firedrill-run 2.2.5 → 3.0.0

package/dist/contracts/catalog-contracts.js

@@ -0,0 +1,73 @@
+import { toolProtocolMetadataMatches } from './tool-protocol-contracts.js';
+const uuid = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
+const digest = /^[a-f0-9]{64}$/;
+const serviceKey = /^[a-z][a-z0-9_-]{0,79}$/;
+const operationName = /^[A-Za-z][A-Za-z0-9_.-]{0,127}$/;
+const optionalId = (value) => value === null || uuid.test(value);
+const setupStates = ['preparing', 'inspecting', 'starting', 'instance_requested', 'saved', 'failed', 'withdrawn'];
+export function catalogRead(value, matches) {
+    if (!matches)
+        throw new Error('The catalog response did not match this selection. Refresh the original item or request.');
+    return value;
+}
+function page(value, selected) {
+    return Number.isSafeInteger(value.page) && value.page >= 1 && (!selected || value.page === selected)
+        && Number.isSafeInteger(value.page_size) && value.page_size >= 1 && value.page_size <= 100
+        && Number.isSafeInteger(value.count) && value.count >= 0 && value.results.length <= value.page_size;
+}
+export function catalogReleaseMatches(value, workspace, id) {
+    return !!value && uuid.test(workspace) && value.workspace_id === workspace && uuid.test(value.id) && (!id || id === value.id)
+        && typeof value.category === 'string' && value.category.length <= 64
+        && typeof value.available === 'boolean' && Number.isSafeInteger(value.operation_count) && value.operation_count >= 0
+        && Number.isSafeInteger(value.service_count) && value.service_count >= 1 && value.interfaces.every(one => one === 'http' || one === 'mcp')
+        && (value.logo_url === null || value.logo_url === `/api/workspaces/${workspace}/tools/library/${value.id}/logo`)
+        && (!value.saved_version || uuid.test(value.saved_version.id));
+}
+export function catalogReleaseDetailMatches(value, workspace, id) {
+    return catalogReleaseMatches(value, workspace, id) && digest.test(value.contract_digest) && digest.test(value.manifest_digest)
+        && value.setup.default_duration_seconds >= 60 && value.setup.default_duration_seconds <= value.setup.maximum_duration_seconds;
+}
+export function catalogPageMatches(value, workspace, query = '', selectedPage, category = '') {
+    return !!value && value.workspace_id === workspace && value.query === query.trim() && value.category === category && page(value, selectedPage)
+        && value.results.every(row => catalogReleaseMatches(row, workspace));
+}
+function selection(value, release) {
+    return value.workspace_id === release.workspace_id && value.release_id === release.id
+        && value.contract_digest === release.contract_digest && value.manifest_digest === release.manifest_digest;
+}
+export function catalogServiceMatches(value, release, key) {
+    return !!value && selection(value, release) && serviceKey.test(key) && value.key === key && value.id === key;
+}
+export function catalogServicesMatch(value, release, query = '', selectedPage) {
+    return !!value && selection(value, release) && value.query === query.trim() && page(value, selectedPage)
+        && value.results.every(row => row.id === row.key && serviceKey.test(row.key) && Number.isSafeInteger(row.operation_count) && row.operation_count >= 1);
+}
+export function catalogOperationsMatch(value, release, service, query = '', selectedPage) {
+    return !!value && selection(value, release) && serviceKey.test(service) && value.service_key === service
+        && value.query === query.trim() && page(value, selectedPage) && value.results.every(row => operationName.test(row.name)
+        && toolProtocolMetadataMatches(row)
+        && ['none', 'read', 'write', 'mixed'].includes(row.effect) && ['http', 'mcp'].includes(row.transport.kind));
+}
+export function catalogOperationMatches(value, release, service, name) {
+    return !!value && selection(value, release) && value.service_key === service && serviceKey.test(service)
+        && value.name === name && operationName.test(name) && ['http', 'mcp'].includes(value.transport.kind)
+        && !!value.input_schema && (value.output_schema !== null || value.transport.kind === 'http' && value.transport.response_encoding !== undefined
+        && value.transport.response_encoding !== 'json') && toolProtocolMetadataMatches(value);
+}
+export function catalogSetupMatches(value, scope, selected) {
+    const input = selected?.input;
+    return !!value && uuid.test(scope.workspace) && uuid.test(scope.actor) && value.workspace_id === scope.workspace && value.actor_id === scope.actor
+        && [value.id, value.request_key, value.release_id, value.upload_request_key].every(one => uuid.test(one))
+        && [value.implementation_id, value.instance_id, value.group_id].every(optionalId) && setupStates.includes(value.state)
+        && optionalId(value.usage_quote_id) && (value.duration_seconds === null ? value.usage_quote_id === null : value.usage_quote_id !== null)
+        && (!selected?.key || value.request_key === selected.key) && (!selected?.id || value.id === selected.id)
+        && (!input || value.release_id === input.release_id && value.duration_seconds === input.duration_seconds && value.usage_quote_id === input.usage_quote_id)
+        && (value.duration_seconds === null || Number.isSafeInteger(value.duration_seconds) && value.duration_seconds >= 60)
+        && (value.state !== 'instance_requested' || value.instance_id !== null && value.implementation_id !== null)
+        && (value.state !== 'saved' || value.implementation_id !== null && value.instance_id === null)
+        && (!value.can_withdraw || !['instance_requested', 'saved', 'withdrawn'].includes(value.state));
+}
+export function catalogSetupsMatch(value, scope, release = null, selectedPage) {
+    return !!value && value.workspace_id === scope.workspace && value.actor_id === scope.actor && value.release_filter === release
+        && page(value, selectedPage) && value.results.every(row => catalogSetupMatches(row, scope) && (!release || row.release_id === release));
+}

