0sec-cli 0.24.1 → 0.26.0

package/chunks/chunk-H5QURBBK.js

@@ -1,1123 +0,0 @@
-#!/usr/bin/env node
-import { createRequire as __0CreateRequire } from "node:module";
-const require = __0CreateRequire(import.meta.url);
-import {
-  SEVERITY_RANK,
-  VERSION,
-  compareFindingsByBusinessPriority,
-  getFindingPriority
-} from "./chunk-GXXX7AGH.js";
-
-// packages/core/dist/report-formatters/markdown.js
-var EVIDENCE_BLOCK_LIMIT = 4e3;
-var POC_STEP_LIMIT = 20;
-function formatMarkdown(report) {
-  const lines = [];
-  lines.push("# 0 Scan Report");
-  lines.push("");
-  lines.push(`| Field | Value |`);
-  lines.push(`|-------|-------|`);
-  lines.push(`| Target | ${report.target} |`);
-  lines.push(`| Depth | ${report.scanDepth} |`);
-  lines.push(`| Started | ${report.startedAt} |`);
-  lines.push(`| Duration | ${(report.durationMs / 1e3).toFixed(1)}s |`);
-  lines.push("");
-  lines.push("## Summary");
-  lines.push("");
-  lines.push(`- **Attacks:** ${report.summary.totalAttacks}`);
-  lines.push(`- **Findings:** ${report.summary.totalFindings}`);
-  for (const label of ["Urgent", "High", "Moderate", "Low", "Not assessed"]) {
-    const count = report.findings.filter((finding) => getFindingPriority(finding).label === label).length;
-    if (count)
-      lines.push(`- **Business priority \u2014 ${label}:** ${count}`);
-  }
-  lines.push("", "### Technical severity", "");
-  if (report.summary.critical > 0)
-    lines.push(`- **Critical:** ${report.summary.critical}`);
-  if (report.summary.high > 0)
-    lines.push(`- **High:** ${report.summary.high}`);
-  if (report.summary.medium > 0)
-    lines.push(`- **Medium:** ${report.summary.medium}`);
-  if (report.summary.low > 0)
-    lines.push(`- **Low:** ${report.summary.low}`);
-  lines.push("");
-  if (report.warnings.length > 0) {
-    lines.push("## Warnings");
-    lines.push("");
-    for (const warning of report.warnings) {
-      lines.push(`- **${warning.stage}:** ${warning.message}`);
-    }
-    lines.push("");
-  }
-  if (report.reviewChecks?.length) {
-    lines.push("## Review Checks (Advisory)", "");
-    const literal = (text) => text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/([\\`*_{}\[\]()#+.!|~-])/g, "\\$1");
-    for (const check of report.reviewChecks) {
-      lines.push(`### ${check.status.toUpperCase()}: ${literal(check.name)}`, "");
-      lines.push(`- **ID:** ${literal(check.id)}`);
-      lines.push(`- **Reason:** ${literal(check.reason)}`);
-      if (check.fix)
-        lines.push(`- **Suggested fix:** ${literal(check.fix)}`);
-      lines.push("");
-    }
-  }
-  if (report.findings.length > 0) {
-    lines.push("## Findings");
-    lines.push("");
-    for (const finding of [...report.findings].sort(compareFindingsByBusinessPriority)) {
-      lines.push(formatFinding(finding));
-    }
-  } else {
-    lines.push(report.warnings.length > 0 ? "## No Confirmed Vulnerabilities" : "## No Vulnerabilities Found");
-    lines.push("");
-    lines.push(report.warnings.length > 0 ? "The scanner did not confirm vulnerabilities, but target validation or probe execution produced warnings." : report.reviewChecks?.length ? "No security vulnerabilities were found in the inspected scope. Advisory review-check results are reported separately above." : "The target passed all tests.");
-  }
-  return lines.join("\n");
-}
-function evidenceBlock(label, raw) {
-  const lines = [];
-  lines.push(`**${label}:**`);
-  if (!raw) {
-    lines.push("");
-    lines.push("_(not captured)_");
-    return lines;
-  }
-  const truncated = raw.length > EVIDENCE_BLOCK_LIMIT;
-  const body = truncated ? raw.slice(0, EVIDENCE_BLOCK_LIMIT) : raw;
-  lines.push("```");
-  lines.push(body);
-  lines.push("```");
-  if (truncated) {
-    lines.push(`_Truncated for readability: ${raw.length - EVIDENCE_BLOCK_LIMIT} of ${raw.length} characters not shown. Use \`--format json\` or \`--format sarif\` for the complete evidence._`);
-  }
-  return lines;
-}
-function remediationSection(remediation) {
-  const lines = [];
-  lines.push("**Remediation:**");
-  lines.push("");
-  lines.push(remediation.summary);
-  if (remediation.steps.length > 0) {
-    lines.push("");
-    for (const step of remediation.steps)
-      lines.push(`1. ${step}`);
-  }
-  if (remediation.codeExample) {
-    const { before, after, language } = remediation.codeExample;
-    lines.push("");
-    lines.push("<details>");
-    lines.push("<summary>Suggested change</summary>");
-    lines.push("");
-    lines.push("Before:");
-    lines.push("");
-    lines.push("```" + language);
-    lines.push(before);
-    lines.push("```");
-    lines.push("");
-    lines.push("After:");
-    lines.push("");
-    lines.push("```" + language);
-    lines.push(after);
-    lines.push("```");
-    lines.push("</details>");
-  }
-  if (remediation.references.length > 0) {
-    lines.push("");
-    lines.push("References:");
-    for (const ref of remediation.references)
-      lines.push(`- ${ref}`);
-  }
-  lines.push("");
-  return lines;
-}
-function reproductionSection(steps) {
-  const lines = [];
-  lines.push("**Reproduction steps:**");
-  lines.push("");
-  const shown = steps.slice(0, POC_STEP_LIMIT);
-  shown.forEach((step, i) => {
-    lines.push(`${i + 1}. **[${step.kind}]** ${step.summary}`);
-  });
-  if (steps.length > shown.length) {
-    lines.push("");
