@secureport/core 0.2.1 → 0.4.0

package/src/report/html.ts

@@ -0,0 +1,449 @@
+import { SEVERITY_ORDER } from '../severity.js';
+import type { Snapshot, SnapshotIssue } from '../snapshot.js';
+import {
+  buildReportModel,
+  type ReportModel,
+  type ReportOptions,
+  type RetestVerdict,
+} from './model.js';
+import { formatDate } from './markdown.js';
+
+/** Escapes text for HTML. Every value from a snapshot goes through this. */
+function esc(value: string): string {
+  return value
+    .replace(/&/gu, '&')
+    .replace(/</gu, '&lt;')
+    .replace(/>/gu, '&gt;')
+    .replace(/"/gu, '&quot;');
+}
+
+/**
+ * The stylesheet, inlined.
+ *
+ * **Inlined rather than linked because a report is a single file that gets
+ * emailed.** A stylesheet fetched at render time would make the document depend
+ * on a network the reader may not have, and on a URL that must then outlive the
+ * report.
+ *
+ * The print rules are here rather than in P7 because P7 renders this through
+ * Chromium: a page that only looks right on screen becomes a PDF that only
+ * looks right on screen. Severity colours are chosen to survive greyscale — the
+ * label carries the meaning, the colour only reinforces it.
+ */
+const STYLES = `
+:root {
+  --ink: #14181f; --muted: #5b6472; --rule: #d9dee6; --bg: #ffffff;
+  --critical: #7f1d1d; --high: #9a3412; --medium: #854d0e; --low: #1e40af; --advisory: #475569;
+}
+* { box-sizing: border-box; }
+body {
+  margin: 0; padding: 2.5rem; background: var(--bg); color: var(--ink);
+  font: 15px/1.6 ui-serif, Georgia, "Times New Roman", serif;
+  max-width: 60rem; margin-inline: auto;
+}
+h1 { font-size: 1.9rem; margin: 0 0 .25rem; letter-spacing: -0.01em; }
+h2 { font-size: 1.25rem; margin: 2.5rem 0 .75rem; padding-bottom: .3rem; border-bottom: 1px solid var(--rule); }
+h3 { font-size: 1.05rem; margin: 1.75rem 0 .5rem; text-transform: capitalize; }
+h4 { font-size: 1rem; margin: 1.25rem 0 .4rem; }
+p, li { margin: .5rem 0; }
+.lede { color: var(--muted); margin: 0 0 1.5rem; }
+table { border-collapse: collapse; width: 100%; margin: .75rem 0; font-size: .92em; }
+th, td { text-align: left; padding: .45rem .6rem; border-bottom: 1px solid var(--rule); vertical-align: top; }
+th { font-weight: 600; color: var(--muted); font-size: .82em; text-transform: uppercase; letter-spacing: .04em; }
+td code, code { font: .88em ui-monospace, SFMono-Regular, Menlo, monospace; word-break: break-all; }
+.meta td:first-child { color: var(--muted); width: 12rem; }
+.sev { font-weight: 600; }
+.sev-critical { color: var(--critical); }
+.sev-high { color: var(--high); }
+.sev-medium { color: var(--medium); }
+.sev-low { color: var(--low); }
+.sev-advisory { color: var(--advisory); }
+.breached { color: var(--critical); font-weight: 600; }
+.issue { break-inside: avoid; page-break-inside: avoid; margin-bottom: 1.5rem; }
+.none { color: var(--muted); font-style: italic; }
+footer { margin-top: 3rem; padding-top: .75rem; border-top: 1px solid var(--rule); color: var(--muted); font-size: .85em; }
+
+@media print {
+  body { padding: 0; font-size: 11pt; max-width: none; }
+  h2 { break-after: avoid; page-break-after: avoid; }
+  h3, h4 { break-after: avoid; page-break-after: avoid; }
+  table { break-inside: auto; }
+  tr { break-inside: avoid; page-break-inside: avoid; }
+  a { color: inherit; text-decoration: none; }
+  /* A printed report is read on paper: a bare URL is unusable, so print it. */
+  .refs a::after { content: " (" attr(href) ")"; font-size: .85em; color: var(--muted); }
+}
+@page { margin: 18mm 16mm; }
+`.trim();
+
+const sevClass = (s: string) => `sev sev-${s}`;
+
+/** The change summary, as a table. */
+function changeSummary(model: ReportModel): string {
+  const { run, baseline } = model.snapshot;
+  const rows = SEVERITY_ORDER.map(
+    (s) =>
+      `<tr><td class="${sevClass(s)}">${s}</td><td>${run.new[s]}</td><td>${run.stillOpen[s]}</td>` +
+      `<td>${run.regressed[s]}</td><td>${run.resolved[s]}</td><td>${run.ignored[s]}</td></tr>`,
+  ).join('');
+
+  return `<h2>What changed</h2>
+<p class="lede">${
+    baseline === undefined
+      ? 'First run against this target, so every issue is new.'
