agent-inspect 1.7.0 → 1.8.0

package/packages/core/dist/checks.mjs

@@ -0,0 +1,1512 @@
+// packages/core/src/checks/index.ts
+var SEVERITY_RANK = {
+  error: 0,
+  warning: 1,
+  info: 2
+};
+var STATUS_RANK = {
+  fail: 0,
+  warning: 1,
+  pass: 2
+};
+var CONFIDENCE_RANK = {
+  unknown: 0,
+  heuristic: 1,
+  correlated: 2,
+  explicit: 3
+};
+var DEFAULT_SENSITIVE_KEYS = [
+  "authorization",
+  "cookie",
+  "token",
+  "apikey",
+  "api_key",
+  "password",
+  "secret",
+  "email"
+];
+var DEFAULT_RAW_CONTENT_KEYS = [
+  "body",
+  "headers",
+  "input",
+  "messages",
+  "output",
+  "payload",
+  "prompt",
+  "requestbody",
+  "request_body",
+  "responsebody",
+  "response_body",
+  "rawprompt",
+  "raw_prompt",
+  "rawoutput",
+  "raw_output",
+  "toolinput",
+  "tool_input",
+  "tooloutput",
+  "tool_output"
+];
+var DEFAULT_SECRET_PATTERNS = [
+  { id: "bearer-token", pattern: /Bearer\s+[A-Za-z0-9._~+/-]{12,}=*/ },
+  { id: "openai-key", pattern: /sk-[A-Za-z0-9_-]{16,}/ },
+  { id: "aws-access-key", pattern: /AKIA[0-9A-Z]{16}/ },
+  { id: "github-token", pattern: /gh[opsu]_[A-Za-z0-9_]{20,}/ },
+  { id: "key-value-secret", pattern: /(api[_-]?key|token|password|secret)=\S{8,}/i }
+];
+function compareStrings(a, b) {
+  return (a ?? "").localeCompare(b ?? "");
+}
+function diagnostic(code, message, ruleId) {
+  return {
+    code,
+    message,
+    severity: "error",
+    ...ruleId ? { ruleId } : {}
+  };
+}
+function emptySummary() {
+  return {
+    passed: 0,
+    failed: 0,
+    warnings: 0,
+    errors: 0
+  };
+}
+function errorResult(input, diagnostics, selectedRun) {
+  return {
+    ok: false,
+    status: "error",
+    format: input.read.format,
+    ...selectedRun ? { runId: selectedRun.runId } : {},
+    summary: {
+      ...emptySummary(),
+      errors: diagnostics.filter((item) => item.severity === "error").length
+    },
+    findings: [],
+    diagnostics: [...diagnostics]
+  };
+}
+function flattenNodes(nodes) {
+  return nodes.flatMap((node) => [node, ...flattenNodes(node.children)]);
+}
+function buildFacts(input, selectedRun) {
+  const scopedRuns = selectedRun ? [selectedRun] : input.read.runs;
+  const scopedRunIds = new Set(scopedRuns.map((run) => run.runId));
+  const scopedEvents = selectedRun === void 0 ? input.read.events : input.read.events.filter((event) => scopedRunIds.has(event.runId));
+  const nodes = flattenNodes(scopedRuns.flatMap((run) => run.children));
+  const nodesByEventId = /* @__PURE__ */ new Map();
+  const childrenByParentId = /* @__PURE__ */ new Map();
+  for (const node of nodes) {
+    nodesByEventId.set(node.event.eventId, node);
+    const parentId = node.event.parentId;
+    if (parentId) {
+      const children = childrenByParentId.get(parentId) ?? [];
+      children.push(node);
+      childrenByParentId.set(parentId, children);
+    }
+  }
+  return {
+    format: input.read.format,
+    runs: Object.freeze([...input.read.runs]),
+    events: Object.freeze([...scopedEvents]),
+    readerWarnings: Object.freeze([...input.read.warnings]),
+    unsupportedFields: Object.freeze([...input.read.unsupportedFields]),
+    sourceFiles: Object.freeze([...input.read.sourceFiles]),
+    nodesByEventId,
+    childrenByParentId,
+    rootNodes: Object.freeze(scopedRuns.flatMap((run) => run.children))
+  };
+}
+function resolveSelectedRun(input, runId) {
+  if (input.selectedRun) {
+    if (runId && input.selectedRun.runId !== runId) {
+      return {
+        diagnostics: [
+          diagnostic(
+            "AI_CHECK_INVALID_ARGUMENTS",
+            `Selected run ${input.selectedRun.runId} does not match requested run ${runId}.`
+          )
+        ]
+      };
+    }
+    return { run: input.selectedRun, diagnostics: [] };
+  }
+  if (runId) {
+    const run = input.read.runs.find((candidate) => candidate.runId === runId);
+    if (!run) {
+      return {
+        diagnostics: [
+          diagnostic("AI_CHECK_RUN_SELECTION_REQUIRED", `Run not found: ${runId}.`)
+        ]
+      };
+    }
+    return { run, diagnostics: [] };
+  }
+  if (input.read.runs.length === 1) {
+    return { run: input.read.runs[0], diagnostics: [] };
+  }
+  if (input.read.runs.length === 0) {
+    return {
+      diagnostics: [
+        diagnostic("AI_CHECK_RUN_SELECTION_REQUIRED", "No runs are available for checks.")
+      ]
+    };
+  }
+  return {
+    diagnostics: [
+      diagnostic(
+        "AI_CHECK_RUN_SELECTION_REQUIRED",
+        "Multiple runs are available; select a run before executing checks."
