITS.files - 1),
+    reason: string().max(4000).nullable(),
+    fields: record(_enum([
+      "promptTokenIds",
+      "completionTokenIds",
+      "logprobs",
+      "tokenizer",
+      "extra"
+    ]), record(_enum(NATIVE_EVIDENCE_AVAILABILITY_STATES), number().int().nonnegative()))
+  })
+});
+
+// src/core/atif/convert.ts
+var SOURCE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+var PORTABLE_ATTEMPT_ID_PATTERN = /^atm_[A-Za-z0-9_-]{1,128}$/;
+var IMAGE_MEDIA_TYPES = new Set([
+  "image/jpeg",
+  "image/png",
+  "image/gif",
+  "image/webp"
+]);
+var AUDIO_MEDIA_TYPES = new Set([
+  "audio/wav",
+  "audio/mpeg",
+  "audio/mp4",
+  "audio/aac",
+  "audio/ogg",
+  "audio/flac",
+  "audio/webm",
+  "audio/aiff"
+]);
+var AUDIO_MEDIA_ALIASES = {
+  "audio/mp3": "audio/mpeg",
+  "audio/mpga": "audio/mpeg",
+  "audio/x-mpeg": "audio/mpeg",
+  "audio/x-wav": "audio/wav",
+  "audio/wave": "audio/wav",
+  "audio/vnd.wave": "audio/wav",
+  "audio/x-m4a": "audio/mp4",
+  "audio/m4a": "audio/mp4",
+  "audio/x-aac": "audio/aac",
+  "audio/x-flac": "audio/flac",
+  "audio/x-aiff": "audio/aiff"
+};
+
+class AtifConversionError extends Error {
+  diagnostics;
+  constructor(message, diagnostics) {
+    super(message);
+    this.name = "AtifConversionError";
+    this.diagnostics = diagnostics;
+  }
+}
+function asObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
+}
+function asArray(value) {
+  return Array.isArray(value) ? value : undefined;
+}
+function hashBytes(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function diagnostic(diagnostics, sourceId, code, message, path, severity = "warning") {
+  diagnostics.push({
+    code,
+    severity,
+    message,
+    sourceId,
+    ...path ? { path } : {}
+  });
+}
+function parseSources(sources) {
+  if (sources.length > ATIF_EXPORT_SOURCE_LIMITS.maxSources) {
+    throw new AtifConversionError("recorded evidence source limit exceeded", [
+      {
+        code: "source_count_limit",
+        severity: "error",
+        message: `a bundle accepts at most ${ATIF_EXPORT_SOURCE_LIMITS.maxSources} sources`
+      }
+    ]);
+  }
+  const totalSourceBytes = sources.reduce((total, source) => total + source.bytes.byteLength, 0);
+  if (totalSourceBytes > ATIF_EXPORT_SOURCE_LIMITS.maxTotalSourceBytes) {
+    throw new AtifConversionError("recorded evidence byte limit exceeded", [
+      {
+        code: "source_byte_limit",
+        severity: "error",
+        message: `bundle source bytes exceed ${ATIF_EXPORT_SOURCE_LIMITS.maxTotalSourceBytes}`
+      }
+    ]);
+  }
+  const diagnostics = [];
+  const ids = new Set;
+  const parsed = [];
+  for (const source of sources) {
+    if (!SOURCE_ID_PATTERN.test(source.id)) {
+      diagnostic(diagnostics, source.id || "source", "invalid_source_id", "source id must be a portable filename component", "source.id", "error");
+      continue;
+    }
+    if (ids.has(source.id)) {
+      diagnostic(diagnostics, source.id, "duplicate_source_id", "source id appears more than once", "source.id", "error");
+      continue;
+    }
+    ids.add(source.id);
+    const measuredHash = hashBytes(source.bytes);
+    if (measuredHash !== source.sha256 || source.bytes.byteLength !== source.sizeBytes) {
+      diagnostic(diagnostics, source.id, "source_identity_mismatch", "source bytes do not match the supplied immutable identity", "source", "error");
+      continue;
+    }
+    try {
+      const raw = JSON.parse(Buffer.from(source.bytes).toString("utf8"));
+      const evidence = parseNativeRolloutEvidence(raw);
+      if (!PORTABLE_ATTEMPT_ID_PATTERN.test(evidence.attempt.attemptId)) {
+        diagnostic(diagnostics, source.id, "invalid_attempt_path_identity", "attemptId cannot be represented as a portable trajectory path", "attempt.attemptId", "error");
+        continue;
+      }
+      parsed.push({ ...source, evidence });
+    } catch (error) {
+      diagnostic(diagnostics, source.id, "invalid_source", error instanceof Error ? error.message : "source is not valid JSON evidence", "source", "error");
+    }
+  }
+  if (diagnostics.length > 0) {
+    throw new AtifConversionError("recorded evidence source validation failed", diagnostics);
+  }
+  if (parsed.length === 0) {
+    throw new AtifConversionError("at least one recorded evidence source is required", [
+      {
+        code: "missing_source",
+        severity: "error",
+        message: "at least one recorded evidence source is required"
+      }
+    ]);
+  }
+  const runIds = new Set(parsed.map((source) => source.evidence.runId));
+  if (runIds.size !== 1) {
+    throw new AtifConversionError("a bundle cannot mix runs", [
+      {
+        code: "mixed_run_sources",
+        severity: "error",
+        message: "all evidence sources in a bundle must have the same runId"
+      }
+    ]);
+  }
+  return parsed;
+}
+function createAssetCollector(diagnostics) {
+  const files = new Map;
+  const add = (file, sourceId) => {
+    const existing = files.get(file.path);
+    if (existing && (hashBytes(existing.bytes) !== hashBytes(file.bytes) || existing.mediaType !== file.mediaType)) {
+      diagnostic(diagnostics, sourceId, "asset_identity_conflict", `asset path ${file.path} resolved to conflicting content`, file.path, "error");
+      return;
+    }
+    files.set(file.path, file);
+  };
+  return {
+    files,
+    addJson(sha256, mediaType, content, sourceId) {
+      const bytes = Buffer.from(stringifyCanonicalJson(content));
+      const path = `assets/${sha256}.json`;
+      if (hashBytes(bytes) !== sha256) {
+        diagnostic(diagnostics, sourceId, "asset_hash_mismatch", "evidence asset content does not match its source hash", path, "error");
+        return;
+      }
+      add({ kind: "asset", path, mediaType, bytes, required: true }, sourceId);
+    },
+    addBinary(bytes, mediaType, sourceId) {
+      const sha256 = hashBytes(bytes);
+      const path = `assets/${sha256}`;
+      add({ kind: "asset", path, mediaType, bytes, required: true }, sourceId);
+      return path;
+    }
+  };
+}
+function canonicalAudioMediaType(mediaType) {
+  return AUDIO_MEDIA_ALIASES[mediaType] ?? mediaType;
+}
+function decodeBase64(value) {
+  const compact = value.replace(/\s/g, "");
+  if (compact.length === 0 || compact.length % 4 !== 0)
+    return;
+  if (!/^[A-Za-z0-9+/]*={0,2}$/.test(compact))
+    return;
+  const bytes = Buffer.from(compact, "base64");
+  const roundTrip = bytes.toString("base64").replace(/=+$/, "");
+  return roundTrip === compact.replace(/=+$/, "") ? bytes : undefined;
+}
+function contentPartFromFile(value, context, path) {
+  const originalMediaType = value.mediaType;
+  if (typeof originalMediaType !== "string") {
+    diagnostic(context.diagnostics, context.source.id, "missing_media_type", "file content has no media type", path);
+    return;
+  }
+  const mediaType = canonicalAudioMediaType(originalMediaType);
+  const type = IMAGE_MEDIA_TYPES.has(mediaType) ? "image" : AUDIO_MEDIA_TYPES.has(mediaType) ? "audio" : undefined;
+  if (!type) {
+    diagnostic(context.diagnostics, context.source.id, "unsupported_media_type", `ATIF-v1.8 cannot represent ${originalMediaType} as message content`, path);
+    return;
+  }
+  const data = value.data;
+  const tagged = asObject(data);
+  let assetPath;
+  if (tagged?.$type === "url" && typeof tagged.value === "string") {
+    try {
+      const url = new URL(tagged.value);
+      if (url.protocol !== "https:" && url.protocol !== "http:") {
+        throw new Error("unsupported URL protocol");
+      }
+      assetPath = url.toString();
+      diagnostic(context.diagnostics, context.source.id, "external_asset_not_archived", "multimodal content references an external URL whose bytes are not archived in this bundle", path);
+    } catch {
+      diagnostic(context.diagnostics, context.source.id, "invalid_media_url", "file content has a non-portable or invalid URL", path);
+      return;
+    }
+  } else {
+    const encoded = typeof data === "string" ? data : tagged?.$type === "bytes" && typeof tagged.value === "string" ? tagged.value : undefined;
+    const bytes = encoded === undefined ? undefined : decodeBase64(encoded);
+    if (!bytes) {
