firedrill-run 2.2.5 → 3.0.1

package/dist/cli/src/native/cloud-resources.js

@@ -0,0 +1,942 @@
+// Consumers for the root-released native cloud authoring producers (see the
+// root plan20-contracts document): the private native library (personas,
+// scenarios, evaluations), native world declarations bound to a registered
+// descriptor revision, and effect-free apply-plan review. None of these
+// provision, quote, reserve funding or execute anything. Producer source exists
+// but is not deployed or qualified, so these calls are wiring-ready, not
+// verified. Definitions are validated by the service; the client only bounds
+// size and shape and never invents fields.
+import { api } from '../auth.js';
+import { creditApprovalPolicy } from './credit-approval.js';
+import { CliError } from '../http.js';
+import { ENDING_REASONS, SHA256_HEX } from './contracts.js';
+import { registrationKey } from './registration.js';
+export const LIBRARY_KINDS = ['persona', 'scenario', 'evaluation'];
+export const LIBRARY_PARAMETERS_SCHEMA = 'firedrill.native-library-parameters.v1';
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const RESPONSE_LIMIT = 4 * 1024 * 1024;
+/** Matches the producer's aggregate document ceiling; larger definitions are refused before upload. */
+const DEFINITION_LIMIT = 2 * 1024 * 1024;
+const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const unconfirmed = (what) => new CliError('native_response_unconfirmed', `The ${what} response could not be confirmed. Nothing local changed; rerun with the same request key to read the saved result.`);
+const scoped = (scope, signal) => ({ actor: scope.owner, workspace: scope.workspace, signal, maximumResponseBytes: RESPONSE_LIMIT });
+function id(value, label) {
+    if (typeof value !== 'string' || !UUID.test(value))
+        throw new CliError('arguments_invalid', `Use the ${label} id exactly as Firedrill printed it. Nothing was submitted.`, 2);
+    return value.toLowerCase();
+}
+function revisionNumber(value) {
+    if (!Number.isSafeInteger(value) || value < 0 || value > 2147483646) {
+        throw new CliError('native_revision_invalid', 'Use the current revision number (0 for a new resource). Nothing was submitted.', 2);
+    }
+    return value;
+}
+function definitionObject(value, label) {
+    if (!object(value))
+        throw new CliError('request_file_invalid', `The ${label} definition must be a JSON object. Nothing was submitted.`, 2);
+    if (Buffer.byteLength(JSON.stringify(value)) > DEFINITION_LIMIT) {
+        throw new CliError('request_file_invalid', `The ${label} definition exceeds ${DEFINITION_LIMIT} bytes. Nothing was submitted.`, 2);
+    }
+    return value;
+}
+function page(raw, row, what) {
+    if (!object(raw) || typeof raw.count !== 'number' || !Array.isArray(raw.results))
+        throw unconfirmed(what);
+    return { count: raw.count, page: typeof raw.page === 'number' ? raw.page : null,
+        next: typeof raw.next === 'string' ? raw.next : null, previous: typeof raw.previous === 'string' ? raw.previous : null,
+        results: raw.results.map(row) };
+}
+function pageQuery(value) {
+    const number = value ?? 1;
+    if (!Number.isSafeInteger(number) || number < 1)
+        throw new CliError('native_page_invalid', 'Use a page number of 1 or more.', 2);
+    return `page=${number}`;
+}
+// ---------------------------------------------------------------------------
+// Library.
+/** Root's typed parameter declaration (1-16 items, each with exactly its seven fields), or null. */
+function parameterSchema(value) {
+    if (value === null)
+        return true;
+    if (!object(value) || Object.keys(value).sort().join(',') !== 'parameters,schema' || value.schema !== LIBRARY_PARAMETERS_SCHEMA
+        || !Array.isArray(value.parameters) || value.parameters.length < 1 || value.parameters.length > 16)
+        return false;
+    const names = new Set();
+    return value.parameters.every((item) => {
+        if (!object(item) || Object.keys(item).sort().join(',') !== 'default,maximum,minimum,name,path,required,type'
+            || typeof item.name !== 'string' || !item.name || names.has(item.name) || typeof item.required !== 'boolean'
+            || (item.type !== 'string' && item.type !== 'integer') || !Array.isArray(item.path) || item.path.length < 1 || item.path.length > 2
+            || typeof item.path[0] !== 'string' || (item.path.length === 2 && !Number.isSafeInteger(item.path[1]))
+            || !Number.isSafeInteger(item.maximum) || item.maximum < 0
+            || (item.type === 'string' ? item.minimum !== null : !Number.isSafeInteger(item.minimum) || item.minimum > item.maximum)
+            || (item.required ? item.default !== null
+                : item.type === 'string' ? typeof item.default !== 'string' : !Number.isSafeInteger(item.default)))
+            return false;
+        names.add(item.name);
+        return true;
+    });
+}
+/** A bound copy's exact values and the source version they were fixed from, or null. */
+function parameterBinding(value) {
+    return value === null || (object(value) && Object.keys(value).sort().join(',') === 'declaration_digest,schema,source_digest,source_revision_id,values'
+        && value.schema === LIBRARY_PARAMETERS_SCHEMA && typeof value.declaration_digest === 'string' && SHA256_HEX.test(value.declaration_digest)
+        && typeof value.source_revision_id === 'string' && UUID.test(value.source_revision_id)
+        && typeof value.source_digest === 'string' && SHA256_HEX.test(value.source_digest) && object(value.values)
+        && Object.values(value.values).every((one) => typeof one === 'string' || Number.isSafeInteger(one)));
+}
+export function libraryRow(withDefinition) {
+    return (value) => {
+        if (!object(value) || typeof value.id !== 'string' || !UUID.test(value.id) || typeof value.resource_id !== 'string'
+            || !UUID.test(value.resource_id) || value.origin !== 'native_library' || !LIBRARY_KINDS.includes(value.kind)
+            || typeof value.name !== 'string' || typeof value.revision !== 'number' || !Number.isSafeInteger(value.revision)
+            || typeof value.digest !== 'string' || !SHA256_HEX.test(value.digest) || (value.state !== 'draft' && value.state !== 'archived')
+            || typeof value.current !== 'boolean' || typeof value.created_at !== 'string'
+            || (value.forked_from !== null && (typeof value.forked_from !== 'string' || !UUID.test(value.forked_from)))
+            || typeof value.owner_workspace_id !== 'string' || !UUID.test(value.owner_workspace_id)
+            || typeof value.can_edit !== 'boolean' || typeof value.can_use !== 'boolean'
+            || (withDefinition && (!object(value.definition) || !parameterSchema(value.parameter_schema) || !parameterBinding(value.parameter_binding)))
+            || (!withDefinition && ('parameter_schema' in value || 'parameter_binding' in value)))
+            throw unconfirmed('library');
+        return value;
+    };
+}
+/** Whether this version belongs to another workspace and is visible here only through a sharing grant. */
+export const sharedHere = (scope, row) => row.owner_workspace_id.toLowerCase() !== scope.workspace.toLowerCase();
+/** Lists current library resources (newest first). Archived resources only when asked. */
+export async function listLibrary(scope, input) {
+    const params = new URLSearchParams(pageQuery(input.page));
+    if (input.kind !== undefined) {
+        if (!LIBRARY_KINDS.includes(input.kind))
+            throw new CliError('arguments_invalid', `Use --kind ${LIBRARY_KINDS.join('|')}.`, 2);
+        params.set('kind', input.kind);
+    }
+    params.set('state', input.archived ? 'archived' : 'draft');
+    if (input.search !== undefined) {
+        if ([...input.search].length > 120)
+            throw new CliError('arguments_invalid', 'Use a search prefix of up to 120 characters.', 2);
+        params.set('q', input.search);
+    }
+    const raw = await api(`/api/workspaces/${scope.workspace}/native-library?${params}`, scoped(scope, input.signal));
+    return page(raw, libraryRow(false), 'library');
+}
+/** Reads one exact library version with its definition. */
+export async function getLibraryRevision(scope, input) {
+    const raw = await api(`/api/workspaces/${scope.workspace}/native-library/revisions/${id(input.revisionId, 'library version')}`, scoped(scope, input.signal));
+    return libraryRow(true)(raw);
+}
+/** Lists a library resource's immutable versions, newest first. */
+export async function libraryHistory(scope, input) {
+    const raw = await api(`/api/workspaces/${scope.workspace}/native-library/${id(input.resourceId, 'library resource')}/revisions?${pageQuery(input.page)}`, scoped(scope, input.signal));
+    return page(raw, libraryRow(false), 'library history');
+}
+/**
+ * Records one library change as a new immutable version:
+ * - save without resourceId creates a resource (expectedRevision 0);
+ * - save/archive/restore with resourceId changes it at expectedRevision;
+ * - fork copies an exact version (forkFrom) into a new private resource with the given definition.
