0sec-cli 0.23.0 → 0.24.1

package/chunks/{chunk-KHPOSLCF.js → chunk-H5QURBBK.js}

@@ -1,195 +1,14 @@
 #!/usr/bin/env node
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
-import {
-  source_default
-} from "./chunk-HLFS6WV2.js";
 import {
   SEVERITY_RANK,
   VERSION,
-  createAuditReportDocument,
-  createReviewReportDocument,
-  createScanReportDocument,
-  severityRank
-} from "./chunk-LTEE2JWK.js";
-
-// packages/cli/src/utils.ts
-import { gzipSync } from "zlib";
-async function getRuntimeAvailability() {
-  const { detectAvailableRuntimes, LlmApiRuntime } = await import("./dist-4LGRIBOC.js");
-  const apiRuntimeDiagnostics = new LlmApiRuntime({ type: "api", timeout: 5e3 }).getConfigurationDiagnostics();
-  const hasApiKey = apiRuntimeDiagnostics.valid;
-  const availableRuntimes = [...await detectAvailableRuntimes()];
-  return {
-    hasApiKey,
-    availableRuntimes,
-    apiRuntime: {
-      configured: apiRuntimeDiagnostics.reason !== "missing_key",
-      valid: apiRuntimeDiagnostics.valid,
-      providerLabel: apiRuntimeDiagnostics.providerLabel,
-      error: apiRuntimeDiagnostics.fatalError
-    }
-  };
-}
-async function checkRuntimeAvailability(runtime) {
-  const availability = await getRuntimeAvailability();
-  const { hasApiKey, availableRuntimes, apiRuntime } = availability;
-  if (hasApiKey) return;
-  console.log("");
-  if ((runtime === "api" || runtime === "auto") && apiRuntime.configured && apiRuntime.error) {
-    console.log(source_default.red(`  ${apiRuntime.providerLabel} config error: ${apiRuntime.error.split("\n")[0]}`));
-  }
-  if (runtime === "api") {
-    console.log(source_default.yellow(
-      apiRuntime.configured ? "  Warning: `--runtime api` needs a valid provider configuration. AI analysis will fail until this is fixed." : "  Warning: `--runtime api` needs provider credentials. AI analysis may be skipped."
-    ));
-  } else if (availableRuntimes.length > 0) {
-    console.log(source_default.cyan(`  Using local runtime(s): ${availableRuntimes.join(", ")}`));
-  } else {
-    console.log(source_default.yellow("  Warning: No API key or local agent runtime detected. AI analysis will be skipped."));
-  }
-  console.log(source_default.gray("  Provider credentials: ZERO_CHATGPT_ACCESS_TOKEN | ZERO_CHATGPT_OAUTH_REFRESH_TOKEN, OPENROUTER_API_KEY, ANTHROPIC_API_KEY, AZURE_OPENAI_API_KEY, OPENAI_API_KEY"));
-  console.log("");
-}
-function buildShareUrl(report) {
-  const json = JSON.stringify(report);
-  const compressed = gzipSync(Buffer.from(json, "utf-8"));
-  const b64 = compressed.toString("base64url");
-  return `https://0.security/r#${b64}`;
-}
+  compareFindingsByBusinessPriority,
+  getFindingPriority
+} from "./chunk-GXXX7AGH.js";
 
-// packages/cli/src/formatters/terminal.ts
-var SEVERITY_STYLE = {
-  critical: {
-    badge: (s) => source_default.bgRed.white.bold(` ${s} `),
-    label: "Critical",
-    icon: "\u25CF"
-  },
-  high: {
-    badge: (s) => source_default.bgRedBright.white.bold(` ${s} `),
-    label: "High",
-    icon: "\u25CF"
-  },
-  medium: {
-    badge: (s) => source_default.bgYellow.black.bold(` ${s} `),
-    label: "Medium",
-    icon: "\u25CF"
-  },
-  low: {
-    badge: (s) => source_default.bgBlue.white(` ${s} `),
-    label: "Low",
-    icon: "\u25CB"
-  },
-  info: {
-    badge: (s) => source_default.bgGray.white(` ${s} `),
-    label: "Info",
-    icon: "\xB7"
-  }
-};
-var SEVERITY_COUNT_COLOR = {
-  critical: source_default.red.bold,
-  high: source_default.redBright.bold,
-  medium: source_default.yellow.bold,
-  low: source_default.blue,
-  info: source_default.gray
-};
-function formatTerminal(report) {
-  const W = 60;
-  const lines = [];
-  lines.push("");
-  if (report.warnings.length > 0) {
-    lines.push(`  ${source_default.yellow.bold("WARNINGS")}`);
-    lines.push("");
-    for (const warning of report.warnings) {
-      lines.push(
-        `  ${source_default.yellow.bold("!")} ${source_default.yellow(`[${warning.stage}] ${warning.message}`)}`
-      );
-    }
-    lines.push("");
-  }
-  if (report.findings.length === 0) {
-    lines.push("");
-    if (report.warnings.length > 0 || report.executionSuccessful === false) {
-      lines.push(
-        `  ${source_default.yellow.bold("!")} ${source_default.yellow("No vulnerabilities confirmed. Scan finished with warnings.")}`
-      );
-    } else if (report.reviewChecks?.some((check) => check.status !== "pass")) {
-      lines.push(`  ${source_default.yellow.bold("!")} ${source_default.yellow("No security vulnerabilities found. Advisory review checks need attention.")}`);
-    } else {
-      lines.push(`  ${source_default.green.bold("\u2713")} ${source_default.green("No vulnerabilities found.")}`);
-    }
-  } else {
-    lines.push(`  ${source_default.bold.white("FINDINGS")}`);
-    lines.push("");
-    const sorted = [...report.findings].sort(
-      (a, b) => severityRank(b.severity) - severityRank(a.severity)
-    );
-    for (const finding of sorted) {
-      lines.push(formatFinding(finding));
-    }
-  }
-  if (report.reviewChecks?.length) {
-    lines.push("", `  ${source_default.bold.white("REVIEW CHECKS (advisory)")}`, "");
-    for (const check of report.reviewChecks) {
-      const color = check.status === "pass" ? source_default.green : source_default.yellow;
-      lines.push(`  ${color(check.status.toUpperCase())} ${check.name} (${check.id})`);
-      lines.push(`    Reason: ${check.reason}`);
-      if (check.fix) lines.push(`    Suggested fix: ${check.fix}`);
-      lines.push("");
-    }
-  }
-  lines.push("");
-  lines.push(`  ${source_default.gray("\u2500".repeat(50))}`);
-  lines.push("");
-  const { summary } = report;
-  const sev = [
-    summary.critical > 0 ? source_default.red.bold(`${summary.critical} critical`) : source_default.gray(`${summary.critical} critical`),
-    summary.high > 0 ? source_default.hex("#f97316").bold(`${summary.high} high`) : source_default.gray(`${summary.high} high`),
-    summary.medium > 0 ? source_default.yellow.bold(`${summary.medium} medium`) : source_default.gray(`${summary.medium} medium`),
-    source_default.gray(`${summary.low} low`),
-    source_default.gray(`${summary.info} info`)
-  ].join(source_default.gray("  "));
-  lines.push(`  ${sev}`);
-  lines.push(`  ${source_default.white.bold(String(summary.totalFindings))} findings ${source_default.gray("in")} ${source_default.white(formatDuration(report.durationMs))}`);
-  lines.push(`  ${source_default.gray("Share:")} ${source_default.cyan(buildShareUrl(report))}`);
-  lines.push("");
-  return lines.join("\n");
-}
-function formatFinding(finding) {
-  const style = SEVERITY_STYLE[finding.severity];
-  const lines = [];
-  lines.push(`  ${style.badge(style.label.toUpperCase().padEnd(8))} ${source_default.bold.white(finding.title)}`);
-  const meta = [];
-  meta.push(`${source_default.gray("Category:")} ${formatCategory(finding.category)}`);
-  if (finding.status === "confirmed") {
-    meta.push(source_default.green("\u2713 Confirmed"));
-  }
-  lines.push(`  ${" ".repeat(11)}${meta.join(source_default.gray("  \xB7  "))}`);
