@secureport/core 0.2.1 → 0.4.0

package/dist/report/markdown.js

@@ -0,0 +1,304 @@
+import { SEVERITY_ORDER } from '../severity.js';
+import { buildReportModel, } from './model.js';
+/** A date, printed the same way everywhere, without a locale to disagree about. */
+export function formatDate(date) {
+    return date.toISOString().slice(0, 10);
+}
+/** Escapes the characters that would break out of a Markdown table cell. */
+function cell(value) {
+    return value.replace(/\|/gu, '\\|').replace(/\n/gu, ' ');
+}
+/** The change summary every report opens with, per `00-DOMAIN.md` §7. */
+function changeSummary(model) {
+    const { run, baseline } = model.snapshot;
+    const rows = SEVERITY_ORDER.map((severity) => {
+        const cells = [
+            severity,
+            run.new[severity],
+            run.stillOpen[severity],
+            run.regressed[severity],
+            run.resolved[severity],
+            run.ignored[severity],
+        ];
+        return `| ${cells.join(' | ')} |`;
+    });
+    return [
+        '## What changed',
+        '',
+        baseline === undefined
+            ? '_First run against this target, so every issue is new._'
+            : `_Compared with the run of ${formatDate(baseline.createdAt)}._`,
+        '',
+        '| Severity | New | Still open | Regressed | Resolved | Suppressed |',
+        '| --- | --- | --- | --- | --- | --- |',
+        ...rows,
+        '',
+        `**${model.outstandingTotal} outstanding.** Exposure score ${model.exposureScore}.` +
+            (model.breached > 0
+                ? ` **${model.breached} past ${model.breached === 1 ? 'its' : 'their'} remediation deadline.**`
+                : ''),
+    ];
+}
+/** One issue, in full. The Penetration Test presentation. */
+function issueDetail(entry) {
+    const { issue } = entry;
+    const lines = [
+        `#### ${issue.title}`,
+        '',
+        `| | |`,
+        `| --- | --- |`,
+        `| Severity | ${issue.effectiveSeverity}${issue.effectiveSeverity === issue.detectedSeverity
+            ? ''
+            : ` (detected ${issue.detectedSeverity})`} |`,
+        `| Status | ${issue.status} · ${entry.change.replace('_', ' ')} |`,
+        `| Location | \`${cell(issue.location)}\`${issue.parameter === undefined ? '' : ` (\`${cell(issue.parameter)}\`)`} |`,
+        `| First seen | ${formatDate(issue.firstSeen)} (${entry.daysOpen} days) |`,
+        `| Remediation | ${issue.slaDueAt === undefined || issue.slaDueAt === null
+            ? 'no deadline'
+            : `${formatDate(issue.slaDueAt)} — ${entry.slaStatus.replace('_', ' ')}`} |`,
+    ];
+    if (issue.cwe !== undefined)
+        lines.push(`| Weakness | ${issue.cwe} |`);
+    lines.push('');
+    const first = entry.findings[0];
+    if (first?.description !== undefined)
+        lines.push(first.description, '');
+    if (first?.recommendation !== undefined) {
+        lines.push('**Recommendation.** ' + first.recommendation, '');
+    }
+    if (entry.findings.length > 0) {
+        // The count, not the engine. Which scanner produced a finding is an
+        // implementation detail of the assessment, and naming the stack in a
+        // customer-facing document gives away more than it explains.
+        lines.push(`_Evidence: ${entry.findings.length} finding${entry.findings.length === 1 ? '' : 's'} recorded._`, '');
+        const references = [...new Set(entry.findings.flatMap((f) => f.references ?? []))];
+        if (references.length > 0) {
+            lines.push(...references.map((r) => `- ${r}`), '');
+        }
+    }
+    return lines;
+}
+/** One issue, as a table row. The Vulnerability Assessment presentation. */
+function issueRow(entry) {
+    const { issue } = entry;
+    const location = issue.parameter === undefined ? issue.location : `${issue.location} (${issue.parameter})`;
+    return `| ${cell(issue.title)} | ${issue.effectiveSeverity} | \`${cell(location)}\` | ${entry.change.replace('_', ' ')} | ${entry.daysOpen} | ${entry.slaStatus.replace('_', ' ')} |`;
+}
+/** How a verdict is printed. The dashes are an implementation detail. */
+const VERDICT_LABELS = Object.freeze({
+    fixed: 'fixed',
+    still_present: 'still present',
+    returned: 'returned',
+    not_retested: 'not retested',
+    new: 'new since',
+});
+/** The Retest body: the difference between two runs, and nothing else. */
+function retestBody(model) {
+    // `buildReportModel` refuses to build a retest without one.
