agentic-qe 3.15.5 → 3.15.7

package/dist/cli/scheduler/persistent-scheduler.js

@@ -112,12 +112,17 @@ export class PersistentScheduler {
         }
         try {
             const content = fs.readFileSync(this.schedulesPath, 'utf-8');
-            const data = this.parseSchedulesFile(content);
+            const { file: data, skipped } = this.parseSchedulesFile(content);
+            if (skipped.length > 0) {
+                console.warn(`[PersistentScheduler] Skipped ${skipped.length} malformed schedule ` +
+                    `entries in ${this.schedulesPath} (not an object, no id, or duplicate id)`);
+            }
             this.log(`Loaded ${data.schedules.length} schedules`);
             return data.schedules;
         }
         catch (error) {
-            // Handle corrupt file - backup and recreate
+            // Only a genuinely unparseable file gets here (bad JSON, no schedules
+            // array, oversize); malformed entries are disabled or skipped (#991).
             await this.handleCorruptFile(error);
             return [];
         }
@@ -128,7 +133,7 @@ export class PersistentScheduler {
     async saveSchedule(schedule) {
         await this.initialize();
         await this.withFileLock(async () => {
-            const schedules = await this.loadSchedulesUnsafe();
+            const { schedules, skipped } = this.loadForWrite();
             const existingIndex = schedules.findIndex(s => s.id === schedule.id);
             if (existingIndex >= 0) {
                 schedules[existingIndex] = schedule;
@@ -138,7 +143,7 @@ export class PersistentScheduler {
                 schedules.push(schedule);
                 this.log(`Added schedule: ${schedule.id}`);
             }
-            await this.writeSchedules(schedules);
+            await this.writeSchedules(schedules, skipped);
         });
     }
     /**
@@ -147,13 +152,13 @@ export class PersistentScheduler {
     async removeSchedule(id) {
         await this.initialize();
         await this.withFileLock(async () => {
-            const schedules = await this.loadSchedulesUnsafe();
+            const { schedules, skipped } = this.loadForWrite();
             const newSchedules = schedules.filter(s => s.id !== id);
             if (newSchedules.length === schedules.length) {
                 this.log(`Schedule not found: ${id}`);
                 return;
             }
-            await this.writeSchedules(newSchedules);
+            await this.writeSchedules(newSchedules, skipped);
             this.log(`Removed schedule: ${id}`);
         });
     }
@@ -189,15 +194,20 @@ export class PersistentScheduler {
     async markExecuted(id) {
         await this.initialize();
         await this.withFileLock(async () => {
-            const schedules = await this.loadSchedulesUnsafe();
+            const { schedules, skipped } = this.loadForWrite();
             const schedule = schedules.find(s => s.id === id);
             if (!schedule) {
                 throw new Error(`Schedule not found: ${id}`);
             }
             const now = new Date();
             schedule.lastRun = now.toISOString();
-            schedule.nextRun = calculateNextRun(schedule.schedule, now).toISOString();
-            await this.writeSchedules(schedules);
+            // #913: an entry disabled on load (legacy/invalid cron, missing fields)
+            // has no computable next run. Record the run and keep it disabled
+            // instead of throwing from calculateNextRun.
+            if (!schedule.disabledReason) {
+                schedule.nextRun = calculateNextRun(schedule.schedule, now).toISOString();
+            }
+            await this.writeSchedules(schedules, skipped);
             this.log(`Marked executed: ${id}, next run: ${schedule.nextRun}`);
         });
     }
@@ -207,17 +217,22 @@ export class PersistentScheduler {
     async setEnabled(id, enabled) {
         await this.initialize();
         await this.withFileLock(async () => {
-            const schedules = await this.loadSchedulesUnsafe();
+            const { schedules, skipped } = this.loadForWrite();
             const schedule = schedules.find(s => s.id === id);
             if (!schedule) {
                 throw new Error(`Schedule not found: ${id}`);
             }
+            // #913/#991: an entry disabled on load cannot run; say why instead of
+            // failing inside calculateNextRun (or with no cron at all).