+ * The request key makes a retry replay the same change instead of creating another.
+ * parameterSchema applies to save and fork only: omitted keeps the existing (or
+ * forked) declaration, null removes it, and an object declares new parameters.
+ */
+export async function changeLibrary(scope, input) {
+    if (!LIBRARY_KINDS.includes(input.kind))
+        throw new CliError('arguments_invalid', `Use --kind ${LIBRARY_KINDS.join('|')}. Nothing was submitted.`, 2);
+    const expected = revisionNumber(input.expectedRevision);
+    const resource = input.resourceId === undefined ? null : id(input.resourceId, 'library resource');
+    const replacing = input.action === 'save' || input.action === 'fork';
+    if (input.action === 'fork' ? resource !== null || input.forkFrom === undefined || expected !== 0 : input.forkFrom !== undefined)
+        throw new CliError('arguments_invalid', 'Fork an exact library version into a new resource with revision 0. Nothing was submitted.', 2);
+    if ((input.action === 'archive' || input.action === 'restore') && (resource === null || input.definition !== undefined))
+        throw new CliError('arguments_invalid', 'Archive or restore an existing resource without a definition. Nothing was submitted.', 2);
+    if (input.action === 'save' && resource === null && expected !== 0)
+        throw new CliError('native_revision_invalid', 'A new library resource starts at revision 0. Nothing was submitted.', 2);
+    if (input.parameterSchema !== undefined && !replacing) {
+        throw new CliError('arguments_invalid', 'Declare or remove parameters only when saving or forking a definition. Nothing was submitted.', 2);
+    }
+    if (input.parameterSchema !== undefined && input.parameterSchema !== null && !parameterSchema(input.parameterSchema)) {
+        throw new CliError('request_file_invalid', `Parameters must be {"schema": "${LIBRARY_PARAMETERS_SCHEMA}", "parameters": [...]} with 1-16 items, each with exactly `
+            + 'name, path, type (string or integer), minimum, maximum, required and default. Nothing was submitted.', 2);
+    }
+    const requestKey = registrationKey(input.requestKey);
+    const body = {
+        request_key: requestKey, action: input.action, expected_revision: expected, kind: input.kind,
+        definition: replacing ? definitionObject(input.definition, input.kind) : null,
+        fork_from: input.action === 'fork' ? id(input.forkFrom, 'library version') : null,
+        ...input.parameterSchema === undefined ? {} : { parameter_schema: input.parameterSchema },
+    };
+    const path = resource === null ? `/api/workspaces/${scope.workspace}/native-library`
+        : `/api/workspaces/${scope.workspace}/native-library/${resource}/revisions`;
+    const row = libraryRow(true)(await api(path, { method: 'POST', body, ...scoped(scope, input.signal) }));
+    if (row.kind !== input.kind || (resource !== null && row.resource_id !== resource)
+        || row.state !== (input.action === 'archive' ? 'archived' : 'draft'))
+        throw unconfirmed('library change');
+    return { ...row, request_key: requestKey };
+}
+// ---------------------------------------------------------------------------
+// Native worlds.
+export function worldRow(withDefinition) {
+    return (value) => {
+        if (!object(value) || typeof value.id !== 'string' || !UUID.test(value.id) || typeof value.world_id !== 'string' || !UUID.test(value.world_id)
+            || typeof value.revision !== 'number' || !Number.isSafeInteger(value.revision) || value.revision < 1
+            || typeof value.native_descriptor_id !== 'string' || !UUID.test(value.native_descriptor_id)
+            || typeof value.definition_digest !== 'string' || !SHA256_HEX.test(value.definition_digest)
+            || typeof value.created_at !== 'string' || value.state !== 'draft' || value.execution_started !== false
+            || (withDefinition && !object(value.definition)))
+            throw unconfirmed('world');
+        return value;
+    };
+}
+/**
+ * Saves a native world declaration bound to an exact registered descriptor
+ * revision. Without worldId it creates the world (expectedRevision 0);
+ * with worldId it records the next revision. Nothing is provisioned or run.
+ */
+export async function saveNativeWorld(scope, input) {
+    const expected = revisionNumber(input.expectedRevision);
+    const world = input.worldId === undefined ? null : id(input.worldId, 'world');
+    if (world === null && expected !== 0)
+        throw new CliError('native_revision_invalid', 'A new world starts at revision 0. Nothing was submitted.', 2);
+    const requestKey = registrationKey(input.requestKey);
+    const body = {
+        request_key: requestKey, agent_id: id(input.agentId, 'agent'), native_descriptor_id: id(input.descriptorRevisionId, 'descriptor revision'),
+        expected_revision: expected, definition: definitionObject(input.definition, 'world'),
+    };
+    const path = world === null ? `/api/workspaces/${scope.workspace}/native-worlds`
+        : `/api/workspaces/${scope.workspace}/worlds/${world}/native-revisions`;
+    const row = worldRow(true)(await api(path, { method: 'POST', body, ...scoped(scope, input.signal) }));
+    if ((world !== null && row.world_id !== world) || row.revision !== expected + 1 || row.native_descriptor_id !== body.native_descriptor_id)
+        throw unconfirmed('world change');
+    return { ...row, request_key: requestKey };
+}
+/** Lists a native world's declaration revisions, newest first. */
+export async function worldHistory(scope, input) {
+    const raw = await api(`/api/workspaces/${scope.workspace}/worlds/${id(input.worldId, 'world')}/native-revisions?${pageQuery(input.page)}`, scoped(scope, input.signal));
+    return page(raw, worldRow(false), 'world history');
+}
+/** Reads one exact native world revision with its definition. */
+export async function getWorldRevision(scope, input) {
+    const raw = await api(`/api/workspaces/${scope.workspace}/worlds/${id(input.worldId, 'world')}/native-revisions/${id(input.revisionId, 'world revision')}`, scoped(scope, input.signal));
+    return worldRow(true)(raw);
+}
+/** The newest revision of a native world (what `plan --world` reviews by default). */
+export async function latestWorldRevision(scope, input) {
+    const history = await worldHistory(scope, { worldId: input.worldId, page: 1, signal: input.signal });
+    const newest = history.results[0];
+    if (!newest)
+        throw new CliError('native_world_empty', 'This world has no saved declaration yet. Save one with firedrill world save.', 2);
+    return newest;
+}
+// ---------------------------------------------------------------------------
+// Apply-plan review (effect-free).
+function planRow(value) {
+    if (!object(value) || typeof value.id !== 'string' || !UUID.test(value.id) || typeof value.world_revision_id !== 'string'
+        || !UUID.test(value.world_revision_id) || typeof value.review_digest !== 'string' || !SHA256_HEX.test(value.review_digest)
+        || typeof value.expires_at !== 'string' || typeof value.expired !== 'boolean' || !object(value.review)
+        || value.review.schema !== 'firedrill.native-apply-review.v1' || !Array.isArray(value.review.gaps)
+        || !Array.isArray(value.review.real_dependency_grants) || !Array.isArray(value.review.required_gates))
+        throw unconfirmed('plan review');
+    return value;
+}
+/**
+ * Creates an effect-free review of one exact world revision. The digest pins
+ * the revision the caller read; a changed world is refused by the service.