package/dist/contracts/ci-access-contracts.js

@@ -0,0 +1,68 @@
+export const ciAcknowledgementNames = ['prepare_source', 'simulate_source', 'driver_input', 'execute_source', 'future_commits', 'untrusted_fork', 'saved_values', 'target_models',
+    'real_startup', 'real_trials', 'shared_real_state', 'evaluation_evidence', 'starting_data', 'browser_recording', 'voice_recording', 'desktop_recording'];
+const uuid = (v) => typeof v === 'string' && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
+const sha = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+const count = (v, min = 0) => typeof v === 'number' && Number.isSafeInteger(v) && v >= min;
+const date = (v) => v === null || Number.isFinite(Date.parse(v));
+export function ciAccessRead(value, matches) {
+    if (!matches)
+        throw new Error('The CI access response did not match the selected workspace, configuration or original request. Review its retained history before continuing.');
+    return value;
+}
+function identity(v, workspace, original) {
+    return !!v && v.workspace_id === workspace && [v.id, v.workspace_id, v.request_key, v.configuration_id, v.configuration_revision_id].every(uuid)
+        && sha(v.request_digest) && count(v.revision, 1) && (!original.id || original.id === v.id)
+        && (!original.configuration || original.configuration === v.configuration_id) && (!original.key || original.key === v.request_key)
+        && (!original.digest || original.digest === v.request_digest) && (original.revision === undefined || original.revision === v.revision);
+}
+export function ciApprovalMatches(v, workspace, original = {}) {
+    if (!identity(v, workspace, original) || !uuid(v.approved_by_id) || original.actor && original.actor !== v.approved_by_id
+        || !sha(v.sha256) || !count(v.vault_entry_count) || !Number.isFinite(Date.parse(v.created_at)) || !date(v.revoked_at)
+        || !['recorded', 'revoked'].includes(v.state) || (v.state === 'revoked') !== (v.revoked_at !== null) || typeof v.fork !== 'boolean'
+        || !v.acknowledgements || Object.keys(v.acknowledgements).length !== ciAcknowledgementNames.length
+        || ciAcknowledgementNames.some(key => typeof v.acknowledgements[key] !== 'boolean')
+        || !v.acknowledgements.execute_source || !v.acknowledgements.starting_data || v.acknowledgements.untrusted_fork !== v.fork)
+        return false;
+    return v.scope === 'same_repository' ? v.run_id === null && v.head_sha === null && !v.fork && v.acknowledgements.future_commits
+        : v.scope === 'exact_run' && uuid(v.run_id) && typeof v.head_sha === 'string' && /^[a-f0-9]{40}$/.test(v.head_sha) && !v.acknowledgements.future_commits;
+}
+function page(v, number) {
+    return v.page === number && count(v.page, 1) && count(v.page_size, 1) && v.page_size <= 100 && count(v.count) && Array.isArray(v.results) && v.results.length <= v.page_size;
+}
+export function ciApprovalsMatch(v, workspace, configuration, filters = {}, number = 1) {
+    return !!v && v.workspace_id === workspace && v.configuration_id === configuration && !!v.filters && page(v, number)
+        && ['revision', 'state', 'scope', 'run_id'].every(key => v.filters[key] === (filters[key] ?? ''))
+        && v.results.every(row => ciApprovalMatches(row, workspace, { configuration }) && (!filters.revision || String(row.revision) === filters.revision)
+            && (!filters.state || row.state === filters.state) && (!filters.scope || row.scope === filters.scope) && (!filters.run_id || row.run_id === filters.run_id));
+}
+export function ciApprovalBasisMatches(v, workspace, configuration, revision, world) {
+    return !!v && v.workspace_id === workspace && v.configuration_id === configuration && v.revision === revision && count(v.revision, 1)
+        && sha(v.basis_sha256) && uuid(v.world_id) && (!world || world === v.world_id) && count(v.configuration_revision, 1)
+        && [v.vault_entry_count, v.model_connection_count, v.real_connection_count, v.scenario_count, v.planned_trials].every(one => count(one))
+        && count(v.parallelism, 1) && count(v.trial_seconds, 1) && count(v.source_component_count, 1)
+        && (v.driver_kind === null || ['browser_workflow', 'adaptive_browser', 'desktop', 'process', 'event'].includes(v.driver_kind))
+        && typeof v.driver_input_required === 'boolean' && v.driver_input_required === (v.driver_kind !== null)
+        && (v.preparation_budget === null || count(v.preparation_budget.maximum_units, 1) && count(v.preparation_budget.credit_scale, 1)
+            && typeof v.preparation_budget.denomination === 'string' && typeof v.preparation_budget.policy_version === 'string')
+        && (v.simulation_budget === null || count(v.simulation_budget.maximum_units) && count(v.simulation_budget.credit_scale, 1)
+            && typeof v.simulation_budget.denomination === 'string' && typeof v.simulation_budget.policy_version === 'string')
+        && [v.evaluation_evidence, v.browser_recording, v.voice_recording, v.desktop_recording].every(one => typeof one === 'boolean');
+}
+export function ciApprovalRequestMatches(v, workspace, original) {
+    return !!v && v.workspace_id === workspace && v.actor_id === original.actor && v.request_key === original.key
+        && (v.state === 'not_received' ? v.approval === null && !original.id : v.state === 'received' && v.approval !== null && ciApprovalMatches(v.approval, workspace, original));
+}
+export function ciActivationMatches(v, workspace, original = {}) {
+    return identity(v, workspace, original) && uuid(v.created_by_id) && (!original.actor || original.actor === v.created_by_id)
+        && uuid(v.input_approval_id) && Number.isFinite(Date.parse(v.created_at)) && date(v.revoked_at)
+        && ['enabled', 'paused'].includes(v.state) && (v.revoked_at === null || v.state === 'paused')
+        && (v.revoke_reason === null || ['user_paused', 'configuration_changed', 'input_approval_revoked', 'authorization_changed'].includes(v.revoke_reason));
+}
+export function ciActivationsMatch(v, workspace, configuration, revision = '', state = '', number = 1) {
+    return !!v && v.workspace_id === workspace && v.configuration_id === configuration && v.revision === revision && v.state === state && page(v, number)
+        && v.results.every(row => ciActivationMatches(row, workspace, { configuration }) && (!revision || String(row.revision) === revision) && (!state || row.state === state));
+}
+export function ciActivationRequestMatches(v, workspace, original) {
+    return !!v && v.workspace_id === workspace && v.actor_id === original.actor && v.request_key === original.key
+        && (v.state === 'not_received' ? v.activation === null && !original.id : v.state === 'received' && v.activation !== null && ciActivationMatches(v.activation, workspace, original));
+}

