agentic-workflow-manager 6.4.2 → 6.5.0

package/dist/src/commands/sensors/coverage/contract.js

@@ -0,0 +1,156 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_COVERAGE_FILE_BYTES = exports.COVERAGE_SCHEMA_VERSION = void 0;
+exports.parseCoverageContract = parseCoverageContract;
+exports.parseCoverageManifest = parseCoverageManifest;
+exports.COVERAGE_SCHEMA_VERSION = 1;
+exports.MAX_COVERAGE_FILE_BYTES = 1024 * 1024;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function sourceSuffix(source) {
+    return typeof source === 'string' && source.length > 0 ? ` in ${source}` : '';
+}
+function invalid(source, message) {
+    throw new Error(`Invalid coverage contract${sourceSuffix(source)}: ${message}`);
+}
+function record(value, source, location) {
+    if (!isRecord(value))
+        invalid(source, `${location} must be an object`);
+    return value;
+}
+function fields(value, allowed, source, location) {
+    for (const key of Object.keys(value)) {
+        if (!allowed.includes(key))
+            invalid(source, `${location} has unknown field "${key}"`);
+    }
+}
+function nonEmptyString(value, source, location) {
+    if (typeof value !== 'string' || value.trim().length === 0)
+        invalid(source, `${location} must be a nonempty string`);
+    return value;
+}
+function safeName(value, source, location) {
+    const name = nonEmptyString(value, source, location);
+    if (name === '.' || name === '..' || name.includes('..') || /[/\\]/.test(name) || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name)) {
+        invalid(source, `${location} must be a safe filename component`);
+    }
+    return name;
+}
+function stringArray(value, source, location, allowEmpty) {
+    if (!Array.isArray(value) || (!allowEmpty && value.length === 0)) {
+        invalid(source, `${location} must be ${allowEmpty ? 'an array' : 'a nonempty array'}`);
+    }
+    return value.map((item, index) => nonEmptyString(item, source, `${location}[${index}]`));
+}
+function parseFileRequirement(input, source, location) {
+    const value = record(input, source, location);
+    fields(value, ['path', 'containsAll'], source, location);
+    const path = safeName(value.path, source, `${location}.path`);
+    const containsAll = stringArray(value.containsAll, source, `${location}.containsAll`, true);
+    return { path, containsAll };
+}
+function parseEvidence(input, source, location) {
+    const value = record(input, source, location);
+    fields(value, ['commandIncludes', 'files'], source, location);
+    const evidence = {};
+    if ('commandIncludes' in value)
+        evidence.commandIncludes = stringArray(value.commandIncludes, source, `${location}.commandIncludes`, false);
+    if ('files' in value) {
+        if (!Array.isArray(value.files) || value.files.length === 0)
+            invalid(source, `${location}.files must be a nonempty array`);
+        evidence.files = value.files.map((file, index) => parseFileRequirement(file, source, `${location}.files[${index}]`));
+    }
+    return evidence;
+}
+function parseDetector(input, source, location) {
+    const value = record(input, source, location);
+    fields(value, ['sensor', 'evidence'], source, location);
+    const detector = { sensor: safeName(value.sensor, source, `${location}.sensor`) };
+    if ('evidence' in value)
+        detector.evidence = parseEvidence(value.evidence, source, `${location}.evidence`);
+    return detector;
+}
+function parseClass(input, source, location) {
+    const value = record(input, source, location);
+    fields(value, ['description', 'detectors', 'remedy'], source, location);
+    const description = nonEmptyString(value.description, source, `${location}.description`);
+    if (!Array.isArray(value.detectors) || value.detectors.length === 0)
+        invalid(source, `${location}.detectors must be a nonempty array`);
+    const remedyInput = record(value.remedy, source, `${location}.remedy`);
+    fields(remedyInput, ['summary', 'command'], source, `${location}.remedy`);
+    return {
+        description,