+ */
+export async function createApplyPlan(scope, input) {
+    if (!SHA256_HEX.test(input.worldDigest))
+        throw new CliError('arguments_invalid', 'Use the world digest exactly as Firedrill printed it. Nothing was submitted.', 2);
+    const requestKey = registrationKey(input.requestKey);
+    const revision = id(input.worldRevisionId, 'world revision');
+    const row = planRow(await api(`/api/workspaces/${scope.workspace}/native-apply-plans`, {
+        method: 'POST', body: { request_key: requestKey, world_revision_id: revision, world_digest: input.worldDigest }, ...scoped(scope, input.signal),
+    }));
+    if (row.world_revision_id !== revision)
+        throw unconfirmed('plan review');
+    return { ...row, request_key: requestKey };
+}
+/** Reads a saved plan review (including whether it expired). */
+export async function getApplyPlan(scope, input) {
+    return planRow(await api(`/api/workspaces/${scope.workspace}/native-apply-plans/${id(input.planId, 'plan')}`, scoped(scope, input.signal)));
+}
+const safeUnits = (value) => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
+/** A sanity bound on quoted cloud-work components; which components exist is root's to say. */
+const MAX_FUNDING_COMPONENTS = 32;
+function fundingRow(value, planId, reviewDigest) {
+    const invalid = () => unconfirmed('cloud-work estimate');
+    if (!object(value) || value.schema !== 'firedrill.native-funding-bundle.v1' || value.reserves_credits !== false
+        || typeof value.digest !== 'string' || !SHA256_HEX.test(value.digest) || !safeUnits(value.maximum_units)
+        || typeof value.denomination !== 'string' || !/^[\x20-\x7e]{1,32}$/.test(value.denomination)
+        || !safeUnits(value.credit_scale) || value.credit_scale < 1 || typeof value.expires_at !== 'string'
+        || !Number.isFinite(Date.parse(value.expires_at)) || !Array.isArray(value.quotes) || value.quotes.length < 1
+        // Root's quoted components are its own list (it changes with billing); only bounded here, never enumerated.
+        || value.quotes.length > MAX_FUNDING_COMPONENTS)
+        throw invalid();
+    const bundle = value;
+    let total = 0;
+    const quotes = bundle.quotes.map((quote) => {
+        const scope = object(quote) ? quote.scope : null;
+        if (!object(quote) || typeof quote.id !== 'string' || !UUID.test(quote.id) || !object(scope)
+            || scope.plan_id !== planId || scope.review_digest !== reviewDigest || scope.local_target_compute_charged !== false
+            || typeof scope.component !== 'string' || !/^[a-z_]{1,32}$/.test(scope.component)
+            || !safeUnits(quote.maximum_units) || !safeUnits(quote.estimated_units)
+            || quote.denomination !== bundle.denomination || quote.credit_scale !== bundle.credit_scale)
+            throw invalid();
+        total += quote.maximum_units;
+        // Participant quotes always freeze their admission limits; no other component carries them.
+        const limits = object(scope.participant_limits) ? scope.participant_limits : null;
+        const participant_limits = limits && safeUnits(limits.max_steps) && safeUnits(limits.max_input_bytes_per_step)
+            && safeUnits(limits.max_output_tokens_per_step) && typeof limits.model === 'string' && /^[\x20-\x7e]{1,128}$/.test(limits.model)
+            ? { max_steps: limits.max_steps, max_input_bytes_per_step: limits.max_input_bytes_per_step,
+                max_output_tokens_per_step: limits.max_output_tokens_per_step, model: limits.model } : null;
+        if ((scope.component === 'participants') !== (participant_limits !== null) || (!participant_limits && scope.participant_limits !== undefined))
+            throw invalid();
+        // Funding v3: isolated custom-tool quotes freeze their run, cleanup and resource ceilings; no other component carries them.
+        const isolated = object(scope.isolated_limits) ? scope.isolated_limits : null;
+        const resources = isolated && object(isolated.resources) ? isolated.resources : null;
+        const positive = (value) => safeUnits(value) && value >= 1;
+        const isolated_limits = isolated && resources && positive(isolated.duration_seconds) && safeUnits(isolated.cleanup_seconds)
+            && positive(resources.cpu_units) && positive(resources.memory_mb) && positive(resources.disk_gb)
+            ? { duration_seconds: isolated.duration_seconds, cleanup_seconds: isolated.cleanup_seconds,
+                cpu_units: resources.cpu_units, memory_mb: resources.memory_mb, disk_gb: resources.disk_gb } : null;
+        if ((scope.component === 'isolated_runtime') !== (isolated_limits !== null) || (!isolated_limits && scope.isolated_limits !== undefined))
+            throw invalid();
+        return { ...creditApprovalPolicy(quote), id: quote.id, component: scope.component, maximum_units: quote.maximum_units, estimated_units: quote.estimated_units,
+            participant_limits, isolated_limits };
+    });
+    if (total !== bundle.maximum_units || new Set(quotes.map((quote) => quote.component)).size !== quotes.length)
+        throw invalid();
+    // Both reservation fields or neither; the initial hold is exactly the baseline's estimate.
+    const policy = bundle.reservation_policy ?? null, initial = bundle.initial_reservation_units ?? null;
+    if ((policy === null) !== (initial === null) || (policy !== null && policy !== 'baseline_then_admitted_drills')
+        || (initial !== null && (!safeUnits(initial) || initial > bundle.maximum_units
+            || initial !== quotes.filter((quote) => quote.component === 'baseline').reduce((sum, quote) => sum + quote.estimated_units, 0))))
+        throw invalid();
+    return { digest: bundle.digest, maximum_units: bundle.maximum_units, denomination: bundle.denomination,
+        credit_scale: bundle.credit_scale, expires_at: bundle.expires_at, quotes,
+        reservation_policy: policy, initial_reservation_units: initial };
+}
+/** Bounded cloud-work estimate for an exact, current, gap-free plan review. Reserves nothing. */
+export async function estimatePlanFunding(scope, input) {
+    const planId = id(input.planId, 'plan');
+    if (!SHA256_HEX.test(input.reviewDigest))
+        throw new CliError('arguments_invalid', 'Use the review digest exactly as Firedrill printed it. Nothing was requested.', 2);
+    const requestKey = registrationKey(input.requestKey);
+    const raw = await api(`/api/workspaces/${scope.workspace}/native-apply-plans/${planId}/funding`, {
+        method: 'POST', body: { request_key: requestKey, review_digest: input.reviewDigest }, ...scoped(scope, input.signal),
+    });
+    return { ...fundingRow(raw, planId, input.reviewDigest), request_key: requestKey };
+}
+export const NATIVE_EXECUTION_STATES = ['offered', 'accepted', 'provisioning', 'starting', 'ready', 'executing', 'paused',
+    'reconciling', 'draining', 'rejected', 'expired', 'completed', 'failed', 'cancelled'];
+export const NATIVE_OBSERVATION_KINDS = ['driver.started', 'conversation.observed', 'action.observed', 'state.observed',
+    'driver.completed', 'driver.failed', 'driver.cancelled'];
+const STATE_NAME = /^[a-z][a-z_]{0,23}$/;
+const uuidField = (value) => typeof value === 'string' && UUID.test(value);
+const nullableUuid = (value) => value === null || uuidField(value);
+const count = (value, min = 0) => typeof value === 'number' && Number.isSafeInteger(value) && value >= min;
+const time = (value) => typeof value === 'string' && Number.isFinite(Date.parse(value));
+function nativeCampaignRow(detail) {
+    return (value) => {
+        if (!object(value) || !uuidField(value.campaign_id) || !uuidField(value.world_revision_id) || !uuidField(value.descriptor_id)
+            || !count(value.planned_drills) || !count(value.allocated_drills) || typeof value.state !== 'string' || !STATE_NAME.test(value.state)
+            || !time(value.created_at) || !time(value.updated_at))
+            throw unconfirmed('native campaign');
+        if (detail && (!count(value.scenario_count) || !count(value.repetitions, 1) || !count(value.max_parallel, 1)
+            || !['unknown', 'per_drill', 'serialized'].includes(value.reset)))
+            throw unconfirmed('native campaign');
+        return value;
+    };
+}
+function slotRow(campaignId) {
+    return (value) => {
+        if (!object(value) || !uuidField(value.slot_id) || value.campaign_id !== campaignId || !uuidField(value.scenario_id)
+            || !count(value.position, 1) || !count(value.repetition, 1) || typeof value.state !== 'string' || !STATE_NAME.test(value.state)
+            || !nullableUuid(value.assignment_id) || !nullableUuid(value.drill_id)