+            if (enabled && schedule.disabledReason) {
+                throw new Error(`Cannot enable schedule ${id}: ${schedule.disabledReason}`);
+            }
             schedule.enabled = enabled;
             // If re-enabling, recalculate next run from now
             if (enabled) {
                 schedule.nextRun = calculateNextRun(schedule.schedule, new Date()).toISOString();
             }
-            await this.writeSchedules(schedules);
+            await this.writeSchedules(schedules, skipped);
             this.log(`Set enabled=${enabled}: ${id}`);
         });
     }
@@ -241,7 +256,8 @@ export class PersistentScheduler {
     async clearAll() {
         await this.initialize();
         await this.withFileLock(async () => {
-            await this.writeSchedules([]);
+            const { skipped } = this.loadForWrite();
+            await this.writeSchedules([], skipped);
             this.log('Cleared all schedules');
         });
     }
@@ -262,19 +278,22 @@ export class PersistentScheduler {
     // Private Helper Methods
     // ============================================================================
     /**
-     * Load schedules without acquiring lock (for use within locked context)
+     * Load schedules for a locked read-modify-write. A genuinely unparseable
+     * file is backed up (not removed) first, so the write that follows cannot
+     * silently replace it with fewer schedules.
      */
-    async loadSchedulesUnsafe() {
+    loadForWrite() {
         if (!fs.existsSync(this.schedulesPath)) {
-            return [];
+            return { schedules: [], skipped: [] };
         }
         try {
             const content = fs.readFileSync(this.schedulesPath, 'utf-8');
-            const data = this.parseSchedulesFile(content);
-            return data.schedules;
+            const { file, skipped } = this.parseSchedulesFile(content);
+            return { schedules: file.schedules, skipped };
         }
-        catch {
-            return [];
+        catch (error) {
+            this.backupCorruptFile(error);
+            return { schedules: [], skipped: [] };
         }
     }
     /**
@@ -288,32 +307,53 @@ export class PersistentScheduler {
             throw new Error(`Schedules file exceeds maximum allowed size (${MAX_SCHEDULES_FILE_SIZE / (1024 * 1024)}MB). File is ${(contentSize / (1024 * 1024)).toFixed(2)}MB.`);
         }
         const data = safeJsonParse(content);
-        // Validate structure
-        if (!data.schedules || !Array.isArray(data.schedules)) {
+        // Validate structure: only a missing schedules array makes the file corrupt.
+        if (!isPlainObject(data) || !Array.isArray(data.schedules)) {
             throw new Error('Invalid schedules file: missing schedules array');
         }
-        // Validate each schedule has required fields
-        for (const schedule of data.schedules) {
-            if (!schedule.id || !schedule.workflowId || !Object.prototype.hasOwnProperty.call(schedule, 'schedule')) {
-                throw new Error(`Invalid schedule entry: missing required fields`);
+        // #991: validate each entry on its own. A malformed entry is disabled
+        // (when it can still be addressed by id) or skipped; it never makes the
+        // whole file "corrupt", which used to back up and REMOVE schedules.json.
+        const schedules = [];
+        const skipped = [];
+        const seen = new Set();
+        for (const entry of data.schedules) {
+            if (!isPlainObject(entry) || typeof entry.id !== 'string' || entry.id.length === 0 || seen.has(entry.id)) {
+                skipped.push(entry);
+                continue;
             }
-            if (typeof schedule.schedule !== 'string' || !isValidCronExpression(schedule.schedule)) {
-                schedule.disabledReason = `Invalid cron expression: ${schedule.schedule}`;
+            const schedule = entry;
+            seen.add(schedule.id);
+            const reason = scheduleDisabledReason(entry);
+            if (reason) {
+                schedule.disabledReason = reason;
                 if (schedule.enabled) {
-                    console.warn(`[PersistentScheduler] Disabled schedule ${schedule.id}: ${schedule.disabledReason}`);
+                    console.warn(`[PersistentScheduler] Disabled schedule ${schedule.id}: ${reason}`);
                 }
                 schedule.enabled = false;
             }
             else {
                 delete schedule.disabledReason;
             }
+            schedules.push(schedule);
         }
-        return data;
+        return { file: { ...data, schedules }, skipped };
     }
     /**
      * Write schedules to disk
      */
-    async writeSchedules(schedules) {
+    async writeSchedules(schedules, skipped = []) {
+        // #991: entries skipped on load are not written back; keep a copy next to
+        // the file first so nothing a user stored is lost silently.
