agentic-workflow-manager 6.5.2 → 8.0.0

package/dist/scripts/sensor-support-matrix.js

@@ -0,0 +1,103 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.R3_PREPUBLICATION_FIXTURE_PURPOSE = exports.R3_PREPUBLICATION_FIXTURE_RELATIVE_PATH = exports.SENSOR_DOC_PATH = exports.SENSOR_PACKS = exports.SENSOR_END_MARKER = exports.SENSOR_BEGIN_MARKER = void 0;
+exports.parseRegistrySensorPacks = parseRegistrySensorPacks;
+exports.renderSensorSupportMatrix = renderSensorSupportMatrix;
+exports.spliceSensorSupportMatrix = spliceSensorSupportMatrix;
+exports.registryRootFromArgs = registryRootFromArgs;
+/** Generates the sensor-pack evidence block in docs/support-matrix.md.
+ *
+ * The registry owns pack definitions. This renderer is intentionally a consumer of
+ * those manifests instead of a second hand-written list of tools or versions.
+ */
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const contract_1 = require("../src/commands/sensors/compatibility/contract");
+exports.SENSOR_BEGIN_MARKER = '<!-- BEGIN GENERATED: sensor-pack-support -->';
+exports.SENSOR_END_MARKER = '<!-- END GENERATED: sensor-pack-support -->';
+exports.SENSOR_PACKS = ['generic', 'js-ts', 'python', 'shell'];
+exports.SENSOR_DOC_PATH = path_1.default.resolve(__dirname, '..', '..', 'docs', 'support-matrix.md');
+exports.R3_PREPUBLICATION_FIXTURE_RELATIVE_PATH = 'tests/fixtures/sensor-support-matrix/registry';
+/**
+ * The CLI R3 contract is implemented before the baseline registry publishes its
+ * v2 manifests. The generated matrix intentionally renders this pinned fixture,
+ * never an invented description of an unpublished registry release.
+ */
+exports.R3_PREPUBLICATION_FIXTURE_PURPOSE = 'R3 pre-publication contract fixture';
+function registryPath(value) {
+    if (typeof value !== 'string' || value.trim().length === 0 || value.includes('\0')) {
+        throw new Error('sensor support matrix requires a non-empty --registry-root');
+    }
+    return path_1.default.resolve(value);
+}
+function packPath(registryRoot, name) {
+    if (!exports.SENSOR_PACKS.includes(name))
+        throw new Error(`unsupported first-party pack: ${name}`);
+    return path_1.default.join(registryRoot, 'sensor-packs', name, 'pack.json');
+}
+function parseRegistrySensorPacks(registryRoot) {
+    const root = registryPath(registryRoot);
+    return exports.SENSOR_PACKS.map((name) => {
+        const file = packPath(root, name);
+        const stat = fs_1.default.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            throw new Error(`sensor pack must be a regular file: ${file}`);
+        let source;
+        try {
+            source = JSON.parse(fs_1.default.readFileSync(file, 'utf8'));
+        }
+        catch (error) {
+            throw new Error(`cannot parse sensor pack ${name}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        return { name, parsed: (0, contract_1.parseSensorPack)(source, file) };
+    });
+}
+function variants(pack) {
+    return Object.entries(pack.sensors).flatMap(([sensor, definition]) => definition.variants.map((variant) => `\`${sensor}/${variant.id}\`: ${variant.requirements.tool} ${variant.requirements.toolRange}; ${variant.requirements.runtime} ${variant.requirements.runtimeRange}; certified ${variant.certifiedRange}`)).join('<br>');
+}
+/** Pure renderer used by freshness tests and the documentation command. */
+function renderSensorSupportMatrix(registryRoot) {
+    const lines = [
+        `### Sensor-pack compatibility contract (${exports.R3_PREPUBLICATION_FIXTURE_PURPOSE})`,
+        '',
+        '| Pack | Contract | Version-aware variants and certified ranges | Evidence status |',
+        '|---|---|---|---|',
+    ];
+    for (const { name, parsed } of parseRegistrySensorPacks(registryRoot)) {
+        if (parsed.kind === 'legacy') {
+            lines.push(`| \`${name}\` | legacy pack | No v2 variants declared | compatible-unverified — migrate the pack before claiming version certification |`);
+        }
+        else {
+            lines.push(`| \`${name}\` | pack schema v2 | ${variants(parsed.pack)} | Fixture-declared ranges only; real-tool and OS certification awaits published registry release evidence |`);
+        }
+    }
+    lines.push('');
+    lines.push('> Generated from the pinned R3 pre-publication contract fixture, not the published `awm-baseline-registry` manifests. **Do not edit by hand** — `npm run docs:matrix` regenerates this block. T13 verifies the actual registry tag and release evidence.');
+    return lines.join('\n');
+}
+function spliceSensorSupportMatrix(markdown, generated) {
+    const begin = markdown.indexOf(exports.SENSOR_BEGIN_MARKER);
+    const end = markdown.indexOf(exports.SENSOR_END_MARKER);
+    if (begin === -1 || end === -1 || end < begin)
+        throw new Error(`support-matrix.md lacks ${exports.SENSOR_BEGIN_MARKER} / ${exports.SENSOR_END_MARKER}`);
+    const eol = markdown.includes('\r\n') ? '\r\n' : '\n';
+    const block = generated.split('\n').join(eol);
+    return markdown.slice(0, begin + exports.SENSOR_BEGIN_MARKER.length) + eol + eol + block + eol + eol + markdown.slice(end);
+}
+function registryRootFromArgs(argv) {
+    const index = argv.indexOf('--registry-root');
+    if (index === -1 || argv[index + 1] === undefined || argv[index + 1].startsWith('--') || index !== argv.lastIndexOf('--registry-root')) {
+        throw new Error('sensor support matrix requires exactly one --registry-root <path>');
+    }
+    return registryPath(argv[index + 1]);
+}
+/* istanbul ignore next: command shell is covered through exported functions. */
+if (require.main === module) {
+    const root = registryRootFromArgs(process.argv.slice(2));
+    const current = fs_1.default.readFileSync(exports.SENSOR_DOC_PATH, 'utf8');
+    fs_1.default.writeFileSync(exports.SENSOR_DOC_PATH, spliceSensorSupportMatrix(current, renderSensorSupportMatrix(root)), 'utf8');
+    process.stdout.write('support-matrix.md sensor-pack evidence regenerated from registry manifests\n');
+}