+      : `Compared with the run of ${formatDate(baseline.createdAt)}.`
+  }</p>
+<table><thead><tr><th>Severity</th><th>New</th><th>Still open</th><th>Regressed</th><th>Resolved</th><th>Suppressed</th></tr></thead><tbody>${rows}</tbody></table>
+<p><strong>${model.outstandingTotal} outstanding.</strong> Exposure score ${model.exposureScore}.${
+    model.breached > 0
+      ? ` <span class="breached">${model.breached} past ${model.breached === 1 ? 'its' : 'their'} remediation deadline.</span>`
+      : ''
+  }</p>`;
+}
+
+/** One issue in full. */
+function issueDetail(entry: SnapshotIssue): string {
+  const { issue } = entry;
+  const first = entry.findings[0];
+  const references = [...new Set(entry.findings.flatMap((f) => f.references ?? []))];
+
+  return `<div class="issue">
+<h4>${esc(issue.title)}</h4>
+<table class="meta"><tbody>
+<tr><td>Severity</td><td class="${sevClass(issue.effectiveSeverity)}">${issue.effectiveSeverity}${
+    issue.effectiveSeverity === issue.detectedSeverity
+      ? ''
+      : ` <span class="lede">(detected ${issue.detectedSeverity})</span>`
+  }</td></tr>
+<tr><td>Status</td><td>${issue.status} · ${entry.change.replace('_', ' ')}</td></tr>
+<tr><td>Location</td><td><code>${esc(issue.location)}</code>${
+    issue.parameter === undefined ? '' : ` <code>${esc(issue.parameter)}</code>`
+  }</td></tr>
+<tr><td>First seen</td><td>${formatDate(issue.firstSeen)} (${entry.daysOpen} days)</td></tr>
+<tr><td>Remediation</td><td${entry.slaStatus === 'breached' ? ' class="breached"' : ''}>${
+    issue.slaDueAt === undefined || issue.slaDueAt === null
+      ? 'no deadline'
+      : `${formatDate(issue.slaDueAt)} — ${entry.slaStatus.replace('_', ' ')}`
+  }</td></tr>
+${issue.cwe === undefined ? '' : `<tr><td>Weakness</td><td>${esc(issue.cwe)}</td></tr>`}
+</tbody></table>
+${first?.description === undefined ? '' : `<p>${esc(first.description)}</p>`}
+${first?.recommendation === undefined ? '' : `<p><strong>Recommendation.</strong> ${esc(first.recommendation)}</p>`}
+${
+  entry.findings.length === 0
+    ? ''
+    : `<p class="lede">Evidence: ${entry.findings.length} finding${entry.findings.length === 1 ? '' : 's'} recorded.</p>`
+}
+${
+  references.length === 0
+    ? ''
+    : `<ul class="refs">${references.map((r) => `<li><a href="${esc(r)}">${esc(r)}</a></li>`).join('')}</ul>`
+}
+</div>`;
+}
+
+/** How a verdict is printed. The dashes are an implementation detail. */
+const VERDICT_LABELS: Readonly<Record<RetestVerdict, string>> = Object.freeze({
+  fixed: 'fixed',
+  still_present: 'still present',
+  returned: 'returned',
+  not_retested: 'not retested',
+  new: 'new since',
+});
+
+/** The Retest body: the difference between two runs, and nothing else. */
+function retestBody(model: ReportModel): string {
+  // `buildReportModel` refuses to build a retest without one.