-    lines.push(`_${steps.length - shown.length} further step(s) omitted; the full graph is in \`--format json\`._`);
-  }
-  lines.push("");
-  return lines;
-}
-function formatFinding(finding) {
-  const lines = [];
-  const priority = getFindingPriority(finding);
-  lines.push(`### [${priority.label}] ${finding.title}`);
-  lines.push("");
-  lines.push(`- **Business priority:** ${priority.label}`);
-  lines.push(`- **Business impact rationale:** ${priority.rationale}`);
-  lines.push(`- **Technical severity:** ${finding.severity}`);
-  lines.push(`- **Category:** ${finding.category}`);
-  lines.push(`- **Status:** ${finding.status}`);
-  if (finding.cvssScore !== void 0 || finding.cvssVector) {
-    const score = finding.cvssScore !== void 0 ? `${finding.cvssScore}` : "n/a";
-    const vector = finding.cvssVector ? ` (\`${finding.cvssVector}\`)` : "";
-    lines.push(`- **CVSS:** ${score}${vector}`);
-  }
-  if (finding.confidence !== void 0) {
-    lines.push(`- **Confidence:** ${(finding.confidence * 100).toFixed(0)}%`);
-  }
-  if (finding.triageNote) {
-    lines.push(`- **Triage:** ${finding.triageNote}`);
-  }
-  lines.push(`- **Description:** ${finding.description}`);
-  lines.push("");
-  if (finding.evidence.analysis) {
-    lines.push(`**Evidence:** ${finding.evidence.analysis}`);
-    lines.push("");
-  }
-  if (finding.pocSteps && finding.pocSteps.length > 0) {
-    lines.push(...reproductionSection(finding.pocSteps));
-  }
-  if (finding.remediation) {
-    lines.push(...remediationSection(finding.remediation));
-  }
-  lines.push("<details>");
-  lines.push("<summary>Request / Response</summary>");
-  lines.push("");
-  lines.push(...evidenceBlock("Request", finding.evidence.request));
-  lines.push("");
-  lines.push(...evidenceBlock("Response", finding.evidence.response));
-  lines.push("</details>");
-  lines.push("");
-  return lines.join("\n");
-}
-
-// packages/core/dist/report-formatters/html.js
-function escapeHtml(str) {
-  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-var SEVERITY_COLORS = {
-  critical: { bg: "#991b1b", text: "#ffffff", accent: "#f87171" },
-  high: { bg: "#c2410c", text: "#ffffff", accent: "#fb923c" },
-  medium: { bg: "#a16207", text: "#000000", accent: "#facc15" },
-  low: { bg: "#1d4ed8", text: "#ffffff", accent: "#60a5fa" },
-  info: { bg: "#4b5563", text: "#ffffff", accent: "#9ca3af" }
-};
-var SEVERITY_ORDER = Object.keys(SEVERITY_RANK).sort((a, b) => SEVERITY_RANK[b] - SEVERITY_RANK[a]);
-function formatCategory(cat) {
-  return cat.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
-}
-function formatDuration(ms) {
-  if (ms < 1e3)
-    return `${ms}ms`;
-  return `${(ms / 1e3).toFixed(1)}s`;
-}
-function riskLevel(summary) {
-  if (summary.critical > 0)
-    return { label: "CRITICAL", color: "#ef4444" };
-  if (summary.high > 0)
-    return { label: "HIGH", color: "#f97316" };
-  if (summary.medium > 0)
-    return { label: "MEDIUM", color: "#eab308" };
-  if (summary.low > 0)
-    return { label: "LOW", color: "#3b82f6" };
-  return { label: "CLEAN", color: "#22c55e" };
-}
-function renderFinding(finding, index) {
-  const sev = SEVERITY_COLORS[finding.severity];
-  const priority = getFindingPriority(finding);
-  const confidence = finding.confidence != null ? `${Math.round(finding.confidence * 100)}%` : null;
-  const cvss = finding.cvssScore != null ? finding.cvssScore.toFixed(1) : null;
-  const rank = finding.findingRank != null ? `Rank: ${finding.findingRank}` : null;
-  const dedupe = finding.semanticDedupe ? `Canonical: ${escapeHtml(finding.semanticDedupe.canonicalId.slice(0, 12))}\u2026` : null;
-  return `
-    <div class="finding-card">
-      <div class="finding-header">
-        <span class="severity-badge" style="background:#1a1a2e;color:#fff">Business priority: ${priority.label}</span>
-        <span class="finding-title">${escapeHtml(finding.title)}</span>
-      </div>
-      <p class="finding-desc"><strong>Business impact rationale:</strong> ${escapeHtml(priority.rationale)}</p>
-      <div class="finding-meta">
-        <span class="meta-tag" style="background:${sev.bg};color:${sev.text}">Technical severity: ${finding.severity}</span>
-        <span class="meta-tag">Category: ${formatCategory(finding.category)}</span>
-        ${finding.status === "confirmed" ? '<span class="meta-tag confirmed">Confirmed</span>' : `<span class="meta-tag">${escapeHtml(finding.status)}</span>`}
-        ${confidence ? `<span class="meta-tag">Confidence: ${confidence}</span>` : ""}
-        ${cvss ? `<span class="meta-tag">CVSS: ${cvss}</span>` : ""}
-        ${finding.cvssVector ? `<span class="meta-tag">CVSS vector: ${escapeHtml(finding.cvssVector)}</span>` : ""}
-        ${rank ? `<span class="meta-tag">${rank}</span>` : ""}
-        ${dedupe ? `<span class="meta-tag">${dedupe}</span>` : ""}
-      </div>
-      <p class="finding-desc">${escapeHtml(finding.description)}</p>
-      ${finding.evidence.analysis ? `<div class="evidence-analysis"><strong>Analysis:</strong> ${escapeHtml(finding.evidence.analysis)}</div>` : ""}
-      <details class="evidence-details">
-        <summary>Request / Response</summary>
-        <div class="evidence-block">
-          <div class="evidence-label">Request</div>
-          <pre><code>${escapeHtml(finding.evidence.request.slice(0, 2e3))}</code></pre>
