@secureport/core 2.1.0 → 2.3.0

package/dist/report/model.js

@@ -1,4 +1,21 @@
 import { SEVERITY_ORDER } from '../severity.js';
+/**
+ * How each verdict is printed.
+ *
+ * Exported because it is printed, and a printed vocabulary is a contract —
+ * `00-DOMAIN.md` §7 says so of the verdicts themselves. It was defined
+ * identically in both renderers, which PDF and DOCX would have made four
+ * copies of, each one a chance for `not_retested` to be worded differently in
+ * the format somebody actually reads. The underscores are an implementation
+ * detail of the union and should never reach a page.
+ */
+export const VERDICT_LABELS = Object.freeze({
+    fixed: 'fixed',
+    still_present: 'still present',
+    returned: 'returned',
+    not_retested: 'not retested',
+    new: 'new since',
+});
 /** Works out what a run established about the issues carried into it. */
 function describeRetest(snapshot) {
     const { baseline } = snapshot;
@@ -43,8 +60,11 @@ function describeRetest(snapshot) {
  * an issue left open because the run never covered it looks identical to one
  * left open because the run found it again, and telling a reader those are the
  * same thing is the failure this report exists to avoid.
+ *
+ * Exported: it is per-issue and needs nothing but the one entry, which is
+ * exactly what the streaming machine renderers can offer it a row at a time.
  */
-function verdictFor(entry) {
+export function verdictFor(entry) {
     if (entry.change === 'resolved')
         return 'fixed';
     if (entry.change === 'regressed')
@@ -53,8 +73,16 @@ function verdictFor(entry) {
         return 'new';
     return entry.findings.length > 0 ? 'still_present' : 'not_retested';
 }
-/** Works out what a report cannot establish, from the run rather than a template. */
-function describeLimitations(snapshot, basis) {
+/**
+ * Works out what a report cannot establish, from the run rather than a
+ * template.
+ *
+ * Takes primitives rather than a {@link Snapshot} so the streaming machine
+ * renderers can produce the same wording from a fold over a cursor, without
+ * needing the eagerly-materialised issue array this package's PDF/HTML path
+ * builds.
+ */
+export function describeLimitations(coveragePaths, runCreatedAt, basis, suppressedCount, omitted) {
     const limitations = [];
     if (!basis.includesManual) {
         limitations.push('This is evidence of automated security testing. It is not a human-led penetration ' +
@@ -62,32 +90,100 @@ function describeLimitations(snapshot, basis) {
     }
     limitations.push('Findings should be verified by a qualified technician before this document is relied ' +
         'upon as audit evidence.');
-    limitations.push(`Testing covered only ${snapshot.run.coverage.paths.join(', ')}. Anything outside that ` +
+    limitations.push(`Testing covered only ${coveragePaths.join(', ')}. Anything outside that ` +
         'was not examined, and its absence from this document is not evidence that it is sound.');
-    limitations.push(`This reflects the state of the target as of ${snapshot.run.createdAt
+    limitations.push(`This reflects the state of the target as of ${runCreatedAt
         .toISOString()
         .slice(0, 10)}. It says nothing about the target before or after that date.`);
     limitations.push('Automated testing cannot establish the absence of a vulnerability. A clean result means ' +
         'nothing was detected, not that nothing is there.');
-    if (snapshot.suppressed.length > 0) {
-        limitations.push(`${snapshot.suppressed.length} finding${snapshot.suppressed.length === 1 ? ' has' : 's have'} been ` +
+    if (suppressedCount > 0) {
+        limitations.push(`${suppressedCount} finding${suppressedCount === 1 ? ' has' : 's have'} been ` +
             'suppressed and excluded from the counts above. They are listed in full in the appendix.');
     }
+    // Immediately after the suppression sentence and before the compliance one,
+    // because it answers the same question a reader is entitled to ask: what am
+    // I not being shown? A floor that removed pages silently would be the
+    // over-claim §7 exists to stop, in a quieter form than the appendix one.
+    if (omitted !== undefined)
+        limitations.push(omitted.statement);
     limitations.push('This document does not certify compliance with any standard, framework or regulation.');
     return limitations;
 }
-const DEFAULT_TITLES = Object.freeze({
+/**
+ * Hex triplets only. See {@link Branding.primaryColour} for why this is a
+ * refusal rather than a sanitisation.
+ */
+const HEX_COLOUR = /^#(?:[0-9a-f]{3}|[0-9a-f]{6}|[0-9a-f]{8})$/iu;
+/**
+ * Why this branding cannot be rendered, or `undefined` if it can.