+  const retest = model.retest as NonNullable<ReportModel['retest']>;
+  const { counts } = retest;
+  const carried = counts.fixed + counts.still_present + counts.returned + counts.not_retested;
+
+  const verdicts = (Object.keys(VERDICT_LABELS) as RetestVerdict[])
+    .map((v) => `<tr><td>${VERDICT_LABELS[v]}</td><td>${counts[v]}</td></tr>`)
+    .join('');
+
+  const rows = retest.entries
+    .map((entry) => {
+      const { issue } = entry.issue;
+      const location =
+        issue.parameter === undefined ? issue.location : `${issue.location} (${issue.parameter})`;
+      return `<tr><td>${esc(issue.title)}</td><td class="${sevClass(issue.effectiveSeverity)}">${
+        issue.effectiveSeverity
+      }</td><td>${VERDICT_LABELS[entry.verdict]}</td><td><code>${esc(location)}</code></td><td>${
+        entry.issue.daysOpen
+      } days</td></tr>`;
+    })
+    .join('');
+
+  return `<h2>Retest verdict</h2>
+<p class="lede">Retested against the run of ${formatDate(retest.baseline.createdAt)}.</p>
+<p>${
+    carried === 0
+      ? 'No issues were carried into this retest.'
+      : `Of the ${carried} issue${carried === 1 ? '' : 's'} carried into this retest, <strong>${
+          counts.fixed
+        } ${counts.fixed === 1 ? 'is' : 'are'} confirmed fixed</strong>, ${counts.still_present} ${
+          counts.still_present === 1 ? 'is' : 'are'
+        } still present, ${counts.returned} returned, and ${
+          counts.not_retested
+        } could not be retested.${
+          counts.new === 0
+            ? ''
+            : ` A further ${counts.new} ${counts.new === 1 ? 'issue was' : 'issues were'} found for the first time by this run.`
+        }`
+  }</p>
+${
+  retest.fixRate === null
+    ? ''
+    : `<p>${Math.round(retest.fixRate * 100)}% of the issues this run could check are fixed.</p>`
+}
+<table><thead><tr><th>Verdict</th><th>Issues</th></tr></thead><tbody>${verdicts}</tbody></table>
+${
+  counts.not_retested === 0
+    ? ''
+    : `<h2>Not retested</h2><p>${counts.not_retested} issue${
+        counts.not_retested === 1 ? '' : 's'
+      } could not be retested by this run: the run did not cover where they were found, or has not missed them often enough to call them resolved. <strong>They are not fixed.</strong> An issue nobody looked at is neither fixed nor unfixed, and it is excluded from the percentage above rather than counted either way.</p>`
+}
+<h2>Issue by issue</h2>
+${
+  rows === ''
+    ? '<p class="none">No issues.</p>'
+    : `<table><thead><tr><th>Issue</th><th>Severity</th><th>Verdict</th><th>Location</th><th>Open for</th></tr></thead><tbody>${rows}</tbody></table>`
+}`;
+}
+
+/** The Executive Summary body. */
+function executiveBody(model: ReportModel): string {
+  const resolvedCount = model.resolved.length;
+  const regressed = model.sections
+    .flatMap((s) => s.issues)
+    .filter((i) => i.change === 'regressed').length;
+  const urgent = model.outstanding.critical + model.outstanding.high;
+
+  const notes: string[] = [];
+  if (resolvedCount > 0) {
+    notes.push(
+      `<p>${resolvedCount} issue${resolvedCount === 1 ? ' was' : 's were'} resolved since the last run.</p>`,
+    );
+  }
+  if (regressed > 0) {
+    notes.push(
+      `<p><strong>${regressed} previously resolved issue${regressed === 1 ? ' has' : 's have'} returned.</strong> A returning issue usually means a fix was reverted or incompletely applied.</p>`,
+    );
+  }
+  if (model.breached > 0) {
+    notes.push(
+      `<p class="breached">${model.breached} ${model.breached === 1 ? 'is' : 'are'} past the remediation deadline set by the severity policy.</p>`,
+    );
+  }
+
+  const rows = SEVERITY_ORDER.filter((sev) => model.outstanding[sev] > 0)
+    .map(
+      (sev) =>
+        `<tr><td class="${sevClass(sev)}">${sev}</td><td>${model.outstanding[sev]}</td></tr>`,
+    )
+    .join('');
+
+  const notable = model.sections
+    .flatMap((s) => s.issues)
+    .filter((i) => ['critical', 'high'].includes(i.issue.effectiveSeverity))
+    .slice(0, 10);
+
+  return `<h2>Where things stand</h2>
+<p>${
+    model.outstandingTotal === 0
+      ? 'Nothing is currently outstanding on this target.'
