@intentius/chant 0.124.13 → 0.124.15

package/dist/audit/proof.js

@@ -0,0 +1,321 @@
+/**
+ * Proof of minimal change — for a deterministic (fixKind: "deterministic")
+ * finding, produce a minimal patched YAML + unified diff so a PR can show it
+ * changes exactly the flagged line and nothing else.
+ *
+ * No LLM, no API key — purely mechanical text edits. Findings that need
+ * judgment (fixKind: "guidance") are NOT auto-fixed here; they return
+ * `applied: false` with the catalog remediation as guidance. Any LLM-assisted
+ * apply of a guidance fix is a separate, optional, local concern.
+ *
+ * Edits are applied directly to the YAML text (not via a model round-trip), so
+ * the patched output differs only where intended — the diff proves it.
+ */
+import { RULE_CATALOG } from "./catalog.js";
+const SHA_RE = /^[0-9a-f]{40}$/;
+const USES_RE = /^(\s*-?\s*uses:\s*)([^@\s'"]+)@([^\s'"#]+)(.*)$/;
+const IMAGE_RE = /^(\s*image:\s*)(["']?)([^\s"'#]+)\2(.*)$/;
+function notApplied(checkId, reason, note) {
+    return { checkId, applied: false, reason, note };
+}
+/** Extract unpinned `uses: action@ref` references (deduped) from workflow YAML. */
+export function extractUnpinnedActions(content) {
+    const seen = new Set();
+    const out = [];
+    for (const line of content.split("\n")) {
+        const m = line.match(USES_RE);
+        if (!m)
+            continue;
+        const [, , action, ref] = m;
+        if (SHA_RE.test(ref))
+            continue;
+        const key = `${action}@${ref}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push({ action, ref });
+    }
+    return out;
+}
+/** Pin unpinned `uses: action@ref` lines to a SHA. */
+function pinActions(content, opts) {
+    const lines = content.split("\n");
+    let changed = false;
+    let needsSha = false;
+    for (let i = 0; i < lines.length; i++) {
+        const m = lines[i].match(USES_RE);
+        if (!m)
+            continue;
+        const [, prefix, action, ref, rest] = m;
+        if (SHA_RE.test(ref))
+            continue; // already pinned
+        const sha = opts.resolveSha?.(action, ref);
+        if (!sha) {
+            needsSha = true;
+            continue;
+        }
+        lines[i] = `${prefix}${action}@${sha}  # ${ref}${rest.replace(/\s*#.*$/, "")}`;
+        changed = true;
+    }
+    return { patched: lines.join("\n"), changed, needsSha };
+}
+/** A container image is unpinnable here if it lacks a digest and isn't a variable. */
+function isPinnableImage(ref) {
+    return !ref.includes("@sha256:") && !ref.includes("$");
+}
+/** Extract unpinned `image:` references (deduped) from CI YAML. */
+export function extractUnpinnedImages(content) {
+    const seen = new Set();
+    const out = [];
+    for (const line of content.split("\n")) {
+        const m = line.match(IMAGE_RE);
+        if (!m)
+            continue;
+        const ref = m[3];
+        if (!isPinnableImage(ref) || seen.has(ref))
+            continue;
+        seen.add(ref);
+        out.push(ref);
+    }
+    return out;
+}
+/** Pin unpinned `image:` references to a digest via the resolver. */
+function pinImages(content, opts) {
+    const lines = content.split("\n");
+    let changed = false;
+    let needsValue = false;
+    for (let i = 0; i < lines.length; i++) {
+        const m = lines[i].match(IMAGE_RE);
+        if (!m)
+            continue;
+        const [, prefix, , ref, rest] = m;
+        if (!isPinnableImage(ref))
+            continue;
+        const digest = opts.resolveDigest?.(ref);
+        if (!digest) {
+            needsValue = true;
+            continue;
+        }
+        lines[i] = `${prefix}${ref}@${digest}${rest.replace(/\s*#.*$/, "")}`;
+        changed = true;
+    }
+    return { patched: lines.join("\n"), changed, needsValue };
+}
+/** Insert a least-privilege top-level permissions block if absent. */
+function addPermissions(content) {
+    if (/^permissions:/m.test(content))
+        return { patched: content, changed: false };
+    const lines = content.split("\n");
+    const jobsIdx = lines.findIndex((l) => /^jobs:\s*$/.test(l));
+    if (jobsIdx === -1)
+        return { patched: content, changed: false };
+    lines.splice(jobsIdx, 0, "permissions:", "  contents: read");
+    return { patched: lines.join("\n"), changed: true };
+}
+/** Replace a top-level `permissions: write-all` with a least-privilege block. */
+function narrowWriteAll(content) {
+    const re = /^permissions:[ \t]+write-all[ \t]*$/m;
+    if (!re.test(content))
+        return { patched: content, changed: false };
+    return { patched: content.replace(re, "permissions:\n  contents: read"), changed: true };
+}
+/**
+ * TF019 — drop a meta-argument explicitly set to its own default `false`
+ * (`sensitive`, `ephemeral`, `prevent_destroy`, `create_before_destroy`). The
+ * fix is the deletion of the whole line, which is what tflint-ruleset-redeploy's
+ * own autofix for `terraform_redundant_default` does. Only a literal `false` is
+ * touched: `prevent_destroy = var.protect` is left alone, and so is a line with
+ * a trailing comment, where deleting the line would delete prose too.
