firedrill-run 2.2.5 → 3.0.0

package/dist/contracts/local-trial-live-contracts.js

@@ -0,0 +1,16 @@
+const hex = (value) => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+const integer = (value) => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
+/** Exact original acceptance only. A new current authentication session may read
+ * old metadata; this does not restore the original native write authority. */
+export function localTrialLiveReceiptMatches(value, selected, original) {
+    return !!value && value.schema === 'firedrill.local-trial-live-receipt.v1'
+        && value.actor_id === selected.owner && value.workspace_id === selected.workspace && value.device_key === selected.device
+        && value.request_key === selected.request && value.job_id === selected.job && value.lease_id === selected.lease
+        && value.attempt_id === selected.attempt && hex(value.manifest_sha256) && value.manifest_sha256 === original.manifestSha256
+        && value.execution_id === original.executionId && hex(value.event_id) && value.event_id === original.eventId
+        && integer(value.sequence) && value.sequence === original.sequence && value.provenance === 'customer_device'
+        && value.cloud_completion_recorded === false && typeof value.server_time === 'string' && Number.isFinite(Date.parse(value.server_time))
+        && (value.state === 'retained' ? hex(value.body_sha256) && value.body_sha256 === original.bodySha256
+            && integer(value.body_size) && value.body_size > 0 && value.body_size <= 256 * 1024 && value.body_size === original.bodySize
+            : value.state === 'not_retained' && value.body_sha256 === null && value.body_size === null);
+}