-  if (finding.description) {
-    const desc = finding.description.length > 100 ? finding.description.slice(0, 97) + "..." : finding.description;
-    lines.push(`  ${" ".repeat(11)}${source_default.gray(desc)}`);
-  }
-  if (finding.evidence.analysis) {
-    const ev = finding.evidence.analysis.length > 100 ? finding.evidence.analysis.slice(0, 97) + "..." : finding.evidence.analysis;
-    lines.push(`  ${" ".repeat(11)}${source_default.gray.italic("\u21B3 " + ev)}`);
-  }
-  lines.push("");
-  return lines.join("\n");
-}
-function formatCategory(cat) {
-  return cat.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
-}
-function formatDuration(ms) {
-  if (ms < 1e3) return `${ms}ms`;
-  return `${(ms / 1e3).toFixed(1)}s`;
-}
-
-// packages/cli/src/formatters/json.ts
-function formatJson(report) {
-  return JSON.stringify(report, null, 2);
-}
-
-// packages/cli/src/formatters/markdown.ts
+// packages/core/dist/report-formatters/markdown.js
 var EVIDENCE_BLOCK_LIMIT = 4e3;
 var POC_STEP_LIMIT = 20;
 function formatMarkdown(report) {
@@ -207,11 +26,20 @@ function formatMarkdown(report) {
   lines.push("");
   lines.push(`- **Attacks:** ${report.summary.totalAttacks}`);
   lines.push(`- **Findings:** ${report.summary.totalFindings}`);
+  for (const label of ["Urgent", "High", "Moderate", "Low", "Not assessed"]) {
+    const count = report.findings.filter((finding) => getFindingPriority(finding).label === label).length;
+    if (count)
+      lines.push(`- **Business priority \u2014 ${label}:** ${count}`);
+  }
+  lines.push("", "### Technical severity", "");
   if (report.summary.critical > 0)
     lines.push(`- **Critical:** ${report.summary.critical}`);
-  if (report.summary.high > 0) lines.push(`- **High:** ${report.summary.high}`);
-  if (report.summary.medium > 0) lines.push(`- **Medium:** ${report.summary.medium}`);
-  if (report.summary.low > 0) lines.push(`- **Low:** ${report.summary.low}`);
+  if (report.summary.high > 0)
+    lines.push(`- **High:** ${report.summary.high}`);
+  if (report.summary.medium > 0)
+    lines.push(`- **Medium:** ${report.summary.medium}`);
+  if (report.summary.low > 0)
+    lines.push(`- **Low:** ${report.summary.low}`);
   lines.push("");
   if (report.warnings.length > 0) {
     lines.push("## Warnings");
@@ -228,22 +56,21 @@ function formatMarkdown(report) {
       lines.push(`### ${check.status.toUpperCase()}: ${literal(check.name)}`, "");
       lines.push(`- **ID:** ${literal(check.id)}`);
       lines.push(`- **Reason:** ${literal(check.reason)}`);
-      if (check.fix) lines.push(`- **Suggested fix:** ${literal(check.fix)}`);
+      if (check.fix)
+        lines.push(`- **Suggested fix:** ${literal(check.fix)}`);
       lines.push("");
     }
   }
   if (report.findings.length > 0) {
     lines.push("## Findings");
     lines.push("");
-    for (const finding of report.findings) {
-      lines.push(formatFinding2(finding));
+    for (const finding of [...report.findings].sort(compareFindingsByBusinessPriority)) {
+      lines.push(formatFinding(finding));
     }
   } else {
     lines.push(report.warnings.length > 0 ? "## No Confirmed Vulnerabilities" : "## No Vulnerabilities Found");
     lines.push("");
-    lines.push(
-      report.warnings.length > 0 ? "The scanner did not confirm vulnerabilities, but target validation or probe execution produced warnings." : report.reviewChecks?.length ? "No security vulnerabilities were found in the inspected scope. Advisory review-check results are reported separately above." : "The target passed all tests."
-    );
+    lines.push(report.warnings.length > 0 ? "The scanner did not confirm vulnerabilities, but target validation or probe execution produced warnings." : report.reviewChecks?.length ? "No security vulnerabilities were found in the inspected scope. Advisory review-check results are reported separately above." : "The target passed all tests.");
   }
   return lines.join("\n");
 }
@@ -261,9 +88,7 @@ function evidenceBlock(label, raw) {
   lines.push(body);
   lines.push("```");
   if (truncated) {
-    lines.push(
-      `_Truncated for readability: ${raw.length - EVIDENCE_BLOCK_LIMIT} of ${raw.length} characters not shown. Use \`--format json\` or \`--format sarif\` for the complete evidence._`
-    );
+    lines.push(`_Truncated for readability: ${raw.length - EVIDENCE_BLOCK_LIMIT} of ${raw.length} characters not shown. Use \`--format json\` or \`--format sarif\` for the complete evidence._`);
   }
   return lines;
 }
@@ -274,7 +99,8 @@ function remediationSection(remediation) {
   lines.push(remediation.summary);
   if (remediation.steps.length > 0) {
     lines.push("");
-    for (const step of remediation.steps) lines.push(`1. ${step}`);
+    for (const step of remediation.steps)
+      lines.push(`1. ${step}`);
   }
   if (remediation.codeExample) {
     const { before, after, language } = remediation.codeExample;
@@ -298,7 +124,8 @@ function remediationSection(remediation) {
   if (remediation.references.length > 0) {
     lines.push("");
     lines.push("References:");
-    for (const ref of remediation.references) lines.push(`- ${ref}`);
+    for (const ref of remediation.references)
+      lines.push(`- ${ref}`);
   }
   lines.push("");
   return lines;
@@ -313,18 +140,19 @@ function reproductionSection(steps) {
   });
   if (steps.length > shown.length) {
     lines.push("");
-    lines.push(
-      `_${steps.length - shown.length} further step(s) omitted; the full graph is in \`--format json\`._`
-    );
+    lines.push(`_${steps.length - shown.length} further step(s) omitted; the full graph is in \`--format json\`._`);
   }
   lines.push("");
   return lines;
 }
-function formatFinding2(finding) {
+function formatFinding(finding) {
   const lines = [];
-  const badge = severityBadge(finding.severity);
-  lines.push(`### ${badge} ${finding.title}`);
+  const priority = getFindingPriority(finding);
+  lines.push(`### [${priority.label}] ${finding.title}`);
   lines.push("");
+  lines.push(`- **Business priority:** ${priority.label}`);
+  lines.push(`- **Business impact rationale:** ${priority.rationale}`);
+  lines.push(`- **Technical severity:** ${finding.severity}`);
   lines.push(`- **Category:** ${finding.category}`);
   lines.push(`- **Status:** ${finding.status}`);
   if (finding.cvssScore !== void 0 || finding.cvssVector) {
@@ -360,18 +188,8 @@ function formatFinding2(finding) {
   lines.push("");
   return lines.join("\n");
 }
-function severityBadge(severity) {
-  const badges = {
-    critical: "[CRITICAL]",
-    high: "[HIGH]",
-    medium: "[MEDIUM]",
-    low: "[LOW]",
-    info: "[INFO]"
-  };
-  return badges[severity] ?? `[${severity.toUpperCase()}]`;
-}
 
-// packages/cli/src/formatters/html.ts
+// packages/core/dist/report-formatters/html.js
 function escapeHtml(str) {
   return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
@@ -382,25 +200,29 @@ var SEVERITY_COLORS = {
   low: { bg: "#1d4ed8", text: "#ffffff", accent: "#60a5fa" },
   info: { bg: "#4b5563", text: "#ffffff", accent: "#9ca3af" }