-        </div>
-        <div class="evidence-block">
-          <div class="evidence-label">Response</div>
-          <pre><code>${escapeHtml(finding.evidence.response.slice(0, 2e3))}</code></pre>
-        </div>
-      </details>
-    </div>`;
-}
-function renderSeverityBar(summary) {
-  const total = summary.critical + summary.high + summary.medium + summary.low + summary.info;
-  if (total === 0)
-    return "";
-  const segments = SEVERITY_ORDER.filter((s) => summary[s] > 0).map((s) => {
-    const pct = summary[s] / total * 100;
-    return `<div class="bar-segment" style="width:${pct}%;background:${SEVERITY_COLORS[s].accent}" title="${summary[s]} ${s}"></div>`;
-  }).join("");
-  return `<div class="severity-bar">${segments}</div>`;
-}
-function formatHtml(report) {
-  const risk = riskLevel(report.summary);
-  const sorted = [...report.findings].sort(compareFindingsByBusinessPriority);
-  const businessPriority = sorted[0] ? getFindingPriority(sorted[0]).label : "No findings";
-  const findingsHtml = sorted.length > 0 ? sorted.map((f, i) => renderFinding(f, i)).join("\n") : `<div class="no-findings">${report.warnings.length > 0 || report.executionSuccessful === false ? "No vulnerabilities confirmed. Scan finished with warnings." : report.reviewChecks?.length ? "No security vulnerabilities found. See advisory review-check results below." : "No vulnerabilities found. Target passed all tests."}</div>`;
-  const warningsHtml = report.warnings.length > 0 ? `<div class="section">
-        <h2 class="section-title warning-title">Warnings</h2>
-        ${report.warnings.map((w) => `<div class="warning-item"><span class="warning-stage">${escapeHtml(w.stage)}</span> ${escapeHtml(w.message)}</div>`).join("\n")}
-      </div>` : "";
-  const checksHtml = report.reviewChecks?.length ? `<div class="section"><h2 class="section-title">Review Checks (Advisory)</h2>
-       ${report.reviewChecks.map((check) => `<div class="warning-item">
-         <h3>${escapeHtml(check.status.toUpperCase())}: ${escapeHtml(check.name)}</h3>
-         <p><strong>ID:</strong> ${escapeHtml(check.id)}</p>
-         <p style="white-space:pre-wrap"><strong>Reason:</strong> ${escapeHtml(check.reason)}</p>
-         ${check.fix ? `<p style="white-space:pre-wrap"><strong>Suggested fix:</strong> ${escapeHtml(check.fix)}</p>` : ""}
-       </div>`).join("\n")}</div>` : "";
-  const sevCountsHtml = SEVERITY_ORDER.map((s) => {
-    const count = report.summary[s];
-    return `<div class="sev-count"><span class="sev-dot" style="background:${SEVERITY_COLORS[s].accent}"></span><span class="sev-label">${s}</span><span class="sev-num">${count}</span></div>`;
-  }).join("");
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="UTF-8">
-<meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>0 Report \u2014 ${escapeHtml(report.target)}</title>
-<style>
-  * { margin: 0; padding: 0; box-sizing: border-box; }
-  body {
-    background: #09090b;
-    color: #d4d4d8;
-    font-family: 'SF Mono', 'Cascadia Code', 'Fira Code', 'JetBrains Mono', 'Consolas', monospace;
-    font-size: 14px;
-    line-height: 1.6;
-    padding: 2rem;
-    max-width: 960px;
-    margin: 0 auto;
-  }
-  a { color: #f87171; text-decoration: none; }
-  a:hover { text-decoration: underline; }
-
-  /* Header */
-  .header {
-    border-bottom: 1px solid #27272a;
-    padding-bottom: 1.5rem;
-    margin-bottom: 2rem;
-  }
-  .header-top {
-    display: flex;
-    align-items: center;
-    justify-content: space-between;
-    flex-wrap: wrap;
-    gap: 1rem;
-  }
-  .brand {
-    color: #f87171;
-    font-size: 1.6rem;
-    font-weight: bold;
-    letter-spacing: 0.15em;
-  }
-  .brand-sub { color: #52525b; font-size: 0.8rem; }
-  .risk-badge {
-    font-size: 0.85rem;
-    font-weight: bold;
-    padding: 0.3rem 1rem;
-    border-radius: 4px;
-    letter-spacing: 0.1em;
-  }
-  .meta-grid {
-    display: grid;
-    grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
-    gap: 0.5rem;
-    margin-top: 1rem;
-    font-size: 0.85rem;
-    color: #71717a;
-  }
-  .meta-grid span { display: block; }
-  .meta-grid strong { color: #a1a1aa; }
-
-  /* Summary */
-  .summary-section {
-    display: grid;
-    grid-template-columns: 1fr 1fr;
-    gap: 1.5rem;
-    margin-bottom: 2rem;
-    padding-bottom: 1.5rem;
-    border-bottom: 1px solid #27272a;
-  }
-  @media (max-width: 600px) {
-    .summary-section { grid-template-columns: 1fr; }
-  }
-  .stat-box {
-    background: #18181b;
-    border: 1px solid #27272a;
-    border-radius: 6px;
-    padding: 1rem;
-  }
-  .stat-box h3 {
-    color: #71717a;
-    font-size: 0.75rem;
-    letter-spacing: 0.1em;
-    text-transform: uppercase;
-    margin-bottom: 0.5rem;
-  }
-  .stat-box .big-num {
-    font-size: 2rem;
-    font-weight: bold;
-    color: #fafafa;
-  }
-  .sev-counts {
-    display: flex;
-    flex-wrap: wrap;
-    gap: 0.75rem;
-    margin-top: 0.5rem;
-  }
-  .sev-count {
-    display: flex;
-    align-items: center;
-    gap: 0.35rem;
-    font-size: 0.8rem;
-  }
-  .sev-dot {
-    width: 8px;
-    height: 8px;
-    border-radius: 50%;
-    display: inline-block;
-  }
-  .sev-label { color: #71717a; }
-  .sev-num { color: #d4d4d8; font-weight: bold; }
-
-  .severity-bar {
-    display: flex;
-    height: 6px;
-    border-radius: 3px;
-    overflow: hidden;
-    margin-top: 0.75rem;