+    const retest = model.retest;
+    const { counts } = retest;
+    const carried = counts.fixed + counts.still_present + counts.returned + counts.not_retested;
+    const lines = [
+        '## Retest verdict',
+        '',
+        `Retested against the run of ${formatDate(retest.baseline.createdAt)}.`,
+        '',
+        carried === 0
+            ? 'No issues were carried into this retest.'
+            : `Of the ${carried} issue${carried === 1 ? '' : 's'} carried into this retest, ` +
+                `**${counts.fixed} ${counts.fixed === 1 ? 'is' : 'are'} confirmed fixed**, ` +
+                `${counts.still_present} ${counts.still_present === 1 ? 'is' : 'are'} still present, ` +
+                `${counts.returned} returned, and ${counts.not_retested} could not be retested.` +
+                (counts.new === 0
+                    ? ''
+                    : ` A further ${counts.new} ${counts.new === 1 ? 'issue was' : 'issues were'} found for the first time by this run.`),
+        '',
+    ];
+    if (retest.fixRate !== null) {
+        lines.push(`${Math.round(retest.fixRate * 100)}% of the issues this run could check are fixed.`, '');
+    }
+    lines.push('| Verdict | Issues |', '| --- | --- |', ...Object.keys(VERDICT_LABELS).map((v) => `| ${VERDICT_LABELS[v]} | ${counts[v]} |`), '');
+    // The section that stops this document reporting a coverage gap as
+    // remediation. Stated before the issue table, not in a footnote after it.
+    if (counts.not_retested > 0) {
+        lines.push('## Not retested', '', `${counts.not_retested} issue${counts.not_retested === 1 ? '' : 's'} could not be retested by this run:`, 'the run did not cover where they were found, or has not missed them often enough to', 'call them resolved. **They are not fixed.** An issue nobody looked at is neither fixed', 'nor unfixed, and it is excluded from the percentage above rather than counted either way.', '');
+    }
+    if (retest.entries.length === 0) {
+        lines.push('## Issue by issue', '', '_No issues._', '');
+        return lines;
+    }
+    lines.push('## Issue by issue', '', '| Issue | Severity | Verdict | Location | Open for |', '| --- | --- | --- | --- | --- |', ...retest.entries.map((entry) => {
+        const { issue } = entry.issue;
+        const location = issue.parameter === undefined ? issue.location : `${issue.location} (${issue.parameter})`;
+        return `| ${cell(issue.title)} | ${issue.effectiveSeverity} | ${VERDICT_LABELS[entry.verdict]} | \`${cell(location)}\` | ${entry.issue.daysOpen} days |`;
+    }), '');
+    return lines;
+}
+/** The suppressed-findings appendix. On by default, never optional. */
+function suppressedAppendix(snapshot) {
+    if (snapshot.suppressed.length === 0) {
+        return ['## Suppressed findings', '', '_None._'];
+    }
+    return [
+        '## Suppressed findings',
+        '',
+        'Accepted, out of scope or dismissed. Listed because an accepted risk that',
+        'nobody can see is not an accepted risk.',
+        '',
+        '| Issue | Severity when suppressed | Reason | By | Expires | Justification |',
+        '| --- | --- | --- | --- | --- | --- |',
+        ...snapshot.suppressed.map((s) => `| ${cell(s.issue.title)} | ${s.severityAtIgnore} | ${s.reason.replace('_', ' ')} | ${cell(s.ignoredBy)} | ${s.expiresAt === undefined ? 'never' : formatDate(s.expiresAt)} | ${cell(s.comment)} |`),
+    ];
+}
+/** The Executive Summary body: what changed, what it means, no technical detail. */
+function executiveBody(model) {
+    const resolvedCount = model.resolved.length;
+    const regressed = model.sections
+        .flatMap((s) => s.issues)
+        .filter((i) => i.change === 'regressed').length;
+    const headline = model.outstandingTotal === 0
+        ? 'Nothing is currently outstanding on this target.'
