@owasp-aghast/aghast 0.8.2 → 0.8.4

package/dist/discoveries/semgrep-discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"semgrep-discovery.js","sourceRoot":"","sources":["../../src/discoveries/semgrep-discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,MAAM,GAAG,GAAG,mBAAmB,CAAC;AAEhC,SAAS,2BAA2B,CAAC,IAAY,EAAE,SAAiB,EAAE,OAAe;IACnF,OAAO;;;UAGC,IAAI;WACH,SAAS,IAAI,OAAO;;;;;;;;;;;;;;;CAe9B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,IAAI,EAAE,SAAS;IACf,oBAAoB,EAAE,sBAAsB;IAC5C,iBAAiB,EAAE,IAAI;IACvB,kBAAkB,EAAE,IAAI;IAExB,KAAK,CAAC,QAAQ,CACZ,KAAoB,EACpB,QAAgB,EAChB,QAA2B;QAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAY,CAAC;QAEvC,QAAQ,CAAC,GAAG,EAAE,8BAA8B,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAExD,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC;YACpC,cAAc,EAAE,QAAQ;YACxB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,MAAM,EAAE,WAAW,CAAC,MAAM;SAC3B,CAAC,CAAC;QAEH,IAAI,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACvC,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEtC,QAAQ,CAAC,GAAG,EAAE,cAAc,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;QAEtD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,WAAW,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG;YAC9C,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,gBAAgB,EAAE,2BAA2B,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;SAC7F,CAAC,CAAC,CAAC;IACN,CAAC;CACF,CAAC"}
+{"version":3,"file":"semgrep-discovery.js","sourceRoot":"","sources":["../../src/discoveries/semgrep-discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,MAAM,GAAG,GAAG,mBAAmB,CAAC;AAEhC,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,IAAI,EAAE,SAAS;IACf,oBAAoB,EAAE,sBAAsB;IAC5C,iBAAiB,EAAE,IAAI;IACvB,kBAAkB,EAAE,IAAI;IAExB,KAAK,CAAC,QAAQ,CACZ,KAAoB,EACpB,QAAgB,EAChB,QAA2B;QAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAY,CAAC;QAEvC,QAAQ,CAAC,GAAG,EAAE,8BAA8B,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAExD,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC;YACpC,cAAc,EAAE,QAAQ;YACxB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,MAAM,EAAE,WAAW,CAAC,MAAM;SAC3B,CAAC,CAAC;QAEH,IAAI,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACvC,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEtC,QAAQ,CAAC,GAAG,EAAE,cAAc,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;QAEtD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,WAAW,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG;YAC9C,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,gBAAgB,EAAE,gCAAgC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;SAClG,CAAC,CAAC,CAAC;IACN,CAAC;CACF,CAAC"}

package/dist/error-codes.d.ts

@@ -6,8 +6,9 @@
  *   E2xxx — Configuration (config dir, checks, runtime config)
  *   E3xxx — Agent provider
  *   E4xxx — Repository/target validation
- *   E5xxx — Semgrep
+ *   E5xxx — Semgrep / Opengrep
  *   E6xxx — OpenAnt
+ *   E7xxx — Budget / cost controls
  *   E9xxx — Internal/fatal
  */
 export interface ErrorCode {
@@ -29,6 +30,7 @@ export declare const ERROR_CODES: {
     readonly E3004: ErrorCode;
     readonly E4001: ErrorCode;
     readonly E5001: ErrorCode;
+    readonly E5101: ErrorCode;
     readonly E6001: ErrorCode;
     readonly E6002: ErrorCode;
     readonly E7001: ErrorCode;

package/dist/error-codes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAMD,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;CAsCd,CAAC;AAEX;;;GAGG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAWzE"}
+{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAMD,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;CAuCd,CAAC;AAEX;;;GAGG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAWzE"}

package/dist/error-codes.js

@@ -6,8 +6,9 @@
  *   E2xxx — Configuration (config dir, checks, runtime config)
  *   E3xxx — Agent provider
  *   E4xxx — Repository/target validation
- *   E5xxx — Semgrep
+ *   E5xxx — Semgrep / Opengrep
  *   E6xxx — OpenAnt
+ *   E7xxx — Budget / cost controls
  *   E9xxx — Internal/fatal
  */
 function ec(code, label) {
@@ -35,8 +36,9 @@ export const ERROR_CODES = {
     E3004: ec('E3004', 'OpenCode not installed'),
     // E4xxx — Repository/target validation
     E4001: ec('E4001', 'Repository path not found'),
-    // E5xxx — Semgrep
+    // E5xxx — Semgrep / Opengrep
     E5001: ec('E5001', 'Semgrep not installed'),
+    E5101: ec('E5101', 'Opengrep not installed'),
     // E6xxx — OpenAnt
     E6001: ec('E6001', 'OpenAnt not installed'),
     E6002: ec('E6002', 'OpenAnt execution failed'),