 };
-var SEVERITY_ORDER = Object.keys(SEVERITY_RANK).sort(
-  (a, b) => SEVERITY_RANK[b] - SEVERITY_RANK[a]
-);
-function formatCategory2(cat) {
+var SEVERITY_ORDER = Object.keys(SEVERITY_RANK).sort((a, b) => SEVERITY_RANK[b] - SEVERITY_RANK[a]);
+function formatCategory(cat) {
   return cat.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
 }
-function formatDuration2(ms) {
-  if (ms < 1e3) return `${ms}ms`;
+function formatDuration(ms) {
+  if (ms < 1e3)
+    return `${ms}ms`;
   return `${(ms / 1e3).toFixed(1)}s`;
 }
 function riskLevel(summary) {
-  if (summary.critical > 0) return { label: "CRITICAL", color: "#ef4444" };
-  if (summary.high > 0) return { label: "HIGH", color: "#f97316" };
-  if (summary.medium > 0) return { label: "MEDIUM", color: "#eab308" };
-  if (summary.low > 0) return { label: "LOW", color: "#3b82f6" };
+  if (summary.critical > 0)
+    return { label: "CRITICAL", color: "#ef4444" };
+  if (summary.high > 0)
+    return { label: "HIGH", color: "#f97316" };
+  if (summary.medium > 0)
+    return { label: "MEDIUM", color: "#eab308" };
+  if (summary.low > 0)
+    return { label: "LOW", color: "#3b82f6" };
   return { label: "CLEAN", color: "#22c55e" };
 }
 function renderFinding(finding, index) {
   const sev = SEVERITY_COLORS[finding.severity];
+  const priority = getFindingPriority(finding);
   const confidence = finding.confidence != null ? `${Math.round(finding.confidence * 100)}%` : null;
   const cvss = finding.cvssScore != null ? finding.cvssScore.toFixed(1) : null;
   const rank = finding.findingRank != null ? `Rank: ${finding.findingRank}` : null;
@@ -408,14 +230,17 @@ function renderFinding(finding, index) {
   return `
     <div class="finding-card">
       <div class="finding-header">
-        <span class="severity-badge" style="background:${sev.bg};color:${sev.text}">${finding.severity.toUpperCase()}</span>
+        <span class="severity-badge" style="background:#1a1a2e;color:#fff">Business priority: ${priority.label}</span>
         <span class="finding-title">${escapeHtml(finding.title)}</span>
       </div>
+      <p class="finding-desc"><strong>Business impact rationale:</strong> ${escapeHtml(priority.rationale)}</p>
       <div class="finding-meta">
-        <span class="meta-tag">Category: ${formatCategory2(finding.category)}</span>
+        <span class="meta-tag" style="background:${sev.bg};color:${sev.text}">Technical severity: ${finding.severity}</span>
+        <span class="meta-tag">Category: ${formatCategory(finding.category)}</span>
         ${finding.status === "confirmed" ? '<span class="meta-tag confirmed">Confirmed</span>' : `<span class="meta-tag">${escapeHtml(finding.status)}</span>`}
         ${confidence ? `<span class="meta-tag">Confidence: ${confidence}</span>` : ""}
         ${cvss ? `<span class="meta-tag">CVSS: ${cvss}</span>` : ""}
+        ${finding.cvssVector ? `<span class="meta-tag">CVSS vector: ${escapeHtml(finding.cvssVector)}</span>` : ""}
         ${rank ? `<span class="meta-tag">${rank}</span>` : ""}
         ${dedupe ? `<span class="meta-tag">${dedupe}</span>` : ""}
       </div>
@@ -436,7 +261,8 @@ function renderFinding(finding, index) {
 }
 function renderSeverityBar(summary) {
   const total = summary.critical + summary.high + summary.medium + summary.low + summary.info;
-  if (total === 0) return "";
+  if (total === 0)
+    return "";
   const segments = SEVERITY_ORDER.filter((s) => summary[s] > 0).map((s) => {
     const pct = summary[s] / total * 100;
     return `<div class="bar-segment" style="width:${pct}%;background:${SEVERITY_COLORS[s].accent}" title="${summary[s]} ${s}"></div>`;
@@ -445,9 +271,8 @@ function renderSeverityBar(summary) {
 }
 function formatHtml(report) {
   const risk = riskLevel(report.summary);
-  const sorted = [...report.findings].sort(
-    (a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity)
-  );
+  const sorted = [...report.findings].sort(compareFindingsByBusinessPriority);
+  const businessPriority = sorted[0] ? getFindingPriority(sorted[0]).label : "No findings";
   const findingsHtml = sorted.length > 0 ? sorted.map((f, i) => renderFinding(f, i)).join("\n") : `<div class="no-findings">${report.warnings.length > 0 || report.executionSuccessful === false ? "No vulnerabilities confirmed. Scan finished with warnings." : report.reviewChecks?.length ? "No security vulnerabilities found. See advisory review-check results below." : "No vulnerabilities found. Target passed all tests."}</div>`;
   const warningsHtml = report.warnings.length > 0 ? `<div class="section">
         <h2 class="section-title warning-title">Warnings</h2>
@@ -736,12 +561,13 @@ function formatHtml(report) {
         <div class="brand">ZERO</div>
         <div class="brand-sub">Security Scan Report</div>
       </div>
-      <div class="risk-badge" style="background:${risk.color};color:#fff">${risk.label} RISK</div>
+      <div class="risk-badge" style="background:#1a1a2e;color:#fff">Business priority: ${businessPriority}</div>
     </div>
     <div class="meta-grid">
       <span><strong>Target:</strong> ${escapeHtml(report.target)}</span>
+      <span><strong>Technical risk:</strong> ${risk.label}</span>
       <span><strong>Depth:</strong> ${report.scanDepth}</span>
-      <span><strong>Duration:</strong> ${formatDuration2(report.durationMs)}</span>
+      <span><strong>Duration:</strong> ${formatDuration(report.durationMs)}</span>
       <span><strong>Started:</strong> ${escapeHtml(report.startedAt)}</span>
     </div>
   </div>
@@ -750,6 +576,11 @@ function formatHtml(report) {
     <div class="stat-box">
       <h3>Findings</h3>
       <div class="big-num">${report.summary.totalFindings}</div>
+      <div class="sev-counts">${["Urgent", "High", "Moderate", "Low", "Not assessed"].map((label) => {
+    const count = report.findings.filter((finding) => getFindingPriority(finding).label === label).length;
+    return count ? `<span>Business priority ${label}: ${count}</span>` : "";
+  }).join(" ")}</div>
+      <h3>Technical severity</h3>
       <div class="sev-counts">
         ${sevCountsHtml}
       </div>
@@ -761,7 +592,7 @@ function formatHtml(report) {
       <div class="timeline">
         <div class="timeline-row"><span class="timeline-label">Started</span><span class="timeline-value">${escapeHtml(report.startedAt)}</span></div>
         <div class="timeline-row"><span class="timeline-label">Completed</span><span class="timeline-value">${escapeHtml(report.completedAt)}</span></div>
-        <div class="timeline-row"><span class="timeline-label">Duration</span><span class="timeline-value">${formatDuration2(report.durationMs)}</span></div>
+        <div class="timeline-row"><span class="timeline-label">Duration</span><span class="timeline-value">${formatDuration(report.durationMs)}</span></div>
       </div>
     </div>
   </div>
@@ -782,7 +613,7 @@ function formatHtml(report) {
 </html>`;
 }
 
-// packages/cli/src/formatters/sarif.ts
+// packages/core/dist/report-formatters/sarif.js
 function severityToLevel(severity) {