+      diagnostic(context.diagnostics, context.source.id, "invalid_media_data", "file content is neither a preserved URL nor valid base64 bytes", path);
+      return;
+    }
+    assetPath = posix.relative("trajectories", context.assets.addBinary(bytes, mediaType, context.source.id));
+  }
+  return type === "image" ? {
+    type,
+    source: {
+      media_type: mediaType,
+      path: assetPath
+    }
+  } : {
+    type,
+    source: {
+      media_type: mediaType,
+      path: assetPath
+    }
+  };
+}
+function emptyStepContent() {
+  return {
+    messageParts: [],
+    reasoning: [],
+    toolCalls: [],
+    observations: [],
+    extra: {}
+  };
+}
+function parseToolArguments(value, context, path) {
+  if (typeof value === "string") {
+    try {
+      const parsed = JSON.parse(value);
+      const object = asObject(parsed);
+      if (object)
+        return object;
+    } catch {}
+  } else {
+    const object = asObject(value);
+    if (object)
+      return object;
+  }
+  diagnostic(context.diagnostics, context.source.id, "invalid_tool_arguments", "tool arguments are not a JSON object and were not exported as a call", path);
+  return;
+}
+function toolCallFromPart(part, context, path) {
+  const id = part.toolCallId;
+  const name = part.toolName;
+  if (typeof id !== "string" || typeof name !== "string") {
+    diagnostic(context.diagnostics, context.source.id, "invalid_tool_call", "tool call is missing its stable id or function name", path);
+    return;
+  }
+  const args = parseToolArguments(part.input, context, `${path}.input`);
+  if (!args)
+    return;
+  const extra = {};
+  if (typeof part.providerExecuted === "boolean") {
+    extra.provider_executed = part.providerExecuted;
+  }
+  if (typeof part.dynamic === "boolean")
+    extra.dynamic = part.dynamic;
+  return {
+    tool_call_id: id,
+    function_name: name,
+    arguments: args,
+    ...Object.keys(extra).length > 0 ? { extra } : {}
+  };
+}
+function toolResultContent(output, context, path) {
+  const result = asObject(output);
+  if (!result)
+    return stringifyCanonicalJson(output ?? null);
+  if ((result.type === "text" || result.type === "error-text") && typeof result.value === "string") {
+    return result.value;
+  }
+  if (result.type === "execution-denied") {
+    return typeof result.reason === "string" ? result.reason : "Tool execution was denied.";
+  }
+  if (result.type === "json" || result.type === "error-json") {
+    return stringifyCanonicalJson(result.value ?? null);
+  }
+  if (result.type === "content") {
+    if (!Array.isArray(result.value)) {
+      diagnostic(context.diagnostics, context.source.id, "invalid_tool_result_content", "tool result content is not an array and remains only in source evidence", path);
+      return "";
+    }
+    const parts = [];
+    for (const [index, raw] of result.value.entries()) {
+      const part = asObject(raw);
+      const partPath = `${path}.value[${index}]`;
+      if (part?.type === "text" && typeof part.text === "string") {
+        parts.push({ type: "text", text: part.text });
+      } else if (part?.type === "image-data" || part?.type === "file-data") {
+        const converted = contentPartFromFile(part, context, partPath);
+        if (converted)
+          parts.push(converted);
+      } else {
+        diagnostic(context.diagnostics, context.source.id, "unsupported_tool_result_content", "tool result content part remains only in source evidence", partPath);
+      }
+    }
+    return messageFromParts(parts);
+  }
+  return stringifyCanonicalJson(result);
+}
+function toolResultFromPart(part, context, path) {
+  if (typeof part.toolCallId !== "string") {
+    diagnostic(context.diagnostics, context.source.id, "invalid_tool_result", "tool result is missing source call identity", path);
+    return;
+  }
+  const content = part.output !== undefined ? toolResultContent(part.output, context, `${path}.output`) : part.result !== undefined ? stringifyCanonicalJson(part.result) : "";
+  const extra = {};
+  if (typeof part.toolName === "string")
+    extra.tool_name = part.toolName;
+  if (typeof part.isError === "boolean")
+    extra.is_error = part.isError;
+  if (typeof part.preliminary === "boolean") {
+    extra.preliminary = part.preliminary;
+  }
+  return {
+    source_call_id: part.toolCallId,
+    content,
+    ...Object.keys(extra).length > 0 ? { extra } : {}
+  };
+}
+function collectParts(parts, context, path) {
+  const content = emptyStepContent();
+  for (const [index, raw] of parts.entries()) {
+    const part = asObject(raw);
+    const partPath = `${path}[${index}]`;
+    if (!part || typeof part.type !== "string") {
+      diagnostic(context.diagnostics, context.source.id, "invalid_content_part", "content part is not a typed object", partPath);
+      continue;
+    }
+    if (part.type === "text" && typeof part.text === "string") {
+      content.messageParts.push({ type: "text", text: part.text });
+    } else if (part.type === "reasoning" && typeof part.text === "string") {
+      content.reasoning.push(part.text);
+    } else if (part.type === "file") {
+      const converted = contentPartFromFile(part, context, partPath);
+      if (converted)
+        content.messageParts.push(converted);
+    } else if (part.type === "tool-call") {
+      const call = toolCallFromPart(part, context, partPath);
+      if (call)
+        content.toolCalls.push(call);
+    } else if (part.type === "tool-result") {
+      const result = toolResultFromPart(part, context, partPath);
+      if (result)
+        content.observations.push(result);
+    } else if (part.type === "source") {
+      const sources = content.extra.sources ?? [];
+      sources.push(part);
+      content.extra.sources = sources;
+    } else {
+      diagnostic(context.diagnostics, context.source.id, "unsupported_content_part", `content part ${part.type} is retained only in source evidence`, partPath);
+    }
+  }
+  return content;
+}
+function messageFromParts(parts) {
+  if (parts.length === 0)
+    return "";
+  if (parts.length === 1 && parts[0]?.type === "text")
+    return parts[0].text;
+  return parts;
+}
+function makeStep(stepId, source, content, input) {
+  const extra = { ...content.extra, ...input.extra ?? {} };
+  return {
+    step_id: stepId,
+    source,
+    message: messageFromParts(content.messageParts),
+    ...source === "agent" && input.modelName ? { model_name: input.modelName } : {},
+    ...content.reasoning.length > 0 ? { reasoning_content: content.reasoning.join("") } : {},
+    ...content.toolCalls.length > 0 ? { tool_calls: content.toolCalls } : {},
+    ...content.observations.length > 0 ? { observation: { results: content.observations } } : {},
+    ...input.metrics ? { metrics: input.metrics } : {},
+    ...Object.keys(extra).length > 0 ? { extra } : {},
+    ...source === "agent" && !input.copied ? { llm_call_count: 1 } : {},
+    ...input.copied ? { is_copied_context: true } : {}
+  };
+}
+function promptSteps(prompt, context) {
+  if (!prompt) {
+    diagnostic(context.diagnostics, context.source.id, "missing_prompt", "normalized evidence has no prompt array", "boundary.input.normalizedRef");
+    return [];
+  }
+  const steps = [];
+  for (const [index, raw] of prompt.entries()) {
+    const message = asObject(raw);
+    const path = `prompt[${index}]`;
+    if (!message || typeof message.role !== "string") {
+      diagnostic(context.diagnostics, context.source.id, "invalid_prompt_message", "prompt message has no supported role", path);
+      continue;
+    }
+    if (message.role === "system" && typeof message.content === "string") {
+      steps.push(makeStep(steps.length + 1, "system", {
+        ...emptyStepContent(),
+        messageParts: [{ type: "text", text: message.content }]
+      }, { copied: true }));
+      continue;
+    }
+    const parts = asArray(message.content);
+    if (!parts) {
+      diagnostic(context.diagnostics, context.source.id, "invalid_prompt_message", "prompt message content is not an array", `${path}.content`);
+      continue;
+    }
+    const converted = collectParts(parts, context, `${path}.content`);
+    if (message.role === "user") {
+      steps.push(makeStep(steps.length + 1, "user", converted, { copied: true }));
+    } else if (message.role === "assistant") {