package/dist/error-codes.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-codes.js","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,SAAS,EAAE,CAAC,IAAY,EAAE,KAAa;IACrC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,sBAAsB;IACtB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,gCAAgC,CAAC;IACpD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAE5C,wBAAwB;IACxB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,gCAAgC,CAAC;IACpD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,oCAAoC,CAAC;IACxD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAC9C,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,yBAAyB;IACzB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC5C,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iCAAiC,CAAC;IACrD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAE5C,uCAAuC;IACvC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,2BAA2B,CAAC;IAE/C,kBAAkB;IAClB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAE3C,kBAAkB;IAClB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC3C,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,iCAAiC;IACjC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAE3C,mBAAmB;IACnB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,sBAAsB,CAAC;CAClC,CAAC;AAEX;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,SAAoB,EAAE,OAAe;IAC/D,OAAO,UAAU,SAAS,CAAC,IAAI,MAAM,OAAO,EAAE,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,OAAe;IAC/D,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,kBAAkB,CAAC,gBAAgB,OAAO,mBAAmB,OAAO,EAAE,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,2DAA2D,KAAK,SAAS,IAAI,aAAa,CAAC;IACvG,OAAO;QACL,uBAAuB,WAAW,CAAC,KAAK,CAAC,IAAI,MAAM,OAAO,EAAE;QAC5D,YAAY,OAAO,EAAE;QACrB,EAAE;QACF,0CAA0C;QAC1C,KAAK,GAAG,EAAE;KACX,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"error-codes.js","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,SAAS,EAAE,CAAC,IAAY,EAAE,KAAa;IACrC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,sBAAsB;IACtB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,gCAAgC,CAAC;IACpD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAE5C,wBAAwB;IACxB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,gCAAgC,CAAC;IACpD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,oCAAoC,CAAC;IACxD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAC9C,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,yBAAyB;IACzB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC5C,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iCAAiC,CAAC;IACrD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAE5C,uCAAuC;IACvC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,2BAA2B,CAAC;IAE/C,6BAA6B;IAC7B,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC3C,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAE5C,kBAAkB;IAClB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC3C,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,iCAAiC;IACjC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAE3C,mBAAmB;IACnB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,sBAAsB,CAAC;CAClC,CAAC;AAEX;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,SAAoB,EAAE,OAAe;IAC/D,OAAO,UAAU,SAAS,CAAC,IAAI,MAAM,OAAO,EAAE,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,OAAe;IAC/D,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,kBAAkB,CAAC,gBAAgB,OAAO,mBAAmB,OAAO,EAAE,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,2DAA2D,KAAK,SAAS,IAAI,aAAa,CAAC;IACvG,OAAO;QACL,uBAAuB,WAAW,CAAC,KAAK,CAAC,IAAI,MAAM,OAAO,EAAE;QAC5D,YAAY,OAAO,EAAE;QACrB,EAAE;QACF,0CAA0C;QAC1C,KAAK,GAAG,EAAE;KACX,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/formatters/csv-formatter.d.ts