   switch (severity) {
     case "critical":
@@ -822,7 +653,8 @@ function actionSummary(step) {
   }
 }
 function pocStepsToCodeFlows(pocSteps, target) {
-  if (!pocSteps || pocSteps.length === 0) return void 0;
+  if (!pocSteps || pocSteps.length === 0)
+    return void 0;
   return [
     {
       threadFlows: [
@@ -863,27 +695,48 @@ function findingToResult(finding, target) {
     }
   };
   const codeFlows = pocStepsToCodeFlows(finding.pocSteps, target);
-  if (codeFlows) result.codeFlows = codeFlows;
+  if (codeFlows)
+    result.codeFlows = codeFlows;
+  const priority = getFindingPriority(finding);
   result.properties = {
+    businessPriority: priority.label,
+    businessPriorityRank: priority.rank,
+    businessPriorityAssessed: priority.assessed,
+    businessPriorityRationale: priority.rationale,
     findingId: finding.id,
     category: finding.category,
     severity: finding.severity,
     status: finding.status,
     evidence: finding.evidence
   };
-  if (finding.cvssScore !== void 0) result.properties["cvssScore"] = finding.cvssScore;
-  if (finding.cvssVector) result.properties["cvssVector"] = finding.cvssVector;
-  if (finding.confidence !== void 0) result.properties["confidence"] = finding.confidence;
-  if (finding.publishability) result.properties["publishability"] = finding.publishability;
-  if (finding.noveltyVerdict) result.properties["noveltyVerdict"] = finding.noveltyVerdict;
-  if (finding.dedupRefs) result.properties["dedupRefs"] = finding.dedupRefs;
-  if (finding.advisoryMatches) result.properties["advisoryMatches"] = finding.advisoryMatches;
-  if (finding.verification_result) result.properties["verificationResult"] = finding.verification_result;
-  if (finding.inlineValidation) result.properties["inlineValidation"] = finding.inlineValidation;
-  if (finding.supplyChain) result.properties["supplyChain"] = finding.supplyChain;
-  if (finding.kernelExploit) result.properties["kernelExploit"] = finding.kernelExploit;
-  if (finding.semanticDedupe) result.properties["semanticDedupe"] = finding.semanticDedupe;
-  if (finding.findingRank !== void 0) result.properties["findingRank"] = finding.findingRank;
+  if (finding.impactAssessment)
+    result.properties["impactAssessment"] = finding.impactAssessment;
+  if (finding.cvssScore !== void 0)
+    result.properties["cvssScore"] = finding.cvssScore;
+  if (finding.cvssVector)
+    result.properties["cvssVector"] = finding.cvssVector;
+  if (finding.confidence !== void 0)
+    result.properties["confidence"] = finding.confidence;
+  if (finding.publishability)
+    result.properties["publishability"] = finding.publishability;
+  if (finding.noveltyVerdict)
+    result.properties["noveltyVerdict"] = finding.noveltyVerdict;
+  if (finding.dedupRefs)
+    result.properties["dedupRefs"] = finding.dedupRefs;
+  if (finding.advisoryMatches)
+    result.properties["advisoryMatches"] = finding.advisoryMatches;
+  if (finding.verification_result)
+    result.properties["verificationResult"] = finding.verification_result;
+  if (finding.inlineValidation)
+    result.properties["inlineValidation"] = finding.inlineValidation;
+  if (finding.supplyChain)
+    result.properties["supplyChain"] = finding.supplyChain;
+  if (finding.kernelExploit)
+    result.properties["kernelExploit"] = finding.kernelExploit;
+  if (finding.semanticDedupe)
+    result.properties["semanticDedupe"] = finding.semanticDedupe;
+  if (finding.findingRank !== void 0)
+    result.properties["findingRank"] = finding.findingRank;
   return result;
 }
 function findingToRule(finding) {
@@ -928,7 +781,7 @@ function formatSarif(report) {
           }
         },
         results: [
-          ...report.findings.map((f) => findingToResult(f, report.target)),
+          ...[...report.findings].sort(compareFindingsByBusinessPriority).map((f) => findingToResult(f, report.target)),
           ...(report.reviewChecks ?? []).map((check) => ({
             ruleId: `review-check/${check.id}`,
             kind: check.status === "pass" ? "pass" : check.status === "issue" ? "fail" : "open",
@@ -951,7 +804,7 @@ Suggested fix: ${check.fix}` : ""}` },
   return JSON.stringify(sarif, null, 2);
 }
 
-// packages/cli/src/formatters/pdf.ts
+// packages/core/dist/report-formatters/pdf.js
 import { createRequire } from "node:module";
 import { createWriteStream } from "node:fs";
 var COLORS = {
@@ -983,10 +836,12 @@ function formatDate(iso) {
     minute: "2-digit"
   });
 }
-function formatDuration3(ms) {
-  if (ms < 1e3) return `${ms}ms`;
+function formatDuration2(ms) {
+  if (ms < 1e3)
+    return `${ms}ms`;
   const seconds = Math.floor(ms / 1e3);
-  if (seconds < 60) return `${seconds}s`;
+  if (seconds < 60)
+    return `${seconds}s`;
   const minutes = Math.floor(seconds / 60);
   const remainingSec = seconds % 60;
   return `${minutes}m ${remainingSec}s`;
@@ -996,14 +851,19 @@ function riskScore(summary) {
   return Math.min(100, score);
 }
 function riskRating(score) {
-  if (score >= 80) return "Critical";
-  if (score >= 60) return "High";
-  if (score >= 30) return "Medium";
-  if (score >= 10) return "Low";
+  if (score >= 80)
+    return "Critical";
+  if (score >= 60)
+    return "High";
+  if (score >= 30)
+    return "Medium";
+  if (score >= 10)
+    return "Low";
   return "Informational";
 }
 function truncate(text, maxLen) {
-  if (text.length <= maxLen) return text;
+  if (text.length <= maxLen)
+    return text;
   return text.slice(0, maxLen - 3) + "...";
 }
 async function generatePdfReport(report, outputPath) {
@@ -1041,10 +901,13 @@ function renderCoverPage(doc, report) {
   doc.fontSize(14).font("Helvetica").fillColor(COLORS.white).text("Automated Penetration Test Report", PAGE_MARGIN, 260, { align: "center" });
   doc.moveTo(200, 300).lineTo(412, 300).strokeColor(COLORS.accent).lineWidth(2).stroke();
   doc.fontSize(18).font("Helvetica-Bold").fillColor(COLORS.white).text(report.target, PAGE_MARGIN, 330, { align: "center" });
-  doc.fontSize(12).font("Helvetica").fillColor(COLORS.textLight).text(`Scan Depth: ${report.scanDepth}`, PAGE_MARGIN, 370, { align: "center" }).text(`Date: ${formatDate(report.startedAt)}`, PAGE_MARGIN, 390, { align: "center" }).text(`Duration: ${formatDuration3(report.durationMs)}`, PAGE_MARGIN, 410, { align: "center" });
+  doc.fontSize(12).font("Helvetica").fillColor(COLORS.textLight).text(`Scan Depth: ${report.scanDepth}`, PAGE_MARGIN, 370, { align: "center" }).text(`Date: ${formatDate(report.startedAt)}`, PAGE_MARGIN, 390, { align: "center" }).text(`Duration: ${formatDuration2(report.durationMs)}`, PAGE_MARGIN, 410, { align: "center" });
+  const firstFinding = [...report.findings].sort(compareFindingsByBusinessPriority)[0];
+  if (firstFinding)
+    doc.fontSize(14).font("Helvetica-Bold").fillColor(COLORS.white).text(`Business priority: ${getFindingPriority(firstFinding).label}`, PAGE_MARGIN, 440, { align: "center" });
   const score = riskScore(report.summary);
   const rating = riskRating(score);