+      steps.push(makeStep(steps.length + 1, "agent", converted, { copied: true }));
+    } else if (message.role === "tool") {
+      const prior = steps.at(-1);
+      const priorCallIds = new Set(prior?.source === "agent" ? (prior.tool_calls ?? []).map((call) => call.tool_call_id) : []);
+      const canAttachToPrior = prior?.source === "agent" && converted.messageParts.length === 0 && converted.reasoning.length === 0 && converted.toolCalls.length === 0 && Object.keys(converted.extra).length === 0 && converted.observations.every((result) => result.source_call_id === undefined || priorCallIds.has(result.source_call_id));
+      if (canAttachToPrior) {
+        prior.observation = {
+          results: [
+            ...prior.observation?.results ?? [],
+            ...converted.observations
+          ]
+        };
+      } else {
+        diagnostic(context.diagnostics, context.source.id, "detached_tool_result", "tool-role context could not be attached to its preceding agent action and remains a separate copied system observation", path);
+        const detached = converted.observations.map((result) => {
+          const { source_call_id: sourceCallId, ...rest } = result;
+          return {
+            ...rest,
+            ...sourceCallId ? {
+              extra: {
+                ...result.extra ?? {},
+                apex_source_call_id: sourceCallId
+              }
+            } : {}
+          };
+        });
+        steps.push(makeStep(steps.length + 1, "system", {
+          ...converted,
+          observations: detached,
+          toolCalls: [],
+          reasoning: []
+        }, {
+          copied: true,
+          extra: { source_role: "tool" }
+        }));
+      }
+    } else {
+      diagnostic(context.diagnostics, context.source.id, "unsupported_prompt_role", `prompt role ${message.role} is retained only in source evidence`, path);
+    }
+  }
+  return steps;
+}
+function toolDefinitions(tools, context) {
+  const definitions = [];
+  const settings = [];
+  for (const [index, raw] of (tools ?? []).entries()) {
+    const tool = asObject(raw);
+    const parameters = asObject(tool?.inputSchema);
+    if (tool?.type === "function" && typeof tool.name === "string" && parameters) {
+      const preserved = {};
+      for (const key of ["strict", "inputExamples", "providerOptions"]) {
+        if (tool[key] !== undefined)
+          preserved[key] = tool[key];
+      }
+      if (Object.keys(preserved).length > 0) {
+        settings.push({ index, name: tool.name, ...preserved });
+      }
+      definitions.push({
+        type: "function",
+        function: {
+          name: tool.name,
+          ...typeof tool.description === "string" ? { description: tool.description } : {},
+          parameters
+        }
+      });
+    } else {
+      diagnostic(context.diagnostics, context.source.id, "unsupported_tool_definition", "provider-defined or malformed tool definition remains only in source evidence", `tools[${index}]`);
+    }
+  }
+  return { definitions, settings };
+}
+function evidenceAsset(evidence, reference) {
+  return evidence.assets.find((asset) => asset.ref === reference.ref)?.content;
+}
+function availableValue(availability) {
+  return availability.state === "available" ? availability.value : undefined;
+}
+function integer(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0 ? value : undefined;
+}
+function metricsFromEvidence(evidence, usage, context) {
+  const input = asObject(usage?.inputTokens);
+  const output = asObject(usage?.outputTokens);
+  const promptTokens = integer(input?.total);
+  const completionTokens = integer(output?.total);
+  const observedCachedTokens = integer(input?.cacheRead);
+  const cachedTokens = observedCachedTokens !== undefined && promptTokens !== undefined && observedCachedTokens > promptTokens ? undefined : observedCachedTokens;
+  if (observedCachedTokens !== undefined && cachedTokens === undefined) {
+    diagnostic(context.diagnostics, context.source.id, "misaligned_cached_tokens", "cached input tokens exceed total prompt tokens and remain only in source evidence", "output.usage.inputTokens");
+  }
+  const aligned = (field, values, count) => {
+    if (values === undefined || count === undefined || values.length === count) {
+      return values;
+    }
+    diagnostic(context.diagnostics, context.source.id, "misaligned_native_metric", `${field} length does not match the recorded token count and remains only in source evidence`, `native.${field}`);
+    return;
+  };
+  const promptIds = aligned("promptTokenIds", availableValue(evidence.native.promptTokenIds), promptTokens);
+  const completionIds = aligned("completionTokenIds", availableValue(evidence.native.completionTokenIds), completionTokens);
+  const logprobs = aligned("logprobs", availableValue(evidence.native.logprobs), completionTokens);
+  const extra = {
+    apex_native_availability: {
+      prompt_token_ids: evidence.native.promptTokenIds.state,
+      completion_token_ids: evidence.native.completionTokenIds.state,
+      logprobs: evidence.native.logprobs.state,
+      tokenizer: evidence.native.tokenizer.state,
+      extra: evidence.native.extra.state
+    }
+  };
+  const tokenizer = availableValue(evidence.native.tokenizer);
+  if (tokenizer)
+    extra.tokenizer = tokenizer;
+  const providerExtra = availableValue(evidence.native.extra);
+  if (providerExtra)
+    extra.provider = providerExtra;
+  const metrics = {
+    ...promptTokens !== undefined ? { prompt_tokens: promptTokens } : {},
+    ...completionTokens !== undefined ? { completion_tokens: completionTokens } : {},
+    ...cachedTokens !== undefined ? { cached_tokens: cachedTokens } : {},
+    ...promptIds ? { prompt_token_ids: promptIds } : {},
+    ...completionIds ? { completion_token_ids: completionIds } : {},
+    ...logprobs ? { logprobs } : {},
+    extra
+  };
+  return Object.keys(metrics).length > 1 || Object.keys(extra).length > 0 ? metrics : undefined;
+}
+function collectStreamOutput(parts, context) {
+  const output = emptyStepContent();
+  const text = new Map;
+  const reasoning = new Map;
+  const partialTools = new Map;
+  const transportParts = new Set([
+    "stream-start",
+    "response-metadata",
+    "raw",
+    "text-end",
+    "reasoning-start",
+    "reasoning-end",
+    "tool-input-end"
+  ]);
+  let usage;
+  for (const [index, raw] of parts.entries()) {
+    const part = asObject(raw);
+    const path = `output.parts[${index}]`;
+    if (!part || typeof part.type !== "string") {
+      diagnostic(context.diagnostics, context.source.id, "invalid_content_part", "stream part is not a typed object and remains only in source evidence", path);
+      continue;
+    }
+    if ((part.type === "text-start" || part.type === "text-delta") && typeof part.id === "string") {
+      if (part.type === "text-delta" && typeof part.delta !== "string") {
+        diagnostic(context.diagnostics, context.source.id, "invalid_content_part", "stream text delta is not a string and remains only in source evidence", path);
+        continue;
+      }
+      let value = text.get(part.id);
+      if (!value) {
+        value = { type: "text", text: "" };
+        text.set(part.id, value);
+        output.messageParts.push(value);
+      }
+      if (part.type === "text-delta" && typeof part.delta === "string") {
+        value.text += part.delta;
+      }
+    } else if (part.type === "reasoning-delta" && typeof part.id === "string") {
+      if (typeof part.delta !== "string") {
+        diagnostic(context.diagnostics, context.source.id, "invalid_content_part", "stream reasoning delta is not a string and remains only in source evidence", path);
+        continue;
+      }
+      reasoning.set(part.id, `${reasoning.get(part.id) ?? ""}${part.delta}`);
+    } else if (part.type === "tool-input-start" && typeof part.id === "string" && typeof part.toolName === "string") {
+      partialTools.set(part.id, { name: part.toolName, input: "" });
+    } else if (part.type === "tool-input-delta" && typeof part.id === "string") {
+      const pending = partialTools.get(part.id);
+      if (pending && typeof part.delta === "string")
+        pending.input += part.delta;
+    } else if (part.type === "tool-call") {