+ */
+const REDUNDANT_DEFAULT_RE = /^[ \t]*(?:sensitive|ephemeral|prevent_destroy|create_before_destroy)[ \t]*=[ \t]*false[ \t]*$/;
+function dropRedundantDefaults(content) {
+    const kept = content.split("\n").filter((line) => !REDUNDANT_DEFAULT_RE.test(line));
+    const patched = kept.join("\n");
+    return { patched, changed: patched !== content };
+}
+/**
+ * TF016 — unwrap an attribute whose whole value is one interpolation
+ * (`x = "${var.y}"` becomes `x = var.y`), the deprecated pre-0.12 style
+ * tflint's `terraform_deprecated_interpolation` reports. Anchored on the
+ * source text rather than the parsed body for the reason TF016's own module
+ * gives: `@cdktn/hcl2json` renders a bare reference and a quoted interpolation
+ * identically, so the quotes only exist here.
+ */
+const INTERPOLATION_ONLY_RE = /^([ \t]*)([A-Za-z_][A-Za-z0-9_-]*)([ \t]*=[ \t]*)"\$\{([^"]+)\}"([ \t]*(?:#.*)?)$/;
+/**
+ * Parse a line whose whole value is one interpolation. Exported because a rule
+ * and its fix have to agree on what counts: the terraform lexicon's TF016
+ * check calls this over a block's source text, and `unwrapInterpolations`
+ * below rewrites exactly the lines it accepts.
+ */
+export function interpolationOnlyLine(line) {
+    const m = INTERPOLATION_ONLY_RE.exec(line);
+    if (!m)
+        return undefined;
+    const expr = m[4];
+    // A nested `${` means the template is not one interpolation (it embeds
+    // another), and a `}` before the end means the interpolation closed early,
+    // so the quotes are carrying literal text as well.
+    if (expr.includes("${") || expr.includes("}"))
+        return undefined;
+    return { name: m[2], expr, unwrapped: `${m[1]}${m[2]}${m[3]}${expr}${m[5]}` };
+}
+function unwrapInterpolations(content) {
+    let changed = false;
+    const lines = content.split("\n").map((line) => {
+        const parsed = interpolationOnlyLine(line);
+        if (!parsed)
+            return line;
+        changed = true;
+        return parsed.unwrapped;
+    });
+    return { patched: lines.join("\n"), changed };
+}
+/**
+ * Produce a deterministic fix + diff for a finding, if one is mechanical.
+ * Returns `applied: false` with guidance for non-deterministic findings.