-  }
-  .bar-segment { min-width: 4px; }
-
-  /* Findings */
-  .section { margin-bottom: 2rem; }
-  .section-title {
-    color: #f87171;
-    font-size: 0.9rem;
-    letter-spacing: 0.1em;
-    text-transform: uppercase;
-    margin-bottom: 1rem;
-  }
-  .warning-title { color: #facc15; }
-
-  .finding-card {
-    background: #18181b;
-    border: 1px solid #27272a;
-    border-radius: 6px;
-    padding: 1rem;
-    margin-bottom: 0.75rem;
-  }
-  .finding-header {
-    display: flex;
-    align-items: center;
-    gap: 0.75rem;
-    margin-bottom: 0.5rem;
-  }
-  .severity-badge {
-    font-size: 0.7rem;
-    font-weight: bold;
-    padding: 0.15rem 0.5rem;
-    border-radius: 3px;
-    letter-spacing: 0.05em;
-    flex-shrink: 0;
-  }
-  .finding-title {
-    color: #fafafa;
-    font-weight: bold;
-    font-size: 0.95rem;
-  }
-  .finding-meta {
-    display: flex;
-    flex-wrap: wrap;
-    gap: 0.5rem;
-    margin-bottom: 0.5rem;
-  }
-  .meta-tag {
-    font-size: 0.75rem;
-    color: #71717a;
-    background: #27272a;
-    padding: 0.1rem 0.5rem;
-    border-radius: 3px;
-  }
-  .meta-tag.confirmed { color: #4ade80; background: #052e16; }
-  .finding-desc {
-    color: #a1a1aa;
-    font-size: 0.85rem;
-    margin-bottom: 0.5rem;
-  }
-  .evidence-analysis {
-    color: #a1a1aa;
-    font-size: 0.85rem;
-    font-style: italic;
-    padding: 0.5rem;
-    background: #1c1c1e;
-    border-left: 3px solid #3f3f46;
-    border-radius: 2px;
-    margin-bottom: 0.5rem;
-  }
-  .evidence-details {
-    margin-top: 0.5rem;
-  }
-  .evidence-details summary {
-    cursor: pointer;
-    color: #71717a;
-    font-size: 0.8rem;
-    padding: 0.3rem 0;
-  }
-  .evidence-details summary:hover { color: #a1a1aa; }
-  .evidence-block {
-    margin-top: 0.5rem;
-  }
-  .evidence-label {
-    font-size: 0.75rem;
-    color: #71717a;
-    text-transform: uppercase;
-    letter-spacing: 0.05em;
-    margin-bottom: 0.25rem;
-  }
-  .evidence-details pre {
-    background: #0a0a0a;
-    border: 1px solid #27272a;
-    border-radius: 4px;
-    padding: 0.75rem;
-    overflow-x: auto;
-    font-size: 0.8rem;
-    line-height: 1.5;
-    color: #a1a1aa;
-    white-space: pre-wrap;
-    word-break: break-word;
-  }
-
-  .no-findings {
-    background: #052e16;
-    color: #4ade80;
-    padding: 1rem;
-    border-radius: 6px;
-    border: 1px solid #166534;
-    font-size: 0.9rem;
-  }
-
-  .warning-item {
-    padding: 0.4rem 0.5rem;
-    margin-bottom: 0.25rem;
-    background: #1c1307;
-    border-left: 3px solid #facc15;
-    border-radius: 2px;
-    font-size: 0.85rem;
-  }
-  .warning-stage {
-    color: #facc15;
-    font-weight: bold;
-    margin-right: 0.5rem;
-  }
-
-  /* Timeline */
-  .timeline {
-    font-size: 0.8rem;
-    color: #71717a;
-  }
-  .timeline-row {
-    display: flex;
-    gap: 0.5rem;
-    padding: 0.2rem 0;
-  }
-  .timeline-label { color: #52525b; min-width: 80px; }
-  .timeline-value { color: #a1a1aa; }
-
-  /* Footer */
-  .footer {
-    margin-top: 2rem;
-    padding-top: 1rem;
-    border-top: 1px solid #27272a;
-    color: #3f3f46;
-    font-size: 0.75rem;
-    text-align: center;
-  }
-</style>
-</head>
-<body>
-  <div class="header">
-    <div class="header-top">
-      <div>
-        <div class="brand">ZERO</div>
-        <div class="brand-sub">Security Scan Report</div>
-      </div>
-      <div class="risk-badge" style="background:#1a1a2e;color:#fff">Business priority: ${businessPriority}</div>
-    </div>
-    <div class="meta-grid">
-      <span><strong>Target:</strong> ${escapeHtml(report.target)}</span>
-      <span><strong>Technical risk:</strong> ${risk.label}</span>
-      <span><strong>Depth:</strong> ${report.scanDepth}</span>
-      <span><strong>Duration:</strong> ${formatDuration(report.durationMs)}</span>
-      <span><strong>Started:</strong> ${escapeHtml(report.startedAt)}</span>
-    </div>
-  </div>
-
-  <div class="summary-section">
-    <div class="stat-box">
-      <h3>Findings</h3>
-      <div class="big-num">${report.summary.totalFindings}</div>
-      <div class="sev-counts">${["Urgent", "High", "Moderate", "Low", "Not assessed"].map((label) => {
-    const count = report.findings.filter((finding) => getFindingPriority(finding).label === label).length;
-    return count ? `<span>Business priority ${label}: ${count}</span>` : "";
-  }).join(" ")}</div>
-      <h3>Technical severity</h3>
-      <div class="sev-counts">
-        ${sevCountsHtml}
-      </div>
-      ${renderSeverityBar(report.summary)}
-    </div>
-    <div class="stat-box">
-      <h3>Attacks Tested</h3>
-      <div class="big-num">${report.summary.totalAttacks}</div>
-      <div class="timeline">
-        <div class="timeline-row"><span class="timeline-label">Started</span><span class="timeline-value">${escapeHtml(report.startedAt)}</span></div>
-        <div class="timeline-row"><span class="timeline-label">Completed</span><span class="timeline-value">${escapeHtml(report.completedAt)}</span></div>
-        <div class="timeline-row"><span class="timeline-label">Duration</span><span class="timeline-value">${formatDuration(report.durationMs)}</span></div>
-      </div>
-    </div>
-  </div>
-
-  ${warningsHtml}
-
-  <div class="section">
-    <h2 class="section-title">Findings</h2>
-    ${findingsHtml}
-  </div>
-
-  ${checksHtml}
-
-  <div class="footer">