+        if (skipped.length > 0) {
+            const quarantinePath = `${this.schedulesPath}.quarantine.${Date.now()}.json`;
+            fs.writeFileSync(quarantinePath, JSON.stringify({
+                quarantinedAt: new Date().toISOString(),
+                reason: 'Malformed schedule entries (not an object, no id, or duplicate id)',
+                entries: skipped,
+            }, null, 2), { encoding: 'utf-8', flag: 'wx' });
+            console.warn(`[PersistentScheduler] Moved ${skipped.length} malformed schedule entries to ${quarantinePath}`);
+        }
         const data = {
             version: FILE_VERSION,
             updatedAt: new Date().toISOString(),
@@ -329,17 +369,7 @@ export class PersistentScheduler {
     async handleCorruptFile(error) {
         const errorMsg = toErrorMessage(error);
         this.log(`Corrupt schedules file detected: ${errorMsg}`);
-        // Create backup of corrupt file
-        const backupPath = `${this.schedulesPath}.corrupt.${Date.now()}`;
-        try {
-            if (fs.existsSync(this.schedulesPath)) {
-                fs.copyFileSync(this.schedulesPath, backupPath);
-                this.log(`Backed up corrupt file to: ${backupPath}`);
-            }
-        }
-        catch (backupError) {
-            this.log(`Failed to backup corrupt file: ${backupError}`);
-        }
+        this.backupCorruptFile(error);
         // Remove corrupt file
         try {
             if (fs.existsSync(this.schedulesPath)) {
@@ -351,6 +381,20 @@ export class PersistentScheduler {
             this.log(`Failed to remove corrupt file: ${removeError}`);
         }
     }
+    /** Copy an unparseable schedules file to `.corrupt.<ts>` (left in place). */
+    backupCorruptFile(error) {
+        this.log(`Corrupt schedules file detected: ${toErrorMessage(error)}`);
+        const backupPath = `${this.schedulesPath}.corrupt.${Date.now()}`;
+        try {
+            if (fs.existsSync(this.schedulesPath)) {
+                fs.copyFileSync(this.schedulesPath, backupPath, fs.constants.COPYFILE_EXCL);
+                this.log(`Backed up corrupt file to: ${backupPath}`);
+            }
+        }
+        catch (backupError) {
+            this.log(`Failed to backup corrupt file: ${backupError}`);
+        }
+    }
     /**
      * Execute a function with file locking for safe concurrent access
      */
@@ -433,6 +477,28 @@ export class PersistentScheduler {
     }
 }
 // ============================================================================
+// Entry validation (#991)
+// ============================================================================
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Why a persisted entry cannot run, or undefined when it is valid. Such
+ * entries are kept (disabled) so `workflow list` shows them with the reason.