package/dist/contracts/local-value-source-contracts.js

@@ -0,0 +1,92 @@
+import { rawSourceUploadMatches } from './source-upload-contracts.js';
+const uuid = (v) => typeof v === 'string' && /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(v);
+const hex = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+const date = (v) => typeof v === 'string' && Number.isFinite(Date.parse(v));
+const integer = (v, minimum = 0) => typeof v === 'number' && Number.isSafeInteger(v) && v >= minimum;
+const archive = (v) => !!v && Object.keys(v).sort().join(',') === 'sha256,size' && integer(v.size, 1) && hex(v.sha256);
+const capture = (v) => !!v && v.schema === 'firedrill.local-source.v1'
+    && Object.keys(v).sort().join(',') === 'base_commit,content_digest,expanded_bytes,file_count,project_root,schema'
+    && hex(v.content_digest) && (v.base_commit === null || typeof v.base_commit === 'string' && /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(v.base_commit))
+    && typeof v.project_root === 'string' && v.project_root.length <= 1024 && integer(v.file_count, 1) && integer(v.expanded_bytes);
+/** Canonical non-secret original request metadata only. Never pass private values. */
+export function nativeMetadataCanonical(v) {
+    if (Array.isArray(v))
+        return '[' + v.map(nativeMetadataCanonical).join(',') + ']';
+    if (v && typeof v === 'object') {
+        const row = v;
+        return '{' + Object.keys(row).sort().map(key => JSON.stringify(key) + ':' + nativeMetadataCanonical(row[key])).join(',') + '}';
+    }
+    const encoded = JSON.stringify(v);
+    if (encoded === undefined)
+        throw new Error('The original native metadata is incomplete.');
+    return encoded;
+}
+export function localValueRegistrationMatches(v, scope, id) {
+    return !!v && v.schema === 'firedrill.local-value-reference.v1' && uuid(v.id) && (!id || v.id === id)
+        && v.actor_id === scope.owner && v.workspace_id === scope.workspace && v.world_id === scope.world
+        && uuid(v.device_key) && typeof v.device_label === 'string' && v.device_label.length <= 80
+        && typeof v.name === 'string' && /^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(v.name)
+        && ['build', 'runtime', 'both'].includes(v.phase) && ['revoked', 'available', 'device_unavailable'].includes(v.state)
+        && hex(v.request_digest) && date(v.created_at) && (v.revoked_at === null ? v.state !== 'revoked' : date(v.revoked_at) && v.state === 'revoked')
+        && v.value_uploaded === false;
+}
+export function localValueLookupMatches(v, scope, id) {
+    return !!v && v.id === id && v.actor_id === scope.owner && v.workspace_id === scope.workspace && v.world_id === scope.world
+        && v.value_uploaded === false && (v.state === 'not_retained' || localValueRegistrationMatches(v, scope, id));
+}
+export function localValuePageMatches(v, scope, query = '', page = 1) {
+    return !!v && v.actor_id === scope.owner && v.workspace_id === scope.workspace && v.world_id === scope.world
+        && v.query === query.trim() && v.page === page && integer(v.count) && integer(v.page_size, 1) && v.page_size <= 100
+        && Array.isArray(v.results) && v.results.length <= v.page_size && new Set(v.results.map(one => one.id)).size === v.results.length
+        && v.results.every(one => localValueRegistrationMatches(one, scope));
+}
+export function localValueOriginalMatches(v, scope, id, body, digest) {
+    return localValueRegistrationMatches(v, scope, id) && v.request_digest === digest && v.device_key === body.device_key
+        && v.name === body.name && v.phase === body.phase;
+}
+export function localSourceConnectionMatches(v, scope, key) {
+    if (!v || v.request_key !== key || v.actor_id !== scope.owner || v.workspace_id !== scope.workspace || !uuid(v.native_session_id)
+        || typeof v.defer_world !== 'boolean' || v.component_agent_id !== null && (!uuid(v.component_agent_id) || !v.defer_world)
+        || !['awaiting_upload', 'verifying', 'upload_missing', 'connected', 'withdrawn', 'refused', 'rejected'].includes(v.state)
+        || typeof v.name !== 'string' || v.name.length > 120 || !date(v.expires_at)
+        || !(v.problem === null || typeof v.problem === 'string') || ![v.agent_id, v.source_id, v.world_id].every(one => one === null || uuid(one)))
+        return false;
+    if (v.request_digest === null)
+        return v.state === 'withdrawn' && v.name === '' && v.capture === null && v.archive === null
+            && v.consent_policy === null && v.consented_at === null && v.agent_id === null && v.source_id === null && v.world_id === null;
+    return hex(v.request_digest) && !!v.name && archive(v.archive) && capture(v.capture)
+        && v.consent_policy === 'firedrill.local-source-transfer.v1' && date(v.consented_at)
+        && (v.state !== 'connected' || uuid(v.agent_id) && uuid(v.source_id) && (v.defer_world ? v.world_id === null : uuid(v.world_id)))
+        && (v.agent_id === null || v.component_agent_id === null || v.agent_id === v.component_agent_id);
+}
+export function localSourceLookupMatches(v, scope, key) {
+    return !!v && v.request_key === key && v.actor_id === scope.owner && v.workspace_id === scope.workspace
+        && (v.state === 'not_retained' || localSourceConnectionMatches(v, scope, key));
+}
+export function localSourcePageMatches(v, scope, filters) {
+    const fields = ['schema', 'actor_id', 'workspace_id', 'query', 'state_filter', 'after', 'next_after', 'page_size', 'results'];
+    const rowFields = ['request_key', 'actor_id', 'workspace_id', 'native_session_id', 'request_digest', 'state', 'name', 'capture',
+        'archive', 'agent_id', 'source_id', 'world_id', 'component_agent_id', 'defer_world', 'problem', 'consent_policy', 'consented_at', 'expires_at', 'created_at'];
+    const exact = (value, allowed) => Object.keys(value).length === allowed.length && Object.keys(value).every(key => allowed.includes(key));
+    const cursor = (value) => value === null || typeof value === 'string' && value.length > 0 && value.length <= 2048 && /^[A-Za-z0-9_.:-]+$/.test(value);
+    return !!v && exact(v, fields) && v.schema === 'firedrill.local-source-history.v1'
+        && v.actor_id === scope.owner && v.workspace_id === scope.workspace
+        && v.query === filters.query.trim() && v.state_filter === filters.state && v.after === (filters.after || null)
+        && v.page_size === 20 && cursor(v.after) && cursor(v.next_after) && (v.next_after === null || v.next_after !== v.after)
+        && Array.isArray(v.results) && v.results.length <= 20
+        && (v.next_after === null || v.results.length === 20)
+        && new Set(v.results.map(one => one.request_key)).size === v.results.length
+        && v.results.every(one => !!one && exact(one, rowFields) && uuid(one.request_key) && date(one.created_at)
+            && localSourceConnectionMatches(one, scope, one.request_key) && (filters.state === 'all' || one.state === filters.state));
+}
+export function localSourceOriginalMatches(v, scope, key, body, digest) {
+    return localSourceConnectionMatches(v, scope, key) && v.request_digest === digest && v.name === body.name
+        && v.component_agent_id === (body.component_agent_id ?? null) && v.defer_world === (body.defer_world ?? false)
+        && nativeMetadataCanonical(v.capture) === nativeMetadataCanonical(body.capture)
+        && nativeMetadataCanonical(v.archive) === nativeMetadataCanonical(body.archive);
+}
+export function localSourceUploadMatches(v, scope, key, body, digest) {
+    return !!v && v.request_key === key && v.actor_id === scope.owner && v.workspace_id === scope.workspace && v.request_digest === digest
+        && archive(v.archive) && nativeMetadataCanonical(v.archive) === nativeMetadataCanonical(body.archive)
+        && rawSourceUploadMatches(v, scope.workspace);
+}

package/dist/contracts/local-world-native-contracts.js

@@ -0,0 +1,8 @@
+export const LOCAL_WORLD_IDENTITY_KEYS = ['actor_id', 'workspace_id', 'device_key', 'request_key', 'job_id', 'attempt_id', 'manifest_sha256'];
+/** Original scope only, not proof of current execution or independent attestation. */
+export function localWorldIdentityMatches(value, owner, manifest) {
+    return !!value && value.actor_id === owner.owner && value.workspace_id === owner.workspace && value.device_key === owner.device
+        && value.job_id === owner.job && value.request_key === owner.request && value.attempt_id === owner.attempt
+        && value.lease_id === owner.lease && value.manifest_sha256 === manifest && value.provenance === 'customer_device'
+        && typeof value.server_time === 'string' && Number.isFinite(Date.parse(value.server_time));
+}