-    Generated by 0 &middot; ${escapeHtml((/* @__PURE__ */ new Date()).toISOString())}
-  </div>
-</body>
-</html>`;
-}
-
-// packages/core/dist/report-formatters/sarif.js
-function severityToLevel(severity) {
-  switch (severity) {
-    case "critical":
-    case "high":
-      return "error";
-    case "medium":
-      return "warning";
-    case "low":
-    case "info":
-      return "note";
-  }
-}
-function stableFingerprint(finding, target) {
-  return [
-    finding.fingerprint,
-    finding.templateId,
-    finding.category,
-    finding.title,
-    target
-  ].filter(Boolean).join("|");
-}
-function actionSummary(step) {
-  switch (step.action.type) {
-    case "shell":
-      return { type: "shell", command: step.action.cmd, cwd: step.action.cwd };
-    case "http":
-      return {
-        type: "http",
-        method: step.action.method,
-        url: step.action.url,
-        headers: step.action.headers
-      };
-    case "docker":
-      return { type: "docker", image: step.action.image, args: step.action.args };
-    case "note":
-      return { type: "note" };
-  }
-}
-function pocStepsToCodeFlows(pocSteps, target) {
-  if (!pocSteps || pocSteps.length === 0)
-    return void 0;
-  return [
-    {
-      threadFlows: [
-        {
-          locations: pocSteps.map((step) => ({
-            location: {
-              physicalLocation: {
-                artifactLocation: { uri: target }
-              },
-              message: { text: `${step.kind}: ${step.summary}` },
-              properties: {
-                stepId: step.id,
-                kind: step.kind,
-                action: actionSummary(step),
-                expect: step.expect
-              }
-            }
-          }))
-        }
-      ]
-    }
-  ];
-}
-function findingToResult(finding, target) {
-  const result = {
-    ruleId: finding.templateId,
-    level: severityToLevel(finding.severity),
-    message: { text: finding.description },
-    locations: [
-      {
-        physicalLocation: {
-          artifactLocation: { uri: target }
-        }
-      }
-    ],
-    partialFingerprints: {
-      primary: stableFingerprint(finding, target)
-    }
-  };
-  const codeFlows = pocStepsToCodeFlows(finding.pocSteps, target);
-  if (codeFlows)
-    result.codeFlows = codeFlows;
-  const priority = getFindingPriority(finding);
-  result.properties = {
-    businessPriority: priority.label,
-    businessPriorityRank: priority.rank,
-    businessPriorityAssessed: priority.assessed,
-    businessPriorityRationale: priority.rationale,
-    findingId: finding.id,
-    category: finding.category,
-    severity: finding.severity,
-    status: finding.status,
-    evidence: finding.evidence
-  };
-  if (finding.impactAssessment)
-    result.properties["impactAssessment"] = finding.impactAssessment;
-  if (finding.cvssScore !== void 0)
-    result.properties["cvssScore"] = finding.cvssScore;
-  if (finding.cvssVector)
-    result.properties["cvssVector"] = finding.cvssVector;
-  if (finding.confidence !== void 0)
-    result.properties["confidence"] = finding.confidence;
-  if (finding.publishability)
-    result.properties["publishability"] = finding.publishability;
-  if (finding.noveltyVerdict)
-    result.properties["noveltyVerdict"] = finding.noveltyVerdict;
-  if (finding.dedupRefs)
-    result.properties["dedupRefs"] = finding.dedupRefs;
-  if (finding.advisoryMatches)
-    result.properties["advisoryMatches"] = finding.advisoryMatches;
-  if (finding.verification_result)
-    result.properties["verificationResult"] = finding.verification_result;
-  if (finding.inlineValidation)
-    result.properties["inlineValidation"] = finding.inlineValidation;
-  if (finding.supplyChain)
-    result.properties["supplyChain"] = finding.supplyChain;
-  if (finding.kernelExploit)
-    result.properties["kernelExploit"] = finding.kernelExploit;
-  if (finding.semanticDedupe)
-    result.properties["semanticDedupe"] = finding.semanticDedupe;
-  if (finding.findingRank !== void 0)
-    result.properties["findingRank"] = finding.findingRank;
-  return result;
-}
-function findingToRule(finding) {
-  return {
-    id: finding.templateId,
-    name: finding.title,
-    shortDescription: { text: finding.title },
-    defaultConfiguration: { level: severityToLevel(finding.severity) },
-    properties: {
-      category: finding.category,
-      severity: finding.severity
-    }
-  };
-}
-function formatSarif(report) {
-  const rulesMap = /* @__PURE__ */ new Map();
-  for (const finding of report.findings) {
-    if (!rulesMap.has(finding.templateId)) {
-      rulesMap.set(finding.templateId, findingToRule(finding));
-    }
-  }
-  for (const check of report.reviewChecks ?? []) {
-    rulesMap.set(`review-check/${check.id}`, {
-      id: `review-check/${check.id}`,
-      name: check.name,
-      shortDescription: { text: check.name },
-      defaultConfiguration: { level: "note" },
-      properties: { advisory: true }
-    });
-  }
-  const sarif = {
-    $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
-    version: "2.1.0",
-    runs: [
-      {
-        tool: {
-          driver: {
-            name: "0",
-            version: VERSION,
-            informationUri: "https://github.com/0sec-labs/0",
-            rules: Array.from(rulesMap.values())
-          }
-        },
-        results: [