+      : `${model.outstandingTotal} issue${model.outstandingTotal === 1 ? '' : 's'} ${
+          model.outstandingTotal === 1 ? 'is' : 'are'
+        } currently outstanding, of which ${urgent} ${urgent === 1 ? 'is' : 'are'} critical or high.`
+  }</p>
+${notes.join('')}
+<h2>Outstanding by severity</h2>
+${
+  rows === ''
+    ? '<p class="none">Nothing outstanding.</p>'
+    : `<table><thead><tr><th>Severity</th><th>Outstanding</th></tr></thead><tbody>${rows}</tbody></table>`
+}
+${
+  notable.length === 0
+    ? ''
+    : `<h2>What needs attention first</h2><ul>${notable
+        .map(
+          (e) =>
+            `<li><span class="${sevClass(e.issue.effectiveSeverity)}">${e.issue.effectiveSeverity}</span> — ${esc(
+              e.issue.title,
+            )} (open ${e.daysOpen} days)</li>`,
+        )
+        .join(
+          '',
+        )}</ul><p class="lede">Full detail, including evidence, is in the accompanying technical report.</p>`
+}
+<p>Exposure score ${model.exposureScore}. This is a single number combining how many issues are open, how severe they are and how long they have been open. It falls as issues are fixed and rises while they are not.</p>`;
+}
+
+/** The Attestation Letter body. */
+function attestationBody(model: ReportModel): string {
+  const { snapshot } = model;
+  const found = snapshot.issues.length + snapshot.suppressed.length;
+  const rows = SEVERITY_ORDER.map(
+    (sev) => `<tr><td class="${sevClass(sev)}">${sev}</td><td>${model.outstanding[sev]}</td></tr>`,
+  ).join('');
+
+  return `<h2>Statement</h2>
+<p>${esc(model.preparedBy ?? 'Secureport')} carried out security testing of <strong>${esc(
+    snapshot.target.name,
+  )}</strong> (${esc(snapshot.target.url)}) on ${formatDate(snapshot.run.createdAt)}.</p>
+<p>${esc(model.basis.statement)}</p>
+<p>The testing identified ${found} issue${found === 1 ? '' : 's'} in total, of which ${
+    model.outstandingTotal
+  } ${model.outstandingTotal === 1 ? 'remains' : 'remain'} outstanding at the date of this letter:</p>
+<table><thead><tr><th>Severity</th><th>Outstanding</th></tr></thead><tbody>${rows}</tbody></table>
+<h2>What this letter does not establish</h2>
+<ul>${model.limitations.map((l) => `<li>${esc(l)}</li>`).join('')}</ul>
+<h2>Scope tested</h2>
+<ul>${snapshot.run.coverage.paths.map((p) => `<li><code>${esc(p)}</code></li>`).join('')}</ul>`;
+}
+
+/**
+ * Renders a snapshot as a single self-contained HTML document.
+ *
+ * No external stylesheet, no script, no fonts to fetch: a report is a file that
+ * gets emailed, and one that needs a network to look right is one that
+ * eventually does not. The print rules ship here rather than in P7 because P7
+ * renders this same document through Chromium.
+ *
+ * Every value taken from the snapshot is escaped. A scanner's evidence routinely
+ * contains the payload that proved the weakness — `<script>alert(1)</script>` is
+ * a *normal* finding title — so a report that interpolates it unescaped attacks
+ * whoever opens it.
+ *
+ * @param snapshot - Issue state as of a run.
+ * @param options - Which report, attribution, and the render time.
+ * @returns A complete HTML document.
+ */
+export function renderHtml(snapshot: Snapshot, options: ReportOptions): string {
+  const model = buildReportModel(snapshot, options);
+  const { target } = snapshot;
+
+  const meta = [
+    `<tr><td>Generated</td><td>${formatDate(model.generatedAt)}</td></tr>`,
+    `<tr><td>Run</td><td>${esc(snapshot.run.runId)} (${esc(snapshot.run.trigger)})</td></tr>`,
+    model.preparedFor === undefined
+      ? ''
+      : `<tr><td>Prepared for</td><td>${esc(model.preparedFor)}</td></tr>`,
+    model.preparedBy === undefined
+      ? ''
+      : `<tr><td>Prepared by</td><td>${esc(model.preparedBy)}</td></tr>`,
+  ].join('');
+
+  // The Attestation Letter carries the basis, the scope and the counts itself,
+  // in the order a letter reads. Adding the report furniture on top would state
+  // each of them twice, and a formal document that repeats itself is one a
+  // reader stops trusting.