package/dist/contracts/ci-configuration-contracts.js

@@ -0,0 +1,88 @@
+import { gitHubId } from './github-directory-contracts.js';
+const uuid = (v) => typeof v === 'string' && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
+const sha = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+const integer = (v, minimum = 0) => typeof v === 'number' && Number.isSafeInteger(v) && v >= minimum;
+const text = (v, maximum) => typeof v === 'string' && v.length > 0 && v.length <= maximum && !/[\x00-\x1f\x7f]/.test(v);
+export function ciConfigurationRead(value, matches) {
+    if (!matches)
+        throw new Error('The CI response did not match the selected workspace, configuration, revision or original request. Reload its saved history.');
+    return value;
+}
+export function ciRevisionMatches(v, workspace, configuration) {
+    if (!v || v.workspace_id !== workspace || configuration && v.configuration_id !== configuration
+        || ![v.id, v.workspace_id, v.configuration_id, v.actor_id, v.request_key].every(uuid)
+        || !sha(v.request_digest) || !sha(v.sha256) || !integer(v.revision, 1) || !Number.isFinite(Date.parse(v.created_at)))
+        return false;
+    const doc = v.document;
+    return !!doc && text(doc.name, 120) && ['draft', 'disconnected'].includes(doc.state) && uuid(doc.world_id) && uuid(doc.plan_id)
+        && typeof doc.source_alias === 'string' && /^[a-z][a-z0-9_-]{0,63}$/.test(doc.source_alias)
+        && (doc.preparation_budget === null || integer(doc.preparation_budget.maximum_units, 1) && integer(doc.preparation_budget.credit_scale, 1)
+            && text(doc.preparation_budget.denomination, 64) && text(doc.preparation_budget.policy_version, 64))
+        && (doc.simulation_budget === null || integer(doc.simulation_budget.maximum_units) && integer(doc.simulation_budget.credit_scale, 1)
+            && text(doc.simulation_budget.denomination, 64) && text(doc.simulation_budget.policy_version, 64))
+        && !!doc.scenario_policy && ['all', 'change_relevant'].includes(doc.scenario_policy.mode)
+        && Array.isArray(doc.scenario_policy.mandatory_scenario_ids) && doc.scenario_policy.mandatory_scenario_ids.length <= 100
+        && doc.scenario_policy.mandatory_scenario_ids.every(uuid)
+        && new Set(doc.scenario_policy.mandatory_scenario_ids).size === doc.scenario_policy.mandatory_scenario_ids.length
+        && sha(doc.scenario_policy.sha256)
+        && (doc.nightly_hour_utc === null || integer(doc.nightly_hour_utc) && doc.nightly_hour_utc <= 23)
+        && ['report_only', 'hard_constraints'].includes(doc.mode) && /^[a-f0-9]{40}$/.test(doc.baseline_sha) && text(doc.default_branch, 512)
+        && Array.isArray(doc.triggers) && doc.triggers.length >= 1 && doc.triggers.length <= 3
+        && new Set(doc.triggers).size === doc.triggers.length && doc.triggers.every(one => ['pull_request', 'default_branch', 'nightly'].includes(one))
+        && doc.triggers.includes('nightly') === (doc.nightly_hour_utc !== null);
+}
+export function ciConfigurationMatches(v, workspace, id) {
+    if (!v || v.workspace_id !== workspace || !uuid(v.id) || id !== undefined && v.id !== id
+        || !integer(v.revision, 1) || !text(v.name, 120) || !['draft', 'active', 'disconnected'].includes(v.state)
+        || !gitHubId(v.installation_id) || !gitHubId(v.repository_id) || !text(v.repository, 512)
+        || !text(v.account, 255) || typeof v.connection_state !== 'string' || !Number.isFinite(Date.parse(v.updated_at))
+        || v.activation_id !== null && !uuid(v.activation_id) || !v.head
+        || !ciRevisionMatches(v.head, workspace, v.id) || v.head.revision !== v.revision
+        || (v.state === 'disconnected') !== (v.head.document.state === 'disconnected'))
+        return false;
+    const b = v.baseline;
+    return b === null || b.world_id === v.head.document.world_id && b.plan_id === v.head.document.plan_id
+        && integer(b.plan_revision, 1) && integer(b.scenario_count) && integer(b.planned_trials)
+        && typeof b.world_name === 'string' && b.source_revision === v.head.document.baseline_sha;
+}
+function pageMatches(v, page) {
+    return v.page === page && integer(v.page, 1) && integer(v.page_size, 1) && v.page_size <= 100
+        && integer(v.count) && Array.isArray(v.results) && v.results.length <= v.page_size;
+}
+export function ciConfigurationsMatch(v, workspace, query = '', state = '', page = 1, repository = '') {
+    return !!v && v.workspace_id === workspace && v.query === query.trim() && v.state === state && v.repository_id === repository
+        && pageMatches(v, page) && v.results.every(row => ciConfigurationMatches(row, workspace));
+}
+export function ciRevisionPageMatches(v, workspace, configuration, revision = '', mode = '', page = 1) {
+    return !!v && v.workspace_id === workspace && v.configuration_id === configuration && v.revision === revision && v.mode === mode
+        && pageMatches(v, page) && v.results.every(row => ciRevisionMatches(row, workspace, configuration)
+        && (!revision || String(row.revision) === revision) && (!mode || row.document.mode === mode)
+        && (row.world_url === null || row.world_url === `/worlds/${row.document.world_id}`));
+}
+export function ciConfigurationRequestMatches(v, workspace, original) {
+    return !!v && v.workspace_id === workspace && v.actor_id === original.actor && v.request_key === original.key
+        && (v.state === 'not_received' ? v.configuration_id === null && v.saved_revision === null
+            : v.state === 'received' && uuid(v.configuration_id) && (!original.configuration || v.configuration_id === original.configuration)
+                && v.saved_revision !== null && ciRevisionMatches(v.saved_revision, workspace, v.configuration_id)
+                && v.saved_revision.actor_id === original.actor && v.saved_revision.request_key === original.key && v.saved_revision.request_digest === original.digest);
+}
+export function ciPlansMatch(v, workspace, installation, repository, query = '', page = 1) {
+    return !!v && v.workspace_id === workspace && v.installation_id === installation && v.repository_id === repository
+        && gitHubId(installation) && gitHubId(repository) && v.query === query.trim() && pageMatches(v, page)
+        && v.results.every(row => uuid(row.id) && uuid(row.world_id) && integer(row.revision, 1) && integer(row.scenario_count)
+            && integer(row.planned_trials) && typeof row.world_name === 'string' && /^[a-f0-9]{40}$/.test(row.source_sha)
+            && Array.isArray(row.source_aliases) && row.source_aliases.length > 0 && row.source_aliases.length <= 128
+            && new Set(row.source_aliases.map(one => one.alias)).size === row.source_aliases.length
+            && row.source_aliases.every(one => /^[a-z][a-z0-9_-]{0,63}$/.test(one.alias) && /^[a-f0-9]{40}$/.test(one.revision))
+            && Number.isFinite(Date.parse(row.created_at)));
+}
+export function ciScenariosMatch(v, workspace, configuration, revision, query = '', page = 1) {
+    return !!v && v.workspace_id === workspace && v.configuration_id === configuration && String(v.configuration_revision) === revision
+        && v.query === query.trim() && pageMatches(v, page) && uuid(v.plan_id) && uuid(v.world_id) && integer(v.plan_revision, 1)
+        && integer(v.selected_scenarios) && v.count <= v.selected_scenarios && typeof v.world_name === 'string'
+        && v.results.every((row, index) => integer(row.position) && row.position < v.selected_scenarios
+            && (index === 0 || row.position > v.results[index - 1].position)
+            && (row.available ? uuid(row.scenario_id) && uuid(row.item_id) && typeof row.name === 'string' && integer(row.revision, 1)
+                && sha(row.definition_sha256) && row.detail_path === `/scenarios/${row.item_id}`
+                : row.available === false && [row.scenario_id, row.item_id, row.name, row.revision, row.definition_sha256, row.detail_path].every(one => one === null)));
+}