+      const call = toolCallFromPart(part, context, path);
+      if (call) {
+        output.toolCalls.push(call);
+        partialTools.delete(call.tool_call_id);
+      }
+    } else if (part.type === "tool-result") {
+      const result = toolResultFromPart(part, context, path);
+      if (result)
+        output.observations.push(result);
+    } else if (part.type === "file") {
+      const converted = contentPartFromFile(part, context, path);
+      if (converted)
+        output.messageParts.push(converted);
+    } else if (part.type === "source") {
+      const sources = output.extra.sources ?? [];
+      sources.push(part);
+      output.extra.sources = sources;
+    } else if (part.type === "finish") {
+      usage = asObject(part.usage);
+      output.extra.finish_reason = part.finishReason ?? null;
+    } else if (part.type === "error") {
+      diagnostic(context.diagnostics, context.source.id, "stream_error", "captured stream contains an error part", path);
+    } else if (!transportParts.has(part.type)) {
+      diagnostic(context.diagnostics, context.source.id, "unsupported_content_part", `stream part ${part.type} is retained only in source evidence`, path);
+    }
+  }
+  output.reasoning.push(...reasoning.values());
+  for (const [id] of partialTools) {
+    diagnostic(context.diagnostics, context.source.id, "partial_tool_call", `stream ended before tool call ${id} completed`, "output.parts");
+  }
+  return { content: output, usage };
+}
+function outputStep(evidence, context, stepId) {
+  const outputReference = availableValue(evidence.boundary.output.normalized);
+  const partialReference = evidence.boundary.output.normalized.state === "truncated" || evidence.boundary.output.normalized.state === "interrupted" ? evidence.boundary.output.normalized.partial : undefined;
+  const output = outputReference ?? partialReference;
+  const normalized = output ? evidenceAsset(evidence, output) : undefined;
+  let content = emptyStepContent();
+  let usage;
+  const normalizedObject = asObject(normalized);
+  const generatedContent = asArray(normalizedObject?.content);
+  const streamedParts = asArray(normalizedObject?.parts);
+  if (generatedContent) {
+    content = collectParts(generatedContent, context, "output.content");
+    usage = asObject(normalizedObject?.usage);
+    if (normalizedObject?.finishReason !== undefined) {
+      content.extra.finish_reason = normalizedObject.finishReason;
+    }
+  } else if (streamedParts) {
+    const streamed = collectStreamOutput(streamedParts, context);
+    content = streamed.content;
+    usage = streamed.usage;
+  } else if (normalized === undefined) {
+    diagnostic(context.diagnostics, context.source.id, "missing_output", "attempt has no recorded normalized model output", "boundary.output.normalized");
+  } else {
+    diagnostic(context.diagnostics, context.source.id, "unsupported_output_shape", "normalized output shape is retained only in source evidence", "boundary.output.normalized");
+  }
+  content.extra.apex_attempt = {
+    attempt_id: evidence.attempt.attemptId,
+    idempotency_key: evidence.attempt.idempotencyKey,
+    sequence: evidence.attempt.sequence,
+    root_attempt_id: evidence.attempt.rootAttemptId,
+    ...evidence.attempt.previousAttemptId ? { previous_attempt_id: evidence.attempt.previousAttemptId } : {},
+    lifecycle: evidence.attempt.lifecycle,
+    turn_id: evidence.turnId,
+    turn_index: evidence.turnIndex,
+    segment_id: evidence.segmentId,
+    operation_kind: evidence.operationKind
+  };
+  return makeStep(stepId, "agent", content, {
+    copied: false,
+    modelName: evidence.effective.modelId,
+    metrics: metricsFromEvidence(evidence, usage, context)
+  });
+}
+function sourceContext(evidence, source) {
+  const availability = (value) => ({
+    state: value.state,
+    ...value.state === "available" ? { ref: value.value.ref } : value.state === "truncated" || value.state === "interrupted" ? {
+      reason: value.reason,
+      ...value.partial ? { ref: value.partial.ref } : {},
+      ...value.observed ? { observed: value.observed } : {}
+    } : { reason: value.reason }
+  });
+  return {
+    native_evidence: {
+      schema: evidence.schema,
+      version: evidence.version,
+      run_id: evidence.runId,
+      ...evidence.sessionId ? { session_id: evidence.sessionId } : {}
+    },
+    source: {
+      id: source.id,
+      path: `sources/${source.id}.json`,
+      sha256: source.sha256,
+      size_bytes: source.sizeBytes
+    },
+    boundary: {
+      input: {
+        normalized_ref: evidence.boundary.input.normalizedRef.ref,
+        native: availability(evidence.boundary.input.native)
+      },
+      output: {
+        normalized: availability(evidence.boundary.output.normalized),
+        native: availability(evidence.boundary.output.native)
+      }
+    },
+    requested_model: evidence.requested,
+    effective_model: evidence.effective
+  };
+}
+function trajectoryId(evidence) {
+  return `atif_${evidence.attempt.attemptId}`;
+}
+function documentPath(id) {
+  return `trajectories/${id}.json`;
+}
+function convertSource(source, agentIdentity, assets, diagnostics) {
+  const evidence = source.evidence;
+  if (evidence.attempt.lifecycle !== "completed") {
+    diagnostic(diagnostics, source.id, "incomplete_attempt_lifecycle", `attempt lifecycle is ${evidence.attempt.lifecycle}`, "attempt.lifecycle");
+  }
+  for (const limitation of evidence.limitations) {
+    diagnostic(diagnostics, source.id, `source_${limitation.code}`, limitation.message, limitation.field);
+  }
+  for (const asset of evidence.assets) {
+    assets.addJson(asset.sha256, asset.mediaType, asset.content, source.id);
+  }
+  const context = { source, assets, diagnostics };
+  const normalizedInput = evidenceAsset(evidence, evidence.boundary.input.normalizedRef);
+  const input = asObject(normalizedInput);
+  const steps = promptSteps(asArray(input?.prompt), context);
+  steps.push(outputStep(evidence, context, steps.length + 1));
+  const { definitions, settings } = toolDefinitions(asArray(input?.tools), context);
+  const agent = {
+    ...agentIdentity,
+    model_name: evidence.requested.modelId,
+    ...definitions.length > 0 ? { tool_definitions: definitions } : {},
+    extra: {
+      provider: evidence.requested.provider,
+      operation_kind: evidence.operationKind,
+      ...settings.length > 0 ? { apex_tool_settings: { version: 1, tools: settings } } : {}
+    }
+  };
+  const outputMetrics = steps.at(-1)?.metrics;
+  return {
+    schema_version: ATIF_SCHEMA_VERSION,
+    session_id: evidence.sessionId ?? evidence.runId,
+    trajectory_id: trajectoryId(evidence),
+    agent,
+    steps,
+    notes: "Each document is one physical model attempt. Input steps are the exact recorded call context and are marked copied context; the final agent step is this attempt's output.",
+    final_metrics: {
+      total_steps: steps.length,
+      ...outputMetrics?.prompt_tokens !== undefined ? { total_prompt_tokens: outputMetrics.prompt_tokens } : {},
+      ...outputMetrics?.completion_tokens !== undefined ? { total_completion_tokens: outputMetrics.completion_tokens } : {},
+      ...outputMetrics?.cached_tokens !== undefined ? { total_cached_tokens: outputMetrics.cached_tokens } : {}
+    },
+    extra: sourceContext(evidence, source)
+  };
+}
+function emptyAvailabilityCounts() {
+  return {
+    available: 0,
+    unsupported: 0,
+    omitted: 0,
+    truncated: 0,
+    interrupted: 0
+  };
+}
+function nativeSamplingSummary(sources) {
+  const summary = {
+    promptTokenIds: emptyAvailabilityCounts(),
+    completionTokenIds: emptyAvailabilityCounts(),
+    logprobs: emptyAvailabilityCounts(),
+    tokenizer: emptyAvailabilityCounts(),
+    extra: emptyAvailabilityCounts()
+  };
+  for (const { evidence } of sources) {
+    summary.promptTokenIds[evidence.native.promptTokenIds.state] += 1;
+    summary.completionTokenIds[evidence.native.completionTokenIds.state] += 1;
+    summary.logprobs[evidence.native.logprobs.state] += 1;
+    summary.tokenizer[evidence.native.tokenizer.state] += 1;
+    summary.extra[evidence.native.extra.state] += 1;
+  }
+  return summary;
+}
+function recordMissingAssociations(documents, diagnostics) {
+  const sessions = new Map;