package/dist/contracts/mcp-contracts.js

@@ -0,0 +1,42 @@
+export function mcpReauthorizationRead(value, actor, session) {
+    if (!value || value.user_id !== actor || value.session_id !== session || value.new_authorization_allowed !== true)
+        throw new Error('The connection approval could not be confirmed. Check its current state before another action.');
+    return value;
+}
+export function mcpConnectionRead(value, actor, workspace, expectedAppOrigin) {
+    const httpsRoot = (raw) => {
+        if (typeof raw !== 'string' || raw.length > 2048)
+            return false;
+        try {
+            const url = new URL(raw);
+            return url.protocol === 'https:' && !url.username && !url.password
+                && !url.hash && !url.search && url.pathname === '/' && raw === url.origin
+                && !url.hostname.endsWith('.') && (!url.port || url.port === '443')
+                && (expectedAppOrigin === undefined || url.origin !== expectedAppOrigin);
+        }
+        catch {
+            return false;
+        }
+    };
+    const app = (raw, path) => {
+        if (typeof raw !== 'string')
+            return false;
+        try {
+            const url = new URL(raw);
+            return (url.protocol === 'https:' || ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname) && url.protocol === 'http:')
+                && url.pathname === path && !url.username && !url.password && !url.hash
+                && (expectedAppOrigin === undefined || url.origin === expectedAppOrigin)
+                && (path === '/signin' ? [...url.searchParams.keys()].join(',') === 'screen_hint' && url.searchParams.get('screen_hint') === 'sign-up' : !url.search);
+        }
+        catch {
+            return false;
+        }
+    };
+    if (!value || value.schema !== 'firedrill.mcp-connection.v1' || value.actor_id !== actor || value.workspace_id !== workspace
+        || typeof value.enabled !== 'boolean' || value.authentication !== 'oauth'
+        || (value.enabled ? !httpsRoot(value.url) : value.url !== null)
+        || !app(value.signup_url, '/signin') || !app(value.auth_guide_url, '/auth.md')) {
+        throw new Error('The MCP connection details changed. Reload this workspace before continuing.');
+    }
+    return value;
+}

package/dist/contracts/media-contracts.js

@@ -0,0 +1,28 @@
+/** Corroborate the selected trial's paths without issuing a media request. */
+export function captureMatchesTrial(row, prefix, desktop) {
+    const kind = row.session_origin === 'source_desktop_session' ? 'desktop-captures' : 'captures';
+    if (desktop !== undefined && (kind === 'desktop-captures') !== desktop)
+        return false;
+    if (row.state === 'unavailable')
+        return row.image_path === null && row.download_path === null;
+    const image = `${prefix}/${kind}/${row.id}/image`;
+    return row.state === 'captured' && row.image_path === image && row.download_path === `${image}?download=1`;
+}
+export function fileMatchesTrial(row, prefix) {
+    const path = `${prefix}/files/${row.id}`;
+    if (row.preview !== null && (row.kind !== 'browser_capture' && row.kind !== 'desktop_capture' || row.audio !== null))
+        return false;
+    if (row.preview !== null && (row.preview.evidence_id !== row.id || !captureMatchesTrial(row.preview, prefix)
+        || row.preview.state !== 'captured' || row.download_path !== row.preview.download_path
+        || row.download_content_type !== 'image/png'))
+        return false;
+    if (row.preview === null && row.download_path !== `${path}/download`)
+        return false;
+    if (row.audio !== null && (row.audio.evidence_id !== row.id || row.audio.origin !== row.origin
+        || row.audio.audio_path !== `${path}/audio` || row.audio.download_path !== `${path}/download`
+        || row.download_content_type !== 'audio/wav' || row.content_type !== 'audio/wav'))
+        return false;
+    if (row.audio !== null && (row.kind === 'recording_segment' ? row.audio.partial !== true : !row.kind.startsWith('recording_') || row.audio.partial === true))
+        return false;
+    return true;
+}

package/dist/contracts/native-check-contracts.js

@@ -0,0 +1,31 @@
+export function nativeCheckObservationMatches(value, selected) {
+    const uuid = (one) => typeof one === 'string' && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(one);
+    return !!value && value.workspace_id === selected.workspace && value.campaign_id === selected.campaign
+        && value.execution_id === selected.execution && value.id === selected.observation
+        && [value.workspace_id, value.campaign_id, value.execution_id, value.id, value.evidence_id].every(uuid)
+        && typeof value.name === 'string' && value.name.length > 0 && value.name.length <= 255
+        && ['exact', 'semantic', 'both', 'unknown'].includes(value.method) && typeof value.definition_known === 'boolean'
+        && value.definition_known === (value.method !== 'unknown') && typeof value.reported === 'boolean'
+        && ['met', 'unmet', 'unconfirmed'].includes(value.status) && (value.judged === null || typeof value.judged === 'boolean')
+        && (value.reason === null || typeof value.reason === 'string') && typeof value.reason_truncated === 'boolean'
+        && (!value.reason_truncated || value.reason === null)
+        && (value.reported || value.status === 'unconfirmed' && value.judged === null && value.reason === null && !value.reason_truncated)
+        && value.download_path === `/api/workspaces/${selected.workspace}/campaigns/${selected.campaign}/trials/${selected.execution}/evidence/${value.evidence_id}/bytes`;
+}
+function selectedRunsMatch(value, current, baseline) {
+    return value.current.id === current && (baseline ? value.baseline?.id === baseline && baseline !== current && value.context !== null
+        : value.baseline === null && value.context === null);
+}
+export function checkGroupsMatch(value, current, baseline, method) {
+    return selectedRunsMatch(value, current, baseline) && value.results.every(row => (!method || row.check.method === method)
+        && (baseline ? row.baseline !== null : row.baseline === null));
+}
+export function checkObservationsMatch(value, selected) {
+    return selectedRunsMatch(value, selected.current, selected.baseline) && value.check.id === selected.check
+        && (!selected.definition || value.check.identity === selected.definition.identity)
+        && (selected.baseline ? value.summary.baseline !== null : value.summary.baseline === null)
+        && value.results.every(row => (selected.side === 'both' || row.side === selected.side)
+            && (!selected.status || row.status === selected.status)
+            && (row.side === 'current' ? row.campaign_id === selected.current : row.side === 'baseline'
+                && !!selected.baseline && row.campaign_id === selected.baseline));
+}