-  doc.fontSize(14).font("Helvetica-Bold").fillColor(COLORS.accent).text(`Risk Score: ${score}/100 (${rating})`, PAGE_MARGIN, 460, { align: "center" });
+  doc.fontSize(14).font("Helvetica-Bold").fillColor(COLORS.accent).text(`Technical Risk Score: ${score}/100 (${rating})`, PAGE_MARGIN, 460, { align: "center" });
   doc.fontSize(9).font("Helvetica").fillColor(COLORS.textLight).text("CONFIDENTIAL - For authorized recipients only", PAGE_MARGIN, 700, { align: "center" });
 }
 function renderExecutiveSummary(doc, report) {
@@ -1053,19 +916,18 @@ function renderExecutiveSummary(doc, report) {
   const score = riskScore(report.summary);
   const rating = riskRating(score);
   const { summary } = report;
-  doc.fontSize(11).font("Helvetica").fillColor(COLORS.text).text(
-    `An automated penetration test was conducted against ${report.target} on ${formatDate(report.startedAt)}. The scan ran for ${formatDuration3(report.durationMs)} at "${report.scanDepth}" depth.`,
-    PAGE_MARGIN,
-    doc.y + 10,
-    { width: CONTENT_WIDTH }
-  );
+  doc.fontSize(11).font("Helvetica").fillColor(COLORS.text).text(`An automated penetration test was conducted against ${report.target} on ${formatDate(report.startedAt)}. The scan ran for ${formatDuration2(report.durationMs)} at "${report.scanDepth}" depth.`, PAGE_MARGIN, doc.y + 10, { width: CONTENT_WIDTH });
   doc.moveDown(0.5);
-  doc.text(
-    `The overall risk score is ${score}/100 (${rating}). A total of ${summary.totalFindings} finding(s) were identified across ${summary.totalAttacks} attack(s).`,
-    { width: CONTENT_WIDTH }
-  );
+  doc.text(`The technical risk score is ${score}/100 (${rating}). A total of ${summary.totalFindings} finding(s) were identified across ${summary.totalAttacks} attack(s).`, { width: CONTENT_WIDTH });
   doc.moveDown(1);
-  subSectionTitle(doc, "Findings by Severity");
+  subSectionTitle(doc, "Business priority");
+  for (const label of ["Urgent", "High", "Moderate", "Low", "Not assessed"]) {
+    const count = report.findings.filter((finding) => getFindingPriority(finding).label === label).length;
+    if (count)
+      doc.fontSize(10).font("Helvetica").fillColor(COLORS.text).text(`${label}: ${count}`);
+  }
+  doc.moveDown(0.5);
+  subSectionTitle(doc, "Findings by Technical Severity");
   const severities = ["critical", "high", "medium", "low", "info"];
   const sevCounts = {
     critical: summary.critical,
@@ -1076,7 +938,8 @@ function renderExecutiveSummary(doc, report) {
   };
   for (const sev of severities) {
     const count = sevCounts[sev];
-    if (count === 0) continue;
+    if (count === 0)
+      continue;
     const barWidth = Math.max(4, count / Math.max(summary.totalFindings, 1) * (CONTENT_WIDTH - 140));
     const y = doc.y;
     doc.fontSize(10).font("Helvetica-Bold").fillColor(COLORS.severity[sev]).text(severityLabel(sev), PAGE_MARGIN, y, { width: 70 });
@@ -1094,22 +957,21 @@ function renderExecutiveSummary(doc, report) {
   }
 }
 function renderFindingsTable(doc, report) {
-  if (report.findings.length === 0) return;
+  if (report.findings.length === 0)
+    return;
   doc.addPage();
   sectionTitle(doc, "Findings Overview");
-  const colWidths = { severity: 70, title: 220, category: 120, status: 80 };
+  const colWidths = { severity: 90, title: 210, category: 105, status: 80 };
   const tableX = PAGE_MARGIN;
   const headerY = doc.y + 5;
   doc.rect(tableX, headerY, CONTENT_WIDTH, 20).fill(COLORS.primary);
   doc.fontSize(9).font("Helvetica-Bold").fillColor(COLORS.white);
-  doc.text("Severity", tableX + 5, headerY + 5, { width: colWidths.severity });
+  doc.text("Business priority", tableX + 5, headerY + 5, { width: colWidths.severity });
   doc.text("Title", tableX + colWidths.severity + 5, headerY + 5, { width: colWidths.title });
   doc.text("Category", tableX + colWidths.severity + colWidths.title + 5, headerY + 5, { width: colWidths.category });
   doc.text("Status", tableX + colWidths.severity + colWidths.title + colWidths.category + 5, headerY + 5, { width: colWidths.status });
   doc.y = headerY + 22;
-  const sorted = [...report.findings].sort(
-    (a, b) => severityRank(b.severity) - severityRank(a.severity)
-  );
+  const sorted = [...report.findings].sort(compareFindingsByBusinessPriority);
   for (let i = 0; i < sorted.length; i++) {
     const finding = sorted[i];
     const rowY = doc.y;
@@ -1121,7 +983,7 @@ function renderFindingsTable(doc, report) {
       doc.rect(tableX, rowY, CONTENT_WIDTH, 18).fill(COLORS.background);
     }
     doc.fontSize(8).font("Helvetica");
-    doc.fillColor(COLORS.severity[finding.severity]).font("Helvetica-Bold").text(severityLabel(finding.severity), tableX + 5, rowY + 5, { width: colWidths.severity });
+    doc.fillColor(COLORS.text).font("Helvetica-Bold").text(getFindingPriority(finding).label, tableX + 5, rowY + 5, { width: colWidths.severity });
     doc.fillColor(COLORS.text).font("Helvetica").text(truncate(finding.title, 45), tableX + colWidths.severity + 5, rowY + 5, { width: colWidths.title });
     doc.text(finding.category, tableX + colWidths.severity + colWidths.title + 5, rowY + 5, { width: colWidths.category });
     doc.text(finding.status, tableX + colWidths.severity + colWidths.title + colWidths.category + 5, rowY + 5, { width: colWidths.status });
@@ -1129,16 +991,19 @@ function renderFindingsTable(doc, report) {
   }
 }
 function renderFindingDetails(doc, report) {
-  if (report.findings.length === 0) return;
-  const sorted = [...report.findings].sort(
-    (a, b) => severityRank(b.severity) - severityRank(a.severity)
-  );
+  if (report.findings.length === 0)
+    return;
+  const sorted = [...report.findings].sort(compareFindingsByBusinessPriority);
   for (const finding of sorted) {
     doc.addPage();
     sectionTitle(doc, finding.title);
-    doc.fontSize(10).font("Helvetica-Bold").fillColor(COLORS.severity[finding.severity]).text(`${severityLabel(finding.severity)} Severity`, PAGE_MARGIN, doc.y, { continued: true }).fillColor(COLORS.textLight).font("Helvetica").text(`  |  ${finding.category}  |  ${finding.status}  |  ID: ${finding.id}`);
-    if (finding.cvssScore != null) {
-      doc.fontSize(9).fillColor(COLORS.text).text(`CVSS Score: ${finding.cvssScore}${finding.cvssVector ? ` (${finding.cvssVector})` : ""}`, PAGE_MARGIN, doc.y + 2);
+    const priority = getFindingPriority(finding);
+    doc.fontSize(11).font("Helvetica-Bold").fillColor(COLORS.text).text(`Business priority: ${priority.label}`);
+    doc.fontSize(10).font("Helvetica").text(`Business impact rationale: ${priority.rationale}`, { width: CONTENT_WIDTH });
+    doc.moveDown(0.5);
+    doc.fontSize(10).font("Helvetica-Bold").fillColor(COLORS.severity[finding.severity]).text(`Technical severity: ${severityLabel(finding.severity)}`, PAGE_MARGIN, doc.y, { continued: true }).fillColor(COLORS.textLight).font("Helvetica").text(`  |  ${finding.category}  |  ${finding.status}  |  ID: ${finding.id}`);
+    if (finding.cvssScore != null || finding.cvssVector) {
+      doc.fontSize(9).fillColor(COLORS.text).text(`CVSS Score: ${finding.cvssScore ?? "Not provided"}${finding.cvssVector ? ` (${finding.cvssVector})` : ""}`, PAGE_MARGIN, doc.y + 2);