+        : `${model.outstandingTotal} issue${model.outstandingTotal === 1 ? '' : 's'} ${model.outstandingTotal === 1 ? 'is' : 'are'} currently outstanding, of which ${model.outstanding.critical + model.outstanding.high} ` +
+            `${model.outstanding.critical + model.outstanding.high === 1 ? 'is' : 'are'} critical or high.`;
+    const lines = ['## Where things stand', '', headline, ''];
+    if (resolvedCount > 0) {
+        lines.push(`${resolvedCount} issue${resolvedCount === 1 ? ' was' : 's were'} resolved since the last run.`, '');
+    }
+    if (regressed > 0) {
+        lines.push(`**${regressed} previously resolved issue${regressed === 1 ? ' has' : 's have'} returned.** ` +
+            'A returning issue usually means a fix was reverted or incompletely applied.', '');
+    }
+    if (model.breached > 0) {
+        lines.push(`**${model.breached} ${model.breached === 1 ? 'is' : 'are'} past the remediation deadline** ` +
+            'set by the severity policy.', '');
+    }
+    lines.push('## Outstanding by severity', '', '| Severity | Outstanding |', '| --- | --- |', ...SEVERITY_ORDER.filter((sev) => model.outstanding[sev] > 0).map((sev) => `| ${sev} | ${model.outstanding[sev]} |`), '');
+    if (model.outstandingTotal === 0)
+        lines.push('_Nothing outstanding._', '');
+    // Named, but not explained. An executive summary that reproduces the
+    // technical report is not a summary, and the reader who wants detail has the
+    // other three.
+    const notable = model.sections
+        .flatMap((s) => s.issues)
+        .filter((i) => ['critical', 'high'].includes(i.issue.effectiveSeverity))
+        .slice(0, 10);
+    if (notable.length > 0) {
+        lines.push('## What needs attention first', '', ...notable.map((entry) => `- **${entry.issue.effectiveSeverity}** — ${entry.issue.title} (open ${entry.daysOpen} days)`), '', '_Full detail, including evidence, is in the accompanying technical report._', '');
+    }
+    lines.push(`Exposure score ${model.exposureScore}. This is a single number combining how many issues`, 'are open, how severe they are and how long they have been open. It falls as issues are', 'fixed and rises while they are not.', '');
+    return lines;
+}
+/** The Attestation Letter body: a formal statement, with its limits stated. */
+function attestationBody(model) {
+    const { snapshot } = model;
+    const found = snapshot.issues.length + snapshot.suppressed.length;
+    return [
+        '## Statement',
+        '',
+        `${model.preparedBy ?? 'Secureport'} carried out security testing of **${snapshot.target.name}**`,
+        `(${snapshot.target.url}) on ${formatDate(snapshot.run.createdAt)}.`,
+        '',
+        model.basis.statement,
+        '',
+        `The testing identified ${found} issue${found === 1 ? '' : 's'} in total, of which`,
+        `${model.outstandingTotal} ${model.outstandingTotal === 1 ? 'remains' : 'remain'} outstanding at the date of this letter:`,
+        '',
+        '| Severity | Outstanding |',
+        '| --- | --- |',
+        ...SEVERITY_ORDER.map((sev) => `| ${sev} | ${model.outstanding[sev]} |`),
+        '',
+        // The most important section in the document, and deliberately not last:
+        // a reader who stops early must still have read it.
+        '## What this letter does not establish',
+        '',
+        ...model.limitations.map((l) => `- ${l}`),
+        '',
+        '## Scope tested',
+        '',
+        ...snapshot.run.coverage.paths.map((p) => `- \`${cell(p)}\``),
+        '',
+    ];
+}
+/**
+ * Renders a snapshot as Markdown.
+ *
+ * The Penetration Test report gives every issue in full with its evidence; the
+ * Vulnerability Assessment tabulates the same issues; the Executive Summary
+ * says what changed and what it means without technical detail; the Attestation
+ * Letter states formally that testing was carried out, and states what it does
+ * not establish as prominently as what it found. **They are presentations of one
+ * snapshot** — any difference in substance would be a bug.
+ *
+ * Deterministic: the same snapshot and the same `now` produce byte-identical
+ * output, which is what lets a report be compared with the copy somebody was
+ * sent, and what makes golden-file testing meaningful.
+ *
+ * @param snapshot - Issue state as of a run.
+ * @param options - Which report, attribution, and the render time.
+ * @returns The report as Markdown.
+ */
+export function renderMarkdown(snapshot, options) {
+    const model = buildReportModel(snapshot, options);
+    const { target } = snapshot;
+    const lines = [
+        `# ${model.title}`,
+        '',
+        `**${target.name}** — ${target.url}`,
+        '',
+        `| | |`,
+        `| --- | --- |`,
+        `| Generated | ${formatDate(model.generatedAt)} |`,
+        `| Run | ${snapshot.run.runId} (${snapshot.run.trigger}) |`,
+    ];
+    if (model.preparedFor !== undefined)
+        lines.push(`| Prepared for | ${cell(model.preparedFor)} |`);
+    if (model.preparedBy !== undefined)
+        lines.push(`| Prepared by | ${cell(model.preparedBy)} |`);
+    lines.push('');
+    // The Attestation Letter carries the basis, the scope and the counts itself,
+    // in the order a letter reads. Adding the report furniture on top would state
+    // each of them twice, and a formal document that repeats itself is one a
+    // reader stops trusting.
