@tangle-network/traces 0.23.0 → 1.0.0

package/dist/chunk-4VKPN432.js

@@ -0,0 +1,138 @@
+// src/verify-safe.ts
+import { lstat, readdir, readFile } from "fs/promises";
+import { basename, extname, join, relative } from "path";
+import {
+  assessShareSafety,
+  classifyKey,
+  combineVerdicts
+} from "@tangle-network/agent-eval/traces";
+var PROFILE = "share";
+var JSON_LINES = /* @__PURE__ */ new Set([".jsonl", ".ndjson"]);
+async function verifySafe(target, options = {}) {
+  const assess = (value) => assessShareSafety(numbersAreNotContent(value), { profile: PROFILE, knownSecrets: options.knownSecrets });
+  const verdicts = [];
+  const unreadable = [];
+  const files = await listFiles(target, unreadable);
+  for (const file of files) {
+    const label = relative(target, file) || basename(file);
+    let bytes;
+    try {
+      bytes = await readFile(file);
+    } catch (error) {
+      unreadable.push(`${label}: ${error instanceof Error ? error.message : String(error)}`);
+      continue;
+    }
+    const text = decodeUtf8(bytes);
+    if (text === void 0) {
+      unreadable.push(`${label}: not UTF-8 text`);
+      continue;
+    }
+    const extension = extname(file).toLowerCase();
+    if (JSON_LINES.has(extension)) {
+      text.split("\n").forEach((line, index) => {
+        if (!line.trim()) return;
+        const parsed = parseJson(line);
+        if (parsed === void 0) unreadable.push(`${label}:${index + 1}: not JSON`);
+        else verdicts.push(located(assess(parsed.value), `${label}:${index + 1}`));
+      });
+    } else if (extension === ".json") {
+      const parsed = parseJson(text);
+      if (parsed === void 0) unreadable.push(`${label}: not JSON`);
+      else verdicts.push(located(assess(parsed.value), label));
+    } else {
+      verdicts.push(located(assess(text), label));
+    }
+  }
+  if (files.length === 0 && unreadable.length === 0) unreadable.push(`${target}: no files to check`);
+  return { ...combineVerdicts(PROFILE, verdicts, unreadable), target, files: files.length };
+}
+function onlyNumbers(value) {
+  if (value === null || typeof value === "number" || typeof value === "boolean") return true;
+  if (Array.isArray(value)) return value.every(onlyNumbers);
+  if (typeof value === "object") return Object.values(value).every(onlyNumbers);
+  return false;
+}
+function noFlaggedKeys(value) {
+  if (Array.isArray(value)) return value.every(noFlaggedKeys);
+  if (value === null || typeof value !== "object") return true;
+  return Object.entries(value).every(([key, item]) => {
+    const category = classifyKey(key);
+    return (category === void 0 || category === "raw-content") && noFlaggedKeys(item);
+  });
+}
+function numbersAreNotContent(value) {
+  if (Array.isArray(value)) return value.map(numbersAreNotContent);
+  if (value === null || typeof value !== "object") return value;
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    out[key] = classifyKey(key) === "raw-content" && item !== null && typeof item === "object" && onlyNumbers(item) && noFlaggedKeys(item) ? 0 : numbersAreNotContent(item);
+  }
+  return out;
+}
+async function listFiles(target, unreadable) {
+  let stat;
+  try {
+    stat = await lstat(target);
+  } catch (error) {
+    unreadable.push(`${target}: ${error instanceof Error ? error.message : String(error)}`);
+    return [];
+  }
+  if (stat.isFile()) return [target];
+  if (!stat.isDirectory()) {
+    unreadable.push(`${target}: not a regular file or directory`);
+    return [];
+  }
+  const out = [];
+  const walk = async (dir) => {
+    for (const entry of (await readdir(dir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+      const path = join(dir, entry.name);
+      if (entry.isDirectory()) await walk(path);
+      else if (entry.isFile()) out.push(path);
+      else unreadable.push(`${relative(target, path)}: not a regular file`);
+    }
+  };
+  await walk(target);
+  return out;
+}
+function decodeUtf8(bytes) {