@@ -0,0 +1,34 @@
+/**
+ * CSV output formatter — one row per SecurityIssue (plus a row per ERROR check)
+ * for spreadsheet analysis (Excel, Google Sheets, etc.).
+ *
+ * Output contract:
+ *   - Encoding: UTF-8, no BOM. Excel-on-Windows may render non-ASCII bytes as
+ *     mojibake when a CSV is opened directly without an encoding hint; consumers
+ *     that need Excel auto-detection should use the JSON or SARIF output instead,
+ *     or import the CSV via Excel's "From Text/CSV" wizard which lets you pick
+ *     UTF-8 explicitly.
+ *   - Line terminator: CRLF (RFC 4180). Final row is also CRLF-terminated.
+ *   - Quoting: RFC 4180 — fields containing `,`, `"`, CR, or LF are wrapped in
+ *     double quotes; embedded `"` is doubled.
+ *   - Description: flattened to a single line (CR/LF/CRLF → single space) and
+ *     truncated to {@link DESCRIPTION_MAX_LENGTH} chars with a U+2026 ellipsis.
+ *   - The structured `dataFlow` taint trace on `SecurityIssue` is intentionally
+ *     omitted — flat per-issue rows can't represent a list well; SARIF/JSON
+ *     output keeps the full trace.
+ */
+import type { ScanResults } from '../types.js';
+import type { OutputFormatter } from './types.js';
+/** Escapes a single CSV field per RFC 4180. */
+export declare function escapeCsvField(value: string | number | undefined): string;
+/**
+ * Truncates a description to fit within the CSV column and replaces newlines
+ * with spaces so each issue stays on a single row.
+ */
+export declare function normalizeDescription(description: string): string;
+export declare class CsvFormatter implements OutputFormatter {
+    readonly id = "csv";
+    readonly fileExtension = ".csv";
+    format(results: ScanResults): string;
+}
+//# sourceMappingURL=csv-formatter.d.ts.map

package/dist/formatters/csv-formatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csv-formatter.d.ts","sourceRoot":"","sources":["../../src/formatters/csv-formatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAwC,MAAM,aAAa,CAAC;AACrF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAkBlD,+CAA+C;AAC/C,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAQzE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAMhE;AAyCD,qBAAa,YAAa,YAAW,eAAe;IAClD,QAAQ,CAAC,EAAE,SAAS;IACpB,QAAQ,CAAC,aAAa,UAAU;IAEhC,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM;CAqBrC"}

package/dist/formatters/csv-formatter.js

@@ -0,0 +1,114 @@
+/**
+ * CSV output formatter — one row per SecurityIssue (plus a row per ERROR check)
+ * for spreadsheet analysis (Excel, Google Sheets, etc.).
+ *
+ * Output contract:
+ *   - Encoding: UTF-8, no BOM. Excel-on-Windows may render non-ASCII bytes as
+ *     mojibake when a CSV is opened directly without an encoding hint; consumers
+ *     that need Excel auto-detection should use the JSON or SARIF output instead,
+ *     or import the CSV via Excel's "From Text/CSV" wizard which lets you pick
+ *     UTF-8 explicitly.
+ *   - Line terminator: CRLF (RFC 4180). Final row is also CRLF-terminated.
+ *   - Quoting: RFC 4180 — fields containing `,`, `"`, CR, or LF are wrapped in
+ *     double quotes; embedded `"` is doubled.
+ *   - Description: flattened to a single line (CR/LF/CRLF → single space) and
+ *     truncated to {@link DESCRIPTION_MAX_LENGTH} chars with a U+2026 ellipsis.
+ *   - The structured `dataFlow` taint trace on `SecurityIssue` is intentionally
+ *     omitted — flat per-issue rows can't represent a list well; SARIF/JSON
+ *     output keeps the full trace.
+ */
+/** Maximum length of the description field in CSV output (longer values are truncated with an ellipsis). */
+const DESCRIPTION_MAX_LENGTH = 500;
+const CSV_HEADERS = [
+    'checkId',
+    'checkName',
+    'status',
+    'file',
+    'startLine',
+    'endLine',
+    'severity',
+    'confidence',
+    'description',
+    'recommendation',
+];
+/** Escapes a single CSV field per RFC 4180. */
+export function escapeCsvField(value) {
+    if (value === undefined || value === null)
+        return '';
+    const str = String(value);
+    // Wrap in quotes if it contains a comma, quote, CR, or LF.
+    if (/[",\r\n]/.test(str)) {
+        return `"${str.replace(/"/g, '""')}"`;
+    }
+    return str;
+}
+/**
+ * Truncates a description to fit within the CSV column and replaces newlines
+ * with spaces so each issue stays on a single row.
+ */
+export function normalizeDescription(description) {
+    // Replace any sequence of CR/LF with a single space so the cell stays on one line
+    // (CSV viewers do support multi-line cells via quoting, but flattening keeps spreadsheets readable).
+    const flattened = description.replace(/\r\n|\r|\n/g, ' ').replace(/\s+/g, ' ').trim();
+    if (flattened.length <= DESCRIPTION_MAX_LENGTH)
+        return flattened;
+    return flattened.slice(0, DESCRIPTION_MAX_LENGTH - 1) + '…'; // ellipsis
+}
+function statusForIssue(issue, checkStatusByCheckId) {
+    // Fall back to 'UNKNOWN' (not 'FAIL') for orphaned issues so a row in the
+    // spreadsheet doesn't claim a check status that wasn't actually reported.
+    return checkStatusByCheckId.get(issue.checkId) ?? 'UNKNOWN';
+}
+function issueRow(issue, checkStatus) {
+    return [
+        escapeCsvField(issue.checkId),
+        escapeCsvField(issue.checkName),
+        escapeCsvField(checkStatus),
+        escapeCsvField(issue.file),
+        escapeCsvField(issue.startLine),
+        escapeCsvField(issue.endLine),
+        escapeCsvField(issue.severity),
+        escapeCsvField(issue.confidence),
+        escapeCsvField(normalizeDescription(issue.description)),
+        escapeCsvField(issue.recommendation),
+    ].join(',');
+}
+function errorCheckRow(check) {
+    // Surface execution errors so they show up alongside issues in spreadsheets.
+    // No file/line/severity/confidence/recommendation — just the error in the description column.
+    const description = normalizeDescription(check.error ? `Check execution error: ${check.error}` : 'Check execution error');
+    return [
+        escapeCsvField(check.checkId),
+        escapeCsvField(check.checkName),
+        escapeCsvField(check.status),
+        '', // file
+        '', // startLine
+        '', // endLine
+        '', // severity
+        '', // confidence
+        escapeCsvField(description),
+        '', // recommendation
+    ].join(',');
+}
+export class CsvFormatter {
+    id = 'csv';
+    fileExtension = '.csv';
+    format(results) {
+        const checkStatusByCheckId = new Map();
+        for (const check of results.checks) {
+            checkStatusByCheckId.set(check.checkId, check.status);
+        }
+        const lines = [CSV_HEADERS.join(',')];
+        for (const issue of results.issues) {
+            lines.push(issueRow(issue, statusForIssue(issue, checkStatusByCheckId)));
+        }
+        for (const check of results.checks) {
+            if (check.status === 'ERROR') {
+                lines.push(errorCheckRow(check));
+            }
+        }
+        // RFC 4180 specifies CRLF line endings.
+        return lines.join('\r\n') + '\r\n';
+    }
+}
+//# sourceMappingURL=csv-formatter.js.map