+ */
+export function proveFix(checkId, content, opts = {}) {
+    const cat = (opts.catalog ?? RULE_CATALOG)[checkId];
+    if (cat && cat.fixKind !== "deterministic") {
+        return notApplied(checkId, "guidance", cat.remediation || "Manual fix required.");
+    }
+    let result;
+    switch (checkId) {
+        case "GHA021":
+        case "GHA029":
+            result = pinActions(content, opts);
+            if (!result.changed && result.needsSha) {
+                return notApplied(checkId, "needs-input", "A commit SHA is required to pin; resolve it (e.g. via the fetch layer) and re-run.");
+            }
+            break;
+        case "GHA030":
+        case "WGL031": {
+            const r = pinImages(content, opts);
+            if (!r.changed && r.needsValue) {
+                return notApplied(checkId, "needs-input", "A registry digest is required to pin the image; resolve it (e.g. via the fetch layer) and re-run.");
+            }
+            result = r;
+            break;
+        }
+        case "GHA017":
+            result = addPermissions(content);
+            break;
+        case "GHA033":
+            result = narrowWriteAll(content);
+            break;
+        case "TF016":
+            result = unwrapInterpolations(content);
+            break;
+        case "TF019":
+            result = dropRedundantDefaults(content);
+            break;
+        default:
+            return notApplied(checkId, "needs-input", cat?.remediation || "No deterministic fix implemented for this rule yet.");
+    }
+    if (!result.changed) {
+        return notApplied(checkId, "noop", "Nothing to fix — the issue is not present (no-op).");
+    }
+    return {
+        checkId,
+        applied: true,
+        reason: "applied",
+        patched: result.patched,
+        diff: unifiedDiff(content, result.patched),
+    };
+}
+/** LCS-based line diff. */
+function diffOps(a, b) {
+    const n = a.length;
+    const m = b.length;
+    const lcs = Array.from({ length: n + 1 }, () => new Array(m + 1).fill(0));
+    for (let i = n - 1; i >= 0; i--) {
+        for (let j = m - 1; j >= 0; j--) {
+            lcs[i][j] = a[i] === b[j] ? lcs[i + 1][j + 1] + 1 : Math.max(lcs[i + 1][j], lcs[i][j + 1]);
+        }
+    }
+    const ops = [];
+    let i = 0;
+    let j = 0;
+    while (i < n && j < m) {
+        if (a[i] === b[j]) {
+            ops.push({ type: "eq", line: a[i] });
+            i++;
+            j++;
+        }
+        else if (lcs[i + 1][j] >= lcs[i][j + 1]) {
+            ops.push({ type: "del", line: a[i] });
+            i++;
+        }
+        else {
+            ops.push({ type: "add", line: b[j] });
+            j++;
+        }
+    }
+    while (i < n)
+        ops.push({ type: "del", line: a[i++] });
+    while (j < m)
+        ops.push({ type: "add", line: b[j++] });
+    return ops;
+}
+/** Render a unified diff with up to `context` equal lines around changes. */
+export function unifiedDiff(oldStr, newStr, context = 3) {
+    const a = oldStr.split("\n");
+    const b = newStr.split("\n");
+    const ops = diffOps(a, b);
+    // Mark which op indexes are within `context` of a change.
+    const keep = new Array(ops.length).fill(false);
+    for (let k = 0; k < ops.length; k++) {
+        if (ops[k].type !== "eq") {
+            for (let d = -context; d <= context; d++) {
+                const idx = k + d;
+                if (idx >= 0 && idx < ops.length)
+                    keep[idx] = true;
+            }
+        }
+    }
+    const lines = [];
+    let oldLine = 1;
+    let newLine = 1;
+    let k = 0;
+    while (k < ops.length) {
+        if (!keep[k]) {
+            if (ops[k].type !== "add")
+                oldLine++;
+            if (ops[k].type !== "del")
+                newLine++;
+            k++;
+            continue;
+        }
+        // Start of a hunk.
+        const hunk = [];
+        const oldStart = oldLine;
+        const newStart = newLine;
+        let oldCount = 0;
+        let newCount = 0;
+        while (k < ops.length && keep[k]) {
+            const op = ops[k];
+            if (op.type === "eq") {
+                hunk.push(` ${op.line}`);
+                oldCount++;
+                newCount++;
+                oldLine++;
+                newLine++;
+            }
+            else if (op.type === "del") {
+                hunk.push(`-${op.line}`);
+                oldCount++;
+                oldLine++;
+            }
+            else {
+                hunk.push(`+${op.line}`);
+                newCount++;
+                newLine++;
+            }
+            k++;
+        }
+        lines.push(`@@ -${oldStart},${oldCount} +${newStart},${newCount} @@`);
+        lines.push(...hunk);
+    }
+    return lines.join("\n");
+}

package/dist/audit/report-html.js

@@ -0,0 +1,194 @@
+/**
+ * HTML report generator (the "expanded" mode) — a self-contained, presentable
+ * report rendered from the shared report model. Inline CSS, no external assets;
+ * opens in a browser and is shareable as a single file. Also the natural output
+ * for the future hosted service.