+  if (bytes.includes(0)) return void 0;
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    return void 0;
+  }
+}
+function parseJson(text) {
+  try {
+    return { value: JSON.parse(text) };
+  } catch {
+    return void 0;
+  }
+}
+function located(verdict, where) {
+  return {
+    ...verdict,
+    findings: verdict.findings.map((finding) => ({
+      ...finding,
+      paths: finding.paths.map((path) => `${where}#${path}`)
+    })),
+    unreadable: verdict.unreadable.map((entry) => `${where}#${entry}`)
+  };
+}
+function formatVerdict(result) {
+  const lines = [`${result.status}  ${result.target} (${result.files} file(s), share profile)`];
+  for (const finding of result.findings) {
+    lines.push(
+      `  ${finding.severity.padEnd(7)} ${finding.category}/${finding.detector} x${finding.count}  ${finding.paths.join(", ")}`
+    );
+  }
+  for (const entry of result.unreadable) lines.push(`  unread  ${entry}`);
+  if (result.status === "UNSAFE") lines.push("Refuse to share: remove what each finding names, then run traces check <path> --share-safe again.");
+  if (result.status === "UNKNOWN") lines.push("Refuse to share: part of the input could not be read, so its safety is unknown.");
+  return lines.join("\n");
+}
+
+export {
+  verifySafe,
+  formatVerdict
+};

package/dist/chunk-6CLC7DKP.js

@@ -0,0 +1,492 @@
+import {
+  ATTR,
+  capText,
+  stampEnvironmentAttrs
+} from "./chunk-TR6O4S4T.js";
+import {
+  appendAll,
+  otlpRowToSpan,
+  readJsonl,
+  span,
+  validateOtlpSpans
+} from "./chunk-NZ5Y7UEL.js";
+import {
+  redactSpans
+} from "./chunk-RZL5GAWH.js";
+import {
+  toolIoAttributes
+} from "./chunk-DU534HAX.js";
+
+// src/file-export.ts
+import { createHash } from "crypto";
+import { readFile } from "fs/promises";
+function isObject(value) {
+  return value != null && typeof value === "object" && !Array.isArray(value);
+}
+function stringValue(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function objectValue(value) {
+  return isObject(value) ? value : void 0;
+}
+function stableJson(value) {
+  return JSON.stringify(value, (_key, v) => {
+    if (!isObject(v)) return v;
+    return Object.keys(v).sort().reduce((acc, key) => {
+      acc[key] = v[key];
+      return acc;
+    }, {});
+  });
+}
+function hashId(value, chars = 16) {
+  return createHash("sha256").update(stableJson(value)).digest("hex").slice(0, chars);
+}
+function isoTime(value) {
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    const normalized = /^\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}:\d{2}(?:\.\d+)?$/.test(trimmed) ? `${trimmed.replace(" ", "T")}Z` : trimmed;
+    const ms = Date.parse(normalized);
+    return Number.isFinite(ms) ? new Date(ms).toISOString() : void 0;
+  }
+  if (typeof value === "number" && Number.isFinite(value)) {
+    const ms = value < 1e10 ? value * 1e3 : value;
+    return new Date(ms).toISOString();
+  }
+  return void 0;
+}
+function firstTime(obj, keys) {
+  for (const key of keys) {
+    const value = isoTime(obj[key]);
+    if (value) return value;
+  }
+  return void 0;
+}
+function firstTimeDeep(value, keys, depth = 5) {
+  if (depth < 0) return void 0;
+  if (isObject(value)) {
+    const direct = firstTime(value, keys);
+    if (direct) return direct;
+    for (const child of Object.values(value)) {
+      const found = firstTimeDeep(child, keys, depth - 1);
+      if (found) return found;
+    }
+  } else if (Array.isArray(value)) {
+    for (const child of value) {
+      const found = firstTimeDeep(child, keys, depth - 1);
+      if (found) return found;
+    }
+  }
+  return void 0;
+}
+function copyDefined(target, entries) {
+  for (const [key, value] of Object.entries(entries)) {
+    if (value != null && value !== "") target[key] = value;
+  }
+}
+function parseJsonRows(text) {
+  const trimmed = text.trim();
+  if (!trimmed) throw new Error("input file is empty");
+  if (trimmed.startsWith("[") || trimmed.startsWith("{")) {