+    if (model.kind === 'attest') {
+        lines.push(...attestationBody(model), ...suppressedAppendix(snapshot), '');
+        return lines.join('\n');
+    }
+    lines.push('## Basis of testing', '', model.basis.statement, '');
+    lines.push('## Scope', '', `This report covers only what the run exercised: ${snapshot.run.coverage.paths
+        .map((p) => `\`${cell(p)}\``)
+        .join(', ')}.`, 'Anything outside that was not tested and is not described here.', '');
+    lines.push(...changeSummary(model), '');
+    if (model.kind === 'exec') {
+        lines.push(...executiveBody(model), ...suppressedAppendix(snapshot), '');
+        return lines.join('\n');
+    }
+    if (model.kind === 'retest') {
+        lines.push(...retestBody(model), ...suppressedAppendix(snapshot), '');
+        return lines.join('\n');
+    }
+    if (model.sections.length === 0) {
+        lines.push('## Findings', '', '_No issues were found._', '');
+    }
+    else if (model.kind === 'pen') {
+        lines.push('## Findings', '');
+        for (const section of model.sections) {
+            lines.push(`### ${section.severity} (${section.issues.length})`, '');
+            for (const entry of section.issues)
+                lines.push(...issueDetail(entry));
+        }
+    }
+    else {
+        lines.push('## Findings', '', '| Issue | Severity | Location | Change | Days open | Remediation |', '| --- | --- | --- | --- | --- | --- |');
+        for (const section of model.sections) {
+            for (const entry of section.issues)
+                lines.push(issueRow(entry));
+        }
+        lines.push('');
+    }
+    if (model.resolved.length > 0) {
+        lines.push('## Resolved since the last run', '', `${model.resolved.length} issue${model.resolved.length === 1 ? '' : 's'} no longer detected by a run that covered ${model.resolved.length === 1 ? 'it' : 'them'}.`, '', '| Issue | Severity | Location | Open for |', '| --- | --- | --- | --- |', ...model.resolved.map((entry) => `| ${cell(entry.issue.title)} | ${entry.issue.effectiveSeverity} | \`${cell(entry.issue.location)}\` | ${entry.daysOpen} days |`), '');
+    }
+    lines.push(...suppressedAppendix(snapshot), '');
+    return lines.join('\n');
+}
+//# sourceMappingURL=markdown.js.map

package/dist/report/markdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.js","sourceRoot":"","sources":["../../src/report/markdown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EACL,gBAAgB,GAIjB,MAAM,YAAY,CAAC;AAEpB,mFAAmF;AACnF,MAAM,UAAU,UAAU,CAAC,IAAU;IACnC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,4EAA4E;AAC5E,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,yEAAyE;AACzE,SAAS,aAAa,CAAC,KAAkB;IACvC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;IACzC,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG;YACZ,QAAQ;YACR,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;YACjB,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC;YACvB,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC;YACvB,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtB,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;SACtB,CAAC;QACF,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,iBAAiB;QACjB,EAAE;QACF,QAAQ,KAAK,SAAS;YACpB,CAAC,CAAC,yDAAyD;YAC3D,CAAC,CAAC,6BAA6B,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI;QACnE,EAAE;QACF,qEAAqE;QACrE,uCAAuC;QACvC,GAAG,IAAI;QACP,EAAE;QACF,KAAK,KAAK,CAAC,gBAAgB,kCAAkC,KAAK,CAAC,aAAa,GAAG;YACjF,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC;gBACjB,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,SAAS,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,0BAA0B;gBAC/F,CAAC,CAAC,EAAE,CAAC;KACV,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,SAAS,WAAW,CAAC,KAAoB;IACvC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACxB,MAAM,KAAK,GAAa;QACtB,QAAQ,KAAK,CAAC,KAAK,EAAE;QACrB,EAAE;QACF,OAAO;QACP,eAAe;QACf,gBAAgB,KAAK,CAAC,iBAAiB,GACrC,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,gBAAgB;YAChD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,cAAc,KAAK,CAAC,gBAAgB,GAC1C,IAAI;QACJ,cAAc,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI;QAClE,kBAAkB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI;QACrH,kBAAkB,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,QAAQ,UAAU;QAC1E,mBACE,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;YACrD,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,EAC1E,IAAI;KACL,CAAC;IACF,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IACvE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,KAAK,EAAE,WAAW,