+ */
+function scheduleDisabledReason(entry) {
+    if (!Object.prototype.hasOwnProperty.call(entry, 'schedule')) {
+        return 'Missing cron expression (no schedule field)';
+    }
+    if (typeof entry.schedule !== 'string' || !isValidCronExpression(entry.schedule)) {
+        return `Invalid cron expression: ${String(entry.schedule)}`;
+    }
+    if (typeof entry.workflowId !== 'string' || entry.workflowId.length === 0) {
+        return 'Missing workflowId';
+    }
+    return undefined;
+}
+// ============================================================================
 // Factory Function
 // ============================================================================
 /**

package/dist/cli/utils/ci-output.d.ts

@@ -7,6 +7,7 @@
 import type { SecurityCoverage } from '../../domains/security-compliance/interfaces.js';
 import type { SecurityScanEvidence } from '../../domains/security-compliance/scan-evidence.js';
 import type { discoverSecurityFiles } from '../../domains/security-compliance/scan-discovery.js';
+import type { DependencyScanReport } from '../../domains/security-compliance/dependency-advisory-engine.js';
 export type OutputFormat = 'text' | 'json' | 'sarif' | 'junit' | 'markdown';
 export interface CIOutputOptions {
     format: OutputFormat;
@@ -20,6 +21,8 @@ export interface SecurityVulnerability {
     message: string;
     ruleId?: string;
     cweId?: string;
+    /** CVE id of a dependency advisory, when the advisory has one (#1049). */
+    cveId?: string;
 }
 export interface SecurityScanResult {
     vulnerabilities: SecurityVulnerability[];
@@ -38,6 +41,8 @@ export interface SecurityScanResult {
     coverage?: SecurityCoverage;
     evidence?: SecurityScanEvidence;
     discovery?: Awaited<ReturnType<typeof discoverSecurityFiles>>['discovery'];
+    /** #1049: OSV dependency advisory scan; any status but 'complete' is not a clean result. */
+    dependencyScan?: DependencyScanReport;
 }
 export type SecurityExecutionStatus = 'complete' | 'partial' | 'none' | 'failed' | 'not-run' | 'unverified';
 export interface SecurityCheckResult {
@@ -71,8 +76,15 @@ export interface CoverageResult {
         function: number | null;
         statement: number | null;
     };
-    meetsThreshold: boolean;
+    /** `null` = no verdict: nothing was measured (UNMEASURED or estimate only, #1012). */
+    meetsThreshold: boolean | null;
     threshold: number;
+    /** Provenance, the same vocabulary as MCP `coverage_analyze_sublinear` (#1012). */
+    measured?: boolean;
+    estimated?: boolean;
+    unmeasured?: boolean;
+    coverageMethod?: string;
+    warning?: string;
     files?: Array<{
         path: string;
         lineCoverage: number;

package/dist/cli/utils/ci-output.js

@@ -207,17 +207,28 @@ export function toJUnit(summary) {
 // ============================================================================
 export function coverageToMarkdown(result) {
     let md = `# Coverage Report\n\n`;
+    // #1012: an estimate is labelled and carries no verdict.
+    if (result.estimated) {
+        md += `> **STATIC ESTIMATE — not measured.** ${result.warning ?? ''}\n\n`;
+    }
+    const evaluated = result.meetsThreshold !== null && !result.estimated;
+    // #1027 N7: one decimal, never `~33.33333333333333%`.
+    const fmt = (v) => String(Math.round(v * 10) / 10);
     md += `| Metric | Value | Status |\n`;
     md += `|--------|-------|--------|\n`;
     // #995: an uncollected metric is "n/a", with no pass/fail mark — it is not 0%.