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (Array.isArray(parsed)) return { rows: parsed };
+      if (isObject(parsed)) {
+        const events = parsed.events;
+        if (Array.isArray(events)) return { rows: events, wrapper: parsed };
+        return { rows: [parsed] };
+      }
+      throw new Error("input JSON must be an object, array, or JSONL rows");
+    } catch (error) {
+      const hasMultipleRows = /\r?\n/.test(trimmed);
+      if (!hasMultipleRows) throw error;
+    }
+  }
+  return {
+    rows: trimmed.split(/\r?\n/).filter((line) => line.trim().length > 0).map((line) => JSON.parse(line))
+  };
+}
+function isOpenInferenceRow(row) {
+  if (!isObject(row)) return false;
+  return typeof row.trace_id === "string" && typeof row.span_id === "string" && (row.parent_span_id == null || typeof row.parent_span_id === "string") && typeof row.name === "string" && typeof row.start_time === "string" && typeof row.end_time === "string" && isObject(row.status) && isObject(row.attributes) && (row.resource === void 0 || isObject(row.resource)) && (row.scope === void 0 || isObject(row.scope)) && (row.links === void 0 || Array.isArray(row.links));
+}
+function eventType(row) {
+  return stringValue(row.type) ?? stringValue(row.event) ?? stringValue(row.name) ?? stringValue(row.kind);
+}
+function looksLikeSandboxEvent(row) {
+  if (!isObject(row)) return false;
+  const type = eventType(row)?.toLowerCase();
+  return type === "start" || type === "raw" || type === "result" || type === "done" || type === "error";
+}
+function detectEvidenceFormat(rows) {
+  if (rows.length === 0 || rows.every(isOpenInferenceRow)) return void 0;
+  if (rows.some(looksLikeSandboxEvent)) return "sandbox-events";
+  return void 0;
+}
+function detectFormat(rows, requested) {
+  if (requested !== "auto") return requested;
+  if (rows.length === 0) throw new Error("input contains no rows");
+  if (rows.every(isOpenInferenceRow)) return "openinference";
+  if (rows.some(looksLikeSandboxEvent)) return "sandbox-events";
+  throw new Error("could not detect input format: expected OpenInference span rows or sandbox events");
+}
+function requireOpenInferenceRows(rows) {
+  if (!rows.every(isOpenInferenceRow)) throw new Error("openinference input must contain only complete OpenInference span rows");
+  return rows;
+}
+function requireObjectRows(rows) {
+  if (!rows.every(isObject)) throw new Error("sandbox-events input must contain only JSON object events");
+  return rows;
+}
+function findStringKey(value, keys, depth = 4) {
+  if (depth < 0) return void 0;
+  if (isObject(value)) {
+    for (const key of keys) {
+      const found = stringValue(value[key]);
+      if (found) return found;
+    }
+    for (const child of Object.values(value)) {
+      const found = findStringKey(child, keys, depth - 1);
+      if (found) return found;
+    }
+  } else if (Array.isArray(value)) {
+    for (const child of value) {
+      const found = findStringKey(child, keys, depth - 1);
+      if (found) return found;
+    }
+  }
+  return void 0;
+}
+function eventValue(row, keys) {
+  const scopes = [row, objectValue(row.data), objectValue(row.payload)];
+  for (const scope of scopes) {
+    if (!scope) continue;
+    for (const key of keys) {
+      if (scope[key] !== void 0) return scope[key];
+    }
+  }
+  return void 0;
+}
+function eventTimestamp(row) {
+  return firstTimeDeep(row, [
+    "timestamp",
+    "start_time",
+    "startTime",
+    "startedAt",
+    "createdAt",
+    "created_at",
+    "created",
+    "time"
+  ]);
+}
+function eventEndTimestamp(row, fallback) {
+  return firstTimeDeep(row, [
+    "end_time",
+    "endTime",
+    "completedAt",
+    "completed_at",
+    "finishedAt",
+    "updatedAt",
+    "updated_at",
+    "updated"
+  ]) ?? fallback;
+}
+function eventStatus(row, type) {
+  const lowered = type.toLowerCase();
+  const errorMessage = stringValue(row.error) ?? findStringKey(row, ["error", "errorMessage", "error_message"], 3);