+  for (const document of documents) {
+    const sessionId = document.session_id ?? "";
+    const calls = sessions.get(sessionId) ?? [];
+    sessions.set(sessionId, calls);
+    for (const step of document.steps) {
+      const stepCalls = step.tool_calls ?? [];
+      if (step.is_copied_context) {
+        for (const result of step.observation?.results ?? []) {
+          const copiedCalls = stepCalls.filter((call) => call.tool_call_id === result.source_call_id);
+          if (copiedCalls.length !== 1)
+            continue;
+          const copied = copiedCalls[0];
+          const candidates = calls.filter(({ call }) => call.tool_call_id === copied.tool_call_id && call.function_name === copied.function_name && stringifyCanonicalJson(call.arguments) === stringifyCanonicalJson(copied.arguments));
+          if (candidates.length === 1)
+            candidates[0].resolved = true;
+          else if (candidates.length > 1)
+            diagnostics.push({
+              code: "ambiguous_tool_result",
+              severity: "warning",
+              message: `copied result for ${copied.tool_call_id} cannot identify one original call occurrence in session ${sessionId}`,
+              path: document.trajectory_id
+            });
+        }
+        continue;
+      }
+      for (const call of stepCalls) {
+        if (calls.some((entry) => entry.call.tool_call_id === call.tool_call_id))
+          diagnostics.push({
+            code: "reused_tool_call_id",
+            severity: "warning",
+            message: `tool call id ${call.tool_call_id} appears in multiple original call occurrences in session ${sessionId}`,
+            path: document.trajectory_id
+          });
+        calls.push({
+          call,
+          trajectoryId: document.trajectory_id ?? "trajectory",
+          resolved: stepCalls.filter((entry) => entry.tool_call_id === call.tool_call_id).length === 1 && (step.observation?.results.some((result) => result.source_call_id === call.tool_call_id) ?? false)
+        });
+      }
+    }
+  }
+  for (const calls of sessions.values()) {
+    for (const { call, trajectoryId, resolved } of calls) {
+      if (!resolved)
+        diagnostics.push({
+          code: "missing_tool_result",
+          severity: "warning",
+          message: `tool call ${call.tool_call_id} has no recorded result for this occurrence in its session`,
+          path: trajectoryId
+        });
+    }
+  }
+}
+function attachSessionRelationships(sources, rootSessionId, documents, documentPaths, diagnostics) {
+  const sourcesBySession = new Map;
+  for (const source of sources) {
+    const sessionId = source.evidence.sessionId ?? source.evidence.runId;
+    const entries = sourcesBySession.get(sessionId) ?? [];
+    entries.push(source);
+    sourcesBySession.set(sessionId, entries);
+  }
+  for (const [sessionId, sessionSources] of sourcesBySession) {
+    const parentEntries = sessionSources.flatMap((source) => source.evidence.parent ? [source.evidence.parent] : []);
+    if (parentEntries.length === 0) {
+      if (sessionId !== rootSessionId) {
+        diagnostics.push({
+          code: "session_relationship_unavailable",
+          severity: "warning",
+          message: `session ${sessionId} has no authoritative parent tool call`,
+          path: sessionId
+        });
+      }
+      continue;
+    }
+    if (parentEntries.length !== sessionSources.length) {
+      diagnostics.push({
+        code: "incomplete_session_relationship",
+        severity: "error",
+        message: `session ${sessionId} has only partially attributed source evidence`,
+        path: sessionId
+      });
+      continue;
+    }
+    const [parent] = parentEntries;
+    if (!parent || parentEntries.some((entry) => entry.sessionId !== parent.sessionId || entry.toolCallId !== parent.toolCallId)) {
+      diagnostics.push({
+        code: "conflicting_session_relationship",
+        severity: "error",
+        message: `session ${sessionId} has conflicting parent attribution`,
+        path: sessionId
+      });
+      continue;
+    }
+    if (parent.sessionId === sessionId) {
+      diagnostics.push({
+        code: "cyclic_session_relationship",
+        severity: "error",
+        message: `session ${sessionId} cannot be its own parent`,
+        path: sessionId
+      });
+      continue;
+    }
+    const child = documents[sessionId]?.[0];
+    const childId = child?.trajectory_id;
+    const childPath = childId ? documentPaths.get(childId) : undefined;
+    if (!child || !childId || !childPath) {
+      diagnostics.push({
+        code: "unresolved_child_trajectory",
+        severity: "error",
+        message: `session ${sessionId} has no resolvable first trajectory`,
+        path: sessionId
+      });
+      continue;
+    }
+    const matchingSteps = (documents[parent.sessionId] ?? []).flatMap((document) => document.steps.filter((step) => step.is_copied_context !== true && step.tool_calls?.some((call) => call.tool_call_id === parent.toolCallId)));
+    if (matchingSteps.length !== 1) {
+      diagnostics.push({
+        code: matchingSteps.length === 0 ? "subagent_parent_call_unavailable" : "ambiguous_subagent_parent_call",
+        severity: matchingSteps.length === 0 ? "warning" : "error",
+        message: matchingSteps.length === 0 ? `parent tool call ${parent.toolCallId} is not present in recorded session ${parent.sessionId}` : `parent tool call ${parent.toolCallId} appears in more than one original inference step`,
+        path: sessionId
+      });
+      continue;
+    }
+    const step = matchingSteps[0];
+    if (!step)
+      continue;
+    const results = step.observation?.results ?? [];
+    let result = results.find((entry) => entry.source_call_id === parent.toolCallId);
+    if (!result) {
+      result = { source_call_id: parent.toolCallId };
+      results.push(result);
+    }
+    result.subagent_trajectory_ref = [
+      ...result.subagent_trajectory_ref ?? [],
+      {
+        trajectory_id: childId,
+        trajectory_path: posix.relative("trajectories", childPath),
+        session_id: sessionId
+      }
+    ];
+    step.observation = { results };
+  }
+}
+function convertNativeRolloutSourcesToAtif(input) {
+  const sources = parseSources(input.sources);
+  const root = sources.find((source) => source.id === input.rootSourceId);
+  if (!root) {
+    throw new AtifConversionError("rootSourceId does not resolve", [
+      {
+        code: "unresolved_root_source",
+        severity: "error",
+        message: "rootSourceId must identify one supplied source"
+      }
+    ]);
+  }
+  const diagnostics = [];
+  const assets = createAssetCollector(diagnostics);
+  const sorted = [...sources].sort((left, right) => {
+    const leftSession = left.evidence.sessionId ?? left.evidence.runId;
+    const rightSession = right.evidence.sessionId ?? right.evidence.runId;
+    return leftSession.localeCompare(rightSession) || left.evidence.turnIndex - right.evidence.turnIndex || left.evidence.attempt.sequence - right.evidence.attempt.sequence || left.id.localeCompare(right.id);
+  });
+  const documents = Object.create(null);
+  const documentPaths = new Map;
+  for (const source of sorted) {
+    const document = convertSource(source, input.agent, assets, diagnostics);
+    const id = document.trajectory_id;
+    const sessionId = document.session_id;
+    if (!id || !sessionId) {
+      diagnostic(diagnostics, source.id, "missing_document_identity", "converted ATIF documents require trajectory_id and session_id", "trajectory", "error");
+      continue;
+    }
+    if (documentPaths.has(id)) {
+      diagnostic(diagnostics, source.id, "duplicate_trajectory_id", `trajectory id ${id} is not unique`, id, "error");
+      continue;
+    }
+    documentPaths.set(id, documentPath(id));
+    const sessionDocuments = documents[sessionId] ?? [];
+    sessionDocuments.push(document);
+    documents[sessionId] = sessionDocuments;
+  }
+  for (const sessionDocuments of Object.values(documents)) {
+    for (let index = 0;index < sessionDocuments.length - 1; index++) {
+      const current = sessionDocuments[index];
+      const nextId = sessionDocuments[index + 1]?.trajectory_id;
+      if (current && nextId) {