     }
     doc.moveDown(1);
     subSectionTitle(doc, "Description");
@@ -1161,26 +1026,24 @@ function renderFindingDetails(doc, report) {
   }
 }
 function renderReviewChecks(doc, report) {
-  if (!report.reviewChecks?.length) return;
+  if (!report.reviewChecks?.length)
+    return;
   doc.addPage();
   sectionTitle(doc, "Review Checks (Advisory)");
   for (const check of report.reviewChecks) {
-    if (doc.y > doc.page.height - PAGE_MARGIN - 80) doc.addPage();
+    if (doc.y > doc.page.height - PAGE_MARGIN - 80)
+      doc.addPage();
     subSectionTitle(doc, `${check.status.toUpperCase()}: ${check.name}`);
     doc.fontSize(10).font("Helvetica").fillColor(COLORS.text).text(`ID: ${check.id}`, PAGE_MARGIN, doc.y, { width: CONTENT_WIDTH }).text(`Reason: ${check.reason}`, { width: CONTENT_WIDTH });
-    if (check.fix) doc.text(`Suggested fix: ${check.fix}`, { width: CONTENT_WIDTH });
+    if (check.fix)
+      doc.text(`Suggested fix: ${check.fix}`, { width: CONTENT_WIDTH });
     doc.moveDown(1);
   }
 }
 function renderMethodology(doc, report) {
   doc.addPage();
   sectionTitle(doc, "Methodology");
-  doc.fontSize(10).font("Helvetica").fillColor(COLORS.text).text(
-    "This report was generated by 0, a fully autonomous agentic pentesting framework. The tool uses AI-driven attack generation and multi-agent consensus verification to identify security vulnerabilities.",
-    PAGE_MARGIN,
-    doc.y + 10,
-    { width: CONTENT_WIDTH }
-  );
+  doc.fontSize(10).font("Helvetica").fillColor(COLORS.text).text("This report was generated by 0, a fully autonomous agentic pentesting framework. The tool uses AI-driven attack generation and multi-agent consensus verification to identify security vulnerabilities.", PAGE_MARGIN, doc.y + 10, { width: CONTENT_WIDTH });
   doc.moveDown(1);
   subSectionTitle(doc, "Scan Parameters");
   const params = [
@@ -1188,7 +1051,7 @@ function renderMethodology(doc, report) {
     ["Scan Depth", report.scanDepth],
     ["Started", formatDate(report.startedAt)],
     ["Completed", formatDate(report.completedAt)],
-    ["Duration", formatDuration3(report.durationMs)],
+    ["Duration", formatDuration2(report.durationMs)],
     ["Total Attacks", String(report.summary.totalAttacks)],
     ["Total Findings", String(report.summary.totalFindings)]
   ];
@@ -1211,12 +1074,7 @@ function renderMethodology(doc, report) {
   }
   doc.moveDown(1);
   subSectionTitle(doc, "Disclaimer");
-  doc.fontSize(9).font("Helvetica").fillColor(COLORS.textLight).text(
-    "This automated scan provides a point-in-time assessment. It may not identify all vulnerabilities. Results should be validated by security professionals. The findings do not guarantee the absence of other security issues. This report is confidential and intended for authorized recipients only.",
-    PAGE_MARGIN,
-    doc.y,
-    { width: CONTENT_WIDTH }
-  );
+  doc.fontSize(9).font("Helvetica").fillColor(COLORS.textLight).text("This automated scan provides a point-in-time assessment. It may not identify all vulnerabilities. Results should be validated by security professionals. The findings do not guarantee the absence of other security issues. This report is confidential and intended for authorized recipients only.", PAGE_MARGIN, doc.y, { width: CONTENT_WIDTH });
 }
 function sectionTitle(doc, title) {
   doc.fontSize(20).font("Helvetica-Bold").fillColor(COLORS.primary).text(title, PAGE_MARGIN, PAGE_MARGIN);
@@ -1235,425 +1093,31 @@ function codeBlock(doc, text) {
     width: CONTENT_WIDTH - 20
   });
   const blockHeight = Math.min(textHeight + 16, 300);
-  const y = doc.y;
-  if (y + blockHeight > 740) {
+  if (doc.y + blockHeight > 740) {
     doc.addPage();
   }
-  doc.rect(PAGE_MARGIN, doc.y, CONTENT_WIDTH, blockHeight).fill("#f1f3f5");
-  doc.fontSize(8).font("Courier").fillColor(COLORS.text).text(displayText, PAGE_MARGIN + 10, doc.y - blockHeight + 8, {
+  const blockY = doc.y;
+  doc.rect(PAGE_MARGIN, blockY, CONTENT_WIDTH, blockHeight).fill("#f1f3f5");
+  doc.fontSize(8).font("Courier").fillColor(COLORS.text).text(displayText, PAGE_MARGIN + 10, blockY + 8, {
     width: CONTENT_WIDTH - 20,
     height: blockHeight - 16,
     ellipsis: true
   });
-  doc.y = doc.y + 4;
+  doc.y = blockY + blockHeight + 4;
 }
 function renderFooters(doc) {
   const pageCount = doc.bufferedPageRange().count;
   for (let i = 0; i < pageCount; i++) {
     doc.switchToPage(i);
-    if (i === 0) continue;
-    doc.fontSize(8).font("Helvetica").fillColor(COLORS.textLight).text(
-      `0 Pentest Report  |  Page ${i + 1} of ${pageCount}  |  CONFIDENTIAL`,
-      PAGE_MARGIN,
-      760,
-      { width: CONTENT_WIDTH, align: "center" }
-    );
-  }
-}
-
-// packages/cli/src/formatters/replay.ts
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function stripAnsi(s) {
-  return s.replace(/\x1b\[[0-9;]*m/g, "");
-}
-var BOX_WIDTH = 55;
-function boxTop(label) {
-  const inner = ` ${label} `;
-  const remaining = BOX_WIDTH - inner.length - 1;
-  return source_default.dim("\u250C\u2500 ") + source_default.bold.white(label) + source_default.dim(" " + "\u2500".repeat(Math.max(0, remaining)) + "\u2510");
-}
-function boxRow(content) {
-  const visible = stripAnsi(content);
-  const pad = Math.max(0, BOX_WIDTH - visible.length - 2);
-  return source_default.dim("\u2502") + " " + content + " ".repeat(pad) + source_default.dim("\u2502");
-}
-function boxBottom(withArrow) {
-  if (withArrow) {
-    const half = Math.floor((BOX_WIDTH - 1) / 2);
-    const rest = BOX_WIDTH - half - 1;
-    return source_default.dim("\u2514" + "\u2500".repeat(half) + "\u2534" + "\u2500".repeat(rest) + "\u2518");
-  }
-  return source_default.dim("\u2514" + "\u2500".repeat(BOX_WIDTH) + "\u2518");
-}
-function connector() {
-  const half = Math.floor((BOX_WIDTH + 1) / 2);
-  return " ".repeat(half) + source_default.dim("\u25BC");
-}
-function outcomeLabel(outcome) {
-  switch (outcome) {
-    case "vulnerable":
-      return source_default.red.bold("VULNERABLE");
-    case "leaked":
-      return source_default.red.bold("LEAKED");
-    case "bypassed":
-      return source_default.red.bold("BYPASSED");
-    case "safe":
-      return source_default.green("SAFE");
-    case "error":
-      return source_default.yellow("ERROR");
-    default:
-      return source_default.gray(outcome.toUpperCase());
-  }
-}
-function buildReplayLines(data) {
-  const lines = [];
-  const FAST = 50;
-  const MED = 75;
-  const SLOW = 100;
-  const PAUSE = 200;
-  lines.push({ text: boxTop("DISCOVER"), delay: PAUSE });
-  if (data.targetInfo) {
-    const t = data.targetInfo;
-    const truncUrl = t.url.length > 30 ? t.url.slice(0, 27) + "..." : t.url;
-    lines.push({
-      text: boxRow(
-        source_default.dim("\u25B8") + " " + source_default.white(`GET ${truncUrl}`) + source_default.dim(" \u2192 ") + source_default.white(`200`) + source_default.gray(` (${t.type} endpoint detected)`)
-      ),
-      delay: MED
-    });
-    if (t.systemPrompt) {
-      lines.push({