+      )
+    ]
+  };
+}
+function selectRules(rules, selectedIds) {
+  const diagnostics = [];
+  const byId = /* @__PURE__ */ new Map();
+  for (const rule of rules) {
+    if (byId.has(rule.id)) {
+      diagnostics.push(
+        diagnostic("AI_CHECK_INVALID_CONFIG", `Duplicate trace check rule id: ${rule.id}.`, rule.id)
+      );
+      continue;
+    }
+    byId.set(rule.id, rule);
+  }
+  if (selectedIds && selectedIds.length > 0) {
+    const selected = new Set(selectedIds);
+    for (const id of selected) {
+      if (!byId.has(id)) {
+        diagnostics.push(
+          diagnostic("AI_CHECK_INVALID_CONFIG", `Unknown trace check rule id: ${id}.`, id)
+        );
+      }
+    }
+    return {
+      rules: [...byId.values()].filter((rule) => selected.has(rule.id)).sort(compareRules),
+      diagnostics
+    };
+  }
+  return { rules: [...byId.values()].sort(compareRules), diagnostics };
+}
+function compareRules(a, b) {
+  return a.id.localeCompare(b.id);
+}
+function eventTimestamp(finding, eventById) {
+  const eventId = finding.evidence[0]?.eventId;
+  return eventId ? eventById.get(eventId)?.timestamp ?? "" : "";
+}
+function compareFindings(eventById) {
+  return (a, b) => {
+    if (SEVERITY_RANK[a.severity] !== SEVERITY_RANK[b.severity]) {
+      return SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity];
+    }
+    const byRule = a.ruleId.localeCompare(b.ruleId);
+    if (byRule !== 0) return byRule;
+    if (STATUS_RANK[a.status] !== STATUS_RANK[b.status]) {
+      return STATUS_RANK[a.status] - STATUS_RANK[b.status];
+    }
+    const byRun = compareStrings(a.evidence[0]?.runId, b.evidence[0]?.runId);
+    if (byRun !== 0) return byRun;
+    const byTime = eventTimestamp(a, eventById).localeCompare(eventTimestamp(b, eventById));
+    if (byTime !== 0) return byTime;
+    const byEvent = compareStrings(a.evidence[0]?.eventId, b.evidence[0]?.eventId);
+    if (byEvent !== 0) return byEvent;
+    return compareStrings(a.evidence[0]?.path, b.evidence[0]?.path);
+  };
+}
+function normalizeFinding(rule, finding) {
+  return {
+    ruleId: finding.ruleId || rule.id,
+    severity: finding.severity ?? rule.defaultSeverity,
+    status: finding.status,
+    message: finding.message,
+    ...finding.expected !== void 0 ? { expected: finding.expected } : {},
+    ...finding.actual !== void 0 ? { actual: finding.actual } : {},
+    evidence: [...finding.evidence ?? []]
+  };
+}
+function summarize(findings, diagnostics) {
+  return {
+    passed: findings.filter((finding) => finding.status === "pass").length,
+    failed: findings.filter(
+      (finding) => finding.status === "fail" && finding.severity === "error"
+    ).length,
+    warnings: findings.filter(
+      (finding) => finding.status === "warning" || finding.severity === "warning"
+    ).length,
+    errors: diagnostics.filter((item) => item.severity === "error").length
+  };
+}
+function stringAttr(event, keys) {
+  for (const key of keys) {
+    const value = event.attributes?.[key];
+    if (typeof value === "string" && value.trim() !== "") return value;
+  }
+  return void 0;
+}
+function numericAttr(event, keys) {
+  for (const key of keys) {
+    const value = event.attributes?.[key];
+    if (typeof value === "number" && Number.isFinite(value)) return value;
+  }
+  return void 0;
+}
+function booleanAttr(event, keys) {
+  for (const key of keys) {
+    const value = event.attributes?.[key];
+    if (typeof value === "boolean") return value;
+  }
+  return void 0;
+}
+function stripPrefix(name, prefixes) {
+  for (const prefix of prefixes) {
+    if (name.startsWith(prefix)) return name.slice(prefix.length);
+  }
+  return name;
+}
+function eventEvidence(event, path) {
+  return {
+    runId: event.runId,
+    eventId: event.eventId,
+    parentId: event.parentId,
+    traceId: event.trace?.traceId,
+    spanId: event.trace?.spanId,
+    kind: event.kind,
+    name: event.name,
+    status: event.status,
+    ...path ? { path } : {}
+  };
+}
+function runEvidence(run) {
+  return run ? [{ runId: run.runId, name: run.name, status: run.status }] : [];
+}
+function failFinding(ruleId, message, evidence, expected, actual) {
+  return {
+    ruleId,
+    severity: "error",
+    status: "fail",
+    message,
+    ...expected !== void 0 ? { expected } : {},
+    ...actual !== void 0 ? { actual } : {},
+    evidence: [...evidence]
+  };
+}
+function toolName(event) {
+  return stringAttr(event, ["toolName", "tool"]) ?? stripPrefix(event.name, ["tool:", "function:", "mcp-tools:"]);
+}
+function llmModel(event) {
+  return stringAttr(event, ["model", "modelId", "responseModelId", "modelName", "model_name"]) ?? stripPrefix(event.name, ["llm:", "generation:", "transcription:", "speech:"]);
+}
+function llmProvider(event) {
+  return stringAttr(event, ["provider", "providerName", "provider_name"]);
+}
+function llmFinishReason(event) {
+  return stringAttr(event, ["finishReason", "rawFinishReason", "finish_reason"]);
+}
+function retryCount(event) {
+  return numericAttr(event, ["retryCount", "retryAttempt", "retry_attempt", "attempt"]);
+}
+function finishedEvents(context, kind) {
+  return context.events.filter(
+    (event) => (kind === void 0 || event.kind === kind) && event.status !== "running"
+  );
+}
+function firstIndexByName(events) {
+  const index = /* @__PURE__ */ new Map();
+  for (const [position, event] of events.entries()) {
+    const name = toolName(event);
+    if (!index.has(name)) index.set(name, position);
+  }
+  return index;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function eventMap(events) {
+  return new Map(events.map((event) => [event.eventId, event]));
+}
+function parseEventTime(value) {
+  if (!value) return void 0;
+  const parsed = Date.parse(value);
+  return Number.isFinite(parsed) ? parsed : void 0;
+}
+function eventStartMs(event) {
+  return parseEventTime(event.startedAt) ?? parseEventTime(event.timestamp);
+}
+function eventEndMs(event) {
+  const endedAt = parseEventTime(event.endedAt);
+  if (endedAt !== void 0) return endedAt;
+  const startedAt = eventStartMs(event);
+  if (startedAt !== void 0 && event.durationMs !== void 0 && Number.isFinite(event.durationMs)) {
+    return startedAt + event.durationMs;
+  }
+  return void 0;
+}
+function sortedStrings(values) {
+  return [...values ?? []].sort((a, b) => a.localeCompare(b));
+}
+function normalizedKey(value) {
+  return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
+}
+function lastPathSegment(path) {
+  const parts = path.split(".");
+  return parts[parts.length - 1] ?? path;
+}
+function valueType(value) {
+  if (Array.isArray(value)) return "array";
+  if (value === null) return "null";
+  return typeof value;
+}
+function serializedByteLength(value) {
+  try {
+    return Buffer.byteLength(JSON.stringify(value), "utf-8");
+  } catch {
+    return void 0;
+  }
+}
+function pushValueEntries(entries, event, value, path, key, depth = 0) {
+  entries.push({ event, path, key, value });
+  if (depth >= 8) return;
+  if (Array.isArray(value)) {