package/dist/scripts/support-matrix.js

@@ -47,6 +47,29 @@ function cell(value, absent, home) {
         return absent;
     return `\`${homeRelative(value, home)}\``;
 }
+/** The matrix documents portable defaults, not one operator's provider override.
+ * `providers()` deliberately honors settings such as CODEX_HOME at runtime; turning
+ * that runtime path into public documentation would make the checked-in matrix vary
+ * by the machine used to regenerate it. Rebase only the provider-owned prefix onto
+ * its declared default while preserving every suffix derived by the provider table. */
+function defaultProviderPath(value, c, home) {
+    if (value === null)
+        return null;
+    if (c.configHome.envVar === null)
+        return value;
+    // `path.join` normalizes a provider override while configHome.resolved keeps
+    // the literal environment value. Compare their canonical filesystem forms:
+    // otherwise a trailing slash or `..` segment makes the prefix check fail and
+    // leaks the operator-specific path into this public, committed document.
+    const relative = path_1.default.relative(path_1.default.resolve(c.configHome.resolved), path_1.default.resolve(value));
+    if (relative === '' || (!relative.startsWith(`..${path_1.default.sep}`) && relative !== '..' && !path_1.default.isAbsolute(relative))) {
+        return path_1.default.join(home, c.configHome.dir, relative);
+    }
+    return value;
+}
+function providerCell(value, absent, c, home) {
+    return cell(defaultProviderPath(value, c, home), absent, home);
+}
 /** El tier declarado por la forma de la config — la misma derivacion que `providerTier`
  *  en `core/diagnostics/provider-checks.ts`, no una segunda opinion. */
 function tier(c) {
@@ -61,14 +84,14 @@ function tier(c) {
 function injectionCell(c, home) {
     const inj = c.injection;
     if (!inj)
-        return '— (ninguna)';
+        return '— (none)';
     if (inj.type === 'cc-settings-merge')
         return 'hook `SessionStart`';
     if (inj.type === 'config-instructions')
-        return `\`${homeRelative(inj.configPath, home)}\` → campo \`${inj.field}\``;
+        return `${providerCell(inj.configPath, '**unsupported**', c, home)} → \`${inj.field}\` field`;
     return inj.globalPath === null
-        ? `\`${inj.localFile}\` del proyecto (sin equivalente global)`
-        : `\`${inj.localFile}\` + \`${homeRelative(inj.globalPath, home)}\``;
+        ? `project \`${inj.localFile}\` (no global equivalent)`
+        : `\`${inj.localFile}\` + ${providerCell(inj.globalPath, '**unsupported**', c, home)}`;
 }
 function renderProviderTables() {
     // `homeDir()`, la MISMA funcion de la que `providers()` deriva sus rutas. Tomarlo
@@ -79,33 +102,33 @@ function renderProviderTables() {
     const p = (0, providers_1.providers)();
     const row = (a) => p[a];
     const lines = [];
-    lines.push('### Dónde aterriza cada artefacto');
+    lines.push('### Where each artifact is installed');
     lines.push('');
-    lines.push('| Agente | Tier | Skills (global) | Skills (proyecto) | Formato |');
+    lines.push('| Agent | Tier | Skills (global) | Skills (project) | Renderer |');
     lines.push('|---|---|---|---|---|');
     for (const a of providers_1.AGENT_TARGETS) {
         const c = row(a);
-        lines.push(`| \`${a}\` | ${tier(c)} | ${cell(c.skill.global, '**no soportado**', home)} | \`${c.skill.local}\` | \`${c.skill.renderer}\` |`);