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACxE,IAAI,KAAK,EAAE,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,sBAAsB,GAAG,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,oEAAoE;QACpE,qEAAqE;QACrE,6DAA6D;QAC7D,KAAK,CAAC,IAAI,CACR,cAAc,KAAK,CAAC,QAAQ,CAAC,MAAM,WAAW,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,aAAa,EACjG,EAAE,CACH,CAAC;QACF,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,SAAS,QAAQ,CAAC,KAAoB;IACpC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACxB,MAAM,QAAQ,GACZ,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,SAAS,GAAG,CAAC;IAC5F,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,iBAAiB,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,QAAQ,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC;AACxL,CAAC;AAED,yEAAyE;AACzE,MAAM,cAAc,GAA4C,MAAM,CAAC,MAAM,CAAC;IAC5E,KAAK,EAAE,OAAO;IACd,aAAa,EAAE,eAAe;IAC9B,QAAQ,EAAE,UAAU;IACpB,YAAY,EAAE,cAAc;IAC5B,GAAG,EAAE,WAAW;CACjB,CAAC,CAAC;AAEH,0EAA0E;AAC1E,SAAS,UAAU,CAAC,KAAkB;IACpC,4DAA4D;IAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,MAA4C,CAAC;IAClE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC;IAE5F,MAAM,KAAK,GAAG;QACZ,mBAAmB;QACnB,EAAE;QACF,+BAA+B,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG;QACvE,EAAE;QACF,OAAO,KAAK,CAAC;YACX,CAAC,CAAC,0CAA0C;YAC5C,CAAC,CAAC,UAAU,OAAO,SAAS,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,6BAA6B;gBAC/E,KAAK,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,sBAAsB;gBAC5E,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,kBAAkB;gBACtF,GAAG,MAAM,CAAC,QAAQ,kBAAkB,MAAM,CAAC,YAAY,yBAAyB;gBAChF,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;oBACf,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,cAAc,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,wCAAwC,CAAC;QAC3H,EAAE;KACH,CAAC;IAEF,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CACR,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,iDAAiD,EACpF,EAAE,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CACR,sBAAsB,EACtB,eAAe,EACf,GAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAqB,CAAC,GAAG,CACrD,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,IAAI,CACjD,EACD,EAAE,CACH,CAAC;IAEF,mEAAmE;IACnE,0EAA0E;IAC1E,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CACR,iBAAiB,EACjB,EAAE,EACF,GAAG,MAAM,CAAC,YAAY,SAAS,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,qCAAqC,EACxG,qFAAqF,EACrF,wFAAwF,EACxF,2FAA2F,EAC3F,EAAE,CACH,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,IAAI,CACR,mBAAmB,EACnB,EAAE,EACF,sDAAsD,EACtD,iCAAiC,EACjC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9B,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC;QAC9B,MAAM,QAAQ,GACZ,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,SAAS,GAAG,CAAC;QAC5F,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,iBAAiB,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,CAAC,KAAK,CAAC,QAAQ,SAAS,CAAC;IAC3J,CAAC,CAAC,EACF,EAAE,CACH,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AACvE,SAAS,kBAAkB,CAAC,QAAkB;IAC5C,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,wBAAwB,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IACD,OAAO;QACL,wBAAwB;QACxB,EAAE;QACF,2EAA2E;QAC3E,yCAAyC;QACzC,EAAE;QACF,8EAA8E;QAC9E,uCAAuC;QACvC,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CACxB,CAAC,CAAC,EAAE,EAAE,CACJ,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,gBAAgB,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MACrG,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAC9D,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAC5B;KACF,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,aAAa,CAAC,KAAkB;IACvC,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ;SAC7B,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC;IAElD,MAAM,QAAQ,GACZ,KAAK,CAAC,gBAAgB,KAAK,CAAC;QAC1B,CAAC,CAAC,kDAAkD;QACpD,CAAC,CAAC,GAAG,KAAK,CAAC,gBAAgB,SAAS,KAAK,CAAC,gBAAgB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IACvE,KAAK,CAAC,gBAAgB,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KACxC,oCAAoC,KAAK,CAAC,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,GAAG;YAC1F,GAAG,KAAK,CAAC,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC;IAEtG,MAAM,KAAK,GAAG,CAAC,uBAAuB,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAE1D,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,GAAG,aAAa,SAAS,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,+BAA+B,EAC/F,EAAE,CACH,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CACR,KAAK,SAAS,6BAA6B,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,eAAe;YAC3F,6EAA6E,EAC/E,EAAE,CACH,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