     const row = (label, v) => v === null
         ? `| ${label} | n/a (not collected) | \u2014 |\n`
-        : `| ${label} | ${v}% | ${v >= result.threshold ? '\u2705' : '\u274C'} |\n`;
+        : evaluated
+            ? `| ${label} | ${fmt(v)}% | ${v >= result.threshold ? '\u2705' : '\u274C'} |\n`
+            : `| ${label} | ~${fmt(v)}% (estimate) | \u2014 |\n`;
     md += row('Lines', result.summary.line);
     md += row('Branches', result.summary.branch);
     md += row('Functions', result.summary.function);
     md += row('Statements', result.summary.statement);
-    md += `\n**Threshold:** ${result.threshold}% \u2014 ${result.meetsThreshold ? '\u2705 Met' : '\u274C Not met'}\n`;
+    md += evaluated
+        ? `\n**Threshold:** ${result.threshold}% \u2014 ${result.meetsThreshold ? '\u2705 Met' : '\u274C Not met'}\n`
+        : `\n**Threshold:** ${result.threshold}% \u2014 not evaluated (UNMEASURED)\n`;
     if (result.gaps && result.gaps.length > 0) {
         md += `\n## Coverage Gaps\n\n`;
         md += `| File | Uncovered Lines | Risk | Severity |\n`;
@@ -286,6 +297,14 @@ export function securityToMarkdown(result) {
     if (result.evidence || result.discovery) {
         md += `## Execution receipts\n\n\`\`\`json\n${toJSON({ evidence: result.evidence, discovery: result.discovery })}\n\`\`\`\n\n`;
     }
+    if (result.dependencyScan) {
+        md += `## Dependency advisories (OSV)\n\n**Status:** ${result.dependencyScan.status}\n\n${result.dependencyScan.message}\n\n`;
+        for (const pkg of result.dependencyScan.uncheckedPackages) {
+            md += `- not checked: ${pkg.name}@${pkg.version} (${pkg.reason})\n`;
+        }
+        if (result.dependencyScan.uncheckedPackages.length > 0)
+            md += '\n';
+    }
     if (result.vulnerabilities.length > 0) {
         md += `## Vulnerabilities\n\n`;
         md += `| Severity | Type | File | Line | Message |\n`;

package/dist/cli/utils/coverage-data.d.ts

@@ -50,6 +50,9 @@ export interface CoverageData {
 /**
  * Try to read real coverage data from a coverage-final.json file.
  * Returns null if no instrumented coverage is available.
+ *
+ * #1012: per-file figures come from the shared istanbul parser, so the CLI
+ * and MCP compute "line" coverage the same way (source lines, not statements).
  */
 export declare function readInstrumentedCoverage(projectRoot: string): Map<string, FileCoverage> | null;
 /** Aggregate per-file coverage into whole-number percentages. */

package/dist/cli/utils/coverage-data.js

@@ -11,6 +11,7 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
+import { parseCoverageJson } from '../../coordination/handlers/handler-utils.js';
 // ============================================================================
 // V8/Istanbul Coverage Reader
 // ============================================================================
@@ -23,6 +24,9 @@ const COVERAGE_JSON_PATHS = [
 /**
  * Try to read real coverage data from a coverage-final.json file.
  * Returns null if no instrumented coverage is available.
+ *
+ * #1012: per-file figures come from the shared istanbul parser, so the CLI
+ * and MCP compute "line" coverage the same way (source lines, not statements).
  */
 export function readInstrumentedCoverage(projectRoot) {
     for (const relPath of COVERAGE_JSON_PATHS) {
@@ -30,50 +34,16 @@ export function readInstrumentedCoverage(projectRoot) {
         if (!fs.existsSync(fullPath))
             continue;
         try {
-            const raw = JSON.parse(fs.readFileSync(fullPath, 'utf-8'));
+            const content = fs.readFileSync(fullPath, 'utf-8');
+            const raw = JSON.parse(content);
             // coverage-summary.json has a different shape
             if (raw.total && raw.total.lines) {
                 return readCoverageSummary(raw, projectRoot);
             }
             // coverage-final.json: Record<filepath, IstanbulFileCoverage>
             const coverageMap = new Map();
-            for (const [filePath, entry] of Object.entries(raw)) {
-                const cov = entry;
-                const stmtKeys = Object.keys(cov.s);