+  const preamble =
+    model.kind === 'attest'
+      ? ''
+      : `<h2>Basis of testing</h2>
+<p>${esc(model.basis.statement)}</p>
+<h2>Scope</h2>
+<p>This report covers only what the run exercised: ${snapshot.run.coverage.paths
+          .map((p) => `<code>${esc(p)}</code>`)
+          .join(', ')}. Anything outside that was not tested and is not described here.</p>
+${changeSummary(model)}`;
+
+  let findings: string;
+  if (model.kind === 'exec') {
+    findings = executiveBody(model);
+  } else if (model.kind === 'retest') {
+    findings = retestBody(model);
+  } else if (model.kind === 'attest') {
+    findings = attestationBody(model);
+  } else if (model.sections.length === 0) {
+    findings = '<h2>Findings</h2><p class="none">No issues were found.</p>';
+  } else if (model.kind === 'pen') {
+    findings =
+      '<h2>Findings</h2>' +
+      model.sections
+        .map(
+          (section) =>
+            `<h3 class="${sevClass(section.severity)}">${section.severity} (${section.issues.length})</h3>` +
+            section.issues.map(issueDetail).join(''),
+        )
+        .join('');
+  } else {
+    const rows = model.sections
+      .flatMap((s) => s.issues)
+      .map((entry) => {
+        const { issue } = entry;
+        const location =
+          issue.parameter === undefined ? issue.location : `${issue.location} (${issue.parameter})`;
+        return `<tr><td>${esc(issue.title)}</td><td class="${sevClass(issue.effectiveSeverity)}">${
+          issue.effectiveSeverity
+        }</td><td><code>${esc(location)}</code></td><td>${entry.change.replace('_', ' ')}</td><td>${
+          entry.daysOpen
+        }</td><td${entry.slaStatus === 'breached' ? ' class="breached"' : ''}>${entry.slaStatus.replace('_', ' ')}</td></tr>`;
+      })
+      .join('');
+    findings = `<h2>Findings</h2><table><thead><tr><th>Issue</th><th>Severity</th><th>Location</th><th>Change</th><th>Days open</th><th>Remediation</th></tr></thead><tbody>${rows}</tbody></table>`;
+  }
+
+  const resolved =
+    model.kind === 'exec' ||
+    model.kind === 'attest' ||
+    model.kind === 'retest' ||
+    model.resolved.length === 0
+      ? ''
+      : `<h2>Resolved since the last run</h2>
+<p class="lede">${model.resolved.length} issue${model.resolved.length === 1 ? '' : 's'} no longer detected by a run that covered ${
+          model.resolved.length === 1 ? 'it' : 'them'
+        }.</p>
+<table><thead><tr><th>Issue</th><th>Severity</th><th>Location</th><th>Open for</th></tr></thead><tbody>${model.resolved
+          .map(
+            (entry) =>
+              `<tr><td>${esc(entry.issue.title)}</td><td class="${sevClass(
+                entry.issue.effectiveSeverity,
+              )}">${entry.issue.effectiveSeverity}</td><td><code>${esc(
+                entry.issue.location,
+              )}</code></td><td>${entry.daysOpen} days</td></tr>`,
+          )
+          .join('')}</tbody></table>`;
+
+  const suppressed =
+    snapshot.suppressed.length === 0
+      ? '<h2>Suppressed findings</h2><p class="none">None.</p>'
+      : `<h2>Suppressed findings</h2>
+<p class="lede">Accepted, out of scope or dismissed. Listed because an accepted risk nobody can see is not an accepted risk.</p>
+<table><thead><tr><th>Issue</th><th>Severity when suppressed</th><th>Reason</th><th>By</th><th>Expires</th><th>Justification</th></tr></thead><tbody>${snapshot.suppressed
+          .map(
+            (s) =>
+              `<tr><td>${esc(s.issue.title)}</td><td class="${sevClass(s.severityAtIgnore)}">${
+                s.severityAtIgnore
+              }</td><td>${s.reason.replace('_', ' ')}</td><td>${esc(s.ignoredBy)}</td><td>${
+                s.expiresAt === undefined ? 'never' : formatDate(s.expiresAt)
+              }</td><td>${esc(s.comment)}</td></tr>`,
+          )
+          .join('')}</tbody></table>`;
+
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${esc(model.title)} — ${esc(target.name)}</title>
+<style>${STYLES}</style>
+</head>
+<body>
+<h1>${esc(model.title)}</h1>
+<p class="lede"><strong>${esc(target.name)}</strong> — ${esc(target.url)}</p>
+<table class="meta"><tbody>${meta}</tbody></table>
+${preamble}
+${findings}
+${resolved}
+${suppressed}
+<footer>Generated by Secureport from run ${esc(snapshot.run.runId)}. Issue state as of ${formatDate(
+    snapshot.run.createdAt,
+  )}.</footer>
+</body>
+</html>`;
+}

package/src/report/json.ts

@@ -0,0 +1,134 @@
+import type { Snapshot } from '../snapshot.js';
+import {
+  buildReportModel,
+  type ReportKind,
+  type ReportOptions,
+  type RetestVerdict,
+} from './model.js';
+
+/**
+ * The machine-readable report.