+    for (const [index, item] of value.entries()) {
+      pushValueEntries(entries, event, item, `${path}.${index}`, String(index), depth + 1);
+    }
+    return;
+  }
+  if (!isRecord(value)) return;
+  for (const nestedKey of Object.keys(value).sort((a, b) => a.localeCompare(b))) {
+    pushValueEntries(
+      entries,
+      event,
+      value[nestedKey],
+      `${path}.${nestedKey}`,
+      nestedKey,
+      depth + 1
+    );
+  }
+}
+function eventValueEntries(event, options = {}) {
+  const entries = [];
+  if (event.attributes !== void 0) {
+    pushValueEntries(entries, event, event.attributes, "attributes", "attributes");
+  }
+  if (options.includeSummaries) {
+    if (event.inputSummary !== void 0) {
+      pushValueEntries(entries, event, event.inputSummary, "inputSummary", "inputSummary");
+    }
+    if (event.outputSummary !== void 0) {
+      pushValueEntries(entries, event, event.outputSummary, "outputSummary", "outputSummary");
+    }
+  }
+  if (options.includeError && event.error !== void 0) {
+    pushValueEntries(entries, event, event.error, "error", "error");
+  }
+  return entries;
+}
+function limitFindings(findings, maxFindings) {
+  if (maxFindings === void 0 || findings.length <= maxFindings) return findings;
+  return findings.slice(0, Math.max(0, maxFindings));
+}
+function hasRedactionMarker(value, markers) {
+  return markers.some((marker) => value.includes(marker)) || /^\[HASH:[A-Za-z0-9_-]+\]$/.test(value);
+}
+function isSensitiveKey(key, sensitiveKeys) {
+  if (!key) return false;
+  const normalized = normalizedKey(key);
+  return sensitiveKeys.some((sensitive) => normalized.includes(normalizedKey(sensitive)));
+}
+function isRawContentKey(key, forbiddenKeys) {
+  if (!key) return false;
+  const normalized = normalizedKey(key);
+  return forbiddenKeys.some((forbidden) => normalized === normalizedKey(forbidden));
+}
+function parentMarkedUnresolved(event) {
+  if (booleanAttr(event, [
+    "parentUnresolved",
+    "unresolvedParent",
+    "relationshipUnresolved",
+    "unresolvedRelationship"
+  ]) === true) {
+    return true;
+  }
+  const resolution = stringAttr(event, [
+    "parentResolution",
+    "relationshipResolution",
+    "relationshipStatus"
+  ]);
+  return resolution === "unresolved" || resolution === "missing-parent";
+}
+function signalName(event, attributeKeys, prefixes) {
+  return stringAttr(event, attributeKeys) ?? stripPrefix(event.name, prefixes);
+}
+function guardrailEvents(context) {
+  return finishedEvents2().filter((event) => {
+    const name = event.name.toLowerCase();
+    if (name.startsWith("guardrail:") || name.includes(".guardrail.")) return true;
+    return stringAttr(event, ["guardrailName", "guardrail", "guardrailId"]) !== void 0;
+  });
+  function finishedEvents2() {
+    return context.events.filter((event) => event.status !== "running");
+  }
+}
+function retryValue(event) {
+  return retryCount(event) ?? 0;
+}
+function eventDurationMs(event) {
+  if (event.durationMs !== void 0) return event.durationMs;
+  const start = eventStartMs(event);
+  const end = eventEndMs(event);
+  return start !== void 0 && end !== void 0 && end >= start ? end - start : void 0;
+}
+function treeShape(nodes) {
+  const lines = [];
+  const visit = (node, path) => {
+    lines.push(`${path}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
+    node.children.forEach((child, index) => visit(child, `${path}.${index}`));
+  };
+  nodes.forEach((node, index) => visit(node, String(index)));
+  return lines;
+}
+function statusShape(context) {
+  return context.events.map((event) => `${event.kind}:${event.name}:${event.status ?? "unknown"}`).sort((a, b) => a.localeCompare(b));
+}
+function toolShape(context) {
+  return finishedEvents(context, "TOOL").map(
+    (event) => [
+      toolName(event),
+      event.status ?? "unknown",
+      retryValue(event),
+      eventDurationMs(event) ?? "unknown"
+    ].join(":")
+  );
+}
+function llmShape(context) {
+  return finishedEvents(context, "LLM").map(
+    (event) => [
+      llmProvider(event) ?? "unknown",
+      llmModel(event) ?? "unknown",
+      llmFinishReason(event) ?? "unknown",
+      event.tokenUsage?.input ?? 0,
+      event.tokenUsage?.output ?? 0,
+      event.tokenUsage?.total ?? 0,
+      event.tokenUsage?.cached ?? 0
+    ].join(":")
+  );
+}
+function errorShape(context) {
+  return context.events.filter((event) => event.status === "error" || event.error !== void 0).map(
+    (event) => [
+      event.kind,
+      event.name,
+      event.error?.name ?? "Error",
+      event.error?.code ?? "unknown"
+    ].join(":")
+  ).sort((a, b) => a.localeCompare(b));
+}
+function retrievalShape(context) {
+  return finishedEvents(context, "RETRIEVER").map(
+    (event) => signalName(event, ["retrievalName", "retrieverName", "retriever"], ["retriever:", "retrieval:"])
+  ).sort((a, b) => a.localeCompare(b));
+}
+function guardrailShape(context) {
+  return guardrailEvents(context).map((event) => signalName(event, ["guardrailName", "guardrail", "guardrailId"], ["guardrail:"])).sort((a, b) => a.localeCompare(b));
+}
+function firstEvidenceForKind(context, kind, path) {
+  const event = context.events.find((candidate) => candidate.kind === kind);
+  return event ? [eventEvidence(event, path)] : runEvidence(context.selectedRun);
+}
+function baselineDiffFinding(message, evidence, expected, actual) {
+  return failFinding("baseline.regression", message, evidence, expected, actual);
+}
+function createRunStatusRule(options = {}) {
+  const expected = options.expected ?? "ok";
+  const allowIncomplete = options.allowIncomplete === true;
+  return {
+    id: "run.status",
+    category: "run",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const findings = [];
+      const actual = context.selectedRun?.status ?? "unknown";
+      if (actual !== expected) {
+        findings.push(
+          failFinding(
+            "run.status",
+            `Run status ${actual} did not match expected ${expected}.`,
+            runEvidence(context.selectedRun),
+            expected,
+            actual
+          )
+        );
+      }
+      if (!allowIncomplete) {
+        const running = context.events.filter((event) => event.status === "running");
+        if (running.length > 0) {
+          findings.push(
+            failFinding(
+              "run.status",
+              "Run contains incomplete running events.",
+              running.map((event) => eventEvidence(event)),
+              "no running events",
+              running.length
+            )
+          );
+        }
+      }
+      return findings;
+    }
+  };
+}
+function createRunDurationRule(options) {
+  return {
+    id: "run.duration",
+    category: "run",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const actual = context.selectedRun?.durationMs;
+      if (actual === void 0 || actual <= options.maxDurationMs) return [];
+      return [
+        failFinding(
+          "run.duration",
+          `Run duration ${actual}ms exceeded ${options.maxDurationMs}ms.`,
+          runEvidence(context.selectedRun),