+        detectors: value.detectors.map((detector, index) => parseDetector(detector, source, `${location}.detectors[${index}]`)),
+        remedy: {
+            summary: nonEmptyString(remedyInput.summary, source, `${location}.remedy.summary`),
+            command: nonEmptyString(remedyInput.command, source, `${location}.remedy.command`),
+        },
+    };
+}
+function parseCoverageContract(input, source) {
+    const value = record(input, source, 'root');
+    fields(value, ['schemaVersion', 'classes'], source, 'root');
+    if (value.schemaVersion !== exports.COVERAGE_SCHEMA_VERSION)
+        invalid(source, `schemaVersion must be ${exports.COVERAGE_SCHEMA_VERSION}`);
+    const classesInput = record(value.classes, source, 'classes');
+    const names = Object.keys(classesInput);
+    if (names.length === 0)
+        invalid(source, 'classes must be nonempty');
+    const classes = {};
+    for (const name of names) {
+        if (!/^[a-z][a-z0-9-]*$/.test(name))
+            invalid(source, `class "${name}" must use [a-z][a-z0-9-]*`);
+        classes[name] = parseClass(classesInput[name], source, `classes.${name}`);
+    }
+    return { schemaVersion: exports.COVERAGE_SCHEMA_VERSION, classes };
+}
+function manifestString(value, source, location) {
+    return nonEmptyString(value, source, location);
+}
+function parseManifestSensor(input, source, location) {
+    const value = record(input, source, location);
+    fields(value, ['cmd', 'fast', 'enabled', 'timeout', 'changedCmd', 'changedExtensions', 'formatter'], source, location);
+    const sensor = {};
+    if ('cmd' in value)
+        sensor.cmd = manifestString(value.cmd, source, `${location}.cmd`);
+    if ('fast' in value) {
+        if (typeof value.fast !== 'boolean')
+            invalid(source, `${location}.fast must be a boolean`);
+        sensor.fast = value.fast;
+    }
+    if ('enabled' in value) {
+        if (typeof value.enabled !== 'boolean')
+            invalid(source, `${location}.enabled must be a boolean`);
+        sensor.enabled = value.enabled;
+    }
+    if ('timeout' in value) {
+        if (typeof value.timeout !== 'number' || !Number.isSafeInteger(value.timeout) || value.timeout <= 0)
+            invalid(source, `${location}.timeout must be a positive safe integer`);
+        sensor.timeout = value.timeout;
+    }
+    if ('changedCmd' in value)
+        sensor.changedCmd = manifestString(value.changedCmd, source, `${location}.changedCmd`);
+    if ('changedExtensions' in value)
+        sensor.changedExtensions = stringArray(value.changedExtensions, source, `${location}.changedExtensions`, true);
+    if ('formatter' in value)
+        sensor.formatter = manifestString(value.formatter, source, `${location}.formatter`);
+    return sensor;
+}
+function parseCoverageManifest(input, source) {
+    const value = record(input, source, 'manifest root');
+    fields(value, ['pack', 'sensors', 'concurrency'], source, 'manifest root');
+    const pack = safeName(value.pack, source, 'manifest.pack');
+    const sensorsInput = record(value.sensors, source, 'manifest.sensors');
+    const sensors = {};
+    for (const name of Object.keys(sensorsInput)) {
+        sensors[safeName(name, source, 'manifest sensor name')] = parseManifestSensor(sensorsInput[name], source, `manifest.sensors.${name}`);
+    }
+    const manifest = { pack, sensors };
+    if ('concurrency' in value) {
+        if (typeof value.concurrency !== 'number' || !Number.isSafeInteger(value.concurrency) || value.concurrency <= 0)
+            invalid(source, 'manifest.concurrency must be a positive safe integer');
+        manifest.concurrency = value.concurrency;
+    }
+    return manifest;
+}

package/dist/src/commands/sensors/coverage/evaluate.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluateCoverage = evaluateCoverage;
+const detectorStatuses = ['covered', 'missing', 'disabled', 'ineffective', 'unverifiable'];
+const commandStatuses = ['matched', 'custom', 'missing'];
+const fileStatuses = ['matched', 'missing', 'unverifiable'];
+function keyFor(classId, detectorIndex) {