,KAAK,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,mCAAmC;YAC3F,6BAA6B,EAC/B,EAAE,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CACR,4BAA4B,EAC5B,EAAE,EACF,4BAA4B,EAC5B,eAAe,EACf,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAC/D,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAClD,EACD,EAAE,CACH,CAAC;IACF,IAAI,KAAK,CAAC,gBAAgB,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;IAE3E,qEAAqE;IACrE,6EAA6E;IAC7E,eAAe;IACf,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ;SAC3B,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;SACvE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,+BAA+B,EAC/B,EAAE,EACF,GAAG,OAAO,CAAC,GAAG,CACZ,CAAC,KAAK,EAAE,EAAE,CACR,OAAO,KAAK,CAAC,KAAK,CAAC,iBAAiB,QAAQ,KAAK,CAAC,KAAK,CAAC,KAAK,UAAU,KAAK,CAAC,QAAQ,QAAQ,CAChG,EACD,EAAE,EACF,6EAA6E,EAC7E,EAAE,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CACR,kBAAkB,KAAK,CAAC,aAAa,qDAAqD,EAC1F,wFAAwF,EACxF,qCAAqC,EACrC,EAAE,CACH,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,SAAS,eAAe,CAAC,KAAkB;IACzC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;IAElE,OAAO;QACL,cAAc;QACd,EAAE;QACF,GAAG,KAAK,CAAC,UAAU,IAAI,YAAY,sCAAsC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI;QACjG,IAAI,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG;QACpE,EAAE;QACF,KAAK,CAAC,KAAK,CAAC,SAAS;QACrB,EAAE;QACF,0BAA0B,KAAK,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,qBAAqB;QACnF,GAAG,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,gBAAgB,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,0CAA0C;QAC1H,EAAE;QACF,4BAA4B;QAC5B,eAAe;QACf,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;QACxE,EAAE;QACF,yEAAyE;QACzE,oDAAoD;QACpD,wCAAwC;QACxC,EAAE;QACF,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,EAAE;QACF,iBAAiB;QACjB,EAAE;QACF,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,EAAE;KACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAAC,QAAkB,EAAE,OAAsB;IACvE,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAE5B,MAAM,KAAK,GAAa;QACtB,KAAK,KAAK,CAAC,KAAK,EAAE;QAClB,EAAE;QACF,KAAK,MAAM,CAAC,IAAI,QAAQ,MAAM,CAAC,GAAG,EAAE;QACpC,EAAE;QACF,OAAO;QACP,eAAe;QACf,iBAAiB,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI;QAClD,WAAW,QAAQ,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,GAAG,CAAC,OAAO,KAAK;KAC5D,CAAC;IACF,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACjG,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,yBAAyB;IACzB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAEjE,KAAK,CAAC,IAAI,CACR,UAAU,EACV,EAAE,EACF,mDAAmD,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK;SAC3E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;SAC5B,IAAI,CAAC,IAAI,CAAC,GAAG,EAChB,iEAAiE,EACjE,EAAE,CACH,CAAC;IAEF,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAExC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAC9B,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC,CAAC;YACrE,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,aAAa,EACb,EAAE,EACF,oEAAoE,EACpE,uCAAuC,CACxC,CAAC;QACF,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,gCAAgC,EAChC,EAAE,EACF,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,SAAS,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,6CAA6C,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,EAClK,EAAE,EACF,4CAA4C,EAC5C,2BAA2B,EAC3B,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CACnB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,iBAAiB,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,KAAK,CAAC,QAAQ,SAAS,CACnI,EACD,EAAE,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/report/model.d.ts

@@ -0,0 +1,215 @@
+import type { RunSummary } from '../run.js';
+import type { Severity } from '../severity.js';
+import type { Snapshot, SnapshotIssue } from '../snapshot.js';
+/**
+ * Which report to render.
+ *
+ * - `pen` — Penetration Test. Every issue in full, with its evidence.
+ * - `vap` — Vulnerability Assessment. The same issues, tabulated.
+ * - `exec` — Executive Summary. What changed and what it means, no technical
+ *   detail, for a reader who will not open the others.
+ * - `attest` — Attestation Letter. A formal statement that testing was carried
+ *   out, with its limitations stated as prominently as its findings.
+ * - `retest` — Retest. The difference between two runs: what was fixed, what is
+ *   still there, and what came back. The only kind that requires a baseline.
+ *
+ * **They are presentations of one snapshot, not four analyses.** Anything that
+ * differs between them is layout or level of detail; a number that differed
+ * would be a bug.