+        lines.push(`| \`${a}\` | ${tier(c)} | ${providerCell(c.skill.global, '**unsupported**', c, home)} | \`${c.skill.local}\` | \`${c.skill.renderer}\` |`);
     }
     lines.push('');
-    lines.push('### Perfiles de agente, workflows, hooks y contexto');
+    lines.push('### Agent profiles, workflows, hooks, and context');
     lines.push('');
-    lines.push('| Agente | Perfiles de agente | Workflows | Hooks | Entrega de contexto | Versión mínima |');
+    lines.push('| Agent | Agent profiles | Workflows | Hooks | Context delivery | Minimum version |');
     lines.push('|---|---|---|---|---|---|');
     for (const a of providers_1.AGENT_TARGETS) {
         const c = row(a);
         const agentCell = c.agent === null
-            ? '— (no aplica)'
-            : `${cell(c.agent.global, '**no soportado**', home)} · \`${c.agent.renderer}\``;
+            ? '— (not applicable)'
+            : `${providerCell(c.agent.global, '**unsupported**', c, home)} · \`${c.agent.renderer}\``;
         const wfCell = c.workflow === null
-            ? '— (no aplica)'
-            : cell(c.workflow.global, '**no soportado**', home);
-        lines.push(`| \`${a}\` | ${agentCell} | ${wfCell} | ${c.hooks ? `\`${c.hooks.type}\`` : '— (no tiene)'} ` +
-            `| ${injectionCell(c, home)} | ${c.minimumVersion ?? '— (sin gate)'} |`);
+            ? '— (not applicable)'
+            : providerCell(c.workflow.global, '**unsupported**', c, home);
+        lines.push(`| \`${a}\` | ${agentCell} | ${wfCell} | ${c.hooks ? `\`${c.hooks.type}\`` : '— (none)'} ` +
+            `| ${injectionCell(c, home)} | ${c.minimumVersion ?? '— (no gate)'} |`);
     }
     lines.push('');
-    lines.push('> Generado desde `cli/src/providers/index.ts`. **No editar a mano** — `npm run docs:matrix` lo regenera y');
-    lines.push('> `tests/structural/support-matrix-is-current.test.ts` falla si el documento y el código se separan.');
+    lines.push('> Generated from `cli/src/providers/index.ts`. **Do not edit by hand** — `npm run docs:matrix` regenerates it and');
+    lines.push('> `tests/structural/support-matrix-is-current.test.ts` fails when the document and code diverge.');
     return lines.join('\n');
 }
 /** Reemplaza el bloque entre marcadores. Falla ruidosamente si faltan: un doc sin

package/dist/src/commands/init.js

@@ -40,8 +40,6 @@ exports.renderInitOutcome = renderInitOutcome;
 exports.runInit = runInit;
 exports.makeConfirmExtensions = makeConfirmExtensions;
 exports.registerInitCommand = registerInitCommand;
-// src/commands/init.ts
-const fs_1 = __importDefault(require("fs"));
 const picocolors_1 = __importDefault(require("picocolors"));
 const doctor_1 = require("./doctor");
 const context_1 = require("../core/diagnostics/context");
@@ -202,7 +200,7 @@ async function runInit(opts = {}) {
         try {
             (0, config_1.savePreferences)(nextPreferences);
             (0, registries_1.seedBaselineRegistry)();
-            if ((0, registries_1.listRegistries)().some((r) => !fs_1.default.existsSync(r.contentRoot))) {
+            if ((0, registries_1.registriesNeedSync)()) {
                 // `syncRegistries()` reports per-registry failures as RESULTS,
                 // never as throws (core/registries.ts) — swallowing them here
                 // let an unavailable registry degrade silently into some later