+            || (value.assignment_id === null) !== (value.drill_id === null))
+            throw unconfirmed('drill slot');
+        return value;
+    };
+}
+function executionRow(detail) {
+    return (value) => {
+        if (!object(value) || !uuidField(value.assignment_id) || !uuidField(value.drill_id) || !uuidField(value.device_id)
+            || !uuidField(value.descriptor_id) || !uuidField(value.world_revision_id)
+            || !NATIVE_EXECUTION_STATES.includes(value.state) || !time(value.created_at)
+            || (value.accepted_at !== null && !time(value.accepted_at)) || (value.terminal_at !== null && !time(value.terminal_at))
+            || (detail && (!count(value.retained_observation_count) || !count(value.retained_artifact_count))))
+            throw unconfirmed('native execution');
+        return value;
+    };
+}
+const observationRow = (value) => {
+    if (!object(value) || typeof value.event_id !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$/.test(value.event_id)
+        || !count(value.sequence, 1) || !NATIVE_OBSERVATION_KINDS.includes(value.kind)
+        || !count(value.elapsed_ms) || !uuidField(value.artifact_id))
+        throw unconfirmed('observation');
+    return value;
+};
+const artifactRow = (value) => {
+    if (!object(value) || !uuidField(value.artifact_id) || typeof value.role !== 'string' || !/^[a-z][a-z._-]{0,63}$/.test(value.role)
+        || typeof value.media_kind !== 'string' || value.media_kind.length > 128 || !count(value.size)
+        || typeof value.sha256 !== 'string' || !SHA256_HEX.test(value.sha256) || !time(value.committed_at))
+        throw unconfirmed('evidence record');
+    return value;
+};
+/** Query string from defined values; page numbers go through the shared page check. */
+function readQuery(page, input) {
+    const params = new URLSearchParams(pageQuery(page));
+    for (const [key, value] of Object.entries(input))
+        if (value !== undefined)
+            params.set(key, String(value));
+    return params.toString();
+}
+function stateFilter(value, allowed) {
+    if (value === undefined)
+        return undefined;
+    if (!STATE_NAME.test(value) || (allowed && !allowed.includes(value))) {
+        throw new CliError('arguments_invalid', allowed ? `Use --status ${allowed.join('|')}.` : 'Use a lowercase state name.', 2);
+    }
+    return value;
+}
+/** Native campaigns in the workspace, oldest first. */
+export async function listNativeCampaigns(scope, input) {
+    const query = readQuery(input.page, { state: stateFilter(input.state),
+        world_revision_id: input.worldRevisionId === undefined ? undefined : id(input.worldRevisionId, 'world revision') });
+    return page(await api(`/api/workspaces/${scope.workspace}/native/campaigns?${query}`, scoped(scope, input.signal)), nativeCampaignRow(false), 'native campaigns');
+}
+/** One native campaign with its declared execution shape. A CliError with httpStatus 404 means it is not a native campaign here. */
+export async function getNativeCampaign(scope, input) {
+    const campaignId = id(input.campaignId, 'campaign');
+    const row = nativeCampaignRow(true)(await api(`/api/workspaces/${scope.workspace}/native/campaigns/${campaignId}`, scoped(scope, input.signal)));
+    if (row.campaign_id !== campaignId)
+        throw unconfirmed('native campaign');
+    return row;
+}
+/** Allocated drill slots in position order (100 per page). */
+export async function listNativeCampaignSlots(scope, input) {
+    const campaignId = id(input.campaignId, 'campaign');
+    const query = readQuery(input.page, { page_size: 100, state: stateFilter(input.state),
+        scenario_id: input.scenarioId === undefined ? undefined : id(input.scenarioId, 'scenario') });
+    return page(await api(`/api/workspaces/${scope.workspace}/native/campaigns/${campaignId}/slots?${query}`, scoped(scope, input.signal)), slotRow(campaignId), 'drill slots');
+}
+/** Native executions (assignments), newest first (100 per page). */
+export async function listNativeExecutions(scope, input) {
+    const query = readQuery(input.page, { page_size: 100, state: stateFilter(input.state, NATIVE_EXECUTION_STATES),
+        world_revision_id: input.worldRevisionId === undefined ? undefined : id(input.worldRevisionId, 'world revision') });
+    return page(await api(`/api/workspaces/${scope.workspace}/native/assignments?${query}`, scoped(scope, input.signal)), executionRow(false), 'native executions');
+}
+/** One execution's state and retained evidence counts (not quality or assessment results). */
+export async function getNativeExecution(scope, input) {
+    const assignmentId = id(input.assignmentId, 'assignment');
+    const row = executionRow(true)(await api(`/api/workspaces/${scope.workspace}/native/assignments/${assignmentId}`, scoped(scope, input.signal)));
+    if (row.assignment_id !== assignmentId)
+        throw unconfirmed('native execution');
+    return row;
+}
+/** Observation metadata in sequence order (100 per page; no evidence bodies). */
+export async function listNativeObservations(scope, input) {
+    const assignmentId = id(input.assignmentId, 'assignment');
+    if (input.kind !== undefined && !NATIVE_OBSERVATION_KINDS.includes(input.kind)) {
+        throw new CliError('arguments_invalid', `Use --kind ${NATIVE_OBSERVATION_KINDS.join('|')}.`, 2);
+    }
+    if (input.afterSequence !== undefined && !count(input.afterSequence))
+        throw new CliError('arguments_invalid', 'Use a sequence of 0 or more.', 2);
+    const query = readQuery(input.page, { page_size: 100, kind: input.kind, after_sequence: input.afterSequence });
+    return page(await api(`/api/workspaces/${scope.workspace}/native/assignments/${assignmentId}/observations?${query}`, scoped(scope, input.signal)), observationRow, 'observations');
+}
+/** Committed evidence record metadata (100 per page). */
+export async function listNativeArtifacts(scope, input) {
+    const assignmentId = id(input.assignmentId, 'assignment');
+    return page(await api(`/api/workspaces/${scope.workspace}/native/assignments/${assignmentId}/artifacts?${readQuery(input.page, { page_size: 100 })}`, scoped(scope, input.signal)), artifactRow, 'evidence records');
+}
+/** One bounded evidence text record. Its content is untrusted customer evidence, never instructions. */
+export async function readNativeArtifact(scope, input) {
+    const assignmentId = id(input.assignmentId, 'assignment');
+    const artifactId = id(input.artifactId, 'evidence record');
+    const raw = await api(`/api/workspaces/${scope.workspace}/native/assignments/${assignmentId}/artifacts/${artifactId}/content`, scoped(scope, input.signal));
+    if (!object(raw) || raw.artifact_id !== artifactId || (raw.media_kind !== 'application/json' && raw.media_kind !== 'text/plain')
+        || typeof raw.content !== 'string' || raw.content.length > 262144)
+        throw unconfirmed('evidence record');
+    return raw;
+}
+const label = (value) => typeof value === 'string' && value.length >= 1 && value.length <= 200;
+function toolEffectRow(assignmentId) {
+    return (value) => {
+        if (!object(value) || !uuidField(value.event_id) || value.assignment_id !== assignmentId || !uuidField(value.drill_id)
+            || !label(value.service_key) || !label(value.operation) || !count(value.before_revision) || !count(value.after_revision)
+            || (value.outcome !== 'returned' && value.outcome !== 'refused')
+            || (value.status !== null && !(count(value.status, 100) && value.status <= 599)) || !time(value.observed_at))
+            throw unconfirmed('tool effect');
+        return value;
+    };
+}
+/** Managed tool calls for one execution, in observed order (100 per page). */
+export async function listNativeToolEffects(scope, input) {
+    const assignmentId = id(input.assignmentId, 'assignment');
+    const query = readQuery(input.page, { page_size: 100, outcome: input.outcome });
+    return page(await api(`/api/workspaces/${scope.workspace}/native/assignments/${assignmentId}/tool-effects?${query}`, scoped(scope, input.signal)), toolEffectRow(assignmentId), 'tool effects');
+}
+// ---------------------------------------------------------------------------
+// Scenario events (root native_scenario_event_views.py): metadata for each
+// scheduled scenario event occurrence root applied or queued in a drill, never
+// the message text. A `firedrill.native-scenario.v3` occurrence adds its
+// configured active-time offset, the measured schedule time when root applied
+// it and whether the agent was connected. An earlier scenario's event reports
+// occurrence 0, no timed fields and the agent present.