package/dist/contracts/native-identity-contracts.js

@@ -0,0 +1,52 @@
+const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const uuid = (v) => typeof v === 'string' && /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(v);
+const date = (v) => typeof v === 'string' && Number.isFinite(Date.parse(v));
+const integer = (v) => typeof v === 'number' && Number.isSafeInteger(v) && v >= 0;
+export function nativeIdentityRead(v, matches) {
+    if (!matches)
+        throw new Error('Terminal identity or selected access could not be confirmed. No additional action was sent.');
+    return v;
+}
+export function nativeMembershipSyncMatches(v) {
+    return record(v) && typeof v.state === 'string' && ['not_requested', 'running', 'completed', 'attention_required'].includes(v.state);
+}
+export function nativeWorkspaceMatches(v) {
+    return record(v) && uuid(v.id) && uuid(v.organization_id) && typeof v.name === 'string' && typeof v.role === 'string'
+        && typeof v.can_manage === 'boolean' && typeof v.can_write === 'boolean';
+}
+export function nativeSessionMatches(v, selected = {}) {
+    return record(v) && uuid(v.id) && (!selected.session || v.id === selected.session) && typeof v.label === 'string'
+        && v.label.length >= 1 && v.label.length <= 80 && record(v.user) && uuid(v.user.id) && (!selected.actor || v.user.id === selected.actor)
+        && typeof v.user.name === 'string' && typeof v.user.email === 'string' && v.user.email.includes('@') && date(v.expires_at)
+        && nativeMembershipSyncMatches(v.membership_sync) && (v.workspace === null || nativeWorkspaceMatches(v.workspace))
+        && (!selected.workspace || record(v.workspace) && v.workspace.id === selected.workspace);
+}
+function page(v, user, number) {
+    return record(v) && uuid(v.user_id) && (!user || v.user_id === user) && v.page === number && integer(v.count)
+        && typeof v.page_size === 'number' && Number.isSafeInteger(v.page_size) && v.page_size >= 1 && v.page_size <= 100
+        && Array.isArray(v.results) && v.results.length <= v.page_size;
+}
+export function nativeWorkspacesMatch(v, user, query, number = 1) {
+    return page(v, user, number) && uuid(v.native_session_id) && v.query === query.trim() && nativeMembershipSyncMatches(v.membership_sync)
+        && v.results.every(nativeWorkspaceMatches) && new Set(v.results.map(one => record(one) ? one.id : null)).size === v.results.length;
+}
+export function nativeOrganizationsMatch(v, subject, query = '', number = 1, selected = '', user) {
+    return page(v, user, number) && v.schema === 'firedrill.native-organizations.v1'
+        && typeof v.workos_user_id === 'string' && /^user_[A-Za-z0-9]{1,120}$/.test(v.workos_user_id) && v.workos_user_id === subject
+        && v.query === query.trim() && v.organization_id === selected && nativeMembershipSyncMatches(v.membership_sync)
+        && (v.grant_organization_id === null || typeof v.grant_organization_id === 'string' && /^org_[A-Za-z0-9]{1,120}$/.test(v.grant_organization_id))
+        && v.results.every(one => record(one) && uuid(one.id) && typeof one.name === 'string'
+            && typeof one.workos_organization_id === 'string' && /^org_[A-Za-z0-9]{1,120}$/.test(one.workos_organization_id))
+        && new Set(v.results.map(one => record(one) ? one.id : null)).size === v.results.length
+        && new Set(v.results.map(one => record(one) ? one.workos_organization_id : null)).size === v.results.length;
+}
+export function nativeDevicesMatch(v, user, query, number = 1) {
+    return page(v, user, number) && v.query === query.trim() && v.results.every(one => record(one) && uuid(one.id) && typeof one.label === 'string'
+        && date(one.created_at) && date(one.last_seen_at) && typeof one.state === 'string' && ['active', 'revoked', 'expired'].includes(one.state)
+        && ['terminal', 'mcp'].includes(String(one.kind)) && typeof one.can_reauthorize === 'boolean'
+        && (!one.can_reauthorize || one.kind === 'mcp' && one.state === 'revoked'))
+        && new Set(v.results.map(one => record(one) ? one.id : null)).size === v.results.length;
+}
+export function nativeRevokedMatches(v, user, session) {
+    return record(v) && v.revoked === true && uuid(v.user_id) && uuid(v.session_id) && (!user || v.user_id === user) && (!session || v.session_id === session);
+}