package/dist/src/commands/ledger/index.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerLedgerCommand = registerLedgerCommand;
 const store_1 = require("../../core/ledger/store");
+const types_1 = require("../../core/ledger/types");
 function archiveLabel() {
     return new Date().toISOString().replace(/[-:]/g, '').replace(/\.\d+Z$/, '');
 }
@@ -18,8 +19,12 @@ function registerLedgerCommand(program) {
         .option('--ref <ref>', 'file:line or PR/commit reference')
         .option('--phase <phase>', 'lifecycle phase', 'unknown')
         .option('--source-skill <skill>', 'emitting skill', 'unknown')
+        .option('--defect-class <id>', 'reusable lowercase kebab-case defect class')
         .option('--branch <branch>', 'override branch (default: git current branch)')
         .action((opts) => {
+        if (opts.defectClass !== undefined && !types_1.DEFECT_CLASS.test(opts.defectClass)) {
+            throw new Error('--defect-class requires a lowercase kebab-case value');
+        }
         const cwd = process.cwd();
         const branch = opts.branch ?? (0, store_1.detectBranch)(cwd);
         const entry = {
@@ -33,6 +38,7 @@ function registerLedgerCommand(program) {
             severity: opts.severity,
             desc: opts.desc,
             ref: opts.ref,
+            defectClass: opts.defectClass,
         };
         (0, store_1.addEntry)(cwd, entry);
     });

package/dist/src/commands/preflight/checks.js

@@ -97,8 +97,8 @@ function checkManifest(cwd, manifest) {
     };
 }
 /** Every enabled sensor's command must resolve. This is the check nothing was calling. */
-function checkTools(cwd) {
-    const status = (0, status_1.computeSensorStatus)(cwd);
+async function checkTools(cwd) {
+    const status = await (0, status_1.computeSensorStatus)(cwd);
     if (status.overall === 'NOT_CONFIGURED') {
         return { id: 'tools', ok: false, detail: 'no manifest to check', remedy: 'run `awm sensors init`' };
     }
@@ -276,7 +276,7 @@ function checkHost(cwd) {
     // Bitbucket, Azure DevOps, an internal git server, etc. — don't overclaim support.
     return { id: 'host', ok: true, detail: 'git host not recognized (github/gitlab) — PR/MR automation not applicable' };
 }
-function preflight(cwd = process.cwd()) {
+async function preflight(cwd = process.cwd()) {
     const manifest = readManifest(cwd);
     const manifestExists = fs_1.default.existsSync(path_1.default.join(cwd, MANIFEST));
     const checks = [
@@ -285,7 +285,7 @@ function preflight(cwd = process.cwd()) {
         // Skipped when there is no manifest: reporting "tools broken" (or nudging toward
         // a baseline that has nothing to snapshot) on a repo that was never set up
         // buries the one thing the operator needs to read.
-        ...(manifestExists ? [checkTools(cwd), checkPack(cwd, manifest), checkSensorsBaseline(cwd, manifest)] : []),
+        ...(manifestExists ? [await checkTools(cwd), checkPack(cwd, manifest), checkSensorsBaseline(cwd, manifest)] : []),
         // Runs unconditionally — orthogonal to sensor configuration entirely, this is
         // about PR/MR tooling, not sensors.
         checkHost(cwd),

package/dist/src/commands/preflight/index.js

@@ -45,8 +45,8 @@ function registerPreflightCommand(program) {
         .description('verify the project harness can actually gate before development starts')
         .option('--json', 'emit the report as JSON')
         .option('--cwd <path>', 'project directory to check (default: current)')
-        .action((opts) => {
-        const report = (0, checks_1.preflight)(opts.cwd ?? process.cwd());
+        .action(async (opts) => {
+        const report = await (0, checks_1.preflight)(opts.cwd ?? process.cwd());
         process.stdout.write(opts.json ? JSON.stringify(report, null, 2) + '\n' : formatReport(report));
         const code = exitCodeFor(report);
         if (code !== 0)