package/dist/contracts/ci-coverage-contracts.js

@@ -0,0 +1,65 @@
+import { gitHubId } from './github-directory-contracts.js';
+const uuid = (v) => typeof v === 'string' && /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(v);
+const sha = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+const integer = (v, min = 0) => typeof v === 'number' && Number.isSafeInteger(v) && v >= min;
+const code = (v) => typeof v === 'string' && /^[a-z][a-z0-9_]{0,63}$/.test(v);
+const path = (v) => typeof v === 'string' && v.length > 0 && v.length <= 1024
+    && !v.startsWith('/') && !v.includes('\\') && !v.split('/').some(one => one === '..' || one === '.' || one === '') && !/[\x00-\x1f\x7f]/.test(v);
+const page = (v, number) => integer(v.page, 1) && v.page === number && integer(v.count)
+    && integer(v.page_size, 1) && v.page_size <= 100 && Array.isArray(v.results) && v.results.length <= v.page_size
+    && v.results.length <= v.count;
+export function ciPlanScenariosMatch(v, workspace, plan, selected) {
+    return !!v && v.workspace_id === workspace && uuid(v.workspace_id) && v.plan_id === plan && uuid(v.plan_id)
+        && v.installation_id === selected.installation && gitHubId(v.installation_id) && v.repository_id === selected.repository && gitHubId(v.repository_id)
+        && v.source_alias === selected.sourceAlias && /^[a-z][a-z0-9_-]{0,63}$/.test(v.source_alias)
+        && [v.world_id, v.source_id].every(uuid) && [v.plan_revision, v.world_revision].every(one => integer(one, 1))
+        && integer(v.configuration_revision) && sha(v.plan_sha256) && v.max_mandatory === 100
+        && v.query === (selected.query ?? '').trim() && page(v, selected.page ?? 1)
+        && v.results.every((row, index) => integer(row.position) && (index === 0 || row.position > v.results[index - 1].position)
+            && typeof row.protected_required_checks === 'boolean' && (row.available
+            ? uuid(row.scenario_id) && uuid(row.item_id) && integer(row.revision, 1) && sha(row.definition_sha256)
+                && typeof row.name === 'string' && row.detail_path === `/scenarios/${row.item_id}`
+            : row.available === false && row.protected_required_checks === true
+                && [row.scenario_id, row.item_id, row.revision, row.definition_sha256, row.name, row.detail_path].every(one => one === null)));
+}
+export function ciCoverageMatches(v, workspace, run) {
+    if (!v || v.workspace_id !== workspace || v.run_id !== run || ![v.workspace_id, v.run_id].every(uuid))
+        return false;
+    if (v.state === 'not_available')
+        return v.selection === null;
+    const s = v.selection;
+    return v.state === 'ready' && !!s && uuid(s.id) && ['all', 'change_relevant'].includes(s.policy_mode)
+        && ['all', 'reduced'].includes(s.state) && code(s.reason)
+        && [s.baseline_count, s.selected_count, s.skipped_count, s.baseline_drills, s.selected_drills].every(one => integer(one))
+        && (s.changed_files === null || integer(s.changed_files))
+        && s.selected_count + s.skipped_count === s.baseline_count && s.selected_drills <= s.baseline_drills
+        && s.reduced === (s.state === 'reduced') && (s.reduced ? s.policy_mode === 'change_relevant' && s.skipped_count > 0 && s.selected_count > 0 : s.skipped_count === 0)
+        && s.source_scope === 'retained_sanitized_files' && sha(s.basis_sha256) && sha(s.document_sha256)
+        && typeof s.created_at === 'string' && Number.isFinite(Date.parse(s.created_at));
+}
+function originalPage(v, workspace, run, selection, query, number) {
+    return !!v && v.workspace_id === workspace && v.run_id === run && [v.workspace_id, v.run_id].every(uuid)
+        && v.selection_id === selection.id && v.document_sha256 === selection.document_sha256 && v.query === query.trim() && page(v, number);
+}
+export function ciCoverageScenariosMatch(v, workspace, run, selection, filters = {}) {
+    return originalPage(v, workspace, run, selection, filters.query ?? '', filters.page ?? 1)
+        && v.selected === (filters.selected ?? 'all') && v.reason === (filters.reason ?? '') && v.count <= selection.baseline_count
+        && v.results.every((row, index) => integer(row.position) && row.position < selection.baseline_count
+            && (index === 0 || row.position > v.results[index - 1].position) && [row.scenario_id, row.item_id].every(uuid)
+            && integer(row.revision, 1) && sha(row.definition_sha256) && code(row.reason) && typeof row.selected === 'boolean'
+            && (v.selected === 'all' || row.selected === (v.selected === 'selected')) && (!v.reason || row.reason === v.reason)
+            && (row.available ? typeof row.name === 'string' && row.detail_path === `/scenarios/${row.item_id}`
+                : row.available === false && row.name === null && row.detail_path === null)
+            && Array.isArray(row.links) && row.links.length <= 24 && row.links.every(link => path(link.path)
+            && [link.before_sha256, link.after_sha256].every(one => one === null || sha(one))
+            && ['changed', 'unchanged', 'missing', 'stale', 'unscoped'].includes(link.status)));
+}
+export function ciCoverageFilesMatch(v, workspace, run, selection, query = '', number = 1) {
+    return originalPage(v, workspace, run, selection, query, number) && selection.changed_files !== null && v.count <= selection.changed_files
+        && (query.trim() !== '' || v.count === selection.changed_files) && new Set(v.results.map(row => row.path)).size === v.results.length
+        && v.results.every(row => path(row.path)
+            && [row.before_sha256, row.after_sha256].every(one => one === null || sha(one))
+            && (row.change === 'added' ? row.before_sha256 === null && sha(row.after_sha256)
+                : row.change === 'removed' ? sha(row.before_sha256) && row.after_sha256 === null
+                    : ['modified', 'metadata_changed'].includes(row.change) && sha(row.before_sha256) && sha(row.after_sha256)));
+}