+    return `${classId}:${detectorIndex}`;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+function validateEvidence(evidence) {
+    if (!Array.isArray(evidence))
+        return false;
+    return evidence.every((item) => {
+        if (!isRecord(item) || typeof item.kind !== 'string' || typeof item.status !== 'string')
+            return false;
+        if (item.kind === 'command')
+            return commandStatuses.includes(item.status) && Object.keys(item).every((key) => key === 'kind' || key === 'status');
+        if (item.kind === 'file')
+            return fileStatuses.includes(item.status) && isNonEmptyString(item.path)
+                && Object.keys(item).every((key) => key === 'kind' || key === 'path' || key === 'status');
+        if (item.kind === 'marker')
+            return fileStatuses.includes(item.status) && isNonEmptyString(item.path)
+                && typeof item.ordinal === 'number' && Number.isSafeInteger(item.ordinal) && item.ordinal > 0
+                && Object.keys(item).every((key) => key === 'kind' || key === 'path' || key === 'ordinal' || key === 'status');
+        return false;
+    });
+}
+function validateContract(contract) {
+    if (!isRecord(contract) || contract.schemaVersion !== 1 || !isRecord(contract.classes) || Object.keys(contract.classes).length === 0) {
+        throw new Error('evaluateCoverage: invalid coverage contract');
+    }
+    for (const [classId, coverageClass] of Object.entries(contract.classes)) {
+        if (!isNonEmptyString(classId) || !isRecord(coverageClass) || !isNonEmptyString(coverageClass.description)
+            || !Array.isArray(coverageClass.detectors) || coverageClass.detectors.length === 0
+            || !isRecord(coverageClass.remedy) || !isNonEmptyString(coverageClass.remedy.summary)
+            || !isNonEmptyString(coverageClass.remedy.command)) {
+            throw new Error(`evaluateCoverage: invalid coverage contract class '${classId}'`);
+        }
+        for (const detector of coverageClass.detectors) {
+            if (!isRecord(detector) || !isNonEmptyString(detector.sensor)) {
+                throw new Error(`evaluateCoverage: invalid coverage contract detector for '${classId}'`);
+            }
+        }
+    }
+}
+function validateObservation(item) {
+    return isRecord(item) && isNonEmptyString(item.classId) && typeof item.detectorIndex === 'number' && Number.isSafeInteger(item.detectorIndex)
+        && item.detectorIndex >= 0 && isNonEmptyString(item.sensor) && typeof item.status === 'string'
+        && detectorStatuses.includes(item.status) && validateEvidence(item.evidence);
+}
+function copyEvidence(evidence) {
+    return evidence.map((item) => ({ ...item }));
+}
+function evaluateCoverage(contract, observations) {
+    validateContract(contract);
+    if (!Array.isArray(observations))
+        throw new Error('evaluateCoverage: observations must be an array');
+    const indexed = new Map();
+    for (const item of observations) {
+        if (!validateObservation(item))
+            throw new Error('evaluateCoverage: malformed observation');
+        const key = keyFor(item.classId, item.detectorIndex);
+        if (indexed.has(key))
+            throw new Error(`evaluateCoverage: duplicate observation for '${key}' (${item.sensor})`);
+        indexed.set(key, item);
+    }
+    const classes = Object.keys(contract.classes).sort().map((id) => {
+        const expected = contract.classes[id];
+        const detectors = expected.detectors.map((detector, detectorIndex) => {
+            const identity = keyFor(id, detectorIndex);
+            const found = indexed.get(identity);
+            if (!found)
+                throw new Error(`evaluateCoverage: missing observation for '${identity}' (${detector.sensor})`);
+            if (found.sensor !== detector.sensor) {
+                throw new Error(`evaluateCoverage: observation for '${identity}' must use sensor '${detector.sensor}'`);
+            }
+            return { sensor: found.sensor, status: found.status, evidence: copyEvidence(found.evidence) };
+        });
+        const status = detectors.some((item) => item.status === 'covered') ? 'covered'