package/dist/src/commands/registry/add.js

@@ -27,7 +27,7 @@ function deriveRegistryName(remote) {
 }
 async function addRegistry(remote, nameOverride) {
     const name = nameOverride ?? deriveRegistryName(remote);
-    if (!name || name === '.' || /[/\\]/.test(name)) {
+    if (!name || name === '.' || name.includes('..') || /[/\\]/.test(name)) {
         return { ok: false, error: `Invalid registry name "${name}" — use --name <simple-dir-name>` };
     }
     const existing = (0, registries_1.readRegistriesConfig)();
@@ -51,7 +51,7 @@ async function addRegistry(remote, nameOverride) {
         return {
             ok: false,
             name,
-            error: `Invalid registry layout: expected at least one of ${registries_1.CONTENT_DIR_NAMES.map((d) => `${d}/`).join(', ')} at the repo root of ${remote}`,
+            error: `Invalid registry layout: expected at least one of ${registries_1.REGISTRY_DIR_NAMES.map((d) => `${d}/`).join(', ')} at the repo root of ${remote}`,
         };
     }
     // Collision check against already-known content — BEFORE writing config.

package/dist/src/commands/registry/index.js

@@ -105,6 +105,7 @@ function registerRegistryCommand(program) {
             console.log(picocolors_1.default.dim('No additional registries. Add one with `awm registry add <git-url>`.'));
             return;
         }
+        const safeRoots = new Set((0, registries_1.contentRoots)());
         const earlier = [];
         for (const r of regs) {
             if (!fs_1.default.existsSync(r.contentRoot)) {
@@ -114,6 +115,10 @@ function registerRegistryCommand(program) {
                 earlier.push(r.contentRoot);
                 continue;
             }
+            if (!(0, status_1.canDiscoverRegistryContent)(r.contentRoot, safeRoots)) {
+                console.log(`${picocolors_1.default.cyan(r.name)}  ${r.remote}  ${picocolors_1.default.yellow("unsafe layout — remove the registry and add it again")}`);
+                continue;
+            }
             try {
                 const counts = [
                     `${(0, discovery_1.discoverSkills)([r.contentRoot]).length} skills`,

package/dist/src/commands/registry/status.js

@@ -1,11 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.canDiscoverRegistryContent = canDiscoverRegistryContent;
 exports.overrideStatus = overrideStatus;
 // Estado de los overrides declarados por un registry: activo (tapa un artifact
 // de un root anterior) o sin efecto (huérfano — el nombre ya no existe upstream).
 const registries_1 = require("../../core/registries");
 const discovery_1 = require("../../core/discovery");
 const bundles_1 = require("../../core/bundles");
+/** Registry discovery is permitted only for a root that survived the core
+ * safety scan. Kept as a small pure guard so the command wiring has a
+ * behavioral regression test instead of relying on source-text fragments. */
+function canDiscoverRegistryContent(contentRoot, safeRoots) {
+    return safeRoots.has(contentRoot);
+}
 function artifactNamesInRoot(root) {
     const names = new Set();
     for (const s of (0, discovery_1.discoverSkills)([root]))