+          { maxDurationMs: options.maxDurationMs },
+          actual
+        )
+      ];
+    }
+  };
+}
+function createRunEventCountRule(options) {
+  return {
+    id: "run.eventCount",
+    category: "run",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const count = context.events.filter(
+        (event) => options.kind === void 0 || event.kind === options.kind
+      ).length;
+      const findings = [];
+      if (options.min !== void 0 && count < options.min) {
+        findings.push(
+          failFinding(
+            "run.eventCount",
+            `Event count ${count} was below minimum ${options.min}.`,
+            runEvidence(context.selectedRun),
+            { kind: options.kind, min: options.min },
+            count
+          )
+        );
+      }
+      if (options.max !== void 0 && count > options.max) {
+        findings.push(
+          failFinding(
+            "run.eventCount",
+            `Event count ${count} exceeded maximum ${options.max}.`,
+            runEvidence(context.selectedRun),
+            { kind: options.kind, max: options.max },
+            count
+          )
+        );
+      }
+      return findings;
+    }
+  };
+}
+function createRunDepthRule(options) {
+  return {
+    id: "run.depth",
+    category: "run",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const nodes = [...context.nodesByEventId.values()];
+      const maxDepth = nodes.reduce((max, node) => Math.max(max, node.depth), 0);
+      if (maxDepth <= options.maxDepth) return [];
+      const deepest = nodes.filter((node) => node.depth === maxDepth);
+      return [
+        failFinding(
+          "run.depth",
+          `Run depth ${maxDepth} exceeded ${options.maxDepth}.`,
+          deepest.map((node) => ({
+            runId: node.event.runId,
+            eventId: node.event.eventId,
+            parentId: node.event.parentId,
+            kind: node.event.kind,
+            name: node.event.name,
+            status: node.event.status
+          })),
+          { maxDepth: options.maxDepth },
+          maxDepth
+        )
+      ];
+    }
+  };
+}
+function createToolUsageRule(options) {
+  return {
+    id: "tool.usage",
+    category: "tool",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const tools = finishedEvents(context, "TOOL");
+      const names = tools.map(toolName);
+      const nameSet = new Set(names);
+      const findings = [];
+      for (const required of options.required ?? []) {
+        if (!nameSet.has(required)) {
+          findings.push(
+            failFinding("tool.usage", `Required tool ${required} did not appear.`, runEvidence(context.selectedRun), required, names)
+          );
+        }
+      }
+      const forbidden = new Set(options.forbidden ?? []);
+      const allowed = options.allowed ? new Set(options.allowed) : void 0;
+      for (const event of tools) {
+        const name = toolName(event);
+        if (forbidden.has(name)) {
+          findings.push(
+            failFinding("tool.usage", `Forbidden tool ${name} appeared.`, [eventEvidence(event)], "tool absent", name)
+          );
+        }
+        if (allowed && !allowed.has(name)) {
+          findings.push(
+            failFinding("tool.usage", `Tool ${name} is not in the allowed tool set.`, [eventEvidence(event)], [...allowed].sort(), name)
+          );
+        }
+      }
+      if (options.minCount !== void 0 && tools.length < options.minCount) {
+        findings.push(
+          failFinding("tool.usage", `Tool count ${tools.length} was below minimum ${options.minCount}.`, runEvidence(context.selectedRun), { minCount: options.minCount }, tools.length)
+        );
+      }
+      if (options.maxCount !== void 0 && tools.length > options.maxCount) {
+        findings.push(
+          failFinding("tool.usage", `Tool count ${tools.length} exceeded maximum ${options.maxCount}.`, tools.map((event) => eventEvidence(event)), { maxCount: options.maxCount }, tools.length)
+        );
+      }
+      return findings;
+    }
+  };
+}
+function createToolOrderingRule(options) {
+  return {
+    id: "tool.order",
+    category: "tool",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const tools = finishedEvents(context, "TOOL");
+      const index = firstIndexByName(tools);
+      const beforeIndex = index.get(options.before);
+      const afterIndex = index.get(options.after);
+      if (beforeIndex === void 0 || afterIndex === void 0 || beforeIndex < afterIndex) {
+        return [];
+      }
+      return [
+        failFinding(
+          "tool.order",
+          `Tool ${options.before} must appear before ${options.after}.`,
+          [eventEvidence(tools[beforeIndex]), eventEvidence(tools[afterIndex])],
+          { before: options.before, after: options.after },
+          tools.map(toolName)
+        )
+      ];
+    }
+  };
+}
+function createToolFailureRule(options) {
+  return {
+    id: "tool.failures",
+    category: "tool",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const tools = finishedEvents(context, "TOOL");
+      const failures = tools.filter((event) => event.status === "error");
+      const retries = tools.map((event) => ({ event, count: retryCount(event) })).filter((item) => item.count !== void 0);
+      const findings = [];
+      if (options.maxFailures !== void 0 && failures.length > options.maxFailures) {
+        findings.push(
+          failFinding(
+            "tool.failures",
+            `Tool failure count ${failures.length} exceeded ${options.maxFailures}.`,
+            failures.map((event) => eventEvidence(event)),
+            { maxFailures: options.maxFailures },
+            failures.length
+          )
+        );
+      }
+      if (options.maxRetries !== void 0) {
+        const excessiveRetries = retries.filter((item) => item.count > options.maxRetries);
+        if (excessiveRetries.length > 0) {
+          findings.push(
+            failFinding(
+              "tool.failures",
+              `Tool retry count exceeded ${options.maxRetries}.`,
+              excessiveRetries.map((item) => eventEvidence(item.event, "attributes.retryCount")),
+              { maxRetries: options.maxRetries },
+              excessiveRetries.map((item) => ({ tool: toolName(item.event), retries: item.count }))
+            )
+          );
+        }
+      }
+      return findings;
+    }
+  };
+}
+function createLlmUsageRule(options) {
+  return {
+    id: "llm.usage",
+    category: "llm",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const llms = finishedEvents(context, "LLM");
+      const findings = [];
+      const allowedModels = options.allowedModels ? new Set(options.allowedModels) : void 0;
+      const allowedProviders = options.allowedProviders ? new Set(options.allowedProviders) : void 0;
+      const finishReasons = options.finishReasons ? new Set(options.finishReasons) : void 0;
+      if (options.maxCalls !== void 0 && llms.length > options.maxCalls) {
+        findings.push(
+          failFinding(
+            "llm.usage",