+ *
+ * **Exported so the rules have one home rather than two.** {@link buildReportModel}
+ * enforces these at render time, which is the last possible moment — by then the
+ * value has been stored, and the caller who set it is long gone. A hosted
+ * service wants to refuse it at the boundary instead, with a `400` naming the
+ * field. That needs the same two rules in two places, and a colour pattern
+ * copied into an API schema is a copy free to drift from the one that actually
+ * protects the stylesheet.
+ *
+ * So both callers ask this. The messages are identical wherever the value is
+ * rejected, because there is only one place that composes them.
+ *
+ * The white-label rule is deliberately **not** here: it depends on the report
+ * kind and on `preparedBy`, so it is a property of the options rather than of
+ * the branding, and only the renderer can decide it.
+ */
+export function brandingProblem(branding) {
+    const colour = branding?.primaryColour;
+    if (colour !== undefined && !HEX_COLOUR.test(colour)) {
+        return (`primaryColour must be a hex triplet such as #0a7 or #00aa77, not ${JSON.stringify(colour)}: ` +
+            'it is interpolated into the document stylesheet, where anything else could end the element');
+    }
+    const logo = branding?.logo;
+    if (logo !== undefined && !logo.startsWith('data:image/')) {
+        return (`logo must be a data: URI, not ${JSON.stringify(logo.slice(0, 40))}: ` +
+            'a linked image would make the report depend on a network at render time, ' +
+            'which is the guarantee that lets it be rendered to PDF reproducibly');
+    }
+    return undefined;
+}
+/**
+ * Who the document says carried out the testing, resolved once so the PDF/HTML
+ * path and the streaming machine path cannot word it two different ways.
+ *
+ * @throws TypeError A white-labelled attestation naming nobody: a formal
+ *   statement that testing was carried out has to say who carried it out.
+ */
+export function resolveAttestor(options) {
+    const attestor = options.preparedBy ?? options.branding?.companyName;
+    // An attestation is a statement that a named party carried out testing. With
+    // Secureport's name removed and nothing put in its place there is no such
+    // party, and the document would assert something on nobody's behalf.
+    if (attestor === undefined &&
+        options.branding?.whiteLabel === true &&
+        options.kind === 'attest') {
+        throw new TypeError('a white-labelled attestation must name who carried out the testing: ' +
+            'set branding.companyName or preparedBy');
+    }
+    return attestor ?? 'Secureport';
+}
+/** The title printed when {@link ReportOptions.title} is not given. */
+export const DEFAULT_TITLES = Object.freeze({
     pen: 'Penetration Test Report',
     vap: 'Vulnerability Assessment Report',
     exec: 'Executive Summary',
     attest: 'Attestation of Security Testing',
     retest: 'Retest Report',
 });
-/** Works out how the findings were produced, from the run rather than a claim. */
-function describeBasis(snapshot) {
-    const kind = snapshot.run.kind;
-    const engines = snapshot.run.engines;
-    const includesManual = snapshot.issues.some((i) => i.issue.origin === 'manual');
+/**
+ * Works out how the findings were produced, from the run rather than a claim.
+ *
+ * Takes `kind`/`engines`/`includesManual` as primitives, the same reason
+ * {@link describeLimitations} does: the streaming machine renderers know
+ * `includesManual` only once a fold over the issue cursor finishes, and have
+ * no `Snapshot` to read `run.kind`/`run.engines` from.
+ */
+export function describeBasis(kind, engines, includesManual) {
     const automated = kind === 'scan';
     const uploaded = kind === 'upload';
     const parts = [];
@@ -138,22 +234,36 @@ export function buildReportModel(snapshot, options) {
     const bySeverity = new Map();
     const resolved = [];
     let breached = 0;
+    let omittedBelowFloor = 0;
+    // `SEVERITY_ORDER` is most-severe-first, so "at or above the floor" is a
+    // *lower* index. Same trap `describeRetest` records above, from the other
+    // direction: `severityRank` counts the opposite way and using it here would
+    // floor out everything except the advisories.