+        current.continued_trajectory_ref = posix.relative("trajectories", documentPath(nextId));
+      }
+    }
+  }
+  const allDocuments = Object.values(documents).flat();
+  attachSessionRelationships(sorted, root.evidence.sessionId ?? root.evidence.runId, documents, documentPaths, diagnostics);
+  recordMissingAssociations(allDocuments, diagnostics);
+  const files = [
+    ...sources.map((source) => ({
+      kind: "source",
+      path: `sources/${source.id}.json`,
+      mediaType: "application/json",
+      bytes: source.bytes
+    })),
+    ...assets.files.values()
+  ].sort((left, right) => left.path.localeCompare(right.path));
+  return {
+    rootTrajectoryId: trajectoryId(root.evidence),
+    exporter: input.exporter,
+    documents,
+    documentPaths,
+    files,
+    diagnostics,
+    nativeSampling: nativeSamplingSummary(sources),
+    ...input.independentValidation ? { independentValidation: input.independentValidation } : {}
+  };
+}
+// src/core/atif/serialize.ts
+init_native_rollout_evidence();
+import { createHash as createHash2 } from "node:crypto";
+import { posix as posix2 } from "node:path";
+
+// src/core/atif/validate.ts
+var ISO_8601_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+function error(diagnostics, code, message, path) {
+  diagnostics.push({ code, severity: "error", message, path });
+}
+function validateMetrics(step, path, diagnostics) {
+  const metrics = step.metrics;
+  if (!metrics)
+    return;
+  if (metrics.prompt_token_ids !== undefined && metrics.prompt_tokens !== undefined && metrics.prompt_token_ids.length !== metrics.prompt_tokens) {
+    error(diagnostics, "invalid-metrics", "prompt_token_ids length must match prompt_tokens", `${path}.metrics`);
+  }
+  if (metrics.completion_token_ids !== undefined && metrics.completion_tokens !== undefined && metrics.completion_token_ids.length !== metrics.completion_tokens) {
+    error(diagnostics, "invalid-metrics", "completion_token_ids length must match completion_tokens", `${path}.metrics`);
+  }
+  if (metrics.logprobs !== undefined && metrics.completion_tokens !== undefined && metrics.logprobs.length !== metrics.completion_tokens) {
+    error(diagnostics, "invalid-metrics", "logprobs length must match completion_tokens", `${path}.metrics`);
+  }
+  if (metrics.completion_token_ids !== undefined && metrics.logprobs !== undefined && metrics.completion_token_ids.length !== metrics.logprobs.length) {
+    error(diagnostics, "invalid-metrics", "completion_token_ids and logprobs must align", `${path}.metrics`);
+  }
+  if (metrics.cached_tokens !== undefined && metrics.prompt_tokens !== undefined && metrics.cached_tokens > metrics.prompt_tokens) {
+    error(diagnostics, "invalid-metrics", "cached_tokens cannot exceed prompt_tokens", `${path}.metrics`);
+  }
+}
+function validateStepFields(step, path, diagnostics) {
+  if (step.source !== "agent" && (step.model_name !== undefined || step.reasoning_effort !== undefined || step.reasoning_content !== undefined || step.tool_calls !== undefined || step.metrics !== undefined)) {
+    error(diagnostics, "invalid-step-fields", "model, reasoning, tool calls, and metrics are agent-only fields", path);
+  }
+  if (step.source === "user" && step.observation !== undefined) {
+    error(diagnostics, "invalid-step-fields", "user steps cannot carry an observation", path);
+  }
+  if (step.source === "agent" && step.llm_call_count === 0 && (step.metrics !== undefined || step.reasoning_content !== undefined)) {
+    error(diagnostics, "invalid-step-fields", "a deterministic agent step cannot carry metrics or reasoning", path);
+  }
+  if (step.timestamp !== undefined && (!ISO_8601_PATTERN.test(step.timestamp) || !Number.isFinite(Date.parse(step.timestamp)))) {
+    error(diagnostics, "invalid-timestamp", "timestamp must be a valid ISO 8601 value", `${path}.timestamp`);
+  }
+  validateMetrics(step, path, diagnostics);
+}
+function validateTrajectory(trajectory, path, diagnostics) {
+  const toolCalls = new Map;
+  for (const [index, step] of trajectory.steps.entries()) {
+    const stepPath = `${path}.steps[${index}]`;
+    if (step.step_id !== index + 1) {
+      error(diagnostics, "invalid-step-sequence", "step_id values must start at 1 and remain sequential", `${stepPath}.step_id`);
+    }
+    validateStepFields(step, stepPath, diagnostics);
+    for (const call of step.tool_calls ?? []) {
+      const prior = toolCalls.get(call.tool_call_id);
+      if (prior) {
+        error(diagnostics, "duplicate-tool-call", `tool_call_id ${call.tool_call_id} already appears at ${prior}`, `${stepPath}.tool_calls`);
+      } else {
+        toolCalls.set(call.tool_call_id, stepPath);
+      }
+    }
+    const stepCallIds = new Set((step.tool_calls ?? []).map((call) => call.tool_call_id));
+    for (const [resultIndex, result] of (step.observation?.results ?? []).entries()) {
+      if (result.source_call_id !== undefined && !stepCallIds.has(result.source_call_id)) {
+        error(diagnostics, "unresolved-tool-result", `source_call_id ${result.source_call_id} has no tool call on this step`, `${path}.steps[${index}].observation.results[${resultIndex}]`);
+      }
+    }
+  }
+  const embedded = trajectory.subagent_trajectories ?? [];
+  const embeddedById = new Map;
+  for (const [index, child] of embedded.entries()) {
+    if (!child.trajectory_id) {
+      error(diagnostics, "unresolved-subagent-reference", "an embedded subagent trajectory needs trajectory_id", `${path}.subagent_trajectories[${index}]`);
+    } else if (embeddedById.has(child.trajectory_id)) {
+      error(diagnostics, "duplicate-trajectory-id", `embedded trajectory_id ${child.trajectory_id} is not unique`, `${path}.subagent_trajectories[${index}].trajectory_id`);
+    } else {
+      embeddedById.set(child.trajectory_id, index);
+    }
+    validateTrajectory(child, `${path}.subagent_trajectories[${index}]`, diagnostics);
+  }
+  for (const [stepIndex, step] of trajectory.steps.entries()) {
+    for (const [resultIndex, result] of (step.observation?.results ?? []).entries()) {
+      for (const [refIndex, reference] of (result.subagent_trajectory_ref ?? []).entries()) {
+        if (reference.trajectory_path === undefined && reference.trajectory_id !== undefined && !embeddedById.has(reference.trajectory_id)) {
+          error(diagnostics, "unresolved-subagent-reference", `trajectory_id ${reference.trajectory_id} is not embedded`, `${path}.steps[${stepIndex}].observation.results[${resultIndex}].subagent_trajectory_ref[${refIndex}]`);
+        }
+      }
+    }
+  }
+}
+function collectAtifValidationDiagnostics(value) {
+  const parsed = AtifTrajectorySchema.safeParse(value);
+  if (!parsed.success) {
+    return {
+      diagnostics: parsed.error.issues.map((issue) => ({
+        code: "invalid-document",
+        severity: "error",
+        message: issue.message,
+        path: issue.path.length > 0 ? issue.path.join(".") : "trajectory"
+      }))
+    };
+  }
+  const diagnostics = [];
+  validateTrajectory(parsed.data, "trajectory", diagnostics);
+  return { trajectory: parsed.data, diagnostics };
+}
+
+// src/core/atif/serialize.ts
+function hashBytes2(bytes) {
+  return createHash2("sha256").update(bytes).digest("hex");
+}
+function bundleFile(kind, path, mediaType, bytes) {
+  return {
+    kind,
+    path,
+    mediaType,
+    bytes,
+    sha256: hashBytes2(bytes),
+    sizeBytes: bytes.byteLength
+  };
+}
+function diagnostic2(code, message, path) {
+  return {
+    code,
+    severity: "error",
+    message,
+    ...path ? { path } : {}
+  };
+}
+function isExternalPath(path) {
+  try {
+    const url = new URL(path);
+    return url.protocol === "https:" || url.protocol === "http:";
+  } catch {
+    return false;
+  }
+}
+function validateDocumentReferences(trajectory, path, documentPath, documentPaths, assetPaths, diagnostics) {
+  if (trajectory.continued_trajectory_ref && !documentPaths.has(posix2.join(posix2.dirname(documentPath), trajectory.continued_trajectory_ref))) {
+    diagnostics.push(diagnostic2("unresolved-continuation-reference", "continued_trajectory_ref does not resolve to a bundle document", `${path}.continued_trajectory_ref`));
+  }
+  for (const [stepIndex, step] of trajectory.steps.entries()) {
+    const contentParts = [