+export const SCENARIO_EVENT_KINDS = ['user_message', 'dependency_unavailable', 'dependency_restored'];
+export const SCENARIO_EVENT_STATES = ['pending', 'applied', 'consumed'];
+const SCENARIO_EVENT_KEYS = ['after_active_ms', 'after_turn', 'causal_action_id', 'causal_conversation_id', 'continuation_until',
+    'created_at', 'dependency', 'event_id', 'generation', 'kind', 'observed_active_ms', 'observed_completed_turns', 'occurrence',
+    'position', 'receipt_digest', 'scenario_id', 'state', 'target_present'].join(',');
+const ACTIVE_LIMIT_MS = 86_400_000;
+function scenarioEventRow(value) {
+    const nullable = (item, check) => item === null || check(item);
+    if (!object(value) || Object.keys(value).sort().join(',') !== SCENARIO_EVENT_KEYS
+        || !uuidField(value.event_id) || !uuidField(value.scenario_id) || !count(value.generation, 1)
+        || !count(value.position) || value.position > 63 || !count(value.occurrence) || value.occurrence > 63
+        || !nullable(value.after_active_ms, item => count(item) && item <= ACTIVE_LIMIT_MS)
+        || !nullable(value.observed_active_ms, item => count(item)) || typeof value.target_present !== 'boolean'
+        || !nullable(value.continuation_until, time)
+        || !SCENARIO_EVENT_KINDS.includes(value.kind) || !SCENARIO_EVENT_STATES.includes(value.state)
+        || typeof value.dependency !== 'string' || value.dependency.length > 120 || (value.kind === 'user_message') !== (value.dependency === '')
+        || !count(value.after_turn) || value.after_turn > 1000
+        || !count(value.observed_completed_turns) || value.observed_completed_turns > 1000
+        || !nullable(value.causal_action_id, uuidField) || !nullable(value.causal_conversation_id, uuidField)
+        || typeof value.receipt_digest !== 'string' || !SHA256_HEX.test(value.receipt_digest) || !time(value.created_at)
+        // Only a timed event repeats; a timed occurrence carries the measured time it was applied at.
+        || (value.occurrence !== 0 && value.after_active_ms === null)
+        || (value.after_active_ms !== null && value.observed_active_ms === null)
+        // The agent is away only inside an approved continuation, which always names its cutoff.
+        || value.target_present !== (value.continuation_until === null)
+        || (!value.target_present && value.observed_active_ms === null))
+        throw unconfirmed('scenario event');
+    return value;
+}
+/** A drill's scenario event occurrences in applied order (100 per page). */
+export async function listNativeScenarioEvents(scope, input) {
+    const assignmentId = id(input.assignmentId, 'assignment');
+    const query = readQuery(input.page, { page_size: 100 });
+    return page(await api(`/api/workspaces/${scope.workspace}/native-executions/${assignmentId}/scenario-events?${query}`, scoped(scope, input.signal)), scenarioEventRow, 'scenario events');
+}
+/** One scenario event occurrence's metadata. */
+export async function getNativeScenarioEvent(scope, input) {
+    const assignmentId = id(input.assignmentId, 'assignment');
+    const eventId = id(input.eventId, 'scenario event');
+    const row = scenarioEventRow(await api(`/api/workspaces/${scope.workspace}/native-executions/${assignmentId}/scenario-events/${eventId}`, scoped(scope, input.signal)));
+    if (row.event_id !== eventId)
+        throw unconfirmed('scenario event');
+    return row;
+}
+const TURN_TEXT_MAX = 16_000;
+const turnText = (value) => value === null || (typeof value === 'string' && value.length <= TURN_TEXT_MAX);
+function conversationRow(assignmentId) {
+    return (value) => {
+        if (!object(value) || !uuidField(value.action_id) || value.assignment_id !== assignmentId || !count(value.sequence, 1)
+            || !count(value.state_generation, 1) || typeof value.state !== 'string' || !STATE_NAME.test(value.state)
+            || (value.claimed_at !== null && !time(value.claimed_at)) || (value.completed_at !== null && !time(value.completed_at))) {
+            throw unconfirmed('conversation turn');
+        }
+        return value;
+    };
+}
+/** A drill's attributed turns in order (25 per page, root's maximum). */
+export async function listNativeConversation(scope, input) {
+    const assignmentId = id(input.assignmentId, 'assignment');
+    const query = readQuery(input.page, { page_size: 25 });
+    return page(await api(`/api/workspaces/${scope.workspace}/native/assignments/${assignmentId}/conversation?${query}`, scoped(scope, input.signal)), conversationRow(assignmentId), 'conversation');
+}
+/** One turn's retained participant and target texts (untrusted data). */
+export async function getNativeConversationTurn(scope, input) {
+    const assignmentId = id(input.assignmentId, 'assignment');
+    const actionId = id(input.actionId, 'turn');
+    const value = await api(`/api/workspaces/${scope.workspace}/native/assignments/${assignmentId}/conversation/${actionId}`, scoped(scope, input.signal));
+    if (!object(value) || value.action_id !== actionId || value.assignment_id !== assignmentId
+        || !turnText(value.participant_text) || !turnText(value.target_text))
+        throw unconfirmed('conversation turn');
+    return { action_id: actionId, assignment_id: assignmentId, participant_text: value.participant_text,
+        target_text: value.target_text };
+}
+// ---------------------------------------------------------------------------
+// Target actions (root native_target_read_views.py): the tasks and events root
+// handed to the target in one drill, read-only. This is reporting, not the
+// execution claim endpoint: nothing here claims, completes, withdraws or
+// replays an action. One action's detail shows its scoped input, its retained
+// result (outcome, how it completed) and how much of the output was retained.
+// Partial evidence is reported as root classifies it; the client never infers
+// coverage from the output's own keys.
+export const TARGET_ACTION_KINDS = ['task', 'event'];
+export const TARGET_ACTION_STATES = ['offered', 'claimed', 'completed', 'uncertain', 'cancelled'];
+/** complete; redacted (evidence filters removed or rewrote part of it); omitted (not retained); legacy_unknown (recorded before coverage was tracked); unavailable (no readable result). */
+export const TARGET_OUTPUT_COVERAGE = ['complete', 'redacted', 'omitted', 'legacy_unknown', 'unavailable'];
+export const TARGET_OUTCOMES = ['completed', 'failed', 'cancelled'];
+/** target_returned; delivery_acknowledged (an event reached the target: not proof the work finished); correlated_result (matched to a later observed result). */
+export const TARGET_COMPLETIONS = ['target_returned', 'delivery_acknowledged', 'correlated_result'];
+const TARGET_UNAVAILABLE = ['not_recorded', 'evidence_unavailable'];
+const TARGET_ACTION_PAGE = 25;
+const TARGET_ACTION_KEYS = ['action_id', 'assignment_id', 'claimed_at', 'completed_at', 'delivery_note', 'kind', 'sequence', 'state'];
+const TARGET_ACTION_LIST_KEYS = [...TARGET_ACTION_KEYS].sort().join(',');
+const TARGET_ACTION_DETAIL_KEYS = [...TARGET_ACTION_KEYS, 'completion', 'input', 'input_available', 'outcome', 'output',
+    'output_available', 'output_coverage', 'provenance', 'unavailable_reason'].sort().join(',');
+const among = (values, value) => typeof value === 'string' && values.includes(value);
+function targetActionRow(assignmentId, detail) {
+    return (value) => {
+        if (!object(value) || Object.keys(value).sort().join(',') !== (detail ? TARGET_ACTION_DETAIL_KEYS : TARGET_ACTION_LIST_KEYS)
+            || !uuidField(value.action_id) || value.assignment_id !== assignmentId || !among(TARGET_ACTION_KINDS, value.kind)
+            || !count(value.sequence, 1) || !among(TARGET_ACTION_STATES, value.state)
+            || (value.claimed_at !== null && !time(value.claimed_at)) || (value.completed_at !== null && !time(value.completed_at))
+            || (value.delivery_note !== null && value.delivery_note !== 'device_declared_not_delivered'))
+            throw unconfirmed('target action');
+        if (!detail)
+            return value;
+        // A readable result carries its outcome and completion and no unavailable reason; without one, root says why.