package/dist/src/commands/sensors/compatibility/contract.js

@@ -0,0 +1,261 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseStructuredCommand = parseStructuredCommand;
+exports.assertNoEqualPriorityOverlap = assertNoEqualPriorityOverlap;
+exports.parseSensorPack = parseSensorPack;
+const semver_1 = __importDefault(require("semver"));
+const contract_1 = require("../coverage/contract");
+const PACK_SCHEMA_VERSION = 2;
+const SHELL_EXECUTABLES = new Set(['sh', 'bash', 'cmd', 'powershell']);
+const ALLOWED_PROBES = new Set([
+    'version',
+    'eslint-print-config',
+    'typescript-show-config',
+    'semgrep-validate',
+    'package-script-present',
+    'config-present',
+]);
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function sourceSuffix(source) {
+    return typeof source === 'string' && source.length > 0 && !/[\0\r\n]/.test(source) ? ` in ${source}` : ' in <unknown source>';
+}
+function invalid(source, message) {
+    throw new Error(`Invalid sensor pack${sourceSuffix(source)}: ${message}`);
+}
+function record(value, source, location) {
+    if (!isRecord(value))
+        invalid(source, `${location} must be an object`);
+    return value;
+}
+function fields(value, allowed, source, location) {
+    for (const key of Object.keys(value)) {
+        if (!allowed.includes(key))
+            invalid(source, `${location} has unknown field "${key}"`);
+    }
+}
+function text(value, source, location) {
+    if (typeof value !== 'string' || value.trim().length === 0 || /[\0\r\n]/.test(value)) {
+        invalid(source, `${location} must be a nonempty single-line string without NUL`);
+    }
+    return value;
+}
+function id(value, source, location) {
+    const parsed = text(value, source, location);
+    if (!/^[a-z][a-z0-9-]*$/.test(parsed))
+        invalid(source, `${location} must be a stable lowercase id`);
+    return parsed;
+}
+function asset(value, source, location) {
+    const parsed = text(value, source, location);
+    if (parsed.startsWith('/') || /^[A-Za-z]:[\\/]/.test(parsed) || parsed.startsWith('\\\\') || parsed.includes('\\') || parsed.split('/').some(part => part === '' || part === '.' || part === '..')) {
+        invalid(source, `${location} must be a contained relative asset path`);
+    }
+    return parsed;
+}
+function stringArray(value, source, location) {
+    if (!Array.isArray(value) || value.length === 0)
+        invalid(source, `${location} must be a nonempty array`);
+    return value.map((item, index) => text(item, source, `${location}[${index}]`));
+}
+function parseStructuredCommand(input, source) {
+    const value = record(input, source, 'command');
+    fields(value, ['executable', 'resolution', 'args', 'fileInput'], source, 'command');
+    const executable = text(value.executable, source, 'command.executable');
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(executable) || SHELL_EXECUTABLES.has(executable.toLowerCase().replace(/\.exe$/, ''))) {
+        invalid(source, 'command.executable must not be a shell or path');
+    }
+    if (value.resolution !== 'node-modules-bin' && value.resolution !== 'python-environment' && value.resolution !== 'path') {
+        invalid(source, 'command.resolution must be a supported resolution');
+    }
+    const args = stringArray(value.args, source, 'command.args');
+    for (const [index, arg] of args.entries()) {
+        if (arg.includes('{files}') && arg !== '{files}')
+            invalid(source, `command.args[${index}] must not embed {files}`);
+    }
+    const command = { executable, resolution: value.resolution, args };
+    if ('fileInput' in value) {
+        const fileInput = record(value.fileInput, source, 'command.fileInput');
+        fields(fileInput, ['placeholder', 'extensions'], source, 'command.fileInput');
+        if (fileInput.placeholder !== '{files}')
+            invalid(source, 'command.fileInput.placeholder must be {files}');
+        const extensions = stringArray(fileInput.extensions, source, 'command.fileInput.extensions');
+        for (const [index, extension] of extensions.entries()) {
+            if (!/^\.[A-Za-z0-9]+$/.test(extension))
+                invalid(source, `command.fileInput.extensions[${index}] must be an extension`);
+        }
+        if (args.filter(arg => arg === '{files}').length !== 1)
+            invalid(source, 'command.fileInput requires exactly one {files} argument');
+        command.fileInput = { placeholder: '{files}', extensions };
+    }
+    else if (args.includes('{files}')) {
+        invalid(source, 'command {files} argument requires fileInput');
+    }
+    return command;
+}
+function parseVariant(input, source, location) {
+    const value = record(input, source, location);
+    fields(value, ['id', 'priority', 'requirements', 'certifiedRange', 'command', 'assets', 'formatter', 'probe'], source, location);