-        text: boxRow(
-          source_default.dim("\u25B8") + " " + source_default.white(`System prompt extracted`) + source_default.gray(` (${t.systemPrompt.length} chars)`)
-        ),
-        delay: MED
-      });
-    }
-    if (t.detectedFeatures && t.detectedFeatures.length > 0) {
-      lines.push({
-        text: boxRow(
-          source_default.dim("\u25B8") + " " + source_default.white(`${t.detectedFeatures.length} features detected: `) + source_default.gray(t.detectedFeatures.slice(0, 3).join(", "))
-        ),
-        delay: MED
-      });
-    }
-    if (t.endpoints && t.endpoints.length > 0) {
-      lines.push({
-        text: boxRow(
-          source_default.dim("\u25B8") + " " + source_default.white(`${t.endpoints.length} endpoints found`)
-        ),
-        delay: MED
-      });
-    }
-  } else {
-    const truncTarget = data.target.length > 30 ? data.target.slice(0, 27) + "..." : data.target;
-    lines.push({
-      text: boxRow(
-        source_default.dim("\u25B8") + " " + source_default.white(`GET ${truncTarget}`) + source_default.dim(" \u2192 ") + source_default.white("200") + source_default.gray(" (LLM API detected)")
-      ),
-      delay: MED
-    });
-  }
-  lines.push({ text: boxBottom(true), delay: FAST });
-  lines.push({ text: connector(), delay: PAUSE });
-  lines.push({ text: boxTop("ATTACK"), delay: PAUSE });
-  const vulnerableFindings = data.findings.filter(
-    (f) => f.status !== "false-positive"
-  );
-  if (vulnerableFindings.length > 0) {
-    for (const finding of vulnerableFindings.slice(0, 8)) {
-      const truncTitle = finding.title.length > 30 ? finding.title.slice(0, 27) + "..." : finding.title;
-      let outcome = "VULNERABLE";
-      const cat = finding.category;
-      if (cat === "system-prompt-extraction") outcome = "LEAKED";
-      if (cat === "jailbreak") outcome = "BYPASSED";
-      lines.push({
-        text: boxRow(
-          source_default.dim("\u25B8") + " " + source_default.white(truncTitle) + source_default.dim(" \u2192 ") + "  " + outcomeLabel(outcome.toLowerCase())
-        ),
-        delay: MED
-      });
-    }
-    if (vulnerableFindings.length > 8) {
-      lines.push({
-        text: boxRow(
-          source_default.gray(
-            `  ... and ${vulnerableFindings.length - 8} more attacks`
-          )
-        ),
-        delay: FAST
-      });
-    }
-  } else {
-    lines.push({
-      text: boxRow(
-        source_default.dim("\u25B8") + " " + source_default.white(`${data.summary.totalAttacks} probes executed`) + source_default.dim(" \u2192 ") + source_default.green("ALL SAFE")
-      ),
-      delay: MED
-    });
-  }
-  lines.push({ text: boxBottom(true), delay: FAST });
-  lines.push({ text: connector(), delay: PAUSE });
-  lines.push({ text: boxTop("VERIFY"), delay: PAUSE });
-  const confirmed = data.findings.filter(
-    (f) => f.status === "confirmed" || f.status === "verified" || f.status === "scored" || f.status === "reported"
-  );
-  const falsePositives = data.findings.filter(
-    (f) => f.status === "false-positive"
-  );
-  if (confirmed.length > 0 || data.findings.length > 0) {
-    const reproduced = confirmed.length > 0 ? confirmed.length : data.findings.length;
-    lines.push({
-      text: boxRow(
-        source_default.green("\u2713") + " " + source_default.white(`Reproduced ${reproduced}/${reproduced} findings`)
-      ),
-      delay: MED
-    });
+    if (i === 0)
+      continue;
+    doc.fontSize(8).font("Helvetica").fillColor(COLORS.textLight).text(`0 Pentest Report  |  Page ${i + 1} of ${pageCount}  |  CONFIDENTIAL`, PAGE_MARGIN, 760, { width: CONTENT_WIDTH, align: "center" });
   }
-  if (falsePositives.length > 0) {
-    lines.push({
-      text: boxRow(
-        source_default.red("\u2717") + " " + source_default.white(`Eliminated ${falsePositives.length} false positives`)
-      ),
-      delay: MED
-    });
-  }
-  if (confirmed.length === 0 && falsePositives.length === 0 && data.findings.length === 0) {
-    lines.push({
-      text: boxRow(source_default.green("\u2713") + " " + source_default.white("No findings to verify")),
-      delay: MED
-    });
-  }
-  lines.push({ text: boxBottom(true), delay: FAST });
-  lines.push({ text: connector(), delay: PAUSE });
-  lines.push({ text: boxTop("REPORT"), delay: PAUSE });
-  const totalFindings = data.summary.totalFindings;
-  if (totalFindings > 0) {
-    const parts = [];
-    if (data.summary.critical > 0) parts.push(source_default.red.bold(`${data.summary.critical} CRITICAL`));
-    if (data.summary.high > 0) parts.push(source_default.redBright(`${data.summary.high} HIGH`));
-    if (data.summary.medium > 0) parts.push(source_default.yellow(`${data.summary.medium} MEDIUM`));
-    if (data.summary.low > 0) parts.push(source_default.blue(`${data.summary.low} LOW`));
-    if (data.summary.info > 0) parts.push(source_default.gray(`${data.summary.info} INFO`));
-    lines.push({
-      text: boxRow(
-        source_default.white(`${totalFindings} verified findings: `) + parts.join(source_default.dim(", "))
-      ),
-      delay: MED
-    });
-  } else {
-    lines.push({
-      text: boxRow(source_default.green.bold("0 findings") + source_default.white(" - target appears secure")),
-      delay: MED
-    });
-  }
-  const duration = data.durationMs < 1e3 ? `${data.durationMs}ms` : `${(data.durationMs / 1e3).toFixed(1)}s`;
-  lines.push({
-    text: boxRow(
-      source_default.white(`Completed in ${duration}`) + source_default.dim(" \u2192 ") + source_default.gray("./0-report.json")
-    ),
-    delay: MED
-  });
-  lines.push({ text: boxBottom(false), delay: FAST });
-  return lines;
-}
-async function renderReplay(data) {
-  const lines = buildReplayLines(data);
-  process.stdout.write("\n");
-  process.stdout.write(
-    source_default.red.bold("  \u25C6 0") + source_default.gray(" attack replay") + "\n"
-  );
-  process.stdout.write(
-    source_default.dim("  " + "\u2500".repeat(BOX_WIDTH + 1)) + "\n"
-  );
-  process.stdout.write("\n");
-  await sleep(200);
-  for (const line of lines) {
-    await sleep(line.delay);
-    process.stdout.write("  " + line.text + "\n");
-  }
-  process.stdout.write("\n");
-}
-
-// packages/cli/src/formatters/timeline.ts
-var TIMELINE_FORMATS = ["json", "csv", "markdown"];
-function isTimelineFormat(value) {
-  return TIMELINE_FORMATS.includes(value);
-}
-function formatTimeline(record, format) {
-  switch (format) {
-    case "json":
-      return formatTimelineJson(record);
-    case "csv":
-      return formatTimelineCsv(record);
-    case "markdown":
-      return formatTimelineMarkdown(record);
-  }
-}
-function formatTimelineJson(record) {
-  return JSON.stringify(record, null, 2);
-}
-var CSV_COLUMNS = [
-  "timestamp",
-  "stage",
-  "eventType",
-  "agentRole",
-  "findingId",
-  "action",
-  "attackTechniqueIds",
-  "attackTactics",
-  // Appended, never interleaved with the ATT&CK columns — an importer that
-  // only knows the ATT&CK pair keeps working, and the two taxonomies stay
-  // visibly distinct in a spreadsheet.