+        const result = value.output_coverage !== 'unavailable';
+        if (typeof value.input_available !== 'boolean' || value.input_available !== (value.input !== null)
+            || !among(TARGET_OUTPUT_COVERAGE, value.output_coverage) || typeof value.output_available !== 'boolean'
+            || value.output_available !== (value.output_coverage === 'complete' || value.output_coverage === 'redacted')
+            || ((!result || value.output_coverage === 'omitted') && value.output !== null)
+            || result !== among(TARGET_OUTCOMES, value.outcome) || (!result && value.outcome !== null)
+            || result !== among(TARGET_COMPLETIONS, value.completion) || (!result && value.completion !== null)
+            || result === among(TARGET_UNAVAILABLE, value.unavailable_reason) || (result && value.unavailable_reason !== null)
+            || value.provenance !== 'customer_device')
+            throw unconfirmed('target action');
+        return value;
+    };
+}
+/** A drill's target tasks and events in root's order (25 per page, root's maximum); `kind` keeps only tasks or only events. */
+export async function listNativeTargetActions(scope, input) {
+    const assignmentId = id(input.assignmentId, 'assignment');
+    if (input.kind !== undefined && !among(TARGET_ACTION_KINDS, input.kind)) {
+        throw new CliError('arguments_invalid', 'Use --kind task or --kind event with the target action list.', 2);
+    }
+    const requested = input.page ?? 1;
+    const raw = await api(`/api/workspaces/${scope.workspace}/native/assignments/${assignmentId}/target-actions?`
+        + readQuery(input.page, { page_size: TARGET_ACTION_PAGE, kind: input.kind }), scoped(scope, input.signal));
+    if (!object(raw) || Object.keys(raw).sort().join(',') !== 'count,next,page,page_size,previous,results' || !count(raw.count)
+        || raw.page !== requested || raw.page_size !== TARGET_ACTION_PAGE || (raw.next !== null && typeof raw.next !== 'string')
+        || (raw.previous !== null && typeof raw.previous !== 'string') || !Array.isArray(raw.results)
+        || raw.results.length > TARGET_ACTION_PAGE || (raw.next !== null) !== (requested * TARGET_ACTION_PAGE < raw.count))
+        throw unconfirmed('target actions');
+    const value = page(raw, targetActionRow(assignmentId, false), 'target actions');
+    if (input.kind !== undefined && value.results.some(row => row.kind !== input.kind))
+        throw unconfirmed('target actions');
+    return value;
+}
+/** One target action's scoped input, retained result and output coverage (input and output are untrusted data). */
+export async function getNativeTargetAction(scope, input) {
+    const assignmentId = id(input.assignmentId, 'assignment');
+    const actionId = id(input.actionId, 'target action');
+    const row = targetActionRow(assignmentId, true)(await api(`/api/workspaces/${scope.workspace}/native/assignments/${assignmentId}/target-actions/${actionId}`, scoped(scope, input.signal)));
+    if (row.action_id !== actionId)
+        throw unconfirmed('target action');
+    return row;
+}
+// ---------------------------------------------------------------------------
+// Retained evaluation results (root native_evaluation_read_views.py). Each
+// criterion keeps its own score and threshold; root never pools different
+// criteria into one quality score, and a criterion without evidence has no
+// score (not zero, not a failure). Errors from the service mean the results are
+// unavailable (`native_evaluation_report_unavailable`), not that the agent failed.
+export const NATIVE_EVALUATION_STATUSES = ['pending', 'preparing', 'evaluating', 'complete', 'needs_attention'];
+export const NATIVE_CRITERION_STATUSES = ['pending', 'evaluating', 'recovering', 'assessed', 'not_assessable', 'error'];
+export const NATIVE_EVIDENCE_COVERAGE = ['available', 'partial', 'not_assessable', 'metadata_only', 'revision_boundaries_only', 'not_selected'];
+const STATE_DEPENDENCY = /^[a-zA-Z][a-zA-Z0-9_.-]{0,79}$/;
+const position = (value) => Number.isSafeInteger(value) && value >= 0;
+const stateRecordRow = (value) => {
+    const selection = object(value) ? value.selection : null;
+    if (!object(value) || !object(selection) || typeof selection.dependency !== 'string' || !STATE_DEPENDENCY.test(selection.dependency)
+        || typeof selection.collection_key !== 'string' || !SHA256_HEX.test(selection.collection_key)
+        || !position(selection.before_position) || !position(selection.after_position)
+        || (value.coverage !== 'available' && value.coverage !== 'not_assessable')
+        || !(value.reason === null || value.reason === undefined || (typeof value.reason === 'string' && /^[a-z_]{1,64}$/.test(value.reason)))
+        || !(value.before_checkpoint_id === null || value.before_checkpoint_id === undefined || uuidField(value.before_checkpoint_id))
+        || !(value.after_checkpoint_id === null || value.after_checkpoint_id === undefined || uuidField(value.after_checkpoint_id))
+        || value.per_call_difference !== false)
+        return null;
+    const checkpoint = (one) => (typeof one === 'string' ? one.toLowerCase() : null);
+    return {
+        selection: { dependency: selection.dependency, collection_key: selection.collection_key,
+            before_position: selection.before_position, after_position: selection.after_position },
+        coverage: value.coverage, reason: typeof value.reason === 'string' ? value.reason : null,
+        before_checkpoint_id: checkpoint(value.before_checkpoint_id), after_checkpoint_id: checkpoint(value.after_checkpoint_id),
+        per_call_difference: false,
+    };
+};
+const CHECK_TOKEN = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/;
+const exactCheckRow = (value) => {
+    if (!object(value) || typeof value.key !== 'string' || !CHECK_TOKEN.test(value.key) || typeof value.source !== 'string' || !CHECK_TOKEN.test(value.source)
+        || !(value.service === null || (typeof value.service === 'string' && CHECK_TOKEN.test(value.service)))
+        || !(value.operation === null || (typeof value.operation === 'string' && CHECK_TOKEN.test(value.operation)))
+        || !['eq', 'gte', 'lte'].includes(value.comparison) || !Number.isSafeInteger(value.expected) || value.expected < 0
+        || !(value.observed === null || (Number.isSafeInteger(value.observed) && value.observed >= 0))
+        || !(value.passed === null || typeof value.passed === 'boolean') || (value.passed === null) !== (value.observed === null)
+        || value.coverage !== (value.observed === null ? 'not_assessable' : 'available')
+        || !(value.reason === null || (typeof value.reason === 'string' && /^[a-z_]{1,64}$/.test(value.reason))))
+        return null;
+    return { key: value.key, source: value.source, service: value.service, operation: value.operation,
+        comparison: value.comparison, expected: value.expected, observed: value.observed,
+        passed: value.passed, coverage: value.coverage, reason: value.reason };
+};
+const policyRow = (value) => {
+    if (!object(value) || !uuidField(value.revision_id) || !uuidField(value.policy_id) || typeof value.name !== 'string'
+        || value.name.length < 1 || value.name.length > 1000 || !Number.isSafeInteger(value.version) || value.version < 1
+        || typeof value.sha256 !== 'string' || !SHA256_HEX.test(value.sha256) || typeof value.text_sha256 !== 'string'
+        || !SHA256_HEX.test(value.text_sha256) || !Array.isArray(value.paragraphs) || value.paragraphs.length > 20_000
+        || !value.paragraphs.every((one) => typeof one === 'string' && /^p[0-9]{1,11}$/.test(one)) || value.scope !== 'evaluator_only')
+        return null;
+    return { revision_id: value.revision_id.toLowerCase(), policy_id: value.policy_id.toLowerCase(), name: value.name, version: value.version,
+        sha256: value.sha256, text_sha256: value.text_sha256, paragraphs: value.paragraphs, scope: 'evaluator_only' };
+};
+const score = (value) => typeof value === 'number' && Number.isFinite(value) && value >= 0 && value <= 100;
+const COVERAGE_KEY = /^[a-z][a-z_]{0,63}$/;
+function evaluationReportRow(assignmentId) {
+    return (value) => {
+        // An older root sends neither coverage field; both read as not known.
+        const executionCoverage = object(value) ? value.execution_coverage ?? null : null;
+        const endingReason = object(value) ? value.ending_reason ?? null : null;
+        if (!object(value) || value.assignment_id !== assignmentId || !nullableUuid(value.basis_id)
+            || !NATIVE_EVALUATION_STATUSES.includes(value.status)
+            || ![null, 'complete', 'partial'].includes(executionCoverage)
+            || !(endingReason === null || ENDING_REASONS.includes(endingReason))
+            || (executionCoverage === 'partial' && value.status !== 'needs_attention')
+            || (value.criteria_total !== null && !count(value.criteria_total))
+            || ![value.assessed, value.criteria_met, value.below_threshold, value.not_assessable, value.pending, value.errors].every(one => count(one))
+            || value.quality_score !== null || (value.exact_check !== null && typeof value.exact_check !== 'boolean') || !object(value.coverage)
+            || Object.keys(value.coverage).length > 32
+            || !Object.entries(value.coverage).every(([key, one]) => COVERAGE_KEY.test(key)
+                && NATIVE_EVIDENCE_COVERAGE.includes(one)))
+            throw unconfirmed('evaluation report');
+        const row = { ...value, execution_coverage: executionCoverage, ending_reason: endingReason };
+        // Root's counts partition the criteria; an inconsistent report is not shown as a result. With no criteria
+        // the report is either not prepared yet or, after a cleanup-only end, `needs_attention` with nothing evaluated.