+    const certifiedRange = text(value.certifiedRange, source, `${location}.certifiedRange`);
+    if (semver_1.default.validRange(certifiedRange) === null)
+        invalid(source, `${location}.certifiedRange must be a valid semver range`);
+    if (typeof value.priority !== 'number' || !Number.isSafeInteger(value.priority))
+        invalid(source, `${location}.priority must be a safe integer`);
+    const requirements = record(value.requirements, source, `${location}.requirements`);
+    fields(requirements, ['tool', 'toolRange', 'runtime', 'runtimeRange', 'configFiles'], source, `${location}.requirements`);
+    const toolRange = text(requirements.toolRange, source, `${location}.requirements.toolRange`);
+    const runtimeRange = text(requirements.runtimeRange, source, `${location}.requirements.runtimeRange`);
+    if (semver_1.default.validRange(toolRange) === null || semver_1.default.validRange(runtimeRange) === null)
+        invalid(source, `${location}.requirements ranges must be valid semver ranges`);
+    const probe = record(value.probe, source, `${location}.probe`);
+    fields(probe, ['kind'], source, `${location}.probe`);
+    if (typeof probe.kind !== 'string' || !ALLOWED_PROBES.has(probe.kind))
+        invalid(source, `${location}.probe.kind must be an allowed probe`);
+    return {
+        id: id(value.id, source, `${location}.id`),
+        priority: value.priority,
+        certifiedRange,
+        requirements: { tool: text(requirements.tool, source, `${location}.requirements.tool`), toolRange, runtime: text(requirements.runtime, source, `${location}.requirements.runtime`), runtimeRange, ...('configFiles' in requirements ? { configFiles: stringArray(requirements.configFiles, source, `${location}.requirements.configFiles`).map((file, index) => asset(file, source, `${location}.requirements.configFiles[${index}]`)) } : {}) },
+        assets: stringArray(value.assets, source, `${location}.assets`).map((entry, index) => asset(entry, source, `${location}.assets[${index}]`)),
+        formatter: text(value.formatter, source, `${location}.formatter`),
+        probe: { kind: probe.kind },
+        command: parseStructuredCommand(value.command, source),
+    };
+}
+function assertNoEqualPriorityOverlap(variants) {
+    if (!Array.isArray(variants) || variants.length === 0)
+        throw new Error('variants must be a nonempty array');
+    const parsed = variants.map((variant, index) => parseVariant(variant, 'public overlap validator', `variants[${index}]`));
+    for (let left = 0; left < parsed.length; left++) {
+        const first = parsed[left];
+        for (let right = left + 1; right < variants.length; right++) {
+            const second = parsed[right];
+            const toolRangesIntersect = semver_1.default.intersects(first.requirements.toolRange, second.requirements.toolRange);
+            const runtimeRangesIntersect = semver_1.default.intersects(first.requirements.runtimeRange, second.requirements.runtimeRange);
+            if (first.priority === second.priority && toolRangesIntersect && runtimeRangesIntersect) {
+                throw new Error(`variants "${first.id}" and "${second.id}" overlap at priority ${first.priority}`);
+            }
+        }
+    }
+}
+function parseSensor(input, source, location, variantIds) {
+    const value = record(input, source, location);
+    fields(value, ['applicability', 'variants', 'fast'], source, location);
+    if (!Array.isArray(value.variants) || value.variants.length === 0)
+        invalid(source, `${location}.variants must be a nonempty array`);
+    const variants = value.variants.map((variant, index) => parseVariant(variant, source, `${location}.variants[${index}]`));
+    for (const variant of variants) {
+        if (variantIds.has(variant.id))
+            invalid(source, `variant id "${variant.id}" must be unique`);
+        variantIds.add(variant.id);
+    }
+    try {
+        assertNoEqualPriorityOverlap(variants);
+    }
+    catch (error) {
+        invalid(source, `${location}.variants ${error instanceof Error ? error.message : 'overlap validation failed'}`);
+    }
+    const applicabilityInput = record(value.applicability, source, `${location}.applicability`);
+    fields(applicabilityInput, ['allFiles', 'anyFiles', 'kind'], source, `${location}.applicability`);
+    const applicability = {};
+    if ('allFiles' in applicabilityInput)
+        applicability.allFiles = stringArray(applicabilityInput.allFiles, source, `${location}.applicability.allFiles`).map((file, index) => asset(file, source, `${location}.applicability.allFiles[${index}]`));
+    if ('anyFiles' in applicabilityInput)
+        applicability.anyFiles = stringArray(applicabilityInput.anyFiles, source, `${location}.applicability.anyFiles`).map((file, index) => asset(file, source, `${location}.applicability.anyFiles[${index}]`));
+    if ('kind' in applicabilityInput)