package/dist/contracts/onboarding-contracts.js

@@ -0,0 +1,32 @@
+const uuid = (value) => typeof value === 'string' && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(value);
+const text = (value, max) => typeof value === 'string' && value.length <= max && !/[\x00-\x1f\x7f]/.test(value);
+const date = (value) => value === null || typeof value === 'string' && value.length <= 64 && Number.isFinite(Date.parse(value));
+export function onboardingMatches(value, actor) {
+    if (!value || !uuid(value.user_id) || actor && value.user_id !== actor || !Number.isSafeInteger(value.revision) || value.revision < 0
+        || !['new', 'in_progress', 'skipped', 'completed'].includes(value.state) || ![1, 2].includes(value.step)
+        || !date(value.skipped_at) || !date(value.completed_at) || !value.values || !value.catalog)
+        return false;
+    const catalog = value.catalog;
+    const choices = (rows) => Array.isArray(rows) && rows.length > 0 && rows.length <= 40
+        && rows.every(row => row && text(row.value, 32) && /^[a-z][a-z_]*$/.test(row.value) && text(row.label, 80) && row.label.length > 0)
+        && new Set(rows.map(row => row.value)).size === rows.length;
+    if (!choices(catalog.roles) || !choices(catalog.industries) || !Array.isArray(catalog.country_codes) || catalog.country_codes.length > 250
+        || catalog.country_codes.length < 1 || !catalog.country_codes.every(code => typeof code === 'string' && /^[A-Z]{2}$/.test(code))
+        || new Set(catalog.country_codes).size !== catalog.country_codes.length)
+        return false;
+    const profile = value.values;
+    if (!text(profile.display_name, 255) || !text(profile.organization_name, 120) || !text(profile.website, 253)
+        || !text(profile.role, 32) || profile.role !== '' && !catalog.roles.some(row => row.value === profile.role)
+        || !text(profile.industry, 32) || profile.industry !== '' && !catalog.industries.some(row => row.value === profile.industry)
+        || !text(profile.country_code, 2) || profile.country_code !== '' && !catalog.country_codes.includes(profile.country_code))
+        return false;
+    const request = value.workspace_request;
+    return request === null || !!request && uuid(request.request_key) && text(request.name, 120) && request.name.length > 0
+        && ['pending', 'creating', 'uncertain', 'completed'].includes(request.state) && (request.workspace_id === null || uuid(request.workspace_id))
+        && typeof request.workspace_available === 'boolean' && (!request.workspace_available || request.workspace_id !== null);
+}
+export function onboardingRead(value, actor) {
+    if (!onboardingMatches(value, actor))
+        throw new Error('The optional setup response did not match this account. Reload saved details before continuing.');
+    return value;
+}

package/dist/contracts/performance-contracts.js

@@ -0,0 +1,85 @@
+export function targetUsageMatches(value, campaign, execution, model) {
+    return value.campaign_id === campaign && value.execution_id === (execution ?? null) && value.model_filter === model
+        && value.results.every(row => (!execution || row.execution_id === execution)
+            && completionMatches(row.response_metadata) && (row.failure_category === null || Object.hasOwn(failures, row.failure_category)));
+}
+const stops = new Set(['end_turn', 'tool_use', 'max_tokens', 'stop_sequence', 'pause_turn', 'refusal', 'model_context_window_exceeded']);
+const finishes = new Set(['stop', 'length', 'tool_calls', 'function_call', 'content_filter']);
+const statuses = new Set(['queued', 'in_progress', 'completed', 'incomplete', 'failed', 'cancelled']);
+const incomplete = new Set(['max_output_tokens', 'content_filter']);
+const nullableEnum = (value, choices) => value === null || typeof value === 'string' && choices.has(value);
+function completionMatches(value) {
+    if (value === null)
+        return true;
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const one = value;
+    return Object.keys(one).length === 9 && one.schema === 'firedrill.target-model-completion.v1'
+        && (one.transport === 'json' || one.transport === 'sse') && typeof one.response_observed === 'boolean'
+        && (one.stream_complete === null || typeof one.stream_complete === 'boolean') && (one.transport !== 'json' || one.stream_complete === null)
+        && nullableEnum(one.stop_reason, stops) && nullableEnum(one.response_status, statuses) && nullableEnum(one.incomplete_reason, incomplete)
+        && Array.isArray(one.finish_reasons) && one.finish_reasons.length <= 16 && new Set(one.finish_reasons).size === one.finish_reasons.length
+        && one.finish_reasons.every(reason => typeof reason === 'string' && finishes.has(reason)) && typeof one.unrecognized_reason === 'boolean';
+}
+const failures = {
+    request_rejected: 'The provider rejected the model request.', credential_rejected: 'The provider rejected the saved model credential.',
+    account_rejected: 'The model account did not allow this request.', model_unavailable: 'The requested model was unavailable to this account.',
+    rate_limited: 'The model account reached a provider rate limit.', access_removed: 'Model access ended or could not be confirmed.',
+    connection_interrupted: 'The model connection was interrupted.', transport_unavailable: 'The model transport did not finish this request.',
+    stream_unavailable: 'The model response stream did not finish.', unclassified: 'The model request failed without a classified completion reason.',
+};
+export function targetCompletionAttention(row) {
+    const value = row.response_metadata;
+    return row.failure_category !== null || !!value && (value.stream_complete === false || value.stop_reason === 'max_tokens'
+        || value.stop_reason === 'model_context_window_exceeded' || value.stop_reason === 'refusal' || value.finish_reasons.includes('length')
+        || value.finish_reasons.includes('content_filter') || value.response_status === 'incomplete' || value.response_status === 'failed'
+        || value.response_status === 'cancelled');
+}
+export function targetCompletionNotes(row) {
+    const notes = row.failure_category ? [failures[row.failure_category]] : [];
+    const value = row.response_metadata;
+    if (!value)
+        return notes;
+    if (!value.response_observed)
+        return [...notes, 'No structured provider response was observed.'];
+    if (value.transport === 'sse' && value.stream_complete === false)
+        notes.push('The provider stream did not reach its completion marker.');
+    if (value.stop_reason === 'max_tokens' || value.finish_reasons.includes('length') || value.incomplete_reason === 'max_output_tokens')
+        notes.push('The provider stopped at the output limit.');
+    else if (value.stop_reason === 'model_context_window_exceeded')
+        notes.push('The provider stopped at its context-window limit.');
+    else if (value.stop_reason === 'refusal' || value.finish_reasons.includes('content_filter') || value.incomplete_reason === 'content_filter')
+        notes.push('The provider reported a refusal or content restriction.');
+    else if (value.response_status === 'failed')
+        notes.push('The provider reported a failed response.');
+    else if (value.response_status === 'cancelled')
+        notes.push('The provider reported a canceled response.');
+    else if (value.response_status === 'incomplete')
+        notes.push('The provider reported an incomplete response.');
+    else if (value.stop_reason === 'pause_turn')
+        notes.push('The provider paused this turn.');
+    else if (value.stop_reason === 'tool_use' || value.finish_reasons.some(reason => reason === 'tool_calls' || reason === 'function_call'))
+        notes.push('The provider returned a tool request.');
+    else if (value.stop_reason || value.finish_reasons.length || value.response_status === 'completed')
+        notes.push('The provider ended this response.');
+    else
+        notes.push('The provider did not report a recognized completion reason.');
+    return notes;
+}
+function selectedRunsMatch(value, current, baseline, kind) {
+    return current !== baseline && value.current.id === current && value.baseline.id === baseline && value.kind === kind;
+}
+function cohortMatches(value, kind) {
+    return kind === 'model' ? value.requested_model !== null && value.operation !== null
+        : value.requested_model === null && value.operation === null && value.provider === null;
+}
+export function performanceGroupsMatch(value, current, baseline, kind) {
+    return selectedRunsMatch(value, current, baseline, kind) && value.results.every(row => cohortMatches(row.cohort, kind));
+}
+export function performanceObservationsMatch(value, selected) {
+    return selectedRunsMatch(value, selected.current, selected.baseline, selected.kind) && cohortMatches(value.cohort, selected.kind)
+        && value.cohort.id === selected.cohort && (!selected.identity || value.cohort.identity === selected.identity)
+        && value.results.every(row => (selected.side === 'both' || row.side === selected.side)
+            && (row.side === 'current' ? row.campaign_id === selected.current
+                : row.side === 'baseline' && row.campaign_id === selected.baseline));
+}