+            : detectors.some((item) => item.status === 'unverifiable') ? 'unverifiable'
+                : 'missing';
+        return {
+            id,
+            description: expected.description,
+            status,
+            detectors,
+            remedy: { ...expected.remedy },
+        };
+    });
+    if (indexed.size !== classes.reduce((count, coverageClass) => count + coverageClass.detectors.length, 0)) {
+        for (const [identity, observation] of indexed) {
+            const expected = contract.classes[observation.classId]?.detectors[observation.detectorIndex];
+            if (!expected)
+                throw new Error(`evaluateCoverage: unexpected observation for '${identity}' (${observation.sensor})`);
+        }
+    }
+    const overall = classes.some((item) => item.status === 'missing') ? 'gaps'
+        : classes.some((item) => item.status === 'unverifiable') ? 'inconclusive'
+            : 'covered';
+    return { overall, classes };
+}

package/dist/src/commands/sensors/coverage/evidence.js

@@ -0,0 +1,118 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.observeDetector = observeDetector;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const contract_1 = require("./contract");
+const realIo = {
+    lstatSync: fs_1.default.lstatSync,
+    openSync: fs_1.default.openSync,
+    fstatSync: fs_1.default.fstatSync,
+    readSync: fs_1.default.readSync,
+    closeSync: fs_1.default.closeSync,
+};
+function resolvedEvidencePath(root, relative) {
+    const rootPath = path_1.default.resolve(root);
+    const absolute = path_1.default.resolve(rootPath, relative);
+    const fromRoot = path_1.default.relative(rootPath, absolute);
+    if (fromRoot === '..' || fromRoot.startsWith(`..${path_1.default.sep}`) || path_1.default.isAbsolute(fromRoot)) {
+        throw new Error(`evidence path escaped project root: ${relative}`);
+    }
+    return absolute;
+}
+function inspectFile(root, relative, markers, io) {
+    const absolute = resolvedEvidencePath(root, relative);
+    let stat;
+    try {
+        stat = io.lstatSync(absolute);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return { status: 'missing', evidence: [{ kind: 'file', path: relative, status: 'missing' }] };
+        }
+        return { status: 'unverifiable', evidence: [{ kind: 'file', path: relative, status: 'unverifiable' }] };
+    }
+    if (stat.isSymbolicLink() || !stat.isFile() || stat.size > contract_1.MAX_COVERAGE_FILE_BYTES) {
+        return { status: 'unverifiable', evidence: [{ kind: 'file', path: relative, status: 'unverifiable' }] };
+    }
+    const noFollow = fs_1.default.constants.O_NOFOLLOW;
+    if (typeof noFollow !== 'number') {
+        return { status: 'unverifiable', evidence: [{ kind: 'file', path: relative, status: 'unverifiable' }] };
+    }
+    let fd;
+    let content;
+    try {
+        fd = (io.openSync ?? realIo.openSync)(absolute, fs_1.default.constants.O_RDONLY | noFollow);
+        const opened = (io.fstatSync ?? realIo.fstatSync)(fd);
+        if (!opened.isFile() || opened.size > contract_1.MAX_COVERAGE_FILE_BYTES) {
+            return { status: 'unverifiable', evidence: [{ kind: 'file', path: relative, status: 'unverifiable' }] };
+        }
+        const buffer = Buffer.allocUnsafe(contract_1.MAX_COVERAGE_FILE_BYTES + 1);
+        const bytesRead = (io.readSync ?? realIo.readSync)(fd, buffer, 0, buffer.length, null);
+        if (!Number.isSafeInteger(bytesRead) || bytesRead < 0 || bytesRead > contract_1.MAX_COVERAGE_FILE_BYTES) {
+            return { status: 'unverifiable', evidence: [{ kind: 'file', path: relative, status: 'unverifiable' }] };
+        }
+        content = buffer.subarray(0, bytesRead).toString('utf8');
+    }
+    catch {
+        return { status: 'unverifiable', evidence: [{ kind: 'file', path: relative, status: 'unverifiable' }] };
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                (io.closeSync ?? realIo.closeSync)(fd);
+            }
+            catch {
+                // best-effort: a close failure does not make already-read evidence unsafe.