+ *
+ * Customization: a default template with `{{placeholder}}` slots, overridable
+ * via `template`, plus theme knobs (title, logo, accent, footer).
+ */
+import { ruleDocUrl, lineageLabel } from "./catalog.js";
+import { buildReportModel, buildReportJson } from "./report-model.js";
+const DEFAULT_ACCENT = "#7c3aed";
+const DEFAULT_TITLE = "chant audit";
+const DEFAULT_FOOTER = 'Generated by <a href="https://intentius.io/chant/cli/audit/">chant audit</a>.';
+function esc(s) {
+    return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+/** A rule id as a link to its reference entry. */
+function ruleLink(id) {
+    return `<a class="rule-id" href="${esc(ruleDocUrl(id))}">${esc(id)}</a>`;
+}
+/** External backing for a merge-worthy rule (OSSF Scorecard, CIS, vendor docs). */
+function authorityLinks(meta) {
+    const parts = [];
+    if (meta.authority?.length) {
+        parts.push(`per ${meta.authority.map((a) => `<a href="${esc(a.url)}">${esc(a.name)}</a>`).join(", ")}`);
+    }
+    if (meta.lineage?.length) {
+        parts.push(`prior art: ${meta.lineage.map((l) => `<a href="${esc(l.url)}">${esc(lineageLabel(l))}</a>`).join(", ")}`);
+    }
+    return parts.length ? ` <span class="muted">${parts.join(" · ")}</span>` : "";
+}
+function renderDiff(diff) {
+    const rows = diff
+        .split("\n")
+        .map((l) => {
+        const cls = l.startsWith("@@") ? "hunk" : l.startsWith("+") ? "add" : l.startsWith("-") ? "del" : "ctx";
+        return `<span class="${cls}">${esc(l) || " "}</span>`;
+    })
+        .join("\n");
+    return `<pre class="diff">${rows}</pre>`;
+}
+function renderQuickWins(files) {
+    const cards = files
+        .map((qw) => {
+        const chips = qw.addressed.map((m) => `<span class="chip">${ruleLink(m.id)} ${esc(m.title)}${authorityLinks(m)}</span>`).join(" ");
+        const diff = qw.diff ? renderDiff(qw.diff) : "";
+        const needs = qw.needsInput.length
+            ? `<div class="needs"><strong>Needs a value to auto-patch:</strong><ul>${qw.needsInput
+                .map((f) => `<li>${ruleLink(f.checkId)}${f.entity ? ` (<code>${esc(f.entity)}</code>)` : ""} — ${esc(f.meta.remediation)}${authorityLinks(f.meta)}</li>`)
+                .join("")}</ul></div>`
+            : "";
+        return `<div class="card"><div class="card-head"><code class="file">${esc(qw.file)}</code> ${chips}</div>${diff}${needs}</div>`;
+    })
+        .join("\n");
+    return `<section><h2>Quick wins <span class="muted">deterministic</span></h2><p class="muted">Safe mechanical fixes — the diff changes only the flagged lines.</p>${cards}</section>`;
+}
+function renderNeedsReview(clusters, n) {
+    const body = clusters
+        .map((c) => {
+        const head = c.url ? `<a href="${esc(c.url)}">${esc(c.name)}</a>` : esc(c.name);
+        const rules = c.rules
+            .map(({ meta, findings }) => {
+            const locs = findings
+                .map((f) => {
+                const loc = f.line ? `${f.file}:${f.line}` : f.file;
+                return `<li><code>${esc(loc)}</code>${f.entity ? ` (<code>${esc(f.entity)}</code>)` : ""} — ${esc(f.message)}</li>`;
+            })
+                .join("");
+            return `<div class="rule"><div><span class="sev ${findings[0].severity}"></span><strong>${ruleLink(meta.id)}</strong> — ${esc(meta.title)}. <span class="muted">${esc(meta.remediation)}</span>${authorityLinks(meta)}</div><ul>${locs}</ul></div>`;
+        })
+            .join("");
+        return `<div class="cluster"><h3>${head}</h3>${rules}</div>`;
+    })
+        .join("\n");
+    return `<details open><summary>Needs review <span class="muted">guidance — ${n}</span></summary><p class="muted">These need a judgement call — remediation guidance, not an auto-fix.</p>${body}</details>`;