+    const floorAt = options.severityFloor === undefined
+        ? SEVERITY_ORDER.length
+        : SEVERITY_ORDER.indexOf(options.severityFloor);
     for (const entry of snapshot.issues) {
         if (entry.issue.status === 'resolved') {
             resolved.push(entry);
             continue;
         }
         const severity = entry.issue.effectiveSeverity;
-        const group = bySeverity.get(severity);
-        if (group)
-            group.push(entry);
-        else
-            bySeverity.set(severity, [entry]);
+        // Counted before the floor is consulted, deliberately: the floor decides
+        // what is *listed*, never what is *counted*.
         if (entry.issue.status === 'open' || entry.issue.status === 'regressed') {
             outstanding[severity]++;
             if (entry.slaStatus === 'breached')
                 breached++;
         }
+        if (SEVERITY_ORDER.indexOf(severity) > floorAt) {
+            omittedBelowFloor++;
+            continue;
+        }
+        const group = bySeverity.get(severity);
+        if (group)
+            group.push(entry);
+        else
+            bySeverity.set(severity, [entry]);
     }
     resolved.sort((a, b) => b.issue.lastSeen.getTime() - a.issue.lastSeen.getTime());
     const sections = [];
@@ -168,14 +278,30 @@ export function buildReportModel(snapshot, options) {
             issues: [...issues].sort((a, b) => b.issue.lastSeen.getTime() - a.issue.lastSeen.getTime()),
         });
     }
+    const floor = options.severityFloor;
+    const omitted = omittedBelowFloor === 0 || floor === undefined
+        ? undefined
+        : {
+            count: omittedBelowFloor,
+            floor,
+            statement: `${omittedBelowFloor} issue${omittedBelowFloor === 1 ? '' : 's'} below ${floor} severity ` +
+                `${omittedBelowFloor === 1 ? 'is' : 'are'} not listed individually in this document. ` +
+                `${omittedBelowFloor === 1 ? 'It remains' : 'They remain'} open and ` +
+                `${omittedBelowFloor === 1 ? 'is' : 'are'} included in every count above.`,
+        };
     const outstandingTotal = SEVERITY_ORDER.reduce((sum, s) => sum + outstanding[s], 0);
-    const basis = describeBasis(snapshot);
+    const basis = describeBasis(snapshot.run.kind, snapshot.run.engines, snapshot.issues.some((i) => i.issue.origin === 'manual'));
     const retest = describeRetest(snapshot);
     // Rendering a retest of nothing is the over-claim §7 warns about: the
     // document's whole content is a comparison, and one run does not have one.
     if (options.kind === 'retest' && retest === undefined) {
         throw new TypeError('a retest report needs a baseline: build the snapshot with `previous` set to the run being retested');
     }
+    const branding = options.branding;
+    const problem = brandingProblem(branding);
+    if (problem !== undefined)
+        throw new TypeError(problem);
+    const attestor = resolveAttestor(options);
     return {
         kind: options.kind,
         title: options.title ?? DEFAULT_TITLES[options.kind],
@@ -183,10 +309,16 @@ export function buildReportModel(snapshot, options) {
         generatedAt: options.now,
         ...(options.preparedBy === undefined ? {} : { preparedBy: options.preparedBy }),
         ...(options.preparedFor === undefined ? {} : { preparedFor: options.preparedFor }),
+        attestor,
+        coverPage: options.coverPage === true,
+        tableOfContents: options.tableOfContents === true,
+        ...(branding === undefined ? {} : { branding }),
         basis,
-        limitations: describeLimitations(snapshot, basis),
+        evidenceVerbosity: options.evidenceVerbosity ?? 'summary',
+        limitations: describeLimitations(snapshot.run.coverage.paths, snapshot.run.createdAt, basis, snapshot.suppressed.length, omitted),
         sections,
-        resolved,
+        resolved: options.includeResolved === false ? [] : resolved,
+        ...(omitted === undefined ? {} : { omitted }),
         outstanding,
         outstandingTotal,
         exposureScore: snapshot.run.exposureScore,

package/dist/report/model.js.map

@@ -1 +1 @@
-{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/report/model.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAwOhD,yEAAyE;AACzE,SAAS,cAAc,CAAC,QAAkB;IACxC,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAC9B,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE7C,MAAM,OAAO,GAAkB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7D,KAAK;QACL,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC;KAC3B,CAAC,CAAC,CAAC;IACJ,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,qDAAqD;IACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,MAAM,UAAU,GACd,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACvD,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC1D,OAAO,UAAU,KAAK,CAAC;YACrB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE;YACrE,CAAC,CAAC,UAAU,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAkC;QAC5C,KAAK,EAAE,CAAC;QACR,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,CAAC;QACX,YAAY,EAAE,CAAC;QACf,GAAG,EAAE,CAAC;KACP,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,OAAO;QAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IAErD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;IACxE,OAAO;QACL,QAAQ;QACR,OAAO;QACP,MAAM;QACN,OAAO,EAAE,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,SAAS;KAC3D,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,KAAoB;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,UAAU,CAAC;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;AACtE,CAAC;AAED,qFAAqF;AACrF,SAAS,mBAAmB,CAAC,QAAkB,EAAE,KAAmB;IAClE,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,WAAW,CAAC,IAAI,CACd,oFAAoF;YAClF,+CAA+C,CAClD,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,IAAI,CACd,uFAAuF;QACrF,yBAAyB,CAC5B,CAAC;IACF,WAAW,CAAC,IAAI,CACd,wBAAwB,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B;QACtF,wFAAwF,CAC3F,CAAC;IACF,WAAW,CAAC,IAAI,CACd,+CAA+C,QAAQ,CAAC,GAAG,CAAC,SAAS;SAClE,WAAW,EAAE;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,+DAA+D,CAC/E,CAAC;IACF,WAAW,CAAC,IAAI,CACd,0FAA0F;QACxF,kDAAkD,CACrD,CAAC;IACF,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,WAAW,CAAC,IAAI,CACd,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,WAAW,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,QAAQ;YAClG,yFAAyF,CAC5F,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,IAAI,CACd,uFAAuF,CACxF,CAAC;IAEF,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,cAAc,GAAyC,MAAM,CAAC,MAAM,CAAC;IACzE,GAAG,EAAE,yBAAyB;IAC9B,GAAG,EAAE,iCAAiC;IACtC,IAAI,EAAE,mBAAmB;IACzB,MAAM,EAAE,iCAAiC;IACzC,MAAM,EAAE,eAAe;CACxB,CAAC,CAAC;AAEH,kFAAkF;AAClF,SAAS,aAAa,CAAC,QAAkB;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;IACrC,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,IAAI,KAAK,MAAM,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,KAAK,QAAQ,CAAC;IAEnC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CACR,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CACR,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAClF,IAAI,cAAc,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,cAAc,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CACR,wFAAwF;YACtF,8BAA8B,CACjC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAkB,EAAE,OAAsB;IACzE,MAAM,WAAW,GAA6B;QAC5C,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,QAAQ,EAAE,CAAC;KACZ,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;IACxD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YACxB,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAEvC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACxE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU;gBAAE,QAAQ,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAEjF,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC1D,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ;YACR,wEAAwE;YACxE,yCAAyC;YACzC,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;SAC5F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,gBAAgB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAExC,sEAAsE;IACtE,2EAA2E;IAC3E,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,IAAI,SAAS,CACjB,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QACpD,QAAQ;QACR,WAAW,EAAE,OAAO,CAAC,GAAG;QACxB,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,KAAK;QACL,WAAW,EAAE,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC;QACjD,QAAQ;QACR,QAAQ;QACR,WAAW;QACX,gBAAgB;QAChB,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,aAAa;QACzC,QAAQ;QACR,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/report/model.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAgbhD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAA4C,MAAM,CAAC,MAAM,CAAC;IACnF,KAAK,EAAE,OAAO;IACd,aAAa,EAAE,eAAe;IAC9B,QAAQ,EAAE,UAAU;IACpB,YAAY,EAAE,cAAc;IAC5B,GAAG,EAAE,WAAW;CACjB,CAAC,CAAC;AAuCH,yEAAyE;AACzE,SAAS,cAAc,CAAC,QAAkB;IACxC,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAC9B,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE7C,MAAM,OAAO,GAAkB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7D,KAAK;QACL,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC;KAC3B,CAAC,CAAC,CAAC;IACJ,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,qDAAqD;IACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,MAAM,UAAU,GACd,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACvD,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC1D,OAAO,UAAU,KAAK,CAAC;YACrB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE;YACrE,CAAC,CAAC,UAAU,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAkC;QAC5C,KAAK,EAAE,CAAC;QACR,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,CAAC;QACX,YAAY,EAAE,CAAC;QACf,GAAG,EAAE,CAAC;KACP,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,OAAO;QAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IAErD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;IACxE,OAAO;QACL,QAAQ;QACR,OAAO;QACP,MAAM;QACN,OAAO,EAAE,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,SAAS;KAC3D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,KAAoB;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,UAAU,CAAC;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