+ *
+ * A stable, documented shape rather than the raw snapshot: the snapshot is an
+ * internal contract that will grow, and a consumer building a dashboard on a
+ * report should not have to track that. It carries the derived answers — what
+ * changed, what is outstanding, how the findings were produced — beside the
+ * snapshot itself, so a consumer can use either.
+ */
+export interface JsonReport {
+  /** Format version. Bumped when the shape changes incompatibly. */
+  readonly reportVersion: 1;
+
+  /** Which report this is. */
+  readonly kind: ReportKind;
+
+  /** The title as printed. */
+  readonly title: string;
+
+  /** When it was rendered, ISO 8601. */
+  readonly generatedAt: string;
+
+  /** Who prepared it, if stated. */
+  readonly preparedBy?: string;
+
+  /** Who it is for, if stated. */
+  readonly preparedFor?: string;
+
+  /**
+   * How the findings were produced.
+   *
+   * Present in the JSON as well as the prose because a consumer that renders
+   * its own view must not be able to present automated results as manual
+   * testing simply by not reading the sentence.
+   */
+  readonly basis: {
+    readonly automated: boolean;
+    readonly uploaded: boolean;
+    readonly includesManual: boolean;
+    readonly engines: readonly string[];
+    readonly statement: string;
+  };
+
+  /**
+   * What the report does not establish.
+   *
+   * Here for the same reason as {@link JsonReport.basis}: a consumer rendering
+   * its own view must not be able to drop the limits by not reading the prose.
+   */
+  readonly limitations: readonly string[];
+
+  /**
+   * What this run established about the issues carried into it.
+   *
+   * Present whenever the snapshot has a baseline. Verdicts are keyed by issue
+   * id rather than repeating the issues, which are already in the snapshot.
+   */
+  readonly retest?: {
+    readonly baselineRunId: string;
+    readonly counts: Readonly<Record<RetestVerdict, number>>;
+    readonly fixRate: number | null;
+    readonly verdicts: Readonly<Record<string, RetestVerdict>>;
+  };
+
+  /** Open and regressed issues by severity, and their total. */
+  readonly outstanding: Readonly<Record<string, number>> & { readonly total: number };
+
+  /** Exposure at the end of the run. */
+  readonly exposureScore: number;
+
+  /** Issues past their remediation deadline. */
+  readonly breached: number;
+
+  /** The snapshot this was rendered from. */
+  readonly snapshot: Snapshot;
+}
+
+/**
+ * Renders a snapshot as JSON.
+ *
+ * Deterministic and key-ordered, so two renders of one snapshot are
+ * byte-identical and a diff between two reports shows only what actually
+ * changed.
+ *
+ * @param snapshot - Issue state as of a run.
+ * @param options - Which report, attribution, and the render time.
+ * @returns The report as a JSON string.
+ */
+export function renderJson(snapshot: Snapshot, options: ReportOptions): string {
+  const model = buildReportModel(snapshot, options);
+
+  const report: JsonReport = {
+    reportVersion: 1,
+    kind: model.kind,
+    title: model.title,
+    generatedAt: model.generatedAt.toISOString(),
+    ...(model.preparedBy === undefined ? {} : { preparedBy: model.preparedBy }),
+    ...(model.preparedFor === undefined ? {} : { preparedFor: model.preparedFor }),
+    basis: {
+      automated: model.basis.automated,
+      uploaded: model.basis.uploaded,
+      includesManual: model.basis.includesManual,
+      engines: model.basis.engines,
+      statement: model.basis.statement,
+    },
+    limitations: model.limitations,
+    ...(model.retest === undefined
+      ? {}
+      : {
+          retest: {
+            baselineRunId: model.retest.baseline.runId,
+            counts: model.retest.counts,
+            fixRate: model.retest.fixRate,
+            verdicts: Object.fromEntries(
+              model.retest.entries.map((e) => [e.issue.issue.id, e.verdict]),
+            ),
+          },
+        }),
+    outstanding: { ...model.outstanding, total: model.outstandingTotal },
+    exposureScore: model.exposureScore,
+    breached: model.breached,
+    snapshot,
+  };
+
+  return JSON.stringify(report, null, 2);
+}