+            `LLM call count ${llms.length} exceeded ${options.maxCalls}.`,
+            llms.map((event) => eventEvidence(event)),
+            { maxCalls: options.maxCalls },
+            llms.length
+          )
+        );
+      }
+      for (const event of llms) {
+        const model = llmModel(event);
+        const provider = llmProvider(event);
+        const finishReason = llmFinishReason(event);
+        if (allowedModels && (!model || !allowedModels.has(model))) {
+          findings.push(
+            failFinding("llm.usage", `LLM model ${model ?? "unknown"} is not allowed.`, [eventEvidence(event, "attributes.model")], [...allowedModels].sort(), model ?? "unknown")
+          );
+        }
+        if (allowedProviders && (!provider || !allowedProviders.has(provider))) {
+          findings.push(
+            failFinding("llm.usage", `LLM provider ${provider ?? "unknown"} is not allowed.`, [eventEvidence(event, "attributes.provider")], [...allowedProviders].sort(), provider ?? "unknown")
+          );
+        }
+        if (finishReasons && (!finishReason || !finishReasons.has(finishReason))) {
+          findings.push(
+            failFinding("llm.usage", `LLM finish reason ${finishReason ?? "unknown"} is not allowed.`, [eventEvidence(event, "attributes.finishReason")], [...finishReasons].sort(), finishReason ?? "unknown")
+          );
+        }
+      }
+      const tokenTotals = llms.reduce(
+        (totals, event) => ({
+          input: totals.input + (event.tokenUsage?.input ?? 0),
+          output: totals.output + (event.tokenUsage?.output ?? 0),
+          total: totals.total + (event.tokenUsage?.total ?? 0),
+          cached: totals.cached + (event.tokenUsage?.cached ?? 0)
+        }),
+        { input: 0, output: 0, total: 0, cached: 0 }
+      );
+      const tokenLimits = [
+        ["input", options.maxInputTokens],
+        ["output", options.maxOutputTokens],
+        ["total", options.maxTotalTokens],
+        ["cached", options.maxCachedTokens]
+      ];
+      for (const [key, limit] of tokenLimits) {
+        if (limit !== void 0 && tokenTotals[key] > limit) {
+          findings.push(
+            failFinding(
+              "llm.usage",
+              `LLM ${key} token count ${tokenTotals[key]} exceeded ${limit}.`,
+              llms.map((event) => eventEvidence(event, `tokenUsage.${key}`)),
+              { [`max${key[0].toUpperCase()}${key.slice(1)}Tokens`]: limit },
+              tokenTotals[key]
+            )
+          );
+        }
+      }
+      return findings;
+    }
+  };
+}
+function createStructureIncompleteRule(options = {}) {
+  return {
+    id: "structure.incomplete",
+    category: "structure",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const findings = [];
+      if (!options.allowRunning) {
+        const running = context.events.filter((event) => event.status === "running");
+        if (running.length > 0) {
+          findings.push(
+            failFinding(
+              "structure.incomplete",
+              "Trace contains incomplete running events.",
+              running.map((event) => eventEvidence(event, "status")),
+              "no running events",
+              running.length
+            )
+          );
+        }
+      }
+      if (options.requireEndedAtForStarted) {
+        const missingEndedAt = context.events.filter(
+          (event) => event.startedAt !== void 0 && event.endedAt === void 0 && event.status !== "running"
+        );
+        if (missingEndedAt.length > 0) {
+          findings.push(
+            failFinding(
+              "structure.incomplete",
+              "Trace contains events with startedAt but no endedAt.",
+              missingEndedAt.map((event) => eventEvidence(event, "endedAt")),
+              "endedAt for started events",
+              missingEndedAt.length
+            )
+          );
+        }
+      }
+      return findings;
+    }
+  };
+}
+function createStructureOrphanRule(options = {}) {
+  const allowMarkedUnresolved = options.allowMarkedUnresolved ?? true;
+  return {
+    id: "structure.orphan",
+    category: "structure",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const byId = eventMap(context.events);
+      const orphans = context.events.filter((event) => {
+        if (!event.parentId || byId.has(event.parentId)) return false;
+        return !(allowMarkedUnresolved && parentMarkedUnresolved(event));
+      });
+      if (orphans.length === 0) return [];
+      return [
+        failFinding(
+          "structure.orphan",
+          "Trace contains events whose parentId is not present in the selected run.",
+          orphans.map((event) => eventEvidence(event, "parentId")),
+          "parentId resolves to an event in the selected run",
+          orphans.length
+        )
+      ];
+    }
+  };
+}
+function createStructureCycleRule() {
+  return {
+    id: "structure.cycle",
+    category: "structure",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const byId = eventMap(context.events);
+      const seenCycles = /* @__PURE__ */ new Set();
+      const findings = [];
+      for (const event of [...context.events].sort((a, b) => a.eventId.localeCompare(b.eventId))) {
+        const path = [];
+        const seenAt = /* @__PURE__ */ new Map();
+        let current = event;
+        while (current) {
+          const existing = seenAt.get(current.eventId);
+          if (existing !== void 0) {
+            const cycle = path.slice(existing);
+            const key = cycle.map((item) => item.eventId).sort().join("\0");
+            if (!seenCycles.has(key)) {
+              seenCycles.add(key);
+              findings.push(
+                failFinding(
+                  "structure.cycle",
+                  "Trace contains a parentId cycle.",
+                  cycle.map((item) => eventEvidence(item, "parentId")),
+                  "acyclic parentId graph",
+                  cycle.map((item) => item.eventId).sort()
+                )
+              );
+            }
+            break;
+          }
+          seenAt.set(current.eventId, path.length);
+          path.push(current);
+          current = current.parentId ? byId.get(current.parentId) : void 0;
+        }
+      }
+      return findings;
+    }
+  };
+}
+function createStructureRelationshipRule(options = {}) {
+  return {
+    id: "structure.relationship",
+    category: "structure",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const byId = eventMap(context.events);
+      const findings = [];
+      const minConfidence = options.minConfidence;
+      for (const event of context.events) {
+        if (minConfidence && CONFIDENCE_RANK[event.confidence] < CONFIDENCE_RANK[minConfidence]) {
+          findings.push(
+            failFinding(
+              "structure.relationship",
+              `Event confidence ${event.confidence} is below ${minConfidence}.`,
+              [eventEvidence(event, "confidence")],
+              { minConfidence },
+              event.confidence
+            )
+          );
+        }
+        if (!event.parentId) continue;