package/dist/contracts/ci-coverage-labels.js

@@ -0,0 +1,25 @@
+/** Human descriptions of the original selection reasons, not inferred impact. */
+const reasons = {
+    policy_all: 'All scenarios selected by the reviewed policy',
+    broad_trigger: 'The full plan is kept for this run type',
+    comparison_unavailable: 'The source comparison was unavailable, so the full plan was kept',
+    no_changed_files: 'No changes were found in the source comparison, so the full plan was kept',
+    change_relevant: 'Selection based on reviewed source links',
+    additional_mandatory: 'Included as an additional mandatory case',
+    required_checks: 'Included to preserve required checks',
+    unknown_checks: 'Included because check coverage is uncertain',
+    coverage_unlinked: 'Included because no source links were provided',
+    coverage_invalid: 'Included because its source links could not be validated',
+    coverage_capacity: 'Included because its source links could not be fully reviewed',
+    coverage_missing: 'Included because linked source is missing',
+    coverage_stale: 'Included because its source links are out of date',
+    coverage_unscoped: 'Included because its source links are outside the compared component',
+    linked_change: 'Included because linked source changed',
+    linked_unchanged: 'Skipped because its linked source was unchanged',
+    empty_selection_kept_all: 'No safe subset was found, so the full plan was kept',
+};
+export const ciCoverageReason = (value) => reasons[value] ?? 'Inspect the saved selection details';
+export const ciCoverageLinkLabel = (value) => ({ changed: 'Changed', unchanged: 'Unchanged', missing: 'Source missing',
+    stale: 'Link out of date', unscoped: 'Outside compared source' }[value] ?? 'Source link details unavailable');
+export const ciCoverageFileLabel = (value) => ({ added: 'Added', removed: 'Removed', modified: 'Modified',
+    metadata_changed: 'File metadata changed' }[value] ?? 'Change details unavailable');