+}
+function renderReportOnly(findings, n) {
+    const rows = findings
+        .map((f) => `<tr><td>${ruleLink(f.checkId)}</td><td>${esc(f.meta.title)}</td><td><code>${esc(f.file)}</code></td><td>${esc(f.message)}</td></tr>`)
+        .join("");
+    return `<details><summary>Report-only <span class="muted">hygiene — ${n}</span></summary><table><thead><tr><th>Rule</th><th>Title</th><th>File</th><th>Detail</th></tr></thead><tbody>${rows}</tbody></table></details>`;
+}
+function renderHeader(counts, snapshot, notes) {
+    const sev = `<span class="sev error"></span>${counts.errors} error <span class="sev warning"></span>${counts.warnings} warning <span class="sev info"></span>${counts.infos} info`;
+    const tiers = `<span class="chip">${counts.quickWin} quick-win</span> <span class="chip">${counts.needsReview} needs-review</span> <span class="chip">${counts.reportOnly} hygiene</span>`;
+    const cats = `<span class="chip">${counts.security} security</span> <span class="chip">${counts.correctness} correctness</span> <span class="chip">${counts.bestPractice} best-practice</span> <span class="chip">${counts.efficiency} efficiency</span>`;
+    const meta = [];
+    if (snapshot) {
+        if (snapshot.host)
+            meta.push(esc(snapshot.host));
+        if (snapshot.repo)
+            meta.push(esc(snapshot.repo));
+        else
+            meta.push(esc(snapshot.target));
+        if (snapshot.ref)
+            meta.push(`ref <code>${esc(snapshot.ref)}</code>`);
+        if (snapshot.commit)
+            meta.push(`commit <code>${esc(snapshot.commit.slice(0, 10))}</code>`);
+        meta.push(esc(snapshot.generatedAt.slice(0, 10)));
+        meta.push(`${snapshot.files.length} file${snapshot.files.length === 1 ? "" : "s"}`);
+        meta.push(`chant ${esc(snapshot.toolVersion)}`);
+    }
+    const noteHtml = notes.map((n) => `<div class="note">${esc(n)}</div>`).join("");
+    return `<div class="summary"><div class="meta">${meta.join(" · ")}</div><div class="counts">${sev}</div><div class="tiers">${tiers}</div><div class="tiers">${cats}</div>${noteHtml}</div>`;
+}
+const STYLES = `
+:root { --accent: {{accent}}; }
+* { box-sizing: border-box; }
+body { font: 15px/1.55 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif; color: #1f2328; margin: 0; background: #f6f8fa; }
+.wrap { max-width: 920px; margin: 0 auto; padding: 32px 20px 64px; }
+header { display: flex; align-items: center; gap: 12px; border-bottom: 3px solid var(--accent); padding-bottom: 16px; margin-bottom: 20px; }
+header h1 { font-size: 22px; margin: 0; }
+.logo { height: 32px; }
+.summary { background: #fff; border: 1px solid #d0d7de; border-radius: 10px; padding: 16px 18px; margin-bottom: 24px; }
+.summary .meta { color: #57606a; font-size: 13px; margin-bottom: 10px; }
+.counts { font-weight: 600; margin-bottom: 8px; }
+.sev { display: inline-block; width: 9px; height: 9px; border-radius: 50%; margin: 0 4px 0 10px; vertical-align: middle; }
+.sev.error { background: #cf222e; } .sev.warning { background: #d4a72c; } .sev.info { background: #8c959f; }
+.sev:first-child { margin-left: 0; }
+.chip { display: inline-block; background: #eef1f4; border: 1px solid #d0d7de; border-radius: 999px; padding: 1px 10px; font-size: 12px; color: #424a53; }
+.tiers .chip { margin-right: 4px; }
+.note { margin-top: 10px; background: #fff8c5; border: 1px solid #d4a72c66; border-radius: 6px; padding: 8px 10px; font-size: 13px; }
+h2 { font-size: 18px; margin: 28px 0 4px; } h3 { font-size: 15px; margin: 16px 0 6px; }
+.muted { color: #57606a; font-weight: 400; font-size: 13px; }
+.card { background: #fff; border: 1px solid #d0d7de; border-radius: 10px; padding: 14px 16px; margin: 12px 0; }
+.card-head { margin-bottom: 8px; display: flex; flex-wrap: wrap; gap: 6px; align-items: center; }