+  if (lowered.includes("error") || errorMessage) {
+    const message = errorMessage ?? stringValue(row.message);
+    return { status: "ERROR", ...message ? { message: capText(message) } : {} };
+  }
+  return { status: "OK" };
+}
+function eventKind(row, type) {
+  const lowered = type.toLowerCase();
+  if (lowered === "result") return { kind: "CHAIN" };
+  const tool = findStringKey(row, ["tool", "toolName", "tool_name"], 4);
+  if (tool || lowered.includes("tool") || stableJson(row).includes("tool-invocation")) return { kind: "TOOL", tool };
+  if (lowered.includes("llm") || lowered === "token") return { kind: "LLM" };
+  return { kind: "CHAIN" };
+}
+function sandboxEventsEnvironment(context, rows) {
+  const ready = rows.find((row) => eventType(row) === "runtime.ready");
+  const readyData = ready && isObject(ready.data) ? ready.data : void 0;
+  const pick = (keys) => findStringKey(context, keys, 2) ?? (readyData ? findStringKey(readyData, keys, 2) : void 0);
+  const image = pick(["image"]);
+  const imageDigest = pick(["imageDigest", "image_digest"]);
+  const sandboxId = pick(["sandboxId", "sandbox_id"]);
+  const cwd = pick(["cwd", "workspaceRoot", "workspace_root"]);
+  if (!image && !imageDigest && !sandboxId && !cwd) return null;
+  return {
+    ...image ? { image } : {},
+    ...imageDigest ? { imageDigest } : {},
+    ...sandboxId ? { sandboxId } : {},
+    cwd: cwd ?? null
+  };
+}
+function llmEventUsage(row) {
+  const num = (keys) => {
+    for (const key of keys) {
+      const direct = numberValue(row[key]);
+      if (direct !== void 0) return direct;
+      for (const nest of ["data", "usage", "tokenUsage"]) {
+        const container = row[nest];
+        if (!isObject(container)) continue;
+        const value = numberValue(container[key]);
+        if (value !== void 0) return value;
+        for (const inner of ["usage", "tokenUsage"]) {
+          const deep = container[inner];
+          if (isObject(deep)) {
+            const deepValue = numberValue(deep[key]);
+            if (deepValue !== void 0) return deepValue;
+          }
+        }
+      }
+    }
+    return void 0;
+  };
+  const model = findStringKey(row, ["model"], 3);
+  const inputTokens = num(["prompt_tokens", "input_tokens", "inputTokens"]);
+  const outputTokens = num(["completion_tokens", "output_tokens", "outputTokens"]);
+  const costUsd = num(["totalCostUsd", "total_cost_usd", "costUsd", "cost_usd"]);
+  return {
+    ...model ? { model } : {},
+    ...inputTokens !== void 0 ? { inputTokens } : {},
+    ...outputTokens !== void 0 ? { outputTokens } : {},
+    ...costUsd !== void 0 ? { costUsd } : {}
+  };
+}
+function toolPart(row) {
+  const data = objectValue(row.data);
+  const part = objectValue(data?.part) ?? objectValue(row.part) ?? objectValue(objectValue(data?.event)?.part);
+  return part && part.type === "tool" && stringValue(part.id) ? part : void 0;
+}
+function foldToolPart(into, part) {
+  const state = objectValue(part.state);
+  const time = objectValue(state?.time);
+  into.tool = stringValue(part.tool) ?? into.tool;
+  const input = state?.input;
+  if (input !== void 0 && !(isObject(input) && Object.keys(input).length === 0)) into.input = input;
+  if (state?.output !== void 0) into.output = state.output;
+  into.error = stringValue(state?.error) ?? into.error;
+  const start = isoTime(time?.start);
+  if (start && (into.start === void 0 || start < into.start)) into.start = start;
+  into.end = isoTime(time?.end) ?? into.end;
+}
+function sandboxEventsToSpans(rows, wrapper) {
+  const context = wrapper ?? {};
+  const sessionId = findStringKey(context, ["session_id", "sessionId"], 3) ?? findStringKey(rows, ["session_id", "sessionId"], 4);
+  const traceId = findStringKey(context, ["trace_id", "traceId"], 3) ?? findStringKey(rows, ["trace_id", "traceId"], 4) ?? sessionId ?? findStringKey(context, ["run_id", "runId"], 3) ?? findStringKey(rows, ["run_id", "runId"], 4) ?? `sandbox:${hashId(rows, 32)}`;