package/dist/contracts/ci-delivery-contracts.js

@@ -0,0 +1,61 @@
+export const ciDeliveryStates = ['queued', 'prepared', 'dispatching', 'uncertain', 'attention_required', 'confirmed', 'rejected', 'superseded'];
+const uuid = (v) => typeof v === 'string' && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
+const count = (v, min = 0) => typeof v === 'number' && Number.isSafeInteger(v) && v >= min;
+const date = (v) => typeof v === 'string' && Number.isFinite(Date.parse(v));
+export function ciDeliveryRead(value, matches) {
+    if (!matches)
+        throw new Error('The GitHub delivery did not match this workspace, run or original request. Reload its retained history before continuing.');
+    return value;
+}
+export function ciDeliveryIntentMatches(v, run) {
+    return !!v && uuid(v.intent_id) && uuid(v.run_id) && (!run || v.run_id === run) && ciDeliveryStates.includes(v.state)
+        && count(v.sequence) && count(v.source_revision) && count(v.retry_number) && ['report', 'progress', 'withdrawal', 'rerun_review'].includes(v.purpose)
+        && (v.purpose === 'rerun_review' ? uuid(v.rerun_event_id) : v.rerun_event_id === null)
+        && date(v.created_at) && [v.dispatched_at, v.confirmed_at].every(one => one === null || date(one))
+        && (v.progress_revision === null || count(v.progress_revision, 1)) && (v.phase === null || typeof v.phase === 'string')
+        && (v.write_http_status === null || count(v.write_http_status, 100) && v.write_http_status <= 599)
+        && (v.conclusion === null || ['success', 'failure', 'neutral', 'cancelled', 'action_required'].includes(v.conclusion))
+        && (v.state !== 'confirmed' || v.dispatched_at !== null && v.confirmed_at !== null);
+}
+export function ciDeliveryMatches(v, workspace, run, kind) {
+    if (!v || v.workspace_id !== workspace || v.run_id !== run || v.kind !== kind || !uuid(workspace) || !uuid(run)
+        || ![...ciDeliveryStates, 'not_available', 'not_applicable'].includes(v.state)
+        || ![v.check_confirmed, v.comment_confirmed, v.confirmed_for_run, v.result_current].every(one => typeof one === 'boolean')
+        || v.head !== null && (!ciDeliveryIntentMatches(v.head, kind === 'check' ? run : undefined) || v.head.state !== v.state)
+        || v.waiting_for !== null && !ciDeliveryIntentMatches(v.waiting_for, kind === 'check' ? run : undefined))
+        return false;
+    if (v.url !== null) {
+        try {
+            const url = new URL(v.url);
+            if (url.protocol !== 'https:' || url.hostname !== 'github.com' || url.username || url.password)
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    if (v.state === 'not_available' || v.state === 'not_applicable')
+        return v.head === null && v.waiting_for === null && !v.check_confirmed && !v.comment_confirmed
+            && !v.result_current && !v.confirmed_for_run && (v.state !== 'not_applicable' || kind === 'comment');
+    const confirmed = kind === 'check' ? v.check_confirmed : v.comment_confirmed;
+    return v.head !== null && (kind === 'check' ? !v.comment_confirmed : !v.check_confirmed)
+        && (!confirmed || v.head.state === 'confirmed' && v.head.dispatched_at !== null && v.head.confirmed_at !== null)
+        && (!v.result_current || v.head.purpose === 'report' && v.head.run_id === run);
+}
+export function ciDeliveriesMatch(v, workspace, run, kind, status, page) {
+    return !!v && v.workspace_id === workspace && v.run_id === run && v.kind === kind && v.status === status && count(v.count)
+        && v.page === page && count(v.page_size, 1) && v.page_size <= 100 && Array.isArray(v.results) && v.results.length <= v.page_size
+        && v.results.every(one => ciDeliveryIntentMatches(one, kind === 'check' ? run : undefined) && (!status || one.state === status))
+        && new Set(v.results.map(one => one.intent_id)).size === v.results.length;
+}
+export function ciDeliveryRecoveryMatches(v, workspace, intent, kind, original = {}) {
+    return !!v && v.workspace_id === workspace && v.intent_id === intent && v.kind === kind
+        && [v.id, v.workspace_id, v.actor_id, v.request_key, v.intent_id].every(uuid) && /^[a-f0-9]{64}$/.test(v.request_digest)
+        && count(v.sequence, 1) && typeof v.retry_rejected === 'boolean' && /^[a-z_]{1,24}$/.test(v.state) && date(v.created_at)
+        && (!original.id || original.id === v.id) && (!original.actor || original.actor === v.actor_id)
+        && (!original.key || original.key === v.request_key) && (!original.digest || original.digest === v.request_digest);
+}
+export function ciDeliveryRecoveryRequestMatches(v, workspace, intent, kind, original) {
+    return !!v && v.workspace_id === workspace && v.intent_id === intent && v.kind === kind && v.actor_id === original.actor && v.request_key === original.key
+        && (v.state === 'not_received' ? v.request === null && !original.id : v.state === 'received' && v.request !== null && ciDeliveryRecoveryMatches(v.request, workspace, intent, kind, original));
+}