+ */
+export type ReportKind = 'pen' | 'vap' | 'exec' | 'attest' | 'retest';
+/** What a caller can say about a report that the snapshot does not know. */
+export interface ReportOptions {
+    /** Which report to render. */
+    readonly kind: ReportKind;
+    /** Overrides the default title. */
+    readonly title?: string;
+    /** Who prepared it. White-labelling is a branding option, not a report type. */
+    readonly preparedBy?: string;
+    /** Who it is for. */
+    readonly preparedFor?: string;
+    /**
+     * When it was rendered.
+     *
+     * An argument, like everywhere else in this package: a report re-rendered
+     * from the same snapshot must come out identical, or it cannot be compared
+     * with the copy somebody was sent.
+     */
+    readonly now: Date;
+}
+/**
+ * How the findings in a report were actually produced.
+ *
+ * **This exists because of the honesty rule in `00-DOMAIN.md` §7.** That rule
+ * is written about the Attestation Letter, but a "Penetration Test" report
+ * built entirely from automated scanner output is the same over-claim: it is
+ * the fastest way to lose an auditor's trust, and with it the compliance
+ * business.
+ *
+ * So the basis is derived from the data rather than asserted by the template. A
+ * report over `scan` runs says automated; one that includes findings a person
+ * recorded says so; one over an upload says the results were brought from
+ * elsewhere. Nobody has to remember to be honest.
+ *
+ * It also carries the advice that automated findings **should be verified by a
+ * qualified technician before the report is submitted as audit evidence**. That
+ * is the practical form of the same rule: a scanner's output is a starting
+ * point for an assessment, not the assessment, and saying so protects both the
+ * reader and whoever hands them the document.
+ *
+ * The method is described; **the engines are not named**. Which scanner found
+ * something is an implementation detail, and naming the stack in a
+ * customer-facing report gives away more than it explains.
+ */
+export interface TestingBasis {
+    /** Whether any finding came from a human rather than an engine. */
+    readonly includesManual: boolean;
+    /** Whether Secureport originated the traffic. */
+    readonly automated: boolean;
+    /** Whether results were brought from another tool. */
+    readonly uploaded: boolean;
+    /**
+     * The engines involved, in the order the run recorded them.
+     *
+     * **Available, but deliberately not printed.** Which scanner produced a
+     * finding is an implementation detail of the assessment, not a fact the
+     * reader needs, and naming the stack in a customer-facing document gives
+     * away more than it explains. The prose describes the *method*; this field is
+     * here for a consumer that has a reason to know.
+     */
+    readonly engines: readonly string[];
+    /** One sentence, ready to print. */
+    readonly statement: string;
+}
+/** A group of issues sharing a severity, most urgent first. */
+export interface ReportSection {
+    /** The severity this section covers. */
+    readonly severity: Severity;
+    /** Its issues, most recently seen first. */
+    readonly issues: readonly SnapshotIssue[];
+}
+/** Everything a renderer needs, derived once so no two formats disagree. */
+export interface ReportModel {
+    /** Which report this is. */
+    readonly kind: ReportKind;
+    /** The title as printed. */
+    readonly title: string;
+    /** The snapshot it was built from. */
+    readonly snapshot: Snapshot;
+    /** When it was rendered. */
+    readonly generatedAt: Date;
+    /** Who prepared it, if stated. */
+    readonly preparedBy?: string;
+    /** Who it is for, if stated. */
+    readonly preparedFor?: string;
+    /** How the findings were produced. */
+    readonly basis: TestingBasis;
+    /**
+     * Outstanding issues grouped by severity, most urgent first, empties dropped.
+     *
+     * **Resolved issues are not here.** A fixed issue is not a finding — it is
+     * evidence of remediation, and listing it under "Findings" makes a report
+     * read as though the work is still outstanding. It has its own section.
+     */
+    readonly sections: readonly ReportSection[];
+    /**
+     * Issues this run resolved, most recently seen first.
+     *
+     * Kept and shown rather than dropped: "what you fixed" is the story the
+     * product exists to tell, and a report that silently omits it throws away its
+     * best evidence.
+     */
+    readonly resolved: readonly SnapshotIssue[];
+    /** Open and regressed issues, by severity. What the reader owes work on. */
+    readonly outstanding: Readonly<Record<Severity, number>>;
+    /** Total outstanding, so a header does not have to sum a table. */
+    readonly outstandingTotal: number;
+    /** Exposure at the end of the run. */
+    readonly exposureScore: number;
+    /** Issues past their remediation deadline. */
+    readonly breached: number;
+    /**
+     * What this report does not establish.