+  const service = findStringKey(context, ["service", "harness", "source"], 2) ?? "sandbox-opencode";
+  const times = rows.flatMap((row) => {
+    const time = eventTimestamp(row);
+    return time ? [time] : [];
+  }).sort();
+  const rootId = `events:${hashId({ traceId, rows: rows.length })}`;
+  const hasError = rows.some((row) => eventStatus(row, eventType(row) ?? "event").status === "ERROR");
+  const rootStart = times[0] ?? (/* @__PURE__ */ new Date(0)).toISOString();
+  const rootEnd = times[times.length - 1] ?? rootStart;
+  const spans = [
+    span({
+      traceId,
+      spanId: rootId,
+      parentSpanId: null,
+      name: "sandbox.events",
+      kind: "AGENT",
+      startTime: rootStart,
+      endTime: rootEnd,
+      status: hasError ? "ERROR" : "OK",
+      service,
+      agent: service,
+      extra: {
+        "traces.source_format": "sandbox-events",
+        "traces.event_count": rows.length
+      }
+    })
+  ];
+  const lastEventOfPart = /* @__PURE__ */ new Map();
+  const firstTimeOfPart = /* @__PURE__ */ new Map();
+  const errorOfPart = /* @__PURE__ */ new Map();
+  const stateOfPart = /* @__PURE__ */ new Map();
+  rows.forEach((row, index) => {
+    const toolPartOfRow = toolPart(row);
+    if (toolPartOfRow === void 0) return;
+    const part = stringValue(toolPartOfRow.id);
+    lastEventOfPart.set(part, index);
+    const state = stateOfPart.get(part) ?? {};
+    foldToolPart(state, toolPartOfRow);
+    stateOfPart.set(part, state);
+    const time = eventTimestamp(row);
+    const first = firstTimeOfPart.get(part);
+    if (time && (first === void 0 || time < first)) firstTimeOfPart.set(part, time);
+    const partStatus = stringValue(objectValue(toolPartOfRow.state)?.status);
+    const status = partStatus === "error" || partStatus === "failed" ? { status: "ERROR", ...state.error ? { message: capText(state.error) } : {} } : eventStatus(row, eventType(row) ?? "event");
+    if (status.status === "ERROR") errorOfPart.set(part, status);
+  });
+  const mergedToolEvents = rows.filter((row, index) => {
+    const part = stringValue(toolPart(row)?.id);
+    return part !== void 0 && lastEventOfPart.get(part) !== index;
+  }).length;
+  if (mergedToolEvents > 0) spans[0].attributes["traces.event.tool_part_updates_merged"] = mergedToolEvents;
+  let previousTime = rootStart;
+  rows.forEach((row, index) => {
+    const part = stringValue(toolPart(row)?.id);
+    if (part !== void 0 && lastEventOfPart.get(part) !== index) return;
+    const partState = part !== void 0 ? stateOfPart.get(part) : void 0;
+    const type = eventType(row) ?? "event";
+    const time = partState?.start ?? (part !== void 0 ? firstTimeOfPart.get(part) : void 0) ?? eventTimestamp(row) ?? previousTime;
+    previousTime = time;
+    const { status, message } = (part !== void 0 ? errorOfPart.get(part) : void 0) ?? eventStatus(row, type);
+    const { kind, tool } = partState ? { kind: "TOOL", tool: partState.tool } : eventKind(row, type);
+    const name = kind === "TOOL" && tool ? `tool.${tool}` : `event.${type}`;
+    const toolInput = kind === "TOOL" ? partState?.input ?? eventValue(row, ["toolInput", "tool_input", "input", "args", "arguments", "full_command"]) : void 0;
+    const toolOutput = kind === "TOOL" ? partState?.output ?? partState?.error ?? eventValue(row, ["toolOutput", "tool_output", "output", "result"]) : void 0;
+    const invocations = type === "result" ? objectValue(row.data)?.toolInvocations : void 0;
+    const extra = {
+      "traces.source_format": "sandbox-events",
+      "traces.event.type": type,
+      "traces.event.index": index,
+      ...kind === "TOOL" ? toolIoAttributes({ input: toolInput, output: toolOutput, argsCaptured: toolInput !== void 0 }) : {},
+      // The Sandbox's own count of the run's tool calls, beside the tool spans counted from their events.