package/dist/contracts/planning-contracts.js

@@ -0,0 +1,81 @@
+import { executionDriverMatches } from './agent-execution-contracts.js';
+export function planningDriverMatches(value) {
+    return Boolean(value && typeof value === 'object' && !Array.isArray(value) && 'execution_driver' in value
+        && (value.execution_driver === null || executionDriverMatches(value.execution_driver)));
+}
+export function planningDefaultsMatch(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const row = value;
+    const object = (one) => Boolean(one && typeof one === 'object' && !Array.isArray(one));
+    const positive = (one) => typeof one === 'number' && Number.isSafeInteger(one) && one >= 1;
+    if (!object(row.defaults) || !object(row.capacity) || row.plan !== null && !object(row.plan))
+        return false;
+    const defaults = row.defaults, capacity = row.capacity, plan = row.plan;
+    if (object(plan) && typeof plan.current !== 'boolean')
+        return false;
+    const fields = ['repetitions', 'parallelism', 'trial_seconds'];
+    if (Object.keys(defaults).sort().join(',') !== [...fields].sort().join(',')
+        || !['max_trials', ...fields.map(key => `max_${key}`)].every(key => positive(capacity[key])))
+        return false;
+    for (const key of fields) {
+        const amount = defaults[key];
+        if (!positive(amount))
+            return false;
+        if (object(plan) && plan.current === true) {
+            if (amount !== plan[key])
+                return false;
+        }
+        else if (amount > Number(capacity[`max_${key}`]))
+            return false;
+    }
+    return true;
+}
+export function isNativeSetupReceipt(value) {
+    return Boolean(value && typeof value === 'object' && 'schema' in value && value.schema === 'firedrill.native-simulation-setup.v1');
+}
+export function planMatchesRequest(plan, request) {
+    if (!plan || !plan.selector || !plan.execution || !Array.isArray(plan.selector.ids)
+        || !Array.isArray(plan.selector.excluded) || typeof plan.selector.query !== 'string')
+        return false;
+    const ids = (values) => [...new Set(values ?? [])].map(value => value.toLowerCase()).sort().join(',');
+    const execution = request.execution ?? { location: 'managed' };
+    return /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(plan.id)
+        && /^[a-f0-9]{64}$/.test(plan.recipe_sha256) && Number.isSafeInteger(plan.revision) && plan.revision >= 1
+        && Number.isSafeInteger(plan.scenario_count) && plan.scenario_count >= 1
+        && Number.isSafeInteger(plan.planned_trials) && plan.planned_trials === plan.scenario_count * request.repetitions
+        && plan.selector.mode === request.selector.mode && plan.selector.query === (request.selector.query ?? '').trim()
+        && ids(plan.selector.ids) === ids(request.selector.ids) && ids(plan.selector.excluded) === ids(request.selector.excluded)
+        && plan.repetitions === request.repetitions && plan.parallelism === request.parallelism && plan.trial_seconds === request.trial_seconds
+        && plan.execution.location === execution.location
+        && (execution.location === 'managed' || plan.execution.location === 'local' && plan.execution.grant_id === execution.grant_id)
+        && plan.run_saved_criteria === (request.run_saved_criteria ?? true)
+        && plan.share_evaluation_explanation === (Boolean(request.share_evaluation_explanation) && plan.automatic_criteria > 0)
+        && plan.record_browser === (request.record_browser ?? false) && plan.record_voice === (request.record_voice ?? false)
+        && plan.record_desktop === (request.record_desktop ?? false)
+        && plan.acknowledge_desktop_screen_content === (request.acknowledge_desktop_screen_content ?? false)
+        && plan.driver_input_authorized === (request.driver_input_authorized ?? false)
+        && plan.driver_contract_sha256 === (request.driver_input_authorized ? request.driver_contract_sha256 : null)
+        && plan.mask_browser_form_values === request.mask_browser_form_values
+        && (request.dataset_id === undefined || plan.dataset_id === request.dataset_id)
+        && (!request.share_dataset_with_device || plan.dataset_download_approved_for_actor)
+        && plan.application_checkpoint_id === (request.application_checkpoint_id ?? null)
+        && plan.acknowledge_fresh_world_state === (request.acknowledge_fresh_world_state ?? false)
+        && (!request.share_application_checkpoint_with_device || plan.application_checkpoint_download_approved_for_actor)
+        && plan.coordinated_checkpoint_id === (request.coordinated_checkpoint_id ?? null)
+        && plan.acknowledge_supported_checkpoint_scope === (request.acknowledge_supported_checkpoint_scope ?? false)
+        && (!request.share_coordinated_checkpoint_with_device || plan.coordinated_checkpoint_download_approved_for_actor)
+        && (plan.coordinated_checkpoint_id !== null ? plan.application_checkpoint_id === null && !plan.acknowledge_fresh_world_state
+            && plan.application_continuation?.checkpoint_id === plan.coordinated_checkpoint_id
+            && plan.application_continuation.controlled_services_included === true && plan.application_continuation.dependencies === 'coordinated_native_checkpoint'
+            && ['owned_postgres_rows_sequences_and_sql_clock', 'declared_sqlite_files', 'owned_postgres_and_declared_sqlite_files'].includes(plan.application_continuation.native_scope)
+            && ['wall', 'not_configured'].includes(plan.application_continuation.clock_mode)
+            && plan.acknowledge_supported_checkpoint_scope && !plan.dataset_id && plan.mode !== 'external_shared'
+            : plan.application_checkpoint_id === null ? plan.application_continuation === null
+                : plan.application_continuation?.checkpoint_id === plan.application_checkpoint_id
+                    && plan.application_continuation.controlled_services_included === false
+                    && plan.application_continuation.continuity === 'application_supported_new_process'
+                    && plan.application_continuation.dependencies === 'fresh_prepared_state'
+                    && plan.acknowledge_fresh_world_state && !plan.dataset_id && plan.mode !== 'external_shared')
+        && (!request.external_effects || plan.real_access_approved_for_actor && plan.mode === 'external_shared');
+}