package/dist/contracts/ci-result-contracts.js

@@ -0,0 +1,103 @@
+import { ciCoverageMatches } from './ci-coverage-contracts.js';
+const uuid = (v) => typeof v === 'string' && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
+const sha = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+const count = (v, min = 0) => typeof v === 'number' && Number.isSafeInteger(v) && v >= min;
+const date = (v) => typeof v === 'string' && Number.isFinite(Date.parse(v));
+const reportStates = ['waiting', 'collecting', 'ready', 'attention_required', 'changed', 'canceled', 'not_available'];
+const trialCounts = ['retained', 'completed', 'failed', 'platform_failed', 'timed_out', 'canceled', 'unfinished', 'invoked', 'results',
+    'declared', 'expected_exact', 'observed', 'exact_met', 'exact_unmet', 'unknown', 'native_unmet'];
+export function ciResultRead(value, matches) {
+    if (!matches)
+        throw new Error('The report did not match the selected workspace, run or original request. Reload its retained result before continuing.');
+    return value;
+}
+export function ciResultMatches(v, workspace, run, selected = {}) {
+    if (!v || v.workspace_id !== workspace || v.run_id !== run || !uuid(workspace) || !uuid(run) || !reportStates.includes(v.state)
+        || typeof v.published !== 'boolean' || typeof v.check_confirmed !== 'boolean' || typeof v.publication_current !== 'boolean'
+        || ![true, false, null].includes(v.comment_required) || ![true, false, null].includes(v.comment_confirmed)
+        || ![null, 'pending', 'settled'].includes(v.withdrawal) || v.published !== (v.ci_verdict !== null)
+        || v.ci_verdict !== null && !['neutral', 'success', 'failure'].includes(v.ci_verdict))
+        return false;
+    if (v.state === 'not_available')
+        return v.result === null && v.id === null && v.campaign_id === null && v.sequence === null
+            && v.source_revision === null && v.observed_at === null && v.report_path === null && !v.published && !v.check_confirmed && !v.publication_current
+            && v.comment_required === null && v.comment_confirmed === null && v.withdrawal === null;
+    if (!uuid(v.id) || !uuid(v.campaign_id) || !count(v.sequence, 1) || !count(v.source_revision)
+        || v.report_path !== `/campaigns/${v.campaign_id}` || selected.campaign && selected.campaign !== v.campaign_id
+        || v.observed_at !== null && !date(v.observed_at))
+        return false;
+    if (v.state !== 'ready')
+        return v.result === null && !v.published && v.ci_verdict === null;
+    const result = v.result;
+    if (!result || result.schema !== 'firedrill.github-ci-result.v1' || result.run_id !== run || result.campaign_id !== v.campaign_id
+        || !/^[a-f0-9]{40}$/.test(result.head_sha) || selected.sha && selected.sha !== result.head_sha
+        || !uuid(result.configuration_revision_id) || !sha(result.plan_sha256) || !date(result.observed_at)
+        || !date(v.observed_at) || Date.parse(result.observed_at) !== Date.parse(v.observed_at)
+        || result.report_path !== v.report_path || result.scores_path !== `/api/workspaces/${workspace}/ci/runs/${run}/result/scores`
+        || !count(result.scenarios) || !count(result.planned_trials) || !['completed', 'failed', 'canceled'].includes(result.execution_state))
+        return false;
+    if (result.coverage !== undefined && result.coverage !== null && (!ciCoverageMatches({ workspace_id: workspace, run_id: run,
+        state: 'ready', selection: result.coverage }, workspace, run) || result.scenarios !== result.coverage.selected_count
+        || result.planned_trials !== result.coverage.selected_drills))
+        return false;
+    const trials = result.trials, assessment = result.assessment, decision = result.decision;
+    return !!trials && trialCounts.every(key => count(trials[key])) && !!assessment
+        && [assessment.expected, assessment.assessed, assessment.not_applicable, assessment.not_assessable, assessment.unavailable, assessment.score_groups].every(one => count(one))
+        && assessment.assessed + assessment.not_applicable + assessment.not_assessable + assessment.unavailable === assessment.expected
+        && typeof assessment.requested === 'boolean' && !!decision && decision.published === false && decision.constraint_scope === 'source_exact_checks'
+        && ['report_only', 'hard_constraints'].includes(decision.mode) && ['report_only', 'met', 'unmet', 'incomplete'].includes(decision.status)
+        && ['neutral', 'success', 'failure'].includes(decision.suggested_conclusion)
+        && [decision.complete, decision.execution_complete, decision.check_coverage_complete, decision.assessment_coverage_complete, decision.has_exact_constraints].every(one => typeof one === 'boolean')
+        && decision.complete === (decision.execution_complete && decision.check_coverage_complete && decision.assessment_coverage_complete)
+        && (!v.published || v.publication_current && v.check_confirmed && (!v.comment_required || v.comment_confirmed === true)
+            && v.ci_verdict === decision.suggested_conclusion);
+}
+function reportPageMatches(v, workspace, run, query, page) {
+    if (!v || v.workspace_id !== workspace || v.run_id !== run || v.query !== query.trim() || !uuid(v.campaign_id)
+        || !count(v.source_revision) || v.observed_at !== null && !date(v.observed_at) || !Array.isArray(v.results))
+        return false;
+    if (v.state !== 'ready')
+        return reportStates.includes(v.state) && v.count === null && v.page === null && v.page_size === null
+            && v.next === null && v.previous === null && v.results.length === 0;
+    return count(v.count) && v.page === page && count(v.page_size, 1) && v.page_size <= 100 && v.results.length <= v.page_size
+        && date(v.observed_at) && v.results.every((one, index) => count(one.position)
+        && (index === 0 || one.position > v.results[index - 1].position) && uuid(one.criterion_id));
+}
+export function ciCriteriaMatches(v, workspace, run, query, status, page) {
+    if (!reportPageMatches(v, workspace, run, query, page) || v.status !== status)
+        return false;
+    return v.state !== 'ready' || v.results.every(one => {
+        const values = one.counts;
+        return sha(one.definition_sha256) && (one.name === null || typeof one.name === 'string') && !!values && Object.values(values).every(number => count(number))
+            && values.assessed + values.not_applicable + values.not_assessable + values.unavailable === values.expected
+            && ['complete', 'incomplete', 'not_assessable'].includes(one.coverage_state)
+            && (!status || status === one.coverage_state) && (one.definition_url === null || /^\/evaluations\/[a-f0-9-]{36}$/.test(one.definition_url));
+    });
+}
+export function ciScoresMatch(v, workspace, run, query, page) {
+    if (!reportPageMatches(v, workspace, run, query, page))
+        return false;
+    return v.state !== 'ready' || v.results.every(one => {
+        const { cohort, summary } = one;
+        if (!uuid(one.example_execution_id) || !cohort || !uuid(cohort.assessment_id) || !uuid(cohort.scenario_id) || !sha(cohort.identity)
+            || !Array.isArray(cohort.levels) || cohort.levels.length < 2 || cohort.levels.length > 10 || !cohort.levels.every(level => typeof level === 'string')
+            || !['higher', 'lower'].includes(cohort.direction) || !summary
+            || ![summary.observed, summary.assessed, summary.not_assessable, summary.not_applicable].every(number => count(number))
+            || summary.assessed + summary.not_assessable + summary.not_applicable !== summary.observed)
+            return false;
+        const values = [summary.mean, summary.minimum, summary.maximum];
+        return summary.assessed === 0 ? values.every(value => value === null) : values.every(value => typeof value === 'number'
+            && Number.isFinite(value) && value >= 0 && value <= cohort.levels.length - 1)
+            && summary.minimum <= summary.mean && summary.mean <= summary.maximum;
+    });
+}
+export function ciResultRefreshMatches(v, workspace, run, original = {}) {
+    return !!v && v.workspace_id === workspace && v.run_id === run && [v.id, v.workspace_id, v.actor_id, v.request_key, v.run_id].every(uuid)
+        && sha(v.request_digest) && count(v.sequence, 1) && /^[a-z_]{1,24}$/.test(v.state) && date(v.created_at)
+        && (!original.id || original.id === v.id) && (!original.actor || original.actor === v.actor_id)
+        && (!original.key || original.key === v.request_key) && (!original.digest || original.digest === v.request_digest);
+}
+export function ciResultRefreshRequestMatches(v, workspace, run, original) {
+    return !!v && v.workspace_id === workspace && v.run_id === run && v.actor_id === original.actor && v.request_key === original.key
+        && (v.state === 'not_received' ? v.request === null && !original.id : v.state === 'received' && v.request !== null && ciResultRefreshMatches(v.request, workspace, run, original));
+}