+      ...Array.isArray(step.message) ? step.message : [],
+      ...(step.observation?.results ?? []).flatMap((result) => Array.isArray(result.content) ? result.content : [])
+    ];
+    for (const [partIndex, part] of contentParts.entries()) {
+      if (part.type !== "text" && !isExternalPath(part.source.path) && !assetPaths.has(posix2.join(posix2.dirname(documentPath), part.source.path))) {
+        diagnostics.push(diagnostic2("unresolved-asset-reference", "multimodal content path does not resolve to a bundle asset", `${path}.steps[${stepIndex}].content[${partIndex}]`));
+      }
+    }
+    for (const [resultIndex, result] of (step.observation?.results ?? []).entries()) {
+      for (const [referenceIndex, reference] of (result.subagent_trajectory_ref ?? []).entries()) {
+        if (reference.trajectory_path && !isExternalPath(reference.trajectory_path) && !documentPaths.has(posix2.join(posix2.dirname(documentPath), reference.trajectory_path))) {
+          diagnostics.push(diagnostic2("unresolved-subagent-document", "subagent trajectory_path does not resolve to a bundle document", `${path}.steps[${stepIndex}].observation.results[${resultIndex}].subagent_trajectory_ref[${referenceIndex}]`));
+        }
+      }
+    }
+  }
+  for (const [index, child] of (trajectory.subagent_trajectories ?? []).entries()) {
+    validateDocumentReferences(child, `${path}.subagent_trajectories[${index}]`, documentPath, documentPaths, assetPaths, diagnostics);
+  }
+}
+function eligibilityDiagnostics() {
+  return [
+    {
+      code: "sft-context-novelty-unavailable",
+      severity: "warning",
+      message: "per-attempt exports mark model-visible input as copied context, so this bundle does not assert SFT eligibility"
+    },
+    {
+      code: "rl-training-contract-unavailable",
+      severity: "warning",
+      message: "the recorded boundary has no attributable reward, policy revision, or trainer mask contract, so this bundle does not assert RL eligibility"
+    }
+  ];
+}
+function serializeAtifExportBundle(input) {
+  const draft = convertNativeRolloutSourcesToAtif(input);
+  const files = draft.files.map((file) => bundleFile(file.kind, file.path, file.mediaType, file.bytes));
+  const diagnostics = [...draft.diagnostics];
+  const documentEntries = [];
+  for (const trajectories of Object.values(draft.documents)) {
+    for (const trajectory of trajectories) {
+      const trajectoryId = trajectory.trajectory_id;
+      if (!trajectoryId) {
+        diagnostics.push(diagnostic2("missing-trajectory-id", "a serialized trajectory needs trajectory_id"));
+        continue;
+      }
+      const path = draft.documentPaths.get(trajectoryId);
+      if (!path) {
+        diagnostics.push(diagnostic2("missing-document-path", "a serialized trajectory has no bundle path", trajectoryId));
+        continue;
+      }
+      const validation = collectAtifValidationDiagnostics(trajectory);
+      diagnostics.push(...validation.diagnostics.map((entry) => ({
+        ...entry,
+        path: entry.path ? `${path}:${entry.path}` : path
+      })));
+      const bytes = Buffer.from(stringifyCanonicalJson(toJsonValue(trajectory)));
+      const file = bundleFile("document", path, "application/json", bytes);
+      files.push(file);
+      documentEntries.push({
+        path,
+        trajectoryId,
+        sha256: file.sha256,
+        sizeBytes: file.sizeBytes
+      });
+    }
+  }
+  const documentPaths = new Set(documentEntries.map((entry) => entry.path));
+  const assetPaths = new Set(files.filter((file) => file.kind === "asset").map((file) => file.path));
+  for (const [sessionId, trajectories] of Object.entries(draft.documents)) {
+    for (const [index, trajectory] of trajectories.entries()) {
+      validateDocumentReferences(trajectory, `documents.${sessionId}[${index}]`, draft.documentPaths.get(trajectory.trajectory_id ?? "") ?? "", documentPaths, assetPaths, diagnostics);
+    }
+  }
+  if (!documentEntries.some((entry) => entry.trajectoryId === draft.rootTrajectoryId)) {
+    diagnostics.push(diagnostic2("unresolved-root-trajectory", "rootTrajectoryId does not resolve to a serialized document"));
+  }
+  const paths = new Set;
+  for (const file of files) {
+    if (paths.has(file.path)) {
+      diagnostics.push(diagnostic2("duplicate-bundle-path", "bundle paths must be unique", file.path));
+    }
+    paths.add(file.path);
+  }
+  const validationFailed = diagnostics.some((entry) => entry.severity === "error") || draft.independentValidation?.status === "failed";
+  const transcriptPartial = diagnostics.length > 0;
+  const samplingFields = [
+    "promptTokenIds",
+    "completionTokenIds",
+    "logprobs",
+    "tokenizer"
+  ];
+  const samplingComplete = samplingFields.every((field) => draft.nativeSampling[field].available === input.sources.length);
+  const samplingDocuments = new Set(Object.values(draft.documents).flat().filter((document) => document.steps.some((step) => step.metrics?.prompt_token_ids !== undefined || step.metrics?.completion_token_ids !== undefined || step.metrics?.logprobs !== undefined)).map((document) => document.trajectory_id));
+  const manifest = {
+    type: TRAJECTORY_BUNDLE_TYPE,
+    version: TRAJECTORY_BUNDLE_VERSION,
+    rootTrajectoryId: draft.rootTrajectoryId,
+    atif: {
+      schemaVersion: ATIF_SCHEMA_VERSION,
+      referenceRevision: ATIF_REFERENCE_REVISION
+    },
+    exporter: draft.exporter,
+    documents: documentEntries.sort((left, right) => left.path.localeCompare(right.path)),
+    assets: files.filter((file) => file.kind === "asset").map((file) => ({
+      path: file.path,
+      sha256: file.sha256,
+      sizeBytes: file.sizeBytes,
+      mediaType: file.mediaType,
+      required: true
+    })).sort((left, right) => left.path.localeCompare(right.path)),
+    sources: files.filter((file) => file.kind === "source").map((file) => ({
+      id: file.path.slice("sources/".length, -".json".length),
+      path: file.path,
+      sha256: file.sha256,
+      sizeBytes: file.sizeBytes
+    })).sort((left, right) => left.path.localeCompare(right.path)),
+    validation: {
+      status: validationFailed ? "invalid" : "valid",
+      validator: {
+        name: "apex-atif-v1.8",
+        version: APEX_ATIF_EXPORTER_VERSION
+      },
+      independent: draft.independentValidation ?? {
+        status: "not_run",
+        detail: "no independent ATIF-v1.8 validator result was supplied to the exporter"
+      },
+      diagnostics
+    },
+    completeness: {
+      status: transcriptPartial ? "partial" : "complete",
+      sftEligibility: "ineligible",
+      rlEligibility: "ineligible",
+      diagnostics: [
+        ...diagnostics,
+        {
+          code: "source_relative_completeness",
+          severity: "warning",
+          message: "Completeness describes only the supplied source files. The run capture report is not consumed, so dropped attempts, delivery uncertainty, and whole-run coverage are not assessed."
+        },
+        ...eligibilityDiagnostics()
+      ]
+    },
+    nativeSampling: {
+      status: Object.values(draft.nativeSampling).some((field) => field.available > 0) ? samplingComplete ? "available" : "partial" : "unavailable",
+      artifactPaths: documentEntries.filter((entry) => samplingDocuments.has(entry.trajectoryId)).map((entry) => entry.path),
+      reason: samplingComplete ? null : "One or more native sampling fields were not exposed completely; see the per-field availability counts.",
+      fields: draft.nativeSampling
+    }
+  };
+  const parsedManifest = TrajectoryBundleManifestSchema.parse(manifest);
+  const manifestBytes = Buffer.from(stringifyCanonicalJson(toJsonValue(parsedManifest)));
+  files.push(bundleFile("manifest", TRAJECTORY_BUNDLE_FILENAME, "application/json", manifestBytes));
+  if (files.length > TRAJECTORY_BUNDLE_LIMITS.files || files.some((file) => file.sizeBytes > TRAJECTORY_BUNDLE_LIMITS.fileBytes) || files.reduce((total, file) => total + file.sizeBytes, 0) > TRAJECTORY_BUNDLE_LIMITS.totalBytes) {
+    throw new AtifConversionError("trajectory bundle exceeds portable export limits", [
+      diagnostic2("bundle_size_limit", "Bundle limits include every document, asset, source, and the manifest.")