package/dist/formatters/csv-formatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csv-formatter.js","sourceRoot":"","sources":["../../src/formatters/csv-formatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,4GAA4G;AAC5G,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC,MAAM,WAAW,GAAG;IAClB,SAAS;IACT,WAAW;IACX,QAAQ;IACR,MAAM;IACN,WAAW;IACX,SAAS;IACT,UAAU;IACV,YAAY;IACZ,aAAa;IACb,gBAAgB;CACR,CAAC;AAEX,+CAA+C;AAC/C,MAAM,UAAU,cAAc,CAAC,KAAkC;IAC/D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,2DAA2D;IAC3D,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,kFAAkF;IAClF,qGAAqG;IACrG,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACtF,IAAI,SAAS,CAAC,MAAM,IAAI,sBAAsB;QAAE,OAAO,SAAS,CAAC;IACjE,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW;AAC1E,CAAC;AAED,SAAS,cAAc,CAAC,KAAoB,EAAE,oBAAyC;IACrF,0EAA0E;IAC1E,0EAA0E;IAC1E,OAAO,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;AAC9D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAoB,EAAE,WAAmB;IACzD,OAAO;QACL,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7B,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC;QAC/B,cAAc,CAAC,WAAW,CAAC;QAC3B,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1B,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC;QAC/B,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7B,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC9B,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC;QAChC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvD,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC;KACrC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAA4B;IACjD,6EAA6E;IAC7E,8FAA8F;IAC9F,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,0BAA0B,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;IAC1H,OAAO;QACL,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7B,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC;QAC/B,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC;QAC5B,EAAE,EAAE,OAAO;QACX,EAAE,EAAE,YAAY;QAChB,EAAE,EAAE,UAAU;QACd,EAAE,EAAE,WAAW;QACf,EAAE,EAAE,aAAa;QACjB,cAAc,CAAC,WAAW,CAAC;QAC3B,EAAE,EAAE,iBAAiB;KACtB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,MAAM,OAAO,YAAY;IACd,EAAE,GAAG,KAAK,CAAC;IACX,aAAa,GAAG,MAAM,CAAC;IAEhC,MAAM,CAAC,OAAoB;QACzB,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAkB,CAAC;QACvD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,KAAK,GAAa,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAEhD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC7B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IACrC,CAAC;CACF"}