+        if (event.parentId === event.eventId) {
+          findings.push(
+            failFinding(
+              "structure.relationship",
+              "Event parentId points to itself.",
+              [eventEvidence(event, "parentId")],
+              "parentId references a distinct event",
+              "self"
+            )
+          );
+          continue;
+        }
+        const parent = byId.get(event.parentId);
+        if (!parent) continue;
+        if (options.requireParentBeforeChild) {
+          const parentTime = eventStartMs(parent);
+          const childTime = eventStartMs(event);
+          if (parentTime !== void 0 && childTime !== void 0 && parentTime > childTime) {
+            findings.push(
+              failFinding(
+                "structure.relationship",
+                "Parent event starts after child event.",
+                [eventEvidence(parent), eventEvidence(event, "parentId")],
+                "parent start <= child start",
+                { parentEventId: parent.eventId, childEventId: event.eventId }
+              )
+            );
+          }
+        }
+        if (options.requireTraceParentSpan && parent.trace?.spanId && event.trace) {
+          const actual = event.trace.parentSpanId;
+          if (actual !== parent.trace.spanId) {
+            findings.push(
+              failFinding(
+                "structure.relationship",
+                "Trace parentSpanId does not match parent spanId.",
+                [eventEvidence(event, "trace.parentSpanId")],
+                { parentSpanId: parent.trace.spanId },
+                actual ?? "missing"
+              )
+            );
+          }
+        }
+      }
+      return findings;
+    }
+  };
+}
+function createStructureParallelWidthRule(options) {
+  return {
+    id: "structure.parallelWidth",
+    category: "structure",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const findings = [];
+      const byId = eventMap(context.events);
+      if (options.maxChildren !== void 0) {
+        for (const [parentId, children] of context.childrenByParentId.entries()) {
+          if (children.length <= options.maxChildren) continue;
+          const parent = byId.get(parentId);
+          findings.push(
+            failFinding(
+              "structure.parallelWidth",
+              `Parent ${parentId} has ${children.length} children, exceeding ${options.maxChildren}.`,
+              [
+                ...parent ? [eventEvidence(parent)] : [{ runId: context.selectedRun?.runId, eventId: parentId }],
+                ...children.map((child) => ({
+                  runId: child.event.runId,
+                  eventId: child.event.eventId,
+                  parentId: child.event.parentId,
+                  kind: child.event.kind,
+                  name: child.event.name,
+                  status: child.event.status
+                }))
+              ],
+              { maxChildren: options.maxChildren },
+              children.length
+            )
+          );
+        }
+      }
+      if (options.maxConcurrent !== void 0) {
+        const intervals = context.events.map((event) => ({ event, start: eventStartMs(event), end: eventEndMs(event) })).filter(
+          (item) => item.start !== void 0 && item.end !== void 0 && item.end > item.start
+        );
+        const points = intervals.flatMap((item) => [
+          { time: item.start, delta: 1, event: item.event },
+          { time: item.end, delta: -1, event: item.event }
+        ]);
+        points.sort((a, b) => {
+          const byTime = a.time - b.time;
+          if (byTime !== 0) return byTime;
+          const byDelta = a.delta - b.delta;
+          if (byDelta !== 0) return byDelta;
+          return a.event.eventId.localeCompare(b.event.eventId);
+        });
+        const active = /* @__PURE__ */ new Map();
+        let maxActive = [];
+        for (const point of points) {
+          if (point.delta > 0) {
+            active.set(point.event.eventId, point.event);
+            if (active.size > maxActive.length) {
+              maxActive = [...active.values()].sort((a, b) => a.eventId.localeCompare(b.eventId));
+            }
+          } else {
+            active.delete(point.event.eventId);
+          }
+        }
+        if (maxActive.length > options.maxConcurrent) {
+          findings.push(
+            failFinding(
+              "structure.parallelWidth",
+              `Concurrent event width ${maxActive.length} exceeded ${options.maxConcurrent}.`,
+              maxActive.map((event) => eventEvidence(event)),
+              { maxConcurrent: options.maxConcurrent },
+              maxActive.length
+            )
+          );
+        }
+      }
+      return findings;
+    }
+  };
+}
+function createSignalRule(ruleId, label, options, selectEvents, nameForEvent) {
+  return {
+    id: ruleId,
+    category: "structure",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const events = selectEvents(context);
+      const names = events.map(nameForEvent);
+      const nameSet = new Set(names);
+      const findings = [];
+      for (const required of sortedStrings(options.required)) {
+        if (!nameSet.has(required)) {
+          findings.push(
+            failFinding(
+              ruleId,
+              `Required ${label} ${required} did not appear.`,
+              runEvidence(context.selectedRun),
+              required,
+              names
+            )
+          );
+        }
+      }
+      const forbidden = new Set(options.forbidden ?? []);
+      const allowed = options.allowed ? new Set(options.allowed) : void 0;
+      for (const event of events) {
+        const name = nameForEvent(event);
+        if (forbidden.has(name)) {
+          findings.push(
+            failFinding(
+              ruleId,
+              `Forbidden ${label} ${name} appeared.`,
+              [eventEvidence(event)],
+              `${label} absent`,
+              name
+            )
+          );
+        }
+        if (allowed && !allowed.has(name)) {
+          findings.push(
+            failFinding(
+              ruleId,
+              `${label[0].toUpperCase()}${label.slice(1)} ${name} is not in the allowed set.`,
+              [eventEvidence(event)],
+              [...allowed].sort(),
+              name
+            )
+          );
+        }
+      }
+      if (options.minCount !== void 0 && events.length < options.minCount) {
+        findings.push(
+          failFinding(
+            ruleId,
+            `${label[0].toUpperCase()}${label.slice(1)} count ${events.length} was below minimum ${options.minCount}.`,
+            runEvidence(context.selectedRun),
+            { minCount: options.minCount },
+            events.length
+          )
+        );
+      }
+      if (options.maxCount !== void 0 && events.length > options.maxCount) {
+        findings.push(
+          failFinding(
+            ruleId,
+            `${label[0].toUpperCase()}${label.slice(1)} count ${events.length} exceeded maximum ${options.maxCount}.`,