+        applicability.kind = text(applicabilityInput.kind, source, `${location}.applicability.kind`);
+    if (Object.keys(applicability).length === 0)
+        invalid(source, `${location}.applicability must declare a condition`);
+    if ('fast' in value && typeof value.fast !== 'boolean')
+        invalid(source, `${location}.fast must be a boolean`);
+    return { applicability, variants, ...('fast' in value ? { fast: value.fast } : {}) };
+}
+function legacyCompatibility() {
+    return {
+        state: 'compatible-unverified',
+        reason: 'legacy pack without schemaVersion',
+        variantId: null,
+        toolVersion: null,
+        runtimeVersion: null,
+        certifiedRange: null,
+        evidence: [],
+    };
+}
+function parseLegacyPack(value, source) {
+    fields(value, ['name', 'description', 'detects', 'sensors', 'coverage'], source, 'root');
+    const name = id(value.name, source, 'name');
+    const sensorsInput = record(value.sensors, source, 'sensors');
+    const sensors = {};
+    for (const sensorName of Object.keys(sensorsInput)) {
+        const sensor = record(sensorsInput[sensorName], source, `sensors.${sensorName}`);
+        fields(sensor, ['defaultCmd', 'fast', 'enabled', 'changedCmd', 'changedExtensions', 'formatter', 'configFile', 'configFileFallback'], source, `sensors.${sensorName}`);
+        const parsed = {};
+        if ('defaultCmd' in sensor)
+            parsed.defaultCmd = text(sensor.defaultCmd, source, `sensors.${sensorName}.defaultCmd`);
+        if ('fast' in sensor) {
+            if (typeof sensor.fast !== 'boolean')
+                invalid(source, `sensors.${sensorName}.fast must be a boolean`);
+            parsed.fast = sensor.fast;
+        }
+        if ('enabled' in sensor) {
+            if (typeof sensor.enabled !== 'boolean')
+                invalid(source, `sensors.${sensorName}.enabled must be a boolean`);
+            parsed.enabled = sensor.enabled;
+        }
+        if ('changedCmd' in sensor)
+            parsed.changedCmd = text(sensor.changedCmd, source, `sensors.${sensorName}.changedCmd`);
+        if ('changedExtensions' in sensor)
+            parsed.changedExtensions = stringArray(sensor.changedExtensions, source, `sensors.${sensorName}.changedExtensions`);
+        if ('formatter' in sensor)
+            parsed.formatter = text(sensor.formatter, source, `sensors.${sensorName}.formatter`);
+        if ('configFile' in sensor)
+            parsed.configFile = asset(sensor.configFile, source, `sensors.${sensorName}.configFile`);
+        if ('configFileFallback' in sensor)
+            parsed.configFileFallback = asset(sensor.configFileFallback, source, `sensors.${sensorName}.configFileFallback`);
+        sensors[id(sensorName, source, 'sensor id')] = parsed;
+    }
+    const legacy = { name, sensors, compatibility: legacyCompatibility() };
+    if ('description' in value)
+        legacy.description = text(value.description, source, 'description');
+    if ('detects' in value) {
+        if (!Array.isArray(value.detects))
+            invalid(source, 'detects must be an array');
+        legacy.detects = value.detects.map((detect, index) => text(detect, source, `detects[${index}]`));
+    }
+    if ('coverage' in value)
+        legacy.coverage = (0, contract_1.parseCoverageContract)(value.coverage, source);
+    return legacy;
+}
+function parseSensorPack(input, source) {
+    const value = record(input, source, 'root');
+    if (!('schemaVersion' in value))
+        return { kind: 'legacy', pack: parseLegacyPack(value, source) };
+    fields(value, ['schemaVersion', 'name', 'description', 'detects', 'sensors', 'coverage'], source, 'root');
+    if (value.schemaVersion !== PACK_SCHEMA_VERSION)
+        invalid(source, `unsupported pack schemaVersion ${String(value.schemaVersion)}; supported: legacy, 2; upgrade or migrate the pack`);
+    const sensorsInput = record(value.sensors, source, 'sensors');
+    const sensorNames = Object.keys(sensorsInput);
+    if (sensorNames.length === 0)
+        invalid(source, 'sensors must be nonempty');
+    const sensors = {};
+    const variantIds = new Set();
+    for (const name of sensorNames)
+        sensors[id(name, source, 'sensor id')] = parseSensor(sensorsInput[name], source, `sensors.${name}`, variantIds);
+    let coverage;
+    try {
+        coverage = (0, contract_1.parseCoverageContract)(value.coverage, source);
+    }
+    catch (error) {
+        invalid(source, `coverage.${error instanceof Error ? error.message.replace(/^.*?: /, '') : 'is invalid'}`);
+    }
+    return { kind: 'v2', pack: {
+            schemaVersion: PACK_SCHEMA_VERSION,
+            name: id(value.name, source, 'name'), description: text(value.description, source, 'description'), detects: stringArray(value.detects, source, 'detects'),
+            sensors,
+            coverage,
+        } };
+}