package/dist/formatters/html-formatter.d.ts

@@ -0,0 +1,39 @@
+/**
+ * HTML output formatter — self-contained interactive report.
+ *
+ * Emits a single .html file with inline CSS + JS. Includes:
+ *   - Header with title, scan timestamp, repository info
+ *   - Summary statistics (totals + per-status counters)
+ *   - Filterable, severity-badged issues table
+ *   - Expandable per-check sections with optional code snippets
+ *   - The full `ScanResults` embedded as a JSON island for client-side filtering
+ *
+ * All user-controlled strings are HTML-escaped via `escapeHtml`. The embedded
+ * JSON has `</` sequences neutralised so an attacker-controlled string cannot
+ * break out of the `<script type="application/json">` tag.
+ */
+import type { ScanResults } from '../types.js';
+import type { OutputFormatter } from './types.js';
+/** Escapes the five HTML special characters. */
+export declare function escapeHtml(value: unknown): string;
+/**
+ * Embeds JSON inside a `<script type="application/json">` block safely.
+ *
+ * Two patterns matter for HTML's script-data tokenizer:
+ *   1. `</` — replaced with `<\/` so a stray `</script>` cannot terminate the
+ *      script element early. `\/` is valid JSON for `/`, so JSON.parse
+ *      round-trips faithfully.
+ *   2. `<!--` — the script-data tokenizer enters a "script data escaped"
+ *      state on `<!--`, in which a nested `<script>...</script>` pair can
+ *      terminate the outer element ahead of the literal closing tag we control.
+ *      Encoding `<` as the Unicode escape `<` is unambiguous JSON
+ *      (parses back to `<`) and prevents the tokenizer from ever entering the
+ *      escaped state.
+ */
+export declare function escapeJsonForScriptTag(json: string): string;
+export declare class HtmlFormatter implements OutputFormatter {
+    readonly id = "html";
+    readonly fileExtension = ".html";
+    format(results: ScanResults): string;
+}
+//# sourceMappingURL=html-formatter.d.ts.map

package/dist/formatters/html-formatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html-formatter.d.ts","sourceRoot":"","sources":["../../src/formatters/html-formatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACV,WAAW,EAKZ,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,gDAAgD;AAChD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CASjD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI3D;AA0TD,qBAAa,aAAc,YAAW,eAAe;IACnD,QAAQ,CAAC,EAAE,UAAU;IACrB,QAAQ,CAAC,aAAa,WAAW;IAEjC,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM;CAsCrC"}