,aAAgC,EAChC,YAAkB,EAClB,KAAmB,EACnB,eAAuB,EACvB,OAAkC;IAElC,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,WAAW,CAAC,IAAI,CACd,oFAAoF;YAClF,+CAA+C,CAClD,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,IAAI,CACd,uFAAuF;QACrF,yBAAyB,CAC5B,CAAC;IACF,WAAW,CAAC,IAAI,CACd,wBAAwB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B;QACxE,wFAAwF,CAC3F,CAAC;IACF,WAAW,CAAC,IAAI,CACd,+CAA+C,YAAY;SACxD,WAAW,EAAE;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,+DAA+D,CAC/E,CAAC;IACF,WAAW,CAAC,IAAI,CACd,0FAA0F;QACxF,kDAAkD,CACrD,CAAC;IACF,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;QACxB,WAAW,CAAC,IAAI,CACd,GAAG,eAAe,WAAW,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,QAAQ;YAC5E,yFAAyF,CAC5F,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,4EAA4E;IAC5E,sEAAsE;IACtE,yEAAyE;IACzE,IAAI,OAAO,KAAK,SAAS;QAAE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/D,WAAW,CAAC,IAAI,CACd,uFAAuF,CACxF,CAAC;IAEF,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,GAAG,8CAA8C,CAAC;AAElE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe,CAAC,QAA8B;IAC5D,MAAM,MAAM,GAAG,QAAQ,EAAE,aAAa,CAAC;IACvC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,OAAO,CACL,oEAAoE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI;YAC9F,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,CAAC;IAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1D,OAAO,CACL,iCAAiC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI;YACtE,2EAA2E;YAC3E,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAgE;IAEhE,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC;IACrE,6EAA6E;IAC7E,0EAA0E;IAC1E,qEAAqE;IACrE,IACE,QAAQ,KAAK,SAAS;QACtB,OAAO,CAAC,QAAQ,EAAE,UAAU,KAAK,IAAI;QACrC,OAAO,CAAC,IAAI,KAAK,QAAQ,EACzB,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,sEAAsE;YACpE,wCAAwC,CAC3C,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,IAAI,YAAY,CAAC;AAClC,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,MAAM,cAAc,GAAyC,MAAM,CAAC,MAAM,CAAC;IAChF,GAAG,EAAE,yBAAyB;IAC9B,GAAG,EAAE,iCAAiC;IACtC,IAAI,EAAE,mBAAmB;IACzB,MAAM,EAAE,iCAAiC;IACzC,MAAM,EAAE,eAAe;CACxB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAa,EACb,OAA0B,EAC1B,cAAuB;IAEvB,MAAM,SAAS,GAAG,IAAI,KAAK,MAAM,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,KAAK,QAAQ,CAAC;IAEnC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CACR,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CACR,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAClF,IAAI,cAAc,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,cAAc,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CACR,wFAAwF;YACtF,8BAA8B,CACjC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAkB,EAAE,OAAsB;IACzE,MAAM,WAAW,GAA6B;QAC5C,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,QAAQ,EAAE,CAAC;KACZ,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;IACxD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAE1B,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,OAAO,GACX,OAAO,CAAC,aAAa,KAAK,SAAS;QACjC,CAAC,CAAC,cAAc,CAAC,MAAM;QACvB,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAEpD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAE/C,yEAAyE;QACzE,6CAA6C;QAC7C,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACxE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU;gBAAE,QAAQ,EAAE,CAAC;QACjD,CAAC;QAED,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,EAAE,CAAC;YAC/C,iBAAiB,EAAE,CAAC;YACpB,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YACxB,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAEjF,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC1D,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ;YACR,wEAAwE;YACxE,yCAAyC;YACzC,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;SAC5F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC;IACpC,MAAM,OAAO,GACX,iBAAiB,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS;QAC5C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC;YACE,KAAK,EAAE,iBAAiB;YACxB,KAAK;YACL,SAAS,EACP,GAAG,iBAAiB,SAAS,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,KAAK,YAAY;gBAC1F,GAAG,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,6CAA6C;gBACtF,GAAG,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,YAAY;gBACrE,GAAG,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,iCAAiC;SAC7E,CAAC;IAER,MAAM,gBAAgB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,aAAa,CACzB,QAAQ,CAAC,GAAG,CAAC,IAAI,EACjB,QAAQ,CAAC,GAAG,CAAC,OAAO,EACpB,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CACzD,CAAC;IACF,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAExC,sEAAsE;IACtE,2EAA2E;IAC3E,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,IAAI,SAAS,CACjB,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAE1C,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QACpD,QAAQ;QACR,WAAW,EAAE,OAAO,CAAC,GAAG;QACxB,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,QAAQ;QACR,SAAS,EAAE,OAAO,CAAC,SAAS,KAAK,IAAI;QACrC,eAAe,EAAE,OAAO,CAAC,eAAe,KAAK,IAAI;QACjD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,KAAK;QACL,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,SAAS;QACzD,WAAW,EAAE,mBAAmB,CAC9