-          ...[...report.findings].sort(compareFindingsByBusinessPriority).map((f) => findingToResult(f, report.target)),
-          ...(report.reviewChecks ?? []).map((check) => ({
-            ruleId: `review-check/${check.id}`,
-            kind: check.status === "pass" ? "pass" : check.status === "issue" ? "fail" : "open",
-            level: "note",
-            message: { text: `${check.name}: ${check.reason}${check.fix ? `
-Suggested fix: ${check.fix}` : ""}` },
-            properties: { advisory: true, reviewCheck: check }
-          }))
-        ],
-        invocations: [
-          {
-            executionSuccessful: report.executionSuccessful !== false,
-            startTimeUtc: report.startedAt,
-            endTimeUtc: report.completedAt
-          }
-        ]
-      }
-    ]
-  };
-  return JSON.stringify(sarif, null, 2);
-}
-
-// packages/core/dist/report-formatters/pdf.js
-import { createRequire } from "node:module";
-import { createWriteStream } from "node:fs";
-var COLORS = {
-  primary: "#1a1a2e",
-  accent: "#e94560",
-  background: "#f8f9fa",
-  text: "#2d2d2d",
-  textLight: "#6c757d",
-  white: "#ffffff",
-  severity: {
-    critical: "#dc2626",
-    high: "#ea580c",
-    medium: "#ca8a04",
-    low: "#2563eb",
-    info: "#6b7280"
-  }
-};
-var PAGE_MARGIN = 50;
-var CONTENT_WIDTH = 612 - PAGE_MARGIN * 2;
-function severityLabel(s) {
-  return s.charAt(0).toUpperCase() + s.slice(1);
-}
-function formatDate(iso) {
-  return new Date(iso).toLocaleDateString("en-US", {
-    year: "numeric",
-    month: "long",
-    day: "numeric",
-    hour: "2-digit",
-    minute: "2-digit"
-  });
-}
-function formatDuration2(ms) {
-  if (ms < 1e3)
-    return `${ms}ms`;
-  const seconds = Math.floor(ms / 1e3);
-  if (seconds < 60)
-    return `${seconds}s`;
-  const minutes = Math.floor(seconds / 60);
-  const remainingSec = seconds % 60;
-  return `${minutes}m ${remainingSec}s`;
-}
-function riskScore(summary) {
-  const score = summary.critical * 40 + summary.high * 20 + summary.medium * 10 + summary.low * 3 + summary.info * 0;
-  return Math.min(100, score);
-}
-function riskRating(score) {
-  if (score >= 80)
-    return "Critical";
-  if (score >= 60)
-    return "High";
-  if (score >= 30)
-    return "Medium";
-  if (score >= 10)
-    return "Low";
-  return "Informational";
-}
-function truncate(text, maxLen) {
-  if (text.length <= maxLen)
-    return text;
-  return text.slice(0, maxLen - 3) + "...";
-}
-async function generatePdfReport(report, outputPath) {
-  const require_ = createRequire(import.meta.url);
-  const PDFDocument = require_("pdfkit");
-  return new Promise((resolve, reject) => {
-    const doc = new PDFDocument({
-      size: "LETTER",
-      margins: { top: PAGE_MARGIN, bottom: PAGE_MARGIN, left: PAGE_MARGIN, right: PAGE_MARGIN },
-      info: {
-        Title: `0 Pentest Report - ${report.target}`,
-        Author: "0",
-        Subject: "Automated Penetration Test Report",
-        CreationDate: /* @__PURE__ */ new Date()
-      },
-      bufferPages: true
-    });
-    const stream = createWriteStream(outputPath);
-    stream.on("error", reject);
-    stream.on("finish", resolve);
-    doc.pipe(stream);
-    renderCoverPage(doc, report);
-    renderExecutiveSummary(doc, report);
-    renderFindingsTable(doc, report);
-    renderFindingDetails(doc, report);
-    renderReviewChecks(doc, report);
-    renderMethodology(doc, report);
-    renderFooters(doc);
-    doc.end();
-  });
-}
-function renderCoverPage(doc, report) {
-  doc.rect(0, 0, 612, 792).fill(COLORS.primary);
-  doc.fontSize(48).font("Helvetica-Bold").fillColor(COLORS.accent).text("0", PAGE_MARGIN, 200, { align: "center" });
-  doc.fontSize(14).font("Helvetica").fillColor(COLORS.white).text("Automated Penetration Test Report", PAGE_MARGIN, 260, { align: "center" });
-  doc.moveTo(200, 300).lineTo(412, 300).strokeColor(COLORS.accent).lineWidth(2).stroke();
-  doc.fontSize(18).font("Helvetica-Bold").fillColor(COLORS.white).text(report.target, PAGE_MARGIN, 330, { align: "center" });
-  doc.fontSize(12).font("Helvetica").fillColor(COLORS.textLight).text(`Scan Depth: ${report.scanDepth}`, PAGE_MARGIN, 370, { align: "center" }).text(`Date: ${formatDate(report.startedAt)}`, PAGE_MARGIN, 390, { align: "center" }).text(`Duration: ${formatDuration2(report.durationMs)}`, PAGE_MARGIN, 410, { align: "center" });
-  const firstFinding = [...report.findings].sort(compareFindingsByBusinessPriority)[0];
-  if (firstFinding)
-    doc.fontSize(14).font("Helvetica-Bold").fillColor(COLORS.white).text(`Business priority: ${getFindingPriority(firstFinding).label}`, PAGE_MARGIN, 440, { align: "center" });
-  const score = riskScore(report.summary);
-  const rating = riskRating(score);
-  doc.fontSize(14).font("Helvetica-Bold").fillColor(COLORS.accent).text(`Technical Risk Score: ${score}/100 (${rating})`, PAGE_MARGIN, 460, { align: "center" });
-  doc.fontSize(9).font("Helvetica").fillColor(COLORS.textLight).text("CONFIDENTIAL - For authorized recipients only", PAGE_MARGIN, 700, { align: "center" });
-}
-function renderExecutiveSummary(doc, report) {
-  doc.addPage();
-  sectionTitle(doc, "Executive Summary");
-  const score = riskScore(report.summary);
-  const rating = riskRating(score);
-  const { summary } = report;