package/dist/formatters/html-formatter.js

@@ -0,0 +1,392 @@
+/**
+ * HTML output formatter — self-contained interactive report.
+ *
+ * Emits a single .html file with inline CSS + JS. Includes:
+ *   - Header with title, scan timestamp, repository info
+ *   - Summary statistics (totals + per-status counters)
+ *   - Filterable, severity-badged issues table
+ *   - Expandable per-check sections with optional code snippets
+ *   - The full `ScanResults` embedded as a JSON island for client-side filtering
+ *
+ * All user-controlled strings are HTML-escaped via `escapeHtml`. The embedded
+ * JSON has `</` sequences neutralised so an attacker-controlled string cannot
+ * break out of the `<script type="application/json">` tag.
+ */
+/** Escapes the five HTML special characters. */
+export function escapeHtml(value) {
+    if (value === undefined || value === null)
+        return '';
+    const str = String(value);
+    return str
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+/**
+ * Embeds JSON inside a `<script type="application/json">` block safely.
+ *
+ * Two patterns matter for HTML's script-data tokenizer:
+ *   1. `</` — replaced with `<\/` so a stray `</script>` cannot terminate the
+ *      script element early. `\/` is valid JSON for `/`, so JSON.parse
+ *      round-trips faithfully.
+ *   2. `<!--` — the script-data tokenizer enters a "script data escaped"
+ *      state on `<!--`, in which a nested `<script>...</script>` pair can
+ *      terminate the outer element ahead of the literal closing tag we control.
+ *      Encoding `<` as the Unicode escape `<` is unambiguous JSON
+ *      (parses back to `<`) and prevents the tokenizer from ever entering the
+ *      escaped state.
+ */
+export function escapeJsonForScriptTag(json) {
+    return json
+        .replace(/<\//g, '<\\/')
+        .replace(/<!--/g, '\\u003c!--');
+}
+function severityClass(severity) {
+    switch (severity) {
+        case 'critical':
+        case 'high':
+            return 'sev-high';
+        case 'medium':
+            return 'sev-medium';
+        case 'low':
+        case 'informational':
+            return 'sev-low';
+        default:
+            return 'sev-unknown';
+    }
+}
+function statusClass(status) {
+    switch (status) {
+        case 'PASS':
+            return 'status-pass';
+        case 'FAIL':
+            return 'status-fail';
+        case 'FLAG':
+            return 'status-flag';
+        case 'ERROR':
+            return 'status-error';
+        default:
+            return 'status-unknown';
+    }
+}
+const CSS = `
+:root {
+  color-scheme: light dark;
+  --bg: #f6f7f9;
+  --fg: #1f2329;
+  --muted: #6a7280;
+  --card: #ffffff;
+  --border: #e2e5ea;
+  --pass: #15803d;
+  --fail: #b91c1c;
+  --flag: #b45309;
+  --error: #6b21a8;
+  --sev-high: #b91c1c;
+  --sev-medium: #b45309;
+  --sev-low: #2563eb;
+  --sev-unknown: #6a7280;
+}
+@media (prefers-color-scheme: dark) {
+  :root {
+    --bg: #14171c;
+    --fg: #e6e8eb;
+    --muted: #9ba1aa;
+    --card: #1c2026;
+    --border: #2a2f37;
+  }
+}
+* { box-sizing: border-box; }
+body {
+  margin: 0;
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+  background: var(--bg);
+  color: var(--fg);
+  line-height: 1.5;
+}
+.container { max-width: 1200px; margin: 0 auto; padding: 24px; }
+header { margin-bottom: 24px; }
+header h1 { margin: 0 0 4px; font-size: 1.6rem; }
+header .meta { color: var(--muted); font-size: 0.9rem; }
+.muted { color: var(--muted); }
+.card {
+  background: var(--card);
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  padding: 16px;
+  margin-bottom: 16px;
+}
+.summary-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(140px, 1fr));
+  gap: 12px;
+}
+.stat {
+  background: var(--card);
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  padding: 12px;
+  text-align: center;
+}
+.stat .num { font-size: 1.6rem; font-weight: 600; }
+.stat .label { color: var(--muted); font-size: 0.8rem; text-transform: uppercase; letter-spacing: 0.04em; }
+.badge {
+  display: inline-block;
+  padding: 2px 8px;
+  border-radius: 999px;
+  font-size: 0.75rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: #fff;
+}
+.badge.sev-high { background: var(--sev-high); }
+.badge.sev-medium { background: var(--sev-medium); }
+.badge.sev-low { background: var(--sev-low); }
+.badge.sev-unknown { background: var(--sev-unknown); }
+.badge.status-pass { background: var(--pass); }
+.badge.status-fail { background: var(--fail); }
+.badge.status-flag { background: var(--flag); }
+.badge.status-error { background: var(--error); }
+.badge.status-unknown { background: var(--sev-unknown); }
+.controls { display: flex; flex-wrap: wrap; gap: 8px; margin-bottom: 12px; }
+.controls input, .controls select {