+            }
+        }
+    }
+    const evidence = [{ kind: 'file', path: relative, status: 'matched' }];
+    for (const [index, marker] of markers.entries()) {
+        evidence.push({
+            kind: 'marker',
+            path: relative,
+            ordinal: index + 1,
+            status: content.includes(marker) ? 'matched' : 'missing',
+        });
+    }
+    return {
+        status: evidence.some((item) => item.kind === 'marker' && item.status === 'missing') ? 'missing' : 'matched',
+        evidence,
+    };
+}
+function observeDetector(root, classId, detectorIndex, detector, sensor, io = realIo) {
+    if (typeof root !== 'string' || root.trim().length === 0)
+        throw new Error('observeDetector: root must be a non-empty string');
+    if (typeof classId !== 'string' || classId.trim().length === 0)
+        throw new Error('observeDetector: classId must be a non-empty string');
+    if (typeof detectorIndex !== 'number' || !Number.isSafeInteger(detectorIndex) || detectorIndex < 0) {
+        throw new Error('observeDetector: detectorIndex must be a non-negative integer');
+    }
+    const base = { classId, detectorIndex, sensor: detector.sensor };
+    if (!sensor)
+        return { ...base, status: 'missing', evidence: [] };
+    if (sensor.enabled === false)
+        return { ...base, status: 'disabled', evidence: [] };
+    const requiredCommand = detector.evidence?.commandIncludes ?? [];
+    const command = sensor.cmd;
+    if (requiredCommand.length > 0 && typeof command !== 'string') {
+        return { ...base, status: 'unverifiable', evidence: [{ kind: 'command', status: 'missing' }] };
+    }
+    if (requiredCommand.some((fragment) => !command.includes(fragment))) {
+        return { ...base, status: 'unverifiable', evidence: [{ kind: 'command', status: 'custom' }] };
+    }
+    const evidence = requiredCommand.length > 0 ? [{ kind: 'command', status: 'matched' }] : [];
+    let ineffective = false;
+    let unverifiable = false;
+    for (const file of detector.evidence?.files ?? []) {
+        const result = inspectFile(root, file.path, file.containsAll, io);
+        evidence.push(...result.evidence);
+        ineffective ||= result.status === 'missing';
+        unverifiable ||= result.status === 'unverifiable';
+    }
+    return { ...base, status: unverifiable ? 'unverifiable' : ineffective ? 'ineffective' : 'covered', evidence };
+}

package/dist/src/commands/sensors/coverage/index.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCoverage = runCoverage;
+const evidence_1 = require("./evidence");
+const evaluate_1 = require("./evaluate");
+const resolve_1 = require("./resolve");
+const defaults = { resolve: resolve_1.resolveCoverageInputs, observe: evidence_1.observeDetector };
+/** Build static coverage data only: no command execution and no writes. */
+function runCoverage(cwd, dependencies = {}) {
+    if (typeof cwd !== 'string' || cwd.trim().length === 0)
+        throw new Error('runCoverage: cwd must be a non-empty string');
+    const deps = { ...defaults, ...dependencies };
+    const input = deps.resolve(cwd);
+    if (input.kind === 'not_configured') {
+        return { schemaVersion: 1, pack: null, registry: null, overall: 'inconclusive', static: { status: 'inconclusive', reason: 'not_configured', classes: [] } };
+    }
+    if (input.kind === 'no_reference') {
+        return { schemaVersion: 1, pack: input.pack, registry: input.registry, overall: 'inconclusive', static: { status: 'inconclusive', reason: 'no_reference', classes: [] } };
+    }
+    const observations = [];
+    for (const [classId, coverageClass] of Object.entries(input.contract.classes)) {
+        coverageClass.detectors.forEach((detector, detectorIndex) => {
+            observations.push(deps.observe(input.projectRoot, classId, detectorIndex, detector, input.manifest.sensors[detector.sensor]));
+        });
+    }
+    const evaluated = (0, evaluate_1.evaluateCoverage)(input.contract, observations);
+    return {
+        schemaVersion: 1, pack: input.pack, registry: input.registry, overall: evaluated.overall,