-                const stmtCovered = stmtKeys.filter(k => cov.s[k] > 0).length;
-                const branchKeys = Object.keys(cov.b);
-                let branchTotal = 0;
-                let branchCovered = 0;
-                for (const k of branchKeys) {
-                    for (const count of cov.b[k]) {
-                        branchTotal++;
-                        if (count > 0)
-                            branchCovered++;
-                    }
-                }
-                const fnKeys = Object.keys(cov.f);
-                const fnCovered = fnKeys.filter(k => cov.f[k] > 0).length;
-                // Compute uncovered lines from statement map
-                const coveredLineSet = new Set();
-                const allLineSet = new Set();
-                for (const stmtKey of stmtKeys) {
-                    const stmt = cov.statementMap[stmtKey];
-                    for (let line = stmt.start.line; line <= stmt.end.line; line++) {
-                        allLineSet.add(line);
-                        if (cov.s[stmtKey] > 0)
-                            coveredLineSet.add(line);
-                    }
-                }
-                const uncoveredLines = [...allLineSet].filter(l => !coveredLineSet.has(l)).sort((a, b) => a - b);
-                coverageMap.set(filePath, {
-                    path: filePath,
-                    lines: { covered: coveredLineSet.size, total: allLineSet.size },
-                    branches: { covered: branchCovered, total: branchTotal },
-                    functions: { covered: fnCovered, total: fnKeys.length },
-                    statements: { covered: stmtCovered, total: stmtKeys.length },
-                    uncoveredLines,
-                    uncoveredBranches: uncoveredLines.slice(0, Math.floor(uncoveredLines.length / 2)),
-                });
+            for (const file of parseCoverageJson(content).files) {
+                coverageMap.set(file.path, file);
             }
             return coverageMap.size > 0 ? coverageMap : null;
         }
@@ -167,11 +137,16 @@ export function summarizeCoverage(files) {
     const safeDiv = (a, b) => b > 0 ? Math.round((a / b) * 100) : 0;
     const totalLines = sum(f => f.lines.total);
     const coveredLines = sum(f => f.lines.covered);
+    // #1012: statements are statements. A report without statement detail
+    // (lcov) carries its line figures in `statements`, so this falls back alike.
+    const totalStatements = sum(f => f.statements.total);
     return {
         line: safeDiv(coveredLines, totalLines),
         branch: safeDiv(sum(f => f.branches.covered), sum(f => f.branches.total)),
         function: safeDiv(sum(f => f.functions.covered), sum(f => f.functions.total)),
-        statement: safeDiv(coveredLines, totalLines),
+        statement: totalStatements > 0
+            ? safeDiv(sum(f => f.statements.covered), totalStatements)
+            : safeDiv(coveredLines, totalLines),
         files: files.length,
     };
 }

package/dist/cli/utils/coverage-verdict.d.ts

@@ -0,0 +1,130 @@
+/**
+ * Agentic QE v3 - Shared CLI coverage verdict (#995, #1010, #1012)
+ *
+ * One resolution and one verdict for every CLI surface that reports coverage
+ * (`aqe coverage`, the `aqe ci` coverage phase), built on the same shared
+ * functions as the MCP `coverage_analyze_sublinear` handler
+ * (`resolveExistingCoverage`, `thresholdVerdict`, `reconcileRecommendations`):
+ *
+ *   - measured   — an instrumented report covers the target: judged on the
+ *                  metrics the report collected (an uncollected metric is null,
+ *                  never 0%, and is left out of the threshold);
+ *   - unmeasured — the report has no entry for the target, the runner ran 0
+ *                  tests, or only test files were reported: no figure, exit 3;
+ *   - estimate   — no report exists, so the CLI shows a labelled STATIC
+ *                  ESTIMATE. It carries no threshold verdict, is never
+ *                  persisted as evidence, and also exits 3: nothing was measured;
+ *   - error      — the target is missing or the given report is unreadable.
+ */
+import { type CoverageData } from './coverage-data.js';
+import { type NoDataReason } from '../../coordination/handlers/coverage-target.js';
+/** `aqe coverage` exit code when no coverage measurement exists for the target (#995). */
+export declare const EXIT_UNMEASURED = 3;
+/** Provenance labels, the same vocabulary as MCP `coverage_analyze_sublinear`. */
+export declare const MEASURED_METHOD = "instrumented-report";
+export declare const ESTIMATE_METHOD = "static-estimation";
+export type CliCoverage = {
+    kind: 'data';
+    data: CoverageData;
+    projectRoot?: string;
+} | {
+    kind: 'no-data';
+    reason: NoDataReason;
+    message: string;
+} | {
+    kind: 'no-sources';
+};
+/**
+ * Resolve the coverage data for a CLI target (#995).
+ *
+ * Uses the SAME resolution and verdict as the MCP handler
+ * (`resolveExistingCoverage`), so CLI and MCP cannot disagree about what a
+ * report says for a target:
+ *   - a coverage report file (lcov.info, coverage-final.json, ...) is parsed
+ *     directly;
+ *   - a directory or source file is scoped against the instrumented report of
+ *     its PROJECT ROOT (nearest package.json/.git above it), not the cwd;
+ *   - with no report at the project root, the CLI falls back to its labelled
+ *     heuristic estimate (the CLI never runs the test suite).
+ */
+export declare function resolveCliCoverageData(targetPath: string, log?: (message: string) => void): Promise<CliCoverage>;
+/** Which optional metrics an instrumented report actually carries. */
+export declare function metricsCollected(data: CoverageData): {
+    branch: boolean;
+    function: boolean;
+    statement: boolean;
+};
+/** The slice of the coverage-analysis domain API the verdict needs. */
+export interface CoverageAnalyzeAPI {
+    analyze(request: {
+        coverageData: CoverageData;
+        threshold?: number;
+        includeFileDetails?: boolean;
+        measured?: boolean;
+        projectRoot?: string;
+    }): Promise<{
+        success: boolean;
+        value?: unknown;
+        error?: Error;
+    }>;
+}
+/** Summary figures; `null` = not collected / not measured — never 0%. */
+export interface NullableSummary {
+    line: number | null;
+    branch: number | null;
+    function: number | null;
+    statement: number | null;
+}
+export type CliCoverageOutcome = {
+    kind: 'no-sources';
+} | {
+    kind: 'error';
+    reason: NoDataReason;
+    message: string;
+} | {
+    kind: 'unmeasured';
+    reason: NoDataReason;
+    message: string;
+} | {
+    kind: 'analysis-failed';
+    message: string;
+} | {
+    kind: 'estimate';
+    data: CoverageData;
+    /** Estimated figures — for display only. */
+    summary: NullableSummary & {
+        files: number;
+    };
+    message: string;
+} | {
+    kind: 'measured';
+    data: CoverageData;
+    summary: NullableSummary & {
+        files: number;
+    };
+    collected: {
+        branch: boolean;
+        function: boolean;
+        statement: boolean;
+    };
+    verdict: {
+        overall: number;
+        meetsThreshold: boolean;
+    };
+    recommendations: string[];
+};
+/** Caller-facing explanation of a static estimate. */
+export declare function estimateMessage(): string;
+/**
+ * Resolve, analyze and judge coverage for a CLI target. Shared by
+ * `aqe coverage` and the `aqe ci` coverage phase.
+ */
+export declare function evaluateCliCoverage(api: CoverageAnalyzeAPI, targetPath: string, threshold: number, log?: (message: string) => void): Promise<CliCoverageOutcome>;
+/**
+ * Exit code: 0 meets (by more than 5%), 1 below / error, 2 within 5% above,
+ * 3 UNMEASURED (not in the report, 0 tests, test-only report, or estimate only).
+ */
+export declare function coverageExitCode(outcome: CliCoverageOutcome, threshold: number): number;
+/** The `-F json` document for an outcome (same shape in every case). */
+export declare function coverageJson(outcome: CliCoverageOutcome, threshold: number, target: string): Record<string, unknown>;
+//# sourceMappingURL=coverage-verdict.d.ts.map