+            events.map((event) => eventEvidence(event)),
+            { maxCount: options.maxCount },
+            events.length
+          )
+        );
+      }
+      return findings;
+    }
+  };
+}
+function createRetrievalRule(options) {
+  return createSignalRule(
+    "structure.retrieval",
+    "retrieval",
+    options,
+    (context) => finishedEvents(context, "RETRIEVER"),
+    (event) => signalName(event, ["retrievalName", "retrieverName", "retriever"], ["retriever:", "retrieval:"])
+  );
+}
+function createGuardrailRule(options) {
+  return createSignalRule(
+    "structure.guardrail",
+    "guardrail",
+    options,
+    guardrailEvents,
+    (event) => signalName(event, ["guardrailName", "guardrail", "guardrailId"], ["guardrail:"])
+  );
+}
+function createDecisionRule(options) {
+  return createSignalRule(
+    "structure.decision",
+    "decision",
+    options,
+    (context) => finishedEvents(context, "DECISION"),
+    (event) => signalName(event, ["decisionName", "decision", "decisionId"], ["decision:"])
+  );
+}
+function createSafetyRedactionRule(options = {}) {
+  const sensitiveKeys = options.sensitiveKeys ?? DEFAULT_SENSITIVE_KEYS;
+  const markers = options.redactedMarkers ?? ["[REDACTED]", "[REDACTED:"];
+  return {
+    id: "safety.redaction",
+    category: "safety",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const findings = [];
+      for (const event of context.events) {
+        for (const entry of eventValueEntries(event, { includeSummaries: true, includeError: true })) {
+          if (!isSensitiveKey(entry.key ?? lastPathSegment(entry.path), sensitiveKeys)) continue;
+          if (typeof entry.value === "string" && hasRedactionMarker(entry.value, markers)) continue;
+          findings.push(
+            failFinding(
+              "safety.redaction",
+              `Sensitive-looking field at ${entry.path} is not redacted.`,
+              [eventEvidence(event, entry.path)],
+              "redaction marker",
+              { path: entry.path, valueType: valueType(entry.value) }
+            )
+          );
+        }
+      }
+      return limitFindings(findings, options.maxFindings);
+    }
+  };
+}
+function createSafetyRawContentRule(options = {}) {
+  const forbiddenKeys = options.forbiddenKeys ?? DEFAULT_RAW_CONTENT_KEYS;
+  return {
+    id: "safety.rawPrompt",
+    category: "safety",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const findings = [];
+      for (const event of context.events) {
+        for (const entry of eventValueEntries(event, { includeSummaries: options.includeSummaries })) {
+          const key = entry.key ?? lastPathSegment(entry.path);
+          if (!isRawContentKey(key, forbiddenKeys)) continue;
+          findings.push(
+            failFinding(
+              "safety.rawPrompt",
+              `Raw content-like field ${entry.path} is present.`,
+              [eventEvidence(event, entry.path)],
+              "metadata-only trace fields",
+              { path: entry.path, valueType: valueType(entry.value) }
+            )
+          );
+        }
+      }
+      return limitFindings(findings, options.maxFindings);
+    }
+  };
+}
+function createSafetySecretPatternRule(options = {}) {
+  const patterns = options.patterns ?? DEFAULT_SECRET_PATTERNS;
+  const maxStringLength = options.maxStringLength ?? 4096;
+  return {
+    id: "safety.secretPattern",
+    category: "safety",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const findings = [];
+      for (const event of context.events) {
+        for (const entry of eventValueEntries(event, { includeSummaries: true, includeError: true })) {
+          if (typeof entry.value !== "string") continue;
+          const sample = entry.value.slice(0, maxStringLength);
+          for (const pattern of patterns) {
+            pattern.pattern.lastIndex = 0;
+            if (!pattern.pattern.test(sample)) continue;
+            pattern.pattern.lastIndex = 0;
+            findings.push(
+              failFinding(
+                "safety.secretPattern",
+                `Secret-like pattern ${pattern.id} matched at ${entry.path}.`,
+                [eventEvidence(event, entry.path)],
+                "no secret-like strings",
+                { pattern: pattern.id, path: entry.path }
+              )
+            );
+            break;
+          }
+        }
+      }
+      return limitFindings(findings, options.maxFindings);
+    }
+  };
+}
+function createSafetyOversizedAttributeRule(options) {
+  return {
+    id: "safety.oversizedAttribute",
+    category: "safety",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const findings = [];
+      for (const event of context.events) {
+        for (const entry of eventValueEntries(event, { includeSummaries: true, includeError: true })) {
+          if (typeof entry.value === "string" && options.maxStringLength !== void 0 && entry.value.length > options.maxStringLength) {
+            findings.push(
+              failFinding(
+                "safety.oversizedAttribute",
+                `String at ${entry.path} exceeds ${options.maxStringLength} characters.`,
+                [eventEvidence(event, entry.path)],
+                { maxStringLength: options.maxStringLength },
+                { path: entry.path, length: entry.value.length }
+              )
+            );
+          }
+          if (Array.isArray(entry.value) && options.maxArrayLength !== void 0 && entry.value.length > options.maxArrayLength) {
+            findings.push(
+              failFinding(
+                "safety.oversizedAttribute",
+                `Array at ${entry.path} exceeds ${options.maxArrayLength} items.`,
+                [eventEvidence(event, entry.path)],
+                { maxArrayLength: options.maxArrayLength },
+                { path: entry.path, length: entry.value.length }
+              )
+            );
+          }
+          if (isRecord(entry.value) && options.maxObjectKeys !== void 0 && Object.keys(entry.value).length > options.maxObjectKeys) {
+            findings.push(
+              failFinding(
+                "safety.oversizedAttribute",
+                `Object at ${entry.path} exceeds ${options.maxObjectKeys} keys.`,
+                [eventEvidence(event, entry.path)],
+                { maxObjectKeys: options.maxObjectKeys },
+                { path: entry.path, keys: Object.keys(entry.value).length }
+              )
+            );
+          }
+          if (options.maxSerializedBytes !== void 0) {
+            const bytes = serializedByteLength(entry.value);
+            if (bytes !== void 0 && bytes > options.maxSerializedBytes) {
+              findings.push(
+                failFinding(
+                  "safety.oversizedAttribute",
+                  `Value at ${entry.path} exceeds ${options.maxSerializedBytes} serialized bytes.`,
+                  [eventEvidence(event, entry.path)],
+                  { maxSerializedBytes: options.maxSerializedBytes },
+                  { path: entry.path, bytes }
+                )
+              );
+            }
+          }