+     *
+     * **Stated as prominently as the findings, and not optional.** An attestation
+     * that lists what was found and stays quiet about what it cannot support is
+     * the over-claim `00-DOMAIN.md` §7 warns about — and it is the fastest way to
+     * lose an auditor's trust, and with it the compliance business.
+     *
+     * Derived, so the limitations match the report rather than being boilerplate
+     * somebody forgot to update: a report over automated results says so, a
+     * partial scope says so, and none of them claims compliance with a standard
+     * nothing here assessed.
+     */
+    readonly limitations: readonly string[];
+    /**
+     * What this run established about the issues carried into it.
+     *
+     * Present whenever the snapshot has a baseline, whatever the kind. Absent on
+     * a first run, where there is nothing to compare against.
+     */
+    readonly retest?: RetestOutcome;
+}
+/**
+ * What a retest established about one issue.
+ *
+ * - `fixed` — carried in from the baseline and no longer detected by a run that
+ *   covered it. The only verdict that is evidence of remediation.
+ * - `still_present` — detected again by this run.
+ * - `returned` — was resolved and this run found it again.
+ * - `not_retested` — **not detected, and not fixed either.** The run did not
+ *   cover it, or has not missed it often enough to resolve it. A retest that
+ *   quietly counted these as fixed would be reporting a coverage gap as
+ *   remediation, which is the worst thing this document could do.
+ * - `new` — this run's own finding, not part of what was being retested.
+ */
+export type RetestVerdict = 'fixed' | 'still_present' | 'returned' | 'not_retested' | 'new';
+/** One issue, with what the retest established about it. */
+export interface RetestEntry {
+    /** The issue as the snapshot sees it. */
+    readonly issue: SnapshotIssue;
+    /** What this run established about it. */
+    readonly verdict: RetestVerdict;
+}
+/**
+ * The difference between two runs.
+ *
+ * Present whenever the snapshot has a baseline, whatever the report kind — it
+ * is a fact about the data, not a feature of one template. The `retest` report
+ * requires it; the others may use it.
+ */
+export interface RetestOutcome {
+    /** The run being retested against. */
+    readonly baseline: RunSummary;
+    /** Every issue, most urgent first, with its verdict. */
+    readonly entries: readonly RetestEntry[];
+    /** How many issues fell into each verdict. */
+    readonly counts: Readonly<Record<RetestVerdict, number>>;
+    /**
+     * Fixed as a proportion of what could actually be checked, 0–1.
+     *
+     * **`not_retested` is excluded from the denominator, not counted as a
+     * failure.** An issue nobody looked at is neither fixed nor unfixed, and
+     * folding it either way turns a coverage gap into a number somebody quotes.
+     * `null` when there was nothing to check.
+     */
+    readonly fixRate: number | null;
+}
+/**
+ * Derives everything a report shows, once, from a snapshot.
+ *
+ * Both renderers consume this rather than the snapshot, so a number in the
+ * Markdown and the same number in the HTML cannot drift apart — they are the
+ * same value formatted twice.
+ *
+ * Suppressed issues are already separated by the snapshot and stay separated
+ * here: they never reach {@link ReportModel.sections}, are excluded from
+ * {@link ReportModel.outstanding} and from the exposure score, and appear only
+ * in the suppressed appendix (invariant 7).
+ *
+ * @param snapshot - Issue state as of a run.
+ * @param options - Title, attribution, and the render time.
+ * @returns The model both renderers format.
+ */
+export declare function buildReportModel(snapshot: Snapshot, options: ReportOptions): ReportModel;
+//# sourceMappingURL=model.d.ts.map

package/dist/report/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/report/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE9D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEtE,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B,8BAA8B;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B,mCAAmC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,gFAAgF;IAChF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,qBAAqB;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,YAAY;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IAEjC,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAE5B,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAEpC,oCAAoC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAE5B,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAC3C;AAED,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B,4BAA4B;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAE5B,4BAA4B;IAC5B,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAE3B,kCAAkC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,gCAAgC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,sCAAsC;IACtC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAE7B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAE5C;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAE5C,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAEzD,mEAAmE;IACnE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC,sCAAsC;IACtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,eAAe,GAAG,UAAU,GAAG,cAAc,GAAG,KAAK,CAAC;AAE5F,4DAA4D;AAC5D,MAAM,WAAW,WAAW;IAC1B,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAE9B,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAE9B,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IAEzC,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IAEzD;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA6ID;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,GAAG,WAAW,CAwExF"}