package/dist/contracts/real-operation-contracts.js

@@ -0,0 +1,30 @@
+const uuid = (v) => typeof v === 'string' && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
+const date = (v) => typeof v === 'string' && Number.isFinite(Date.parse(v));
+const integer = (v) => typeof v === 'number' && Number.isSafeInteger(v) && v >= 0;
+const scope = (v, s) => !!v && v.viewer_id === s.viewer && v.workspace_id === s.workspace && v.world_id === s.world;
+export function realOperationMatches(value, selected, operation, reviewKey) {
+    if (!scope(value, selected) || !uuid(value.id) || operation !== undefined && value.id !== operation || !uuid(value.request_key)
+        || typeof value.operation !== 'string' || typeof value.service_name !== 'string' || value.service_id !== null && !uuid(value.service_id)
+        || !['simulation', 'manual_session', 'agent_startup', 'other'].includes(value.activity) || !['read', 'write'].includes(value.effect)
+        || !['admitted', 'dispatching', 'response', 'not_sent', 'uncertain'].includes(value.outcome)
+        || value.http_status !== null && (!integer(value.http_status) || value.http_status < 100 || value.http_status > 599)
+        || !integer(value.request_bytes) || value.response_bytes !== null && !integer(value.response_bytes)
+        || !integer(value.configuration_revision) || value.configuration_revision < 1 || value.service_revision !== null && (!integer(value.service_revision) || value.service_revision < 1)
+        || !date(value.created_at) || [value.dispatch_started_at, value.finished_at, value.review_available_at, value.reviewed_at, value.response_delivery_confirmed_at].some(v => v !== null && !date(v))
+        || typeof value.can_review !== 'boolean' || typeof value.requires_review !== 'boolean' || typeof value.review_available !== 'boolean'
+        || value.review_available && (!value.can_review || !value.requires_review) || value.requires_review !== (value.review_available_at !== null)
+        || value.external_state_resettable !== false || value.business_outcome !== (value.outcome === 'not_sent' ? 'not_dispatched' : 'not_established'))
+        return false;
+    const receipt = value.review_receipt;
+    return reviewKey ? !!receipt && receipt.request_key === reviewKey && receipt.operation_id === value.id
+        && ['accepted', 'not_received', 'reviewed_by_another_request'].includes(receipt.state)
+        && (receipt.state === 'not_received' ? value.reviewed_at === null : value.reviewed_at !== null) : receipt === null;
+}
+export function realOperationsMatch(value, selected, filters = {}) {
+    return scope(value, selected) && value.query === (filters.query ?? '').trim() && value.outcome === (filters.outcome ?? '').trim()
+        && value.service_id === (filters.service ?? null) && value.request_key === (filters.request ?? null) && value.review === (filters.review ?? '')
+        && value.page === (filters.page ?? 1) && integer(value.count) && integer(value.page_size) && value.page_size >= 1 && value.page_size <= 100
+        && Array.isArray(value.results) && value.results.length <= value.page_size && new Set(value.results.map(row => row.id)).size === value.results.length
+        && value.results.every(row => realOperationMatches(row, selected) && (!filters.outcome || row.outcome === filters.outcome)
+            && (!filters.request || row.request_key === filters.request) && (filters.review !== 'required' || row.requires_review));
+}