+        }
+      }
+      return limitFindings(findings, options.maxFindings);
+    }
+  };
+}
+function createBaselineRegressionRule(options) {
+  return {
+    id: "baseline.regression",
+    category: "baseline",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const baselineSelection = resolveSelectedRun(options.baseline, options.baselineRunId);
+      if (baselineSelection.diagnostics.length > 0 || !baselineSelection.run) {
+        return [
+          failFinding(
+            "baseline.regression",
+            "Baseline run could not be selected.",
+            runEvidence(context.selectedRun),
+            "selectable baseline run",
+            baselineSelection.diagnostics.map((item) => item.code)
+          )
+        ];
+      }
+      const baselineFacts = buildFacts(options.baseline, baselineSelection.run);
+      const baselineContext = {
+        ...baselineFacts,
+        selectedRun: baselineSelection.run,
+        sourceLabel: options.baseline.sourceLabel
+      };
+      const findings = [];
+      const durationToleranceMs = options.durationToleranceMs ?? 0;
+      if (options.compareFormat && baselineContext.format !== context.format) {
+        findings.push(
+          baselineDiffFinding(
+            "Trace format differs from baseline.",
+            runEvidence(context.selectedRun),
+            baselineContext.format,
+            context.format
+          )
+        );
+      }
+      const baselineRunStatus = baselineContext.selectedRun?.status ?? "unknown";
+      const candidateRunStatus = context.selectedRun?.status ?? "unknown";
+      if (baselineRunStatus !== candidateRunStatus) {
+        findings.push(
+          baselineDiffFinding(
+            "Run status differs from baseline.",
+            runEvidence(context.selectedRun),
+            baselineRunStatus,
+            candidateRunStatus
+          )
+        );
+      }
+      const baselineDuration = baselineContext.selectedRun?.durationMs;
+      const candidateDuration = context.selectedRun?.durationMs;
+      if (baselineDuration !== void 0 && candidateDuration !== void 0 && Math.abs(candidateDuration - baselineDuration) > durationToleranceMs) {
+        findings.push(
+          baselineDiffFinding(
+            "Run duration differs from baseline beyond tolerance.",
+            runEvidence(context.selectedRun),
+            { durationMs: baselineDuration, toleranceMs: durationToleranceMs },
+            candidateDuration
+          )
+        );
+      }
+      const comparisons = [
+        {
+          label: "Tree shape",
+          path: "tree",
+          expected: treeShape(baselineContext.rootNodes),
+          actual: treeShape(context.rootNodes),
+          evidence: runEvidence(context.selectedRun)
+        },
+        {
+          label: "Event statuses",
+          path: "status",
+          expected: statusShape(baselineContext),
+          actual: statusShape(context),
+          evidence: runEvidence(context.selectedRun)
+        },
+        {
+          label: "Tool usage",
+          path: "tool",
+          expected: toolShape(baselineContext),
+          actual: toolShape(context),
+          evidence: firstEvidenceForKind(context, "TOOL", "tool")
+        },
+        {
+          label: "LLM usage",
+          path: "llm",
+          expected: llmShape(baselineContext),
+          actual: llmShape(context),
+          evidence: firstEvidenceForKind(context, "LLM", "llm")
+        },
+        {
+          label: "Error profile",
+          path: "error",
+          expected: errorShape(baselineContext),
+          actual: errorShape(context),
+          evidence: firstEvidenceForKind(context, "ERROR", "error")
+        },
+        {
+          label: "Retrieval signals",
+          path: "retrieval",
+          expected: retrievalShape(baselineContext),
+          actual: retrievalShape(context),
+          evidence: firstEvidenceForKind(context, "RETRIEVER", "retrieval")
+        },
+        {
+          label: "Guardrail signals",
+          path: "guardrail",
+          expected: guardrailShape(baselineContext),
+          actual: guardrailShape(context),
+          evidence: guardrailEvents(context)[0] ? [eventEvidence(guardrailEvents(context)[0], "guardrail")] : runEvidence(context.selectedRun)
+        }
+      ];
+      for (const comparison of comparisons) {
+        if (JSON.stringify(comparison.expected) === JSON.stringify(comparison.actual)) {
+          continue;
+        }
+        findings.push(
+          baselineDiffFinding(
+            `${comparison.label} differs from baseline.`,
+            comparison.evidence.length > 0 ? comparison.evidence : [{ runId: context.selectedRun?.runId, path: comparison.path }],
+            comparison.expected,
+            comparison.actual
+          )
+        );
+      }
+      return findings;
+    }
+  };
+}
+function runTraceChecks(input, options = {}) {
+  const selected = resolveSelectedRun(input, options.runId);
+  if (selected.diagnostics.length > 0) {
+    return errorResult(input, selected.diagnostics, selected.run);
+  }
+  const rules = selectRules(options.rules ?? [], options.select);
+  if (rules.diagnostics.length > 0) {
+    return errorResult(input, rules.diagnostics, selected.run);
+  }
+  const facts = buildFacts(input, selected.run);
+  const context = {
+    ...facts,
+    ...selected.run ? { selectedRun: selected.run } : {},
+    ...input.sourceLabel ? { sourceLabel: input.sourceLabel } : {}
+  };
+  const diagnostics = [];
+  const findings = [];
+  for (const rule of rules.rules) {
+    try {
+      findings.push(...rule.evaluate(context).map((finding) => normalizeFinding(rule, finding)));
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      diagnostics.push(
+        diagnostic("AI_CHECK_INTERNAL_ERROR", `Rule ${rule.id} failed: ${message}`, rule.id)
+      );
+    }
+  }
+  if (diagnostics.length > 0) {
+    return errorResult(input, diagnostics, selected.run);
+  }
+  const eventById = new Map(input.read.events.map((event) => [event.eventId, event]));
+  const sortedFindings = findings.sort(compareFindings(eventById));
+  const summary = summarize(sortedFindings, diagnostics);
+  const status = summary.failed > 0 ? "fail" : "pass";
+  return {
+    ok: status === "pass",
+    status,
+    format: input.read.format,
+    ...selected.run ? { runId: selected.run.runId } : {},
+    summary,
+    findings: sortedFindings,
+    diagnostics
+  };
+}
+
+export { createBaselineRegressionRule, createDecisionRule, createGuardrailRule, createLlmUsageRule, createRetrievalRule, createRunDepthRule, createRunDurationRule, createRunEventCountRule, createRunStatusRule, createSafetyOversizedAttributeRule, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createStructureCycleRule, createStructureIncompleteRule, createStructureOrphanRule, createStructureParallelWidthRule, createStructureRelationshipRule, createToolFailureRule, createToolOrderingRule, createToolUsageRule, runTraceChecks };
+//# sourceMappingURL=checks.mjs.map
+//# sourceMappingURL=checks.mjs.map