+        const partitioned = row.criteria_total === null
+            ? row.assessed + row.not_assessable + row.pending + row.errors + row.criteria_met + row.below_threshold === 0
+                && (row.status === 'needs_attention'
+                    || ((row.status === 'pending' || row.status === 'preparing') && (row.status === 'pending') === (row.basis_id === null)))
+            : row.basis_id !== null && row.assessed + row.not_assessable + row.pending + row.errors === row.criteria_total
+                && row.criteria_met + row.below_threshold === row.assessed;
+        if (!partitioned)
+            throw unconfirmed('evaluation report');
+        return row;
+    };
+}
+/** One criterion result, exactly as root reports it (also used for a reassessment's criteria). */
+export const criterionRow = (value) => {
+    if (!object(value) || !uuidField(value.criterion_id) || typeof value.name !== 'string' || value.name.length < 1 || value.name.length > 1000
+        || !NATIVE_CRITERION_STATUSES.includes(value.status)
+        || !['pending', 'assessable', 'not_assessable'].includes(value.coverage)
+        || (value.quality_score !== null && !score(value.quality_score)) || !score(value.threshold)
+        || (value.threshold_met !== null && typeof value.threshold_met !== 'boolean')
+        || (value.exact_check !== null && typeof value.exact_check !== 'boolean'))
+        throw unconfirmed('criterion result');
+    // Evaluation v2 fields; an older platform sends none of them, which reads as a v1 rubric.
+    const dimension = value.dimension ?? null;
+    const checks = value.exact_checks ?? [];
+    const policies = value.company_policies ?? [];
+    // Absent stays absent: an older platform, or a criterion that declared no state records.
+    const records = value.state_records ?? [];
+    const memory = value.memory ?? null, style = value.style ?? null;
+    if (!(dimension === null || (typeof dimension === 'string' && /^[a-z_]{1,64}$/.test(dimension)))
+        || !Array.isArray(checks) || checks.length > 32 || !Array.isArray(policies) || policies.length > 100
+        || !Array.isArray(records) || records.length > 16
+        || !(memory === null || object(memory)) || !(style === null || object(style)))
+        throw unconfirmed('criterion result');
+    const exactChecks = checks.map(exactCheckRow);
+    const companyPolicies = policies.map(policyRow);
+    const stateRecords = records.map(stateRecordRow);
+    if (exactChecks.some((one) => one === null) || companyPolicies.some((one) => one === null) || stateRecords.some((one) => one === null)
+        || new Set(exactChecks.map((one) => one?.key)).size !== exactChecks.length)
+        throw unconfirmed('criterion result');
+    // Root's summary of the checks: null without checks or when one could not be checked, else whether all passed.
+    const summary = !exactChecks.length || exactChecks.some((one) => one?.passed === null) ? null : exactChecks.every((one) => one?.passed === true);
+    if (value.exact_check !== summary)
+        throw unconfirmed('criterion result');
+    const row = { ...value, dimension, exact_checks: exactChecks, company_policies: companyPolicies, state_records: stateRecords, memory, style };
+    // Only an assessed criterion carries a score, and its threshold result follows from that score.
+    const consistent = row.status === 'assessed'
+        ? row.coverage === 'assessable' && row.quality_score !== null && row.threshold_met === (row.quality_score >= row.threshold)
+        : row.quality_score === null && row.threshold_met === null && row.coverage === (row.status === 'not_assessable' ? 'not_assessable' : 'pending');
+    if (!consistent)
+        throw unconfirmed('criterion result');
+    return { ...row, criterion_id: row.criterion_id.toLowerCase() };
+};
+/** One drill's evaluation report. Takes no query parameters (root refuses filters on this route). */
+export async function getNativeEvaluationReport(scope, input) {
+    const assignmentId = id(input.assignmentId, 'assignment');
+    const raw = await api(`/api/workspaces/${scope.workspace}/native/assignments/${assignmentId}/evaluation-report`, scoped(scope, input.signal));
+    return evaluationReportRow(assignmentId)(object(raw) && typeof raw.assignment_id === 'string' ? { ...raw, assignment_id: raw.assignment_id.toLowerCase() } : raw);
+}
+/** Per-criterion results in the evaluation's criterion order (100 per page; root holds at most 256). */
+export async function listNativeEvaluationCriteria(scope, input) {
+    const assignmentId = id(input.assignmentId, 'assignment');
+    return page(await api(`/api/workspaces/${scope.workspace}/native/assignments/${assignmentId}/evaluation-criteria?${readQuery(input.page, { page_size: 100 })}`, scoped(scope, input.signal)), criterionRow, 'criterion results');
+}
+export async function getNativeCampaignProgress(scope, input) {
+    const campaignId = id(input.campaignId, 'campaign');
+    const raw = await api(`/api/workspaces/${scope.workspace}/native/campaigns/${campaignId}/report`, scoped(scope, input.signal));
+    const rows = object(raw) && Array.isArray(raw.execution_counts) ? raw.execution_counts : null;
+    const valid = object(raw) && rows !== null && typeof raw.campaign_id === 'string' && raw.campaign_id.toLowerCase() === campaignId
+        && count(raw.planned_drills) && count(raw.allocated_drills) && count(raw.unallocated_drills)
+        && rows.length <= 64 && rows.every(row => object(row) && typeof row.state === 'string' && STATE_NAME.test(row.state) && count(row.count, 1));
+    if (!valid)
+        throw unconfirmed('campaign report');
+    const report = raw;
+    const executions = rows.map(row => ({ state: row.state, count: row.count }));
+    // Allocated and unallocated partition the planned drills, and every allocated slot is counted once.
+    if (report.allocated_drills + report.unallocated_drills !== report.planned_drills
+        || new Set(executions.map(row => row.state)).size !== executions.length
+        || executions.reduce((sum, row) => sum + row.count, 0) !== report.allocated_drills)
+        throw unconfirmed('campaign report');
+    return { campaign_id: campaignId, planned_drills: report.planned_drills, allocated_drills: report.allocated_drills,
+        unallocated_drills: report.unallocated_drills, execution_counts: executions };
+}
+const COHORT_DIGEST = /^[A-Za-z0-9:_-]{1,128}$/;
+const cohortRow = (value) => {
+    if (!object(value) || typeof value.cohort_digest !== 'string' || !COHORT_DIGEST.test(value.cohort_digest) || !uuidField(value.criterion_id)
+        || typeof value.criterion_name !== 'string' || value.criterion_name.length < 1 || value.criterion_name.length > 1000 || !score(value.threshold)
+        || ![value.assessed, value.threshold_met, value.below_threshold, value.not_assessable].every(one => count(one))
+        || ![value.average_quality, value.minimum_quality, value.maximum_quality].every(one => one === null || score(one)))
+        throw unconfirmed('quality cohort');
+    const row = value;
+    // Only a scored drill has a threshold result; figures exist exactly when some drill was scored,
+    // and the average lies between the extremes.
+    const scored = row.average_quality !== null && row.minimum_quality !== null && row.maximum_quality !== null;
+    const unscored = row.average_quality === null && row.minimum_quality === null && row.maximum_quality === null;
+    if (row.threshold_met + row.below_threshold !== row.assessed || (row.assessed > 0
+        // A database average can differ from the extremes in the last bits, hence the tolerance.
+        ? !scored || row.minimum_quality - row.average_quality > 1e-6 || row.average_quality - row.maximum_quality > 1e-6
+        : !unscored))
+        throw unconfirmed('quality cohort');
+    return { ...row, criterion_id: row.criterion_id.toLowerCase() };
+};
+/** A campaign's per-criterion quality cohorts, by criterion then cohort (25 per page, as root pages them). */
+export async function listNativeCampaignQuality(scope, input) {
+    const campaignId = id(input.campaignId, 'campaign');
+    return page(await api(`/api/workspaces/${scope.workspace}/native/campaigns/${campaignId}/quality?${readQuery(input.page, { page_size: 25 })}`, scoped(scope, input.signal)), cohortRow, 'campaign quality');
+}
+/** One criterion's result. */
+export async function getNativeEvaluationCriterion(scope, input) {
+    const assignmentId = id(input.assignmentId, 'assignment');
+    const criterionId = id(input.criterionId, 'criterion');
+    const row = criterionRow(await api(`/api/workspaces/${scope.workspace}/native/assignments/${assignmentId}/evaluation-criteria/${criterionId}`, scoped(scope, input.signal)));
+    if (row.criterion_id !== criterionId)
+        throw unconfirmed('criterion result');
+    return row;
+}
+/**
+ * Request cancellation of the caller's native campaign. The same request key
+ * replays the original receipt; a finished campaign is refused (409).