package/dist/contracts/ci-run-contracts.js

@@ -0,0 +1,51 @@
+export const ciRunStates = ['queued', 'acquiring_source', 'preparing_world', 'configuration_required', 'validating', 'planning', 'running',
+    'report_pending', 'attention_required', 'canceling', 'completed', 'failed', 'canceled', 'superseded'];
+const uuid = (v) => typeof v === 'string' && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
+const integer = (v, min = 0) => typeof v === 'number' && Number.isSafeInteger(v) && v >= min;
+const date = (v) => v === null || Number.isFinite(Date.parse(v));
+export function ciRunRead(value, matches) {
+    if (!matches)
+        throw new Error('The CI run response did not match the selected workspace, original preparation or history filters. Check the retained run before continuing.');
+    return value;
+}
+export function ciRunMatches(v, workspace, selected = {}) {
+    if (!v || v.workspace_id !== workspace || ![v.id, v.workspace_id, v.configuration_id, v.created_by_id, v.event_id, v.request_key].every(uuid)
+        || !/^[a-f0-9]{64}$/.test(v.request_digest) || !integer(v.configuration_revision, 1)
+        || selected.id !== undefined && v.id !== selected.id || selected.configuration !== undefined && v.configuration_id !== selected.configuration
+        || selected.actor !== undefined && v.created_by_id !== selected.actor || selected.key !== undefined && v.request_key !== selected.key
+        || selected.digest !== undefined && v.request_digest !== selected.digest || !/^[a-f0-9]{40}$/.test(v.head_sha)
+        || typeof v.reference !== 'string' || !v.reference.length || v.reference.length > 1024 || /[\x00-\x1f\x7f]/.test(v.reference)
+        || typeof v.fork !== 'boolean' || !ciRunStates.includes(v.state) || typeof v.cleanup_pending !== 'boolean'
+        || v.cleanup_pending !== (v.state === 'canceling') || !Number.isFinite(Date.parse(v.created_at)) || !Number.isFinite(Date.parse(v.updated_at))
+        || !date(v.observed_head_at) || ![v.source_id, v.world_id, v.campaign_id, v.validation_id, v.activation_id].every(one => one === null || uuid(one))
+        || !v.head_status || !['pending', 'current', 'changed'].includes(v.head_status.state) || !date(v.head_status.checked_at)
+        || v.world_url !== null && v.world_url !== `/worlds/${v.world_id}` || v.report_url !== null && v.report_url !== `/campaigns/${v.campaign_id}`
+        || v.world_configuration_revision !== null && (!v.world_id || !integer(v.world_configuration_revision, 1)))
+        return false;
+    if (v.trigger === 'pull_request' ? !integer(v.pull_number, 1) : v.trigger === 'check_run'
+        ? !(v.pull_number === null ? !v.fork : integer(v.pull_number, 1))
+        : !['push', 'scheduled'].includes(v.trigger) || v.pull_number !== null || v.fork)
+        return false;
+    if (v.source && (!uuid(v.source.id) || v.source.id !== v.source_id
+        || !(v.source.revision === v.head_sha || /^set:[a-f0-9]{64}$/.test(v.source.revision))
+        || !integer(v.source.excluded_files)))
+        return false;
+    const report = v.recorded_report;
+    return report === undefined || report === null || report.basis === 'recorded_report' && ['met', 'unmet', 'incomplete', 'report_only'].includes(report.status)
+        && typeof report.complete === 'boolean' && (report.status !== 'met' || report.complete) && Number.isFinite(Date.parse(report.observed_at));
+}
+export function ciRunsMatch(v, workspace, configuration, filters = {}, page = 1) {
+    return !!v && v.workspace_id === workspace && v.configuration_id === configuration && v.page === page && integer(v.page, 1)
+        && integer(v.count) && integer(v.page_size, 1) && v.page_size <= 100 && Array.isArray(v.results) && v.results.length <= v.page_size
+        && !!v.filters && ['sha', 'state', 'trigger', 'reference', 'outcome'].every(key => v.filters[key] === (filters[key] ?? ''))
+        && (filters.world ? v.filters.world?.id === filters.world : v.filters.world === null)
+        && v.results.every(row => ciRunMatches(row, workspace, { configuration }) && (!filters.sha || row.head_sha === filters.sha.toLowerCase())
+            && (!filters.state || row.state === filters.state) && (!filters.trigger || row.trigger === filters.trigger)
+            && (!filters.reference || row.reference.startsWith(filters.reference))
+            && (!filters.outcome || (filters.outcome === 'no_report' ? !row.recorded_report : row.recorded_report?.status === filters.outcome)));
+}
+export function ciRunRequestMatches(v, workspace, original) {
+    return !!v && v.workspace_id === workspace && v.actor_id === original.actor && v.request_key === original.key
+        && (v.state === 'not_received' ? v.run === null && !original.id : v.state === 'received' && v.run !== null
+            && ciRunMatches(v.run, workspace, original) && v.run.activation_id === null);
+}