-  "atlasTechniqueIds",
-  "atlasTactics"
-];
-function formatTimelineCsv(record) {
-  const lines = [CSV_COLUMNS.join(",")];
-  for (const entry of record.entries) {
-    lines.push(
-      [
-        entry.timestamp,
-        entry.stage,
-        entry.eventType,
-        entry.agentRole ?? "",
-        entry.findingId ?? "",
-        entry.action,
-        entry.techniques.map((t) => t.id).join(" "),
-        uniq(entry.techniques.map((t) => t.tactic)).join(" "),
-        entry.atlasTechniques.map((t) => t.id).join(" "),
-        uniq(entry.atlasTechniques.map((t) => t.tactic)).join(" ")
-      ].map(csvCell).join(",")
-    );
-  }
-  return lines.join("\n") + "\n";
-}
-function csvCell(value) {
-  if (!/[",\r\n]/.test(value)) return value;
-  return `"${value.replace(/"/g, '""')}"`;
-}
-function formatTimelineMarkdown(record) {
-  const out = [];
-  out.push(`# Forensic timeline \u2014 scan \`${record.scanId}\``);
-  out.push("");
-  if (record.target) out.push(`- **Target:** ${record.target}`);
-  out.push(`- **Generated:** ${record.generatedAt}`);
-  out.push(`- **Events:** ${record.eventCount} of ${record.totalEventCount} recorded`);
-  if (record.filters.since) out.push(`- **Since:** ${record.filters.since}`);
-  if (record.filters.until) out.push(`- **Until:** ${record.filters.until}`);
-  if (record.filters.attackOnly) {
-    out.push(`- **Filter:** technique-mapped events only (pipeline lifecycle events omitted)`);
-  }
-  out.push("");
-  out.push("All timestamps are UTC (ISO-8601).");
-  out.push("");
-  out.push(
-    "ATT&CK (Enterprise) and ATLAS (AI systems) are separate matrices; a row may carry either, both, or neither."
-  );
-  out.push("");
-  if (record.entries.length === 0) {
-    out.push("_No pipeline events recorded for this scan in the selected window._");
-    out.push("");
-    return out.join("\n");
-  }
-  out.push("| # | Timestamp (UTC) | Stage | Event | Agent | Finding | Action | ATT&CK | ATLAS |");
-  out.push("| --- | --- | --- | --- | --- | --- | --- | --- | --- |");
-  record.entries.forEach((entry, i) => {
-    out.push(
-      "| " + [
-        String(i + 1),
-        entry.timestamp,
-        mdCell(entry.stage),
-        mdCell(entry.eventType),
-        mdCell(entry.agentRole ?? "\u2014"),
-        mdCell(entry.findingId ?? "\u2014"),
-        mdCell(entry.action),
-        mdTechniques(entry.techniques),
-        mdTechniques(entry.atlasTechniques)
-      ].join(" | ") + " |"
-    );
-  });
-  out.push("");
-  return out.join("\n");
-}
-function mdTechniques(techniques) {
-  return techniques.length > 0 ? techniques.map(mdTechnique).join(", ") : "\u2014";
-}
-function mdTechnique(technique) {
-  const label = mdCell(`${technique.id} ${technique.name}`);
-  return technique.url ? `[${label}](${technique.url})` : label;
-}
-function mdCell(value) {
-  return value.replace(/\s+/g, " ").replace(/\|/g, "\\|").trim();
-}
-function uniq(values) {
-  return [...new Set(values.filter((v) => v.length > 0))];
-}
-
-// packages/cli/src/formatters/index.ts
-function formatPresentationDocument(document, format) {
-  if (format === "json" && document.documentType !== "scan-report") {
-    return JSON.stringify(document.report, null, 2);
-  }
-  const report = document.documentType === "scan-report" ? document.report : document.documentType === "audit-report" ? {
-    target: `${document.report.package}@${document.report.version}`,
-    scanDepth: "deep",
-    startedAt: document.report.startedAt,
-    completedAt: document.report.completedAt,
-    durationMs: document.report.durationMs,
-    summary: document.report.summary,
-    findings: document.report.findings,
-    warnings: []
-  } : {
-    target: document.report.repo,
-    scanDepth: "deep",
-    startedAt: document.report.startedAt,
-    completedAt: document.report.completedAt,
-    durationMs: document.report.durationMs,
-    summary: document.report.summary,
-    findings: document.report.findings,
-    warnings: document.report.warnings?.map((warning) => ({ stage: "report", message: `[${warning.stage}] ${warning.message}` })) ?? [],
-    executionSuccessful: document.report.researchFailed ? false : void 0,
-    reviewChecks: document.report.reviewChecks
-  };
-  switch (format) {
-    case "terminal":
-      return formatTerminal(report);
-    case "json":
-      return formatJson(report);
-    case "markdown":
-      return formatMarkdown(report);
-    case "html":
-      return formatHtml(report);
-    case "sarif":
-      return formatSarif(report);
-    case "pdf":
-      return "[PDF output requires generatePdfReport()]";
-  }
-}
-function formatReport(report, format) {
-  return formatPresentationDocument(createScanReportDocument(report), format);
-}
-function formatAuditReport(report, format) {
-  return formatPresentationDocument(createAuditReportDocument(report), format);
-}
-function formatReviewReport(report, format) {
-  return formatPresentationDocument(createReviewReportDocument(report), format);
 }
 
 export {
-  renderReplay,
-  getRuntimeAvailability,
-  checkRuntimeAvailability,
-  buildShareUrl,
+  formatMarkdown,
+  formatHtml,
   formatSarif,
-  generatePdfReport,
-  TIMELINE_FORMATS,
-  isTimelineFormat,
-  formatTimeline,
-  formatReport,
-  formatAuditReport,
-  formatReviewReport
+  generatePdfReport
 };