-  doc.fontSize(11).font("Helvetica").fillColor(COLORS.text).text(`An automated penetration test was conducted against ${report.target} on ${formatDate(report.startedAt)}. The scan ran for ${formatDuration2(report.durationMs)} at "${report.scanDepth}" depth.`, PAGE_MARGIN, doc.y + 10, { width: CONTENT_WIDTH });
-  doc.moveDown(0.5);
-  doc.text(`The technical risk score is ${score}/100 (${rating}). A total of ${summary.totalFindings} finding(s) were identified across ${summary.totalAttacks} attack(s).`, { width: CONTENT_WIDTH });
-  doc.moveDown(1);
-  subSectionTitle(doc, "Business priority");
-  for (const label of ["Urgent", "High", "Moderate", "Low", "Not assessed"]) {
-    const count = report.findings.filter((finding) => getFindingPriority(finding).label === label).length;
-    if (count)
-      doc.fontSize(10).font("Helvetica").fillColor(COLORS.text).text(`${label}: ${count}`);
-  }
-  doc.moveDown(0.5);
-  subSectionTitle(doc, "Findings by Technical Severity");
-  const severities = ["critical", "high", "medium", "low", "info"];
-  const sevCounts = {
-    critical: summary.critical,
-    high: summary.high,
-    medium: summary.medium,
-    low: summary.low,
-    info: summary.info
-  };
-  for (const sev of severities) {
-    const count = sevCounts[sev];
-    if (count === 0)
-      continue;
-    const barWidth = Math.max(4, count / Math.max(summary.totalFindings, 1) * (CONTENT_WIDTH - 140));
-    const y = doc.y;
-    doc.fontSize(10).font("Helvetica-Bold").fillColor(COLORS.severity[sev]).text(severityLabel(sev), PAGE_MARGIN, y, { width: 70 });
-    doc.rect(PAGE_MARGIN + 80, y + 2, barWidth, 12).fill(COLORS.severity[sev]);
-    doc.fontSize(10).font("Helvetica").fillColor(COLORS.text).text(String(count), PAGE_MARGIN + 90 + barWidth, y, { width: 40 });
-    doc.y = y + 22;
-  }
-  if (report.warnings.length > 0) {
-    doc.moveDown(1);
-    subSectionTitle(doc, "Warnings");
-    for (const w of report.warnings) {
-      doc.fontSize(9).font("Helvetica").fillColor(COLORS.textLight).text(`[${w.stage}] ${w.message}`, PAGE_MARGIN, doc.y, { width: CONTENT_WIDTH });
-      doc.moveDown(0.3);
-    }
-  }
-}
-function renderFindingsTable(doc, report) {
-  if (report.findings.length === 0)
-    return;
-  doc.addPage();
-  sectionTitle(doc, "Findings Overview");
-  const colWidths = { severity: 90, title: 210, category: 105, status: 80 };
-  const tableX = PAGE_MARGIN;
-  const headerY = doc.y + 5;
-  doc.rect(tableX, headerY, CONTENT_WIDTH, 20).fill(COLORS.primary);
-  doc.fontSize(9).font("Helvetica-Bold").fillColor(COLORS.white);
-  doc.text("Business priority", tableX + 5, headerY + 5, { width: colWidths.severity });
-  doc.text("Title", tableX + colWidths.severity + 5, headerY + 5, { width: colWidths.title });
-  doc.text("Category", tableX + colWidths.severity + colWidths.title + 5, headerY + 5, { width: colWidths.category });
-  doc.text("Status", tableX + colWidths.severity + colWidths.title + colWidths.category + 5, headerY + 5, { width: colWidths.status });
-  doc.y = headerY + 22;
-  const sorted = [...report.findings].sort(compareFindingsByBusinessPriority);
-  for (let i = 0; i < sorted.length; i++) {
-    const finding = sorted[i];
-    const rowY = doc.y;
-    if (rowY > 720) {
-      doc.addPage();
-      doc.y = PAGE_MARGIN;
-    }
-    if (i % 2 === 0) {
-      doc.rect(tableX, rowY, CONTENT_WIDTH, 18).fill(COLORS.background);
-    }
-    doc.fontSize(8).font("Helvetica");
-    doc.fillColor(COLORS.text).font("Helvetica-Bold").text(getFindingPriority(finding).label, tableX + 5, rowY + 5, { width: colWidths.severity });
-    doc.fillColor(COLORS.text).font("Helvetica").text(truncate(finding.title, 45), tableX + colWidths.severity + 5, rowY + 5, { width: colWidths.title });
-    doc.text(finding.category, tableX + colWidths.severity + colWidths.title + 5, rowY + 5, { width: colWidths.category });
-    doc.text(finding.status, tableX + colWidths.severity + colWidths.title + colWidths.category + 5, rowY + 5, { width: colWidths.status });
-    doc.y = rowY + 20;
-  }
-}
-function renderFindingDetails(doc, report) {
-  if (report.findings.length === 0)
-    return;
-  const sorted = [...report.findings].sort(compareFindingsByBusinessPriority);
-  for (const finding of sorted) {
-    doc.addPage();
-    sectionTitle(doc, finding.title);
-    const priority = getFindingPriority(finding);
-    doc.fontSize(11).font("Helvetica-Bold").fillColor(COLORS.text).text(`Business priority: ${priority.label}`);
-    doc.fontSize(10).font("Helvetica").text(`Business impact rationale: ${priority.rationale}`, { width: CONTENT_WIDTH });
-    doc.moveDown(0.5);
-    doc.fontSize(10).font("Helvetica-Bold").fillColor(COLORS.severity[finding.severity]).text(`Technical severity: ${severityLabel(finding.severity)}`, PAGE_MARGIN, doc.y, { continued: true }).fillColor(COLORS.textLight).font("Helvetica").text(`  |  ${finding.category}  |  ${finding.status}  |  ID: ${finding.id}`);
-    if (finding.cvssScore != null || finding.cvssVector) {
-      doc.fontSize(9).fillColor(COLORS.text).text(`CVSS Score: ${finding.cvssScore ?? "Not provided"}${finding.cvssVector ? ` (${finding.cvssVector})` : ""}`, PAGE_MARGIN, doc.y + 2);
-    }
-    doc.moveDown(1);
-    subSectionTitle(doc, "Description");
-    doc.fontSize(10).font("Helvetica").fillColor(COLORS.text).text(finding.description, PAGE_MARGIN, doc.y, { width: CONTENT_WIDTH });