+.file { background: #eef1f4; padding: 2px 7px; border-radius: 6px; font-size: 13px; }
+.card-head .chip { background: var(--accent); border-color: var(--accent); color: #fff; }
+pre.diff { background: #0d1117; color: #c9d1d9; border-radius: 8px; padding: 12px 14px; overflow-x: auto; font: 12.5px/1.5 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace; margin: 0; }
+pre.diff span { display: block; white-space: pre; }
+pre.diff .add { color: #3fb950; } pre.diff .del { color: #f85149; } pre.diff .hunk { color: #a371f7; } pre.diff .ctx { color: #8b949e; }
+.needs { margin-top: 10px; font-size: 13px; }
+details { background: #fff; border: 1px solid #d0d7de; border-radius: 10px; padding: 8px 16px; margin: 16px 0; }
+summary { cursor: pointer; font-size: 16px; font-weight: 600; }
+.cluster { margin: 10px 0; } .rule { margin: 8px 0; } .rule ul, .needs ul { margin: 4px 0 4px 0; }
+table { border-collapse: collapse; width: 100%; font-size: 13px; margin-top: 8px; }
+th, td { text-align: left; border-bottom: 1px solid #d0d7de; padding: 6px 8px; vertical-align: top; }
+th { color: #57606a; }
+code { font: 12.5px ui-monospace,SFMono-Regular,Menlo,Consolas,monospace; }
+footer { margin-top: 40px; padding-top: 16px; border-top: 1px solid #d0d7de; color: #57606a; font-size: 13px; }
+a { color: var(--accent); }
+.rule-id { color: var(--accent); text-decoration: none; font-weight: 600; }
+.rule-id:hover { text-decoration: underline; }
+.card-head .chip .rule-id { color: #fff; }
+`;
+const DEFAULT_TEMPLATE = `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>{{title}}</title>
+<style>{{styles}}</style>
+</head><body><div class="wrap">
+<header>{{logo}}<h1>{{title}}</h1></header>
+{{body}}
+<footer>{{footer}}</footer>
+</div></body></html>`;
+/** Render an audit report as a self-contained HTML document. */
+export function renderHtml(findings, opts = {}) {
+    const model = buildReportModel(findings, opts);
+    const theme = opts.theme ?? {};
+    const accent = theme.accent ?? DEFAULT_ACCENT;
+    const title = theme.title ?? DEFAULT_TITLE;
+    const logo = theme.logo ? (/^https?:\/\//.test(theme.logo) ? `<img class="logo" src="${esc(theme.logo)}" alt="">` : theme.logo) : "";
+    const footer = theme.footer ?? DEFAULT_FOOTER;
+    // Machine-readable data embedded so the HTML report is also parseable.
+    // `<` escaped so the JSON can't break out of the <script> element.
+    const dataJson = JSON.stringify(buildReportJson(findings, { snapshot: opts.snapshot, truncated: opts.truncated }), null, 0).replace(/</g, "\\u003c");
+    const dataScript = `<script type="application/json" id="chant-audit-report">${dataJson}</script>`;
+    let body;
+    if (model.counts.total === 0) {
+        body = renderHeader(model.counts, opts.snapshot, opts.notes ?? []) + `<section><p>No issues found.</p></section>` + dataScript;
+    }
+    else {
+        const parts = [renderHeader(model.counts, opts.snapshot, opts.notes ?? [])];
+        if (model.quickWins.length > 0)
+            parts.push(renderQuickWins(model.quickWins));
+        if (model.needsReview.length > 0)
+            parts.push(renderNeedsReview(model.needsReview, model.counts.needsReview));
+        if (model.reportOnly.length > 0)
+            parts.push(renderReportOnly(model.reportOnly, model.counts.reportOnly));
+        parts.push(dataScript);
+        body = parts.join("\n");
+    }
+    const slots = {
+        title: esc(title),
+        accent,
+        styles: STYLES.replace("{{accent}}", accent),
+        logo,
+        body,
+        footer,
+    };
+    const template = opts.template ?? DEFAULT_TEMPLATE;
+    // Single pass over the template only, so injected body content isn't re-scanned.
+    return template.replace(/\{\{(\w+)\}\}/g, (_, k) => slots[k] ?? "");
+}