+    ]);
+  }
+  files.sort((left, right) => left.path.localeCompare(right.path));
+  return {
+    manifest: parsedManifest,
+    documents: draft.documents,
+    files
+  };
+}
+// src/core/api/trajectoryExport.ts
+class TrajectoryExportError extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = "TrajectoryExportError";
+  }
+}
+var sha256Pattern = /^[a-f0-9]{64}$/;
+function hash(bytes) {
+  return createHash3("sha256").update(bytes).digest("hex");
+}
+function invalid(message) {
+  throw new TrajectoryExportError("INVALID_INPUT", message);
+}
+function portableBundlePath(path) {
+  if (!path || path.includes("\\") || path.includes("\x00"))
+    return false;
+  if (path.startsWith("/") || path.endsWith("/"))
+    return false;
+  return path.split("/").every((part) => part !== "" && part !== "." && part !== "..");
+}
+function validateInput(input) {
+  if (!input || !Array.isArray(input.sources) || input.sources.length === 0 || input.sources.length > ATIF_EXPORT_SOURCE_LIMITS.maxSources)
+    invalid(`sources must contain 1-${ATIF_EXPORT_SOURCE_LIMITS.maxSources} saved evidence files`);
+  if (!input.rootSourceId || !input.outputDirectory)
+    invalid("rootSourceId and outputDirectory are required");
+  if (!input.agent?.name || !input.agent.version)
+    invalid("agent name and version are required");
+  if (!input.exporter?.name || !input.exporter.version)
+    invalid("exporter name and version are required");
+  const ids = new Set;
+  let total = 0;
+  for (const source of input.sources) {
+    if (!source.id || !source.path || !sha256Pattern.test(source.sha256) || !Number.isSafeInteger(source.sizeBytes) || source.sizeBytes < 0)
+      invalid("each source needs an id, path, lowercase SHA-256, and safe byte length");
+    if (ids.has(source.id))
+      invalid(`duplicate source id: ${source.id}`);
+    ids.add(source.id);
+    total += source.sizeBytes;
+    if (!Number.isSafeInteger(total) || total > ATIF_EXPORT_SOURCE_LIMITS.maxTotalSourceBytes)
+      invalid(`source bytes exceed ${ATIF_EXPORT_SOURCE_LIMITS.maxTotalSourceBytes}`);
+  }
+}
+async function readExactSource(handle, source) {
+  const bytes = Buffer.allocUnsafe(source.sizeBytes);
+  let offset = 0;
+  while (offset < source.sizeBytes) {
+    const result = await handle.read(bytes, offset, source.sizeBytes - offset, offset);
+    if (result.bytesRead === 0)
+      break;
+    offset += result.bytesRead;
+  }
+  const extra = Buffer.allocUnsafe(1);
+  const extraRead = await handle.read(extra, 0, 1, offset);
+  if (offset !== source.sizeBytes || extraRead.bytesRead !== 0)
+    throw new TrajectoryExportError("SOURCE_IDENTITY_MISMATCH", `saved evidence changed while it was being read: ${source.id}`);
+  return bytes;
+}
+async function readSource(source) {
+  let handle;
+  try {
+    handle = await open(source.path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.size !== source.sizeBytes)
+      throw new TrajectoryExportError("SOURCE_IDENTITY_MISMATCH", `saved evidence size does not match: ${source.id}`);
+    const bytes = await readExactSource(handle, source);
+    if (hash(bytes) !== source.sha256)
+      throw new TrajectoryExportError("SOURCE_IDENTITY_MISMATCH", `saved evidence digest does not match: ${source.id}`);
+    return {
+      id: source.id,
+      bytes,
+      sha256: source.sha256,
+      sizeBytes: source.sizeBytes
+    };
+  } catch (error) {
+    if (error instanceof TrajectoryExportError)
+      throw error;
+    throw new TrajectoryExportError("SOURCE_UNAVAILABLE", `saved evidence could not be read: ${source.id}`, { cause: error });
+  } finally {
+    await handle?.close();
+  }
+}
+function validateBundle(files, manifest) {
+  if (manifest.validation.status !== "valid")
+    throw new TrajectoryExportError("BUNDLE_VALIDATION_FAILED", "trajectory bundle validation failed");
+  const parsedManifest = TrajectoryBundleManifestSchema.parse(manifest);
+  const paths = new Set;
+  let manifestFile;
+  for (const file of files) {
+    if (!portableBundlePath(file.path) || paths.has(file.path))
+      throw new TrajectoryExportError("BUNDLE_VALIDATION_FAILED", `invalid or duplicate bundle path: ${file.path}`);
+    paths.add(file.path);
+    if (file.sizeBytes !== file.bytes.byteLength || !sha256Pattern.test(file.sha256) || hash(file.bytes) !== file.sha256)
+      throw new TrajectoryExportError("BUNDLE_VALIDATION_FAILED", `bundle file identity does not match: ${file.path}`);
+    if (file.kind === "manifest") {
+      if (manifestFile)
+        throw new TrajectoryExportError("BUNDLE_VALIDATION_FAILED", "trajectory bundle contains more than one manifest");
+      manifestFile = file;
+    }
+  }
+  if (!manifestFile || manifestFile.path !== TRAJECTORY_BUNDLE_FILENAME)
+    throw new TrajectoryExportError("BUNDLE_VALIDATION_FAILED", `trajectory bundle must contain ${TRAJECTORY_BUNDLE_FILENAME}`);
+  let persistedManifest;
+  try {
+    persistedManifest = TrajectoryBundleManifestSchema.parse(JSON.parse(Buffer.from(manifestFile.bytes).toString("utf8")));
+  } catch (error) {
+    throw new TrajectoryExportError("BUNDLE_VALIDATION_FAILED", "trajectory bundle manifest bytes are invalid", { cause: error });
+  }
+  if (JSON.stringify(persistedManifest) !== JSON.stringify(parsedManifest))
+    throw new TrajectoryExportError("BUNDLE_VALIDATION_FAILED", "trajectory bundle manifest bytes do not match the validated manifest");
+}
+async function persistFile(root, file) {
+  const path = join(root, ...file.path.split("/"));
+  await mkdir(dirname(path), { recursive: true });
+  const handle = await open(path, "wx", 292);
+  try {
+    await handle.writeFile(file.bytes);
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+  const bytes = await readFile(path);
+  if (bytes.byteLength !== file.sizeBytes || hash(bytes) !== file.sha256)
+    throw new TrajectoryExportError("PUBLISH_FAILED", `persisted bundle file identity does not match: ${file.path}`);
+}
+async function publishBundle(destination, files) {
+  const parent = dirname(destination);
+  const name = basename(destination);
+  if (!name || name === ".")
+    invalid("outputDirectory needs a directory name");
+  const manifest = files.find((file) => file.kind === "manifest");
+  if (!manifest)
+    throw new TrajectoryExportError("BUNDLE_VALIDATION_FAILED", "trajectory bundle must contain a manifest");
+  await mkdir(parent, { recursive: true });
+  let ownsDestination = false;
+  try {
+    try {
+      await mkdir(destination, { recursive: false, mode: 448 });
+      ownsDestination = true;
+    } catch (error) {
+      if (error.code === "EEXIST")
+        throw new TrajectoryExportError("DESTINATION_EXISTS", `output directory already exists: ${destination}`);
+      throw error;
+    }
+    for (const file of files) {
+      if (file !== manifest)
+        await persistFile(destination, file);
+    }
+    const temporaryManifest = {
+      ...manifest,
+      path: `${manifest.path}.${randomUUID()}.tmp`
+    };
+    await persistFile(destination, temporaryManifest);
+    await link(join(destination, temporaryManifest.path), join(destination, manifest.path));
+    ownsDestination = false;
+    try {
+      await rm(join(destination, temporaryManifest.path));
+    } catch {}
+  } catch (error) {
+    if (error instanceof TrajectoryExportError)
+      throw error;
+    throw new TrajectoryExportError("PUBLISH_FAILED", `trajectory bundle could not be published: ${destination}`, { cause: error });
+  } finally {
+    if (ownsDestination)
+      await rm(destination, { recursive: true, force: true });
+  }
+}
+async function exportTrajectoryBundle(input) {
+  validateInput(input);
+  const sources = [];
+  for (const source of input.sources)
+    sources.push(await readSource(source));
+  const bundle = serializeAtifExportBundle({
+    sources,
+    rootSourceId: input.rootSourceId,
+    agent: input.agent,
+    exporter: input.exporter,
+    ...input.independentValidation ? { independentValidation: input.independentValidation } : {}
+  });
+  validateBundle(bundle.files, bundle.manifest);
+  const outputDirectory = resolve(input.outputDirectory);
+  await publishBundle(outputDirectory, bundle.files);
+  return {
+    outputDirectory,
+    manifestPath: join(outputDirectory, TRAJECTORY_BUNDLE_FILENAME),
+    manifest: bundle.manifest,
+    files: bundle.files.map(({ bytes: _bytes, ...file }) => file)
+  };
+}
+
+export { exportTrajectoryBundle };