+ */
+export async function cancelNativeCampaign(scope, input) {
+    const campaignId = id(input.campaignId, 'campaign');
+    const requestKey = id(input.requestKey, 'request key');
+    const raw = await api(`/api/workspaces/${scope.workspace}/native/campaigns/${campaignId}/cancel`, { method: 'POST', body: { request_key: requestKey }, ...scoped(scope, input.signal) });
+    if (!object(raw) || raw.campaign_id !== campaignId || raw.request_key !== requestKey || raw.accepted !== true
+        || typeof raw.cleanup_complete !== 'boolean')
+        throw unconfirmed('campaign cancellation');
+    return raw;
+}
+// ---------------------------------------------------------------------------
+// Apply admission and campaign creation (root native_apply_views.py and
+// native_campaign_views.py). Approval reserves the quoted cloud-work credits
+// and queues preparation; queued or provisioning is not ready and never
+// permission to start a target. A campaign allocates drill slots only after
+// preparation is ready, one campaign per preparation; it starts no target either.
+export const NATIVE_APPLY_STATES = ['accepted', 'queued', 'provisioning', 'reconciling', 'ready', 'failed', 'cancelled'];
+function applyOperationRow(value) {
+    const capacity = object(value) ? value.capacity : undefined;
+    if (!object(value) || !uuidField(value.id) || !uuidField(value.plan_id) || !uuidField(value.world_revision_id)
+        || !uuidField(value.request_key) || typeof value.review_digest !== 'string' || !SHA256_HEX.test(value.review_digest)
+        || !NATIVE_APPLY_STATES.includes(value.state) || !count(value.state_revision, 1)
+        || !time(value.created_at) || !time(value.updated_at) || !(value.finished_at === null || time(value.finished_at))
+        || typeof value.failure_code !== 'string' || value.failure_code.length > 64
+        || typeof value.can_request_prepared_cancellation !== 'boolean'
+        || value.can_request_prepared_cancellation && value.state !== 'ready'
+        || value.can_request_unstarted_cancellation !== undefined && typeof value.can_request_unstarted_cancellation !== 'boolean'
+        || value.can_request_unstarted_cancellation === true && value.state !== 'queued'
+        || !(capacity === null || (object(capacity) && typeof capacity.state === 'string' && STATE_NAME.test(capacity.state)
+            && typeof capacity.reason === 'string' && capacity.reason.length <= 200 && typeof capacity.capacity_held === 'boolean'
+            && typeof capacity.retryable === 'boolean')))
+        throw unconfirmed('preparation');
+    return { ...value, id: value.id.toLowerCase(), request_key: value.request_key.toLowerCase(),
+        plan_id: value.plan_id.toLowerCase(), can_request_unstarted_cancellation: value.can_request_unstarted_cancellation === true };
+}
+/**
+ * Approve the exact plan review and budget: root reserves the quoted credits
+ * and queues preparation atomically (201 new, 200 replay of the same key and body).
+ */
+export async function applyNativePlan(scope, input) {
+    const planId = id(input.planId, 'plan');
+    const requestKey = id(input.requestKey, 'request key');
+    if (!SHA256_HEX.test(input.reviewDigest) || !SHA256_HEX.test(input.budgetDigest) || input.quoteIds.length < 1 || input.quoteIds.length > 5) {
+        throw new CliError('arguments_invalid', 'The plan review or cloud-work estimate is incomplete. Nothing was applied.', 2);
+    }
+    const quoteIds = input.quoteIds.map((quote) => id(quote, 'quote'));
+    const row = applyOperationRow(await api(`/api/workspaces/${scope.workspace}/native-apply-operations`, {
+        method: 'POST', body: { request_key: requestKey, plan_id: planId, review_digest: input.reviewDigest, quote_ids: quoteIds,
+            budget_digest: input.budgetDigest, credit_approval: input.creditApproval === true }, ...scoped(scope, input.signal),
+    }));
+    if (row.request_key !== requestKey || row.plan_id !== planId || row.review_digest !== input.reviewDigest)
+        throw unconfirmed('preparation');
+    return row;
+}
+/** One preparation by id, with its current state. */
+export async function getNativeApplyOperation(scope, input) {
+    const operationId = id(input.operationId, 'preparation');
+    const row = applyOperationRow(await api(`/api/workspaces/${scope.workspace}/native-apply-operations/${operationId}`, scoped(scope, input.signal)));
+    if (row.id !== operationId)
+        throw unconfirmed('preparation');
+    return row;
+}
+/**
+ * Cancel a ready preparation that has no campaign. One cancellation exists per
+ * preparation: the same key and review replay the original receipt, a
+ * different key is refused (409 idempotency_conflict).
+ */
+export async function cancelPreparedApply(scope, input) {
+    const operationId = id(input.operationId, 'preparation');
+    const requestKey = id(input.requestKey, 'request key');
+    if (!SHA256_HEX.test(input.reviewDigest))
+        throw new CliError('arguments_invalid', 'The plan review is incomplete. Nothing was cancelled.', 2);
+    const raw = await api(`/api/workspaces/${scope.workspace}/native-apply-operations/${operationId}/cancel-prepared`, {
+        method: 'POST', body: { request_key: requestKey, review_digest: input.reviewDigest }, ...scoped(scope, input.signal),
+    });
+    if (!object(raw) || Object.keys(raw).sort().join(',') !== 'operation_id,physical_cleanup,receipt_digest,state' || raw.operation_id !== operationId
+        || raw.state !== 'cancelled' || typeof raw.receipt_digest !== 'string' || !SHA256_HEX.test(raw.receipt_digest)
+        || raw.physical_cleanup !== 'retained')
+        throw unconfirmed('prepared-world cancellation');
+    return raw;
+}
+/** Cancel only an eligible queued preparation, with the original review and one retained cancellation key. */
+export async function cancelUnstartedApply(scope, input) {
+    const operationId = id(input.operationId, 'preparation');
+    const requestKey = id(input.requestKey, 'request key');
+    if (!SHA256_HEX.test(input.reviewDigest))
+        throw new CliError('arguments_invalid', 'The plan review is incomplete. Nothing was cancelled.', 2);
+    const raw = await api(`/api/workspaces/${scope.workspace}/native-apply-operations/${operationId}/cancel-unstarted`, {
+        method: 'POST', body: { request_key: requestKey, review_digest: input.reviewDigest }, ...scoped(scope, input.signal),
+    });
+    if (!object(raw) || Object.keys(raw).sort().join(',') !== 'operation_id,physical_cleanup,receipt_digest,state' || raw.operation_id !== operationId
+        || raw.state !== 'cancelled' || typeof raw.receipt_digest !== 'string' || !SHA256_HEX.test(raw.receipt_digest)
+        || raw.physical_cleanup !== 'retained')
+        throw unconfirmed('queued preparation cancellation');
+    return raw;
+}
+/** The caller's preparation submitted under `requestKey`, or null when none was retained. */
+export async function findNativeApplyOperation(scope, input) {
+    const requestKey = id(input.requestKey, 'request key');
+    const rows = page(await api(`/api/workspaces/${scope.workspace}/native-apply-operations?request_key=${requestKey}&page=1&page_size=1`, scoped(scope, input.signal)), applyOperationRow, 'preparations');
+    const row = rows.results[0];
+    if (row && row.request_key !== requestKey)
+        throw unconfirmed('preparations');
+    return row ?? null;
+}
+/**
+ * Create the one campaign for a ready preparation: allocates its drill slots
+ * without starting any target (201 new, 200 replay of the same key).
+ */
+export async function createNativeCampaign(scope, input) {
+    const operationId = id(input.operationId, 'preparation');
+    const requestKey = id(input.requestKey, 'request key');
+    return nativeCampaignRow(true)(await api(`/api/workspaces/${scope.workspace}/native/campaigns`, {
+        method: 'POST', body: { operation_id: operationId, request_key: requestKey }, ...scoped(scope, input.signal),
+    }));
+}