+  background: var(--card);
+  color: var(--fg);
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  padding: 6px 10px;
+  font: inherit;
+}
+table { width: 100%; border-collapse: collapse; font-size: 0.9rem; }
+th, td {
+  text-align: left;
+  padding: 8px 10px;
+  border-bottom: 1px solid var(--border);
+  vertical-align: top;
+}
+th { background: var(--card); font-weight: 600; }
+tr.hidden { display: none; }
+details { margin-top: 8px; }
+details summary { cursor: pointer; font-weight: 600; }
+pre.snippet {
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  padding: 8px;
+  overflow-x: auto;
+  font-size: 0.8rem;
+  margin: 8px 0 0;
+}
+.empty { color: var(--muted); font-style: italic; }
+footer { color: var(--muted); font-size: 0.8rem; text-align: center; margin: 32px 0 16px; }
+`;
+const CLIENT_JS = `
+(function () {
+  var data;
+  try {
+    data = JSON.parse(document.getElementById('aghast-results').textContent);
+  } catch (e) {
+    return;
+  }
+  var search = document.getElementById('filter-search');
+  var severity = document.getElementById('filter-severity');
+  var status = document.getElementById('filter-status');
+  var rows = Array.prototype.slice.call(document.querySelectorAll('#issues-table tbody tr'));
+
+  function applyFilters() {
+    var q = (search.value || '').toLowerCase();
+    var sev = severity.value;
+    var st = status.value;
+    rows.forEach(function (row) {
+      var text = row.getAttribute('data-search') || '';
+      var rowSev = row.getAttribute('data-severity') || '';
+      var rowStatus = row.getAttribute('data-status') || '';
+      var matches = (!q || text.indexOf(q) !== -1)
+        && (!sev || rowSev === sev)
+        && (!st || rowStatus === st);
+      row.classList.toggle('hidden', !matches);
+    });
+  }
+
+  if (search) search.addEventListener('input', applyFilters);
+  if (severity) severity.addEventListener('change', applyFilters);
+  if (status) status.addEventListener('change', applyFilters);
+
+  // Expose data for debugging / extensibility.
+  window.aghastResults = data;
+})();
+`;
+function renderHeader(results) {
+    const repo = results.repository;
+    const repoLabel = repo.remoteUrl
+        ? `${escapeHtml(repo.remoteUrl)}`
+        : escapeHtml(repo.path);
+    const branch = repo.branch ? ` <span class="muted">on ${escapeHtml(repo.branch)}</span>` : '';
+    const commit = repo.commit ? ` <span class="muted">@ ${escapeHtml(repo.commit.slice(0, 12))}</span>` : '';
+    return `
+    <header>
+      <h1>aghast Security Scan Report</h1>
+      <div class="meta">
+        Scan ID: <code>${escapeHtml(results.scanId)}</code> &middot;
+        Generated: ${escapeHtml(results.timestamp)} &middot;
+        Provider: ${escapeHtml(results.agentProvider.name)}
+      </div>
+      <div class="meta">
+        Repository: ${repoLabel}${branch}${commit}
+      </div>
+    </header>
+  `;
+}
+function renderSummary(summary, _repo) {
+    return `
+    <section class="summary-grid">
+      <div class="stat"><div class="num">${summary.totalChecks}</div><div class="label">Checks</div></div>
+      <div class="stat"><div class="num">${summary.passedChecks}</div><div class="label">Passed</div></div>
+      <div class="stat"><div class="num">${summary.failedChecks}</div><div class="label">Failed</div></div>
+      <div class="stat"><div class="num">${summary.flaggedChecks}</div><div class="label">Flagged</div></div>
+      <div class="stat"><div class="num">${summary.errorChecks}</div><div class="label">Errors</div></div>
+      <div class="stat"><div class="num">${summary.totalIssues}</div><div class="label">Issues</div></div>
+    </section>
+  `;
+}
+function renderIssuesTable(issues, statusByCheck) {
+    if (issues.length === 0) {
+        return `<section class="card"><h2>Issues</h2><p class="empty">No issues detected.</p></section>`;
+    }
+    const rows = issues.map((issue) => {
+        const sev = issue.severity ?? '';
+        const sevCls = severityClass(issue.severity);
+        const sevBadge = `<span class="badge ${sevCls}">${escapeHtml(sev || 'unknown')}</span>`;
+        // Fall back to 'UNKNOWN' (not 'FAIL') for orphaned issues so the row's
+        // status badge and the data-status filter don't lie when an issue
+        // references a checkId that isn't in the checks list.
+        const status = statusByCheck.get(issue.checkId) ?? 'UNKNOWN';
+        const statusCls = statusClass(status);
+        const statusBadge = `<span class="badge ${statusCls}">${escapeHtml(status)}</span>`;
+        const searchBlob = `${issue.checkId} ${issue.checkName} ${issue.file} ${issue.description}`.toLowerCase();
+        return `
+      <tr data-severity="${escapeHtml(sev)}" data-status="${escapeHtml(status)}" data-search="${escapeHtml(searchBlob)}">