-    if (finding.evidence.request) {
-      doc.moveDown(1);
-      subSectionTitle(doc, "Request");
-      codeBlock(doc, finding.evidence.request);
-    }
-    if (finding.evidence.response) {
-      doc.moveDown(0.5);
-      subSectionTitle(doc, "Response");
-      codeBlock(doc, finding.evidence.response);
-    }
-    if (finding.evidence.analysis) {
-      doc.moveDown(0.5);
-      subSectionTitle(doc, "Analysis & Remediation");
-      doc.fontSize(10).font("Helvetica").fillColor(COLORS.text).text(finding.evidence.analysis, PAGE_MARGIN, doc.y, { width: CONTENT_WIDTH });
-    }
-  }
-}
-function renderReviewChecks(doc, report) {
-  if (!report.reviewChecks?.length)
-    return;
-  doc.addPage();
-  sectionTitle(doc, "Review Checks (Advisory)");
-  for (const check of report.reviewChecks) {
-    if (doc.y > doc.page.height - PAGE_MARGIN - 80)
-      doc.addPage();
-    subSectionTitle(doc, `${check.status.toUpperCase()}: ${check.name}`);
-    doc.fontSize(10).font("Helvetica").fillColor(COLORS.text).text(`ID: ${check.id}`, PAGE_MARGIN, doc.y, { width: CONTENT_WIDTH }).text(`Reason: ${check.reason}`, { width: CONTENT_WIDTH });
-    if (check.fix)
-      doc.text(`Suggested fix: ${check.fix}`, { width: CONTENT_WIDTH });
-    doc.moveDown(1);
-  }
-}
-function renderMethodology(doc, report) {
-  doc.addPage();
-  sectionTitle(doc, "Methodology");
-  doc.fontSize(10).font("Helvetica").fillColor(COLORS.text).text("This report was generated by 0, a fully autonomous agentic pentesting framework. The tool uses AI-driven attack generation and multi-agent consensus verification to identify security vulnerabilities.", PAGE_MARGIN, doc.y + 10, { width: CONTENT_WIDTH });
-  doc.moveDown(1);
-  subSectionTitle(doc, "Scan Parameters");
-  const params = [
-    ["Target", report.target],
-    ["Scan Depth", report.scanDepth],
-    ["Started", formatDate(report.startedAt)],
-    ["Completed", formatDate(report.completedAt)],
-    ["Duration", formatDuration2(report.durationMs)],
-    ["Total Attacks", String(report.summary.totalAttacks)],
-    ["Total Findings", String(report.summary.totalFindings)]
-  ];
-  for (const [label, value] of params) {
-    doc.fontSize(10).font("Helvetica-Bold").fillColor(COLORS.text).text(`${label}: `, PAGE_MARGIN, doc.y, { continued: true }).font("Helvetica").text(value);
-    doc.moveDown(0.2);
-  }
-  doc.moveDown(1);
-  subSectionTitle(doc, "Severity Definitions");
-  const sevDefs = [
-    ["Critical", "Immediate exploitation possible with severe business impact. Requires urgent remediation."],
-    ["High", "Easily exploitable vulnerability with significant impact. Should be fixed in the next release cycle."],
-    ["Medium", "Exploitable with some prerequisites. Should be addressed in planned maintenance."],
-    ["Low", "Minor issue with limited impact. Fix as part of regular development."],
-    ["Info", "Informational finding or best-practice recommendation. No immediate risk."]
-  ];
-  for (const [sev, desc] of sevDefs) {
-    doc.fontSize(10).font("Helvetica-Bold").fillColor(COLORS.text).text(`${sev}: `, PAGE_MARGIN, doc.y, { continued: true }).font("Helvetica").fillColor(COLORS.textLight).text(desc, { width: CONTENT_WIDTH - 60 });
-    doc.moveDown(0.3);
-  }
-  doc.moveDown(1);
-  subSectionTitle(doc, "Disclaimer");
-  doc.fontSize(9).font("Helvetica").fillColor(COLORS.textLight).text("This automated scan provides a point-in-time assessment. It may not identify all vulnerabilities. Results should be validated by security professionals. The findings do not guarantee the absence of other security issues. This report is confidential and intended for authorized recipients only.", PAGE_MARGIN, doc.y, { width: CONTENT_WIDTH });
-}
-function sectionTitle(doc, title) {
-  doc.fontSize(20).font("Helvetica-Bold").fillColor(COLORS.primary).text(title, PAGE_MARGIN, PAGE_MARGIN);
-  doc.moveTo(PAGE_MARGIN, doc.y + 4).lineTo(PAGE_MARGIN + CONTENT_WIDTH, doc.y + 4).strokeColor(COLORS.accent).lineWidth(1.5).stroke();
-  doc.y += 12;
-}
-function subSectionTitle(doc, title) {
-  doc.fontSize(12).font("Helvetica-Bold").fillColor(COLORS.primary).text(title, PAGE_MARGIN, doc.y);
-  doc.moveDown(0.3);
-}
-function codeBlock(doc, text) {
-  const maxChars = 2e3;
-  const displayText = truncate(text, maxChars);
-  doc.font("Courier").fontSize(8);
-  const textHeight = doc.heightOfString(displayText, {
-    width: CONTENT_WIDTH - 20
-  });
-  const blockHeight = Math.min(textHeight + 16, 300);
-  if (doc.y + blockHeight > 740) {
-    doc.addPage();
-  }
-  const blockY = doc.y;
-  doc.rect(PAGE_MARGIN, blockY, CONTENT_WIDTH, blockHeight).fill("#f1f3f5");
-  doc.fontSize(8).font("Courier").fillColor(COLORS.text).text(displayText, PAGE_MARGIN + 10, blockY + 8, {
-    width: CONTENT_WIDTH - 20,
-    height: blockHeight - 16,
-    ellipsis: true
-  });
-  doc.y = blockY + blockHeight + 4;
-}
-function renderFooters(doc) {
-  const pageCount = doc.bufferedPageRange().count;
-  for (let i = 0; i < pageCount; i++) {
-    doc.switchToPage(i);
-    if (i === 0)
-      continue;
-    doc.fontSize(8).font("Helvetica").fillColor(COLORS.textLight).text(`0 Pentest Report  |  Page ${i + 1} of ${pageCount}  |  CONFIDENTIAL`, PAGE_MARGIN, 760, { width: CONTENT_WIDTH, align: "center" });
-  }
-}
-
-export {
-  formatMarkdown,
-  formatHtml,
-  formatSarif,
-  generatePdfReport
-};