+      ...Array.isArray(invocations) ? { "traces.event.tool_invocations": invocations.length } : {}
+    };
+    copyDefined(extra, {
+      "traces.event.part_id": part,
+      "traces.event.id": stringValue(row.id),
+      "traces.event.raw_type": stringValue(row.type),
+      "traces.event.raw_event": stringValue(row.event)
+    });
+    spans.push(span({
+      traceId,
+      spanId: `event:${index}:${hashId(row)}`,
+      parentSpanId: rootId,
+      name,
+      kind,
+      startTime: time,
+      endTime: partState?.end !== void 0 && partState.end >= time ? partState.end : eventEndTimestamp(row, time),
+      status,
+      statusMessage: message,
+      service,
+      agent: service,
+      tool: kind === "TOOL" ? tool ?? type : null,
+      step: index,
+      content: capText(stableJson(row)),
+      extra,
+      ...kind === "LLM" ? llmEventUsage(row) : {}
+    }));
+  });
+  stampEnvironmentAttrs(spans, sandboxEventsEnvironment(context, rows) ?? void 0);
+  if (!sessionId) return spans;
+  return spans.map((item) => ({
+    ...item,
+    attributes: { ...item.attributes, [ATTR.SESSION_ID]: sessionId }
+  }));
+}
+function numberValue(value) {
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (typeof value === "string" && value.trim().length > 0) {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : void 0;
+  }
+  return void 0;
+}
+var OPEN_INFERENCE_STATUS_CODES = /* @__PURE__ */ new Set([
+  "OK",
+  "ERROR",
+  "UNSET",
+  "STATUS_CODE_OK",
+  "STATUS_CODE_ERROR",
+  "STATUS_CODE_UNSET"
+]);
+function openInferenceToSpans(rows) {
+  return rows.map((row) => {
+    const status = objectValue(row.status);
+    const code = status?.code;
+    if (code != null && !(typeof code === "string" && OPEN_INFERENCE_STATUS_CODES.has(code))) {
+      throw new TypeError("OpenInference status.code must be OK, ERROR, UNSET, or its STATUS_CODE_* form");
+    }
+    const traceId = stringValue(row.trace_id);
+    const converted = otlpRowToSpan(row, traceId ?? "openinference");
+    if (!converted.span) {
+      throw new TypeError(`openinference row is not a usable span: ${converted.issue?.detail ?? "unknown reason"}`);
+    }
+    return converted.span;
+  });
+}
+function normalizeAttributes(attributes) {
+  const normalized = {};
+  for (const [key, value] of Object.entries(attributes ?? {})) {
+    if (!key || value == null) continue;
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+      normalized[key] = value;
+    } else if (Array.isArray(value) && value.every(
+      (item) => typeof item === "string" || typeof item === "number" || typeof item === "boolean"
+    )) {
+      normalized[key] = value;
+    } else {
+      normalized[key] = stableJson(value);
+    }
+  }
+  return normalized;
+}
+function withExportAttributes(spans, attributes) {
+  const normalized = normalizeAttributes(attributes);
+  if (Object.keys(normalized).length === 0) return [...spans];
+  return spans.map((s) => ({ ...s, attributes: { ...s.attributes, ...normalized } }));
+}
+function exportTraceEvidenceRows(rows, opts = {}, wrapper) {
+  const format = detectFormat(rows, opts.format ?? "auto");
+  const converted = format === "openinference" ? openInferenceToSpans(requireOpenInferenceRows(rows)) : sandboxEventsToSpans(requireObjectRows(rows), wrapper);
+  const spans = withExportAttributes(converted, opts.attributes);
+  if (spans.length === 0) throw new Error(`no spans exported from ${format} input`);
+  const redacted = redactSpans(spans);
+  const validated = validateOtlpSpans(redacted.spans, `${format} export`);
+  return {
+    format,
+    spans: validated,
+    redactionCount: redacted.report.redactionCount,
+    redactionsByDetector: redacted.report.byDetector
+  };
+}
+function exportTraceEvidenceText(text, opts = {}) {
+  const parsed = parseJsonRows(text);
+  return exportTraceEvidenceRows(parsed.rows, opts, parsed.wrapper);
+}
+async function exportTraceEvidenceFile(inputPath, opts = {}) {
+  if (/\.(?:jsonl|ndjson)$/i.test(inputPath)) {
+    let format;
+    const spans = [];
+    const sandboxRows = [];
+    let redactionCount = 0;
+    const redactionsByDetector = {};
+    for await (const row of readJsonl(inputPath)) {
+      format ??= detectFormat([row], opts.format ?? "auto");
+      if (format === "sandbox-events") {
+        sandboxRows.push(row);
+        continue;
+      }
+      const converted = exportTraceEvidenceRows([row], { ...opts, format });
+      appendAll(spans, converted.spans);
+      redactionCount += converted.redactionCount;
+      for (const [rule, count] of Object.entries(converted.redactionsByDetector)) {
+        redactionsByDetector[rule] = (redactionsByDetector[rule] ?? 0) + count;
+      }
+    }
+    if (!format) throw new Error("input file is empty");
+    if (format === "sandbox-events") {
+      return exportTraceEvidenceRows(sandboxRows, { ...opts, format });
+    }
+    return {
+      format,
+      spans: validateOtlpSpans(spans, `${format} file export`),
+      redactionCount,
+      redactionsByDetector
+    };
+  }
+  const text = await readFile(inputPath, "utf8");
+  return exportTraceEvidenceText(text, opts);
+}
+
+export {
+  detectEvidenceFormat,
+  exportTraceEvidenceFile
+};