+        <td>${escapeHtml(issue.checkId)}</td>
+        <td>${escapeHtml(issue.checkName)}</td>
+        <td>${statusBadge}</td>
+        <td>${sevBadge}</td>
+        <td><code>${escapeHtml(issue.file)}</code>:${escapeHtml(issue.startLine)}-${escapeHtml(issue.endLine)}</td>
+        <td>${escapeHtml(issue.description)}</td>
+      </tr>
+    `;
+    }).join('');
+    return `
+    <section class="card">
+      <h2>Issues</h2>
+      <div class="controls">
+        <input id="filter-search" type="search" placeholder="Filter by text..." />
+        <select id="filter-severity">
+          <option value="">All severities</option>
+          <option value="critical">Critical</option>
+          <option value="high">High</option>
+          <option value="medium">Medium</option>
+          <option value="low">Low</option>
+          <option value="informational">Informational</option>
+        </select>
+        <select id="filter-status">
+          <option value="">All statuses</option>
+          <option value="PASS">Pass</option>
+          <option value="FAIL">Fail</option>
+          <option value="FLAG">Flag</option>
+          <option value="ERROR">Error</option>
+        </select>
+      </div>
+      <table id="issues-table" aria-label="Security issues">
+        <thead>
+          <tr><th>Check ID</th><th>Check</th><th>Status</th><th>Severity</th><th>Location</th><th>Description</th></tr>
+        </thead>
+        <tbody>${rows}</tbody>
+      </table>
+    </section>
+  `;
+}
+function renderCheckDetails(checks, issuesByCheck) {
+    if (checks.length === 0) {
+        return '';
+    }
+    const sections = checks.map((check) => {
+        const checkIssues = issuesByCheck.get(check.checkId) ?? [];
+        const statusBadge = `<span class="badge ${statusClass(check.status)}">${escapeHtml(check.status)}</span>`;
+        const errorBlock = check.error
+            ? `<p><strong>Error:</strong> ${escapeHtml(check.error)}</p>`
+            : '';
+        const issuesBlock = checkIssues.length === 0
+            ? '<p class="empty">No issues for this check.</p>'
+            : checkIssues.map((issue) => {
+                const snippet = issue.codeSnippet
+                    ? `<pre class="snippet">${escapeHtml(issue.codeSnippet)}</pre>`
+                    : '';
+                const recommendation = issue.recommendation
+                    ? `<p><strong>Recommendation:</strong> ${escapeHtml(issue.recommendation)}</p>`
+                    : '';
+                return `
+          <div class="card">
+            <div><strong><code>${escapeHtml(issue.file)}</code>:${escapeHtml(issue.startLine)}-${escapeHtml(issue.endLine)}</strong>
+              ${issue.severity ? `<span class="badge ${severityClass(issue.severity)}">${escapeHtml(issue.severity)}</span>` : ''}
+            </div>
+            <p>${escapeHtml(issue.description)}</p>
+            ${recommendation}
+            ${snippet}
+          </div>
+        `;
+            }).join('');
+        return `
+      <details>
+        <summary>${escapeHtml(check.checkName)} (${escapeHtml(check.checkId)}) ${statusBadge} &middot; ${check.issuesFound} issue(s)</summary>
+        ${errorBlock}
+        ${issuesBlock}
+      </details>
+    `;
+    }).join('');
+    return `<section class="card"><h2>Checks</h2>${sections}</section>`;
+}
+export class HtmlFormatter {
+    id = 'html';
+    fileExtension = '.html';
+    format(results) {
+        const statusByCheck = new Map();
+        const issuesByCheck = new Map();
+        for (const check of results.checks) {
+            statusByCheck.set(check.checkId, check.status);
+            issuesByCheck.set(check.checkId, []);
+        }
+        for (const issue of results.issues) {
+            const arr = issuesByCheck.get(issue.checkId);
+            if (arr)
+                arr.push(issue);
+            else
+                issuesByCheck.set(issue.checkId, [issue]);
+        }
+        const embeddedJson = escapeJsonForScriptTag(JSON.stringify(results));
+        const title = `aghast scan ${escapeHtml(results.scanId)}`;
+        return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${title}</title>
+  <style>${CSS}</style>
+</head>
+<body>
+  <div class="container">
+    ${renderHeader(results)}
+    ${renderSummary(results.summary, results.repository)}
+    ${renderIssuesTable(results.issues, statusByCheck)}
+    ${renderCheckDetails(results.checks, issuesByCheck)}
+    <footer>Generated by aghast v${escapeHtml(results.version)}</footer>
+  </div>
+  <script id="aghast-results" type="application/json">${embeddedJson}</script>
+  <script>${CLIENT_JS}</script>
+</body>
+</html>
+`;
+    }
+}
+//# sourceMappingURL=html-formatter.js.map