package/dist/contracts/recommendation-contracts.js

@@ -0,0 +1,54 @@
+const uuid = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
+const requestKey = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,127}$/;
+const states = new Set(['queued', 'preparing', 'submitted', 'succeeded', 'not_assessable', 'failed', 'unknown', 'unavailable']);
+export function recommendationBatchMatches(value, scope, id) {
+    return !!value && uuid.test(value.id) && (!id || value.id === id) && value.workspace_id === scope.workspace
+        && value.world_id === scope.world && (!scope.turn || value.turn_id === scope.turn) && (!scope.actor || value.actor_id === scope.actor)
+        && uuid.test(value.turn_id) && uuid.test(value.actor_id) && Number.isSafeInteger(value.proposal_count)
+        && value.proposal_count >= 1 && value.proposal_count <= 64 && !!value.states && typeof value.states === 'object' && !Array.isArray(value.states)
+        && Object.entries(value.states).every(([key, count]) => states.has(key) && Number.isSafeInteger(count) && count >= 0)
+        && Object.values(value.states).reduce((sum, count) => sum + count, 0) <= value.proposal_count
+        && value.pending === ['queued', 'preparing', 'submitted'].some(key => (value.states[key] ?? 0) > 0);
+}
+export function recommendationBatchesMatch(value, scope) {
+    return value.workspace_id === scope.workspace && value.world_id === scope.world && value.turn_id === scope.turn
+        && value.results.every(row => recommendationBatchMatches(row, scope));
+}
+export function recommendationTurnsMatch(value, scope, turn) {
+    return value.workspace_id === scope.workspace && value.world_id === scope.world && value.turn_filter === (turn ?? null)
+        && value.results.every(row => uuid.test(row.id) && uuid.test(row.response_id) && (!turn || row.id === turn)
+            && Number.isSafeInteger(row.proposal_count) && row.proposal_count >= 0);
+}
+export function recommendationDetailMatches(value, scope, id) {
+    return recommendationBatchMatches(value, scope, id) && value.results.length <= value.proposal_count
+        && new Set(value.results.map(row => row.proposal_id)).size === value.results.length
+        && value.results.every(row => uuid.test(row.id) && uuid.test(row.proposal_id) && states.has(row.state)
+            && row.requested_model === value.model && row.provider === 'Firedrill'
+            && (row.state !== 'unavailable' || row.result === null && row.evidence_refs.length === 0)
+            && (row.result === null || !!row.model && ['succeeded', 'not_assessable'].includes(row.state)
+                && row.result.levels.length === value.rubric.levels.length && row.result.levels.every((level, index) => level === value.rubric.levels[index])
+                && (row.state === 'succeeded' ? row.result.status === 'assessable' && row.result.score !== null
+                    && Number.isFinite(row.result.score) && row.result.score >= 0 && row.result.score <= row.result.levels.length - 1
+                    : row.result.score === null)));
+}
+export function recommendationReceiptMatches(value, scope, key) {
+    return !!value && value.schema === 'firedrill.recommendation-request-receipt.v1' && value.workspace_id === scope.workspace
+        && value.world_id === scope.world && value.turn_id === scope.turn && value.actor_id === scope.actor
+        && requestKey.test(value.request_key) && (key === undefined || value.request_key === key)
+        && ['accepted', 'withdrawn', 'not_received'].includes(value.state) && typeof value.resource_available === 'boolean'
+        && (value.resource_available ? value.state === 'accepted' && value.batch_id !== null && uuid.test(value.batch_id) : value.batch_id === null);
+}
+export function recommendationAcceptanceMatches(value, batch, scope, key) {
+    return recommendationReceiptMatches(value, scope, key) && recommendationBatchMatches(batch, scope)
+        && value.state === 'accepted' && value.resource_available && value.batch_id === batch.id;
+}
+export function recommendationRequestsMatch(value, selected) {
+    return value.workspace_id === selected.workspace && value.world_id === selected.world && value.turn_id === selected.turn
+        && value.actor_id === selected.actor && value.filters.q === selected.query.trim() && value.filters.status === selected.status
+        && value.results.every(row => recommendationReceiptMatches(row, selected) && row.state !== 'not_received'
+            && (!selected.status || row.state === selected.status));
+}
+export function recommendationRecoveryMatches(value, scope, batch, key) {
+    return value.workspace_id === scope.workspace && value.world_id === scope.world && value.actor_id === scope.actor
+        && value.batch_id === batch && value.request_key === key && Number.isSafeInteger(value.requested) && value.requested >= 0 && value.requested <= 64;
+}

package/dist/contracts/report-contracts.js

@@ -0,0 +1 @@
+export {};