+        static: { status: evaluated.overall, reason: null, classes: evaluated.classes },
+    };
+}

package/dist/src/commands/sensors/coverage/render.js

@@ -0,0 +1,152 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderCoverageJson = renderCoverageJson;
+exports.renderCoverageHuman = renderCoverageHuman;
+const ANSI = /\x1B\[[0-?]*[ -/]*[@-~]/g;
+const OSC = /\x1B\][\s\S]*?(?:\x07|\x1B\\)/g;
+const CONTROLS = /[\u0000-\u001F\u007F-\u009F]/g;
+const OVERALL = ['covered', 'gaps', 'inconclusive'];
+const CLASS_STATUS = ['covered', 'missing', 'unverifiable'];
+const DETECTOR_STATUS = ['covered', 'missing', 'disabled', 'ineffective', 'unverifiable'];
+const REASON = ['not_configured', 'no_reference'];
+const COMMAND_EVIDENCE_STATUS = ['matched', 'custom', 'missing'];
+const FILE_EVIDENCE_STATUS = ['matched', 'missing', 'unverifiable'];
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isOneOf(value, options) {
+    return typeof value === 'string' && options.includes(value);
+}
+function hasExactFields(value, fields) {
+    const keys = Object.keys(value);
+    return keys.length === fields.length && keys.every((key) => fields.includes(key));
+}
+function isNonBlankString(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+function invalidReport(renderer) {
+    throw new Error(`${renderer}: invalid report`);
+}
+function assertEvidence(evidence, renderer) {
+    if (!Array.isArray(evidence))
+        invalidReport(renderer);
+    for (const item of evidence) {
+        if (!isRecord(item))
+            invalidReport(renderer);
+        if (item.kind === 'command') {
+            if (!hasExactFields(item, ['kind', 'status']) || !isOneOf(item.status, COMMAND_EVIDENCE_STATUS))
+                invalidReport(renderer);
+        }
+        else if (item.kind === 'file') {
+            if (!hasExactFields(item, ['kind', 'path', 'status']) || !isNonBlankString(item.path)
+                || !isOneOf(item.status, FILE_EVIDENCE_STATUS))
+                invalidReport(renderer);
+        }
+        else if (item.kind === 'marker') {
+            if (!hasExactFields(item, ['kind', 'path', 'ordinal', 'status']) || !isNonBlankString(item.path)
+                || typeof item.ordinal !== 'number' || !Number.isSafeInteger(item.ordinal) || item.ordinal <= 0
+                || !isOneOf(item.status, FILE_EVIDENCE_STATUS))
+                invalidReport(renderer);
+        }
+        else {
+            invalidReport(renderer);
+        }
+    }
+}
+function assertCoverageEnvelope(report, renderer) {
+    if (!isRecord(report) || !hasExactFields(report, 'empirical' in report
+        ? ['schemaVersion', 'pack', 'registry', 'overall', 'static', 'empirical']
+        : ['schemaVersion', 'pack', 'registry', 'overall', 'static']) || report.schemaVersion !== 1
+        || !(report.pack === null || isNonBlankString(report.pack))
+        || !(report.registry === null || isNonBlankString(report.registry))
+        || !isOneOf(report.overall, OVERALL) || !isRecord(report.static)) {
+        invalidReport(renderer);
+    }
+    const staticReport = report.static;
+    if (!hasExactFields(staticReport, ['status', 'reason', 'classes']) || staticReport.status !== report.overall
+        || !isOneOf(staticReport.status, OVERALL)
+        || !(staticReport.reason === null || isOneOf(staticReport.reason, REASON))
+        || !Array.isArray(staticReport.classes)) {
+        invalidReport(renderer);
+    }
+    if (staticReport.reason === 'not_configured') {
+        if (report.overall !== 'inconclusive' || report.pack !== null || report.registry !== null || staticReport.classes.length !== 0) {
+            invalidReport(renderer);
+        }
+        return;
+    }
+    if (staticReport.reason === 'no_reference') {
+        if (report.overall !== 'inconclusive' || !isNonBlankString(report.pack) || !isNonBlankString(report.registry)
+            || staticReport.classes.length !== 0) {
+            invalidReport(renderer);
+        }
+        return;
+    }
+    if (!isNonBlankString(report.pack) || !isNonBlankString(report.registry) || staticReport.classes.length === 0) {
+        invalidReport(renderer);
+    }
+    let previousId;
+    let hasMissingClass = false;
+    let hasUnverifiableClass = false;
+    for (const coverageClass of staticReport.classes) {
+        if (!isRecord(coverageClass) || !hasExactFields(coverageClass, ['id', 'description', 'status', 'detectors', 'remedy'])
+            || !isNonBlankString(coverageClass.id) || !isNonBlankString(coverageClass.description)
+            || !isOneOf(coverageClass.status, CLASS_STATUS) || !Array.isArray(coverageClass.detectors) || coverageClass.detectors.length === 0
+            || !isRecord(coverageClass.remedy)) {
+            invalidReport(renderer);
+        }
+        if (previousId !== undefined && previousId >= coverageClass.id)
+            invalidReport(renderer);
+        previousId = coverageClass.id;
+        if (!hasExactFields(coverageClass.remedy, ['summary', 'command']))
+            invalidReport(renderer);
+        if (!isNonBlankString(coverageClass.remedy.summary) || !isNonBlankString(coverageClass.remedy.command))
+            invalidReport(renderer);
+        let hasCoveredDetector = false;
+        let hasUnverifiableDetector = false;
+        for (const detector of coverageClass.detectors) {
+            if (!isRecord(detector) || !hasExactFields(detector, ['sensor', 'status', 'evidence'])
+                || !isNonBlankString(detector.sensor) || !isOneOf(detector.status, DETECTOR_STATUS)) {
+                invalidReport(renderer);
+            }
+            assertEvidence(detector.evidence, renderer);
+            hasCoveredDetector ||= detector.status === 'covered';
+            hasUnverifiableDetector ||= detector.status === 'unverifiable';
+        }
+        const expectedClassStatus = hasCoveredDetector ? 'covered' : hasUnverifiableDetector ? 'unverifiable' : 'missing';
+        if (coverageClass.status !== expectedClassStatus)
+            invalidReport(renderer);
+        hasMissingClass ||= expectedClassStatus === 'missing';
+        hasUnverifiableClass ||= expectedClassStatus === 'unverifiable';
+    }
+    const expectedOverall = hasMissingClass ? 'gaps' : hasUnverifiableClass ? 'inconclusive' : 'covered';
+    if (report.overall !== expectedOverall)
+        invalidReport(renderer);
+}
+function safeHumanText(value) {
+    return value.replace(OSC, '').replace(ANSI, '').replace(CONTROLS, ' ');
+}
+function renderCoverageJson(report) {
+    assertCoverageEnvelope(report, 'renderCoverageJson');
+    return `${JSON.stringify(report, null, 2)}\n`;
+}
+function renderCoverageHuman(report) {
+    assertCoverageEnvelope(report, 'renderCoverageHuman');
+    if (report.static.reason === 'not_configured') {
+        return ['Sensor coverage', 'Overall: inconclusive', 'Reason: sensors are not configured', 'Run: awm sensors init', ''].join('\n');
+    }
+    if (report.static.reason === 'no_reference') {
+        return ['Sensor coverage', `Pack: ${safeHumanText(report.pack ?? 'unknown')}`, `Registry: ${safeHumanText(report.registry ?? 'unknown')}`,
+            'Overall: inconclusive', `No coverage reference for pack '${safeHumanText(report.pack ?? 'unknown')}'`, ''].join('\n');
+    }
+    const lines = ['Sensor coverage', `Pack: ${safeHumanText(report.pack ?? 'unknown')}`, `Registry: ${safeHumanText(report.registry ?? 'unknown')}`,
+        `Overall: ${report.overall}`, ''];
+    for (const item of report.static.classes.filter((entry) => entry.status !== 'covered')) {
+        lines.push(`${item.status} ${safeHumanText(item.id)} — ${safeHumanText(item.description)}`);
+        item.detectors.forEach((detector) => lines.push(`  detector: ${safeHumanText(detector.sensor)} (${detector.status})`));
+        lines.push(`  remedy: ${safeHumanText(item.remedy.summary)}`, `  command: ${safeHumanText(item.remedy.command)}`);
+    }
+    const count = (status) => report.static.classes.filter((item) => item.status === status).length;
+    lines.push('', `Summary: ${count('covered')} covered, ${count('missing')} missing, ${count('unverifiable')} unverifiable`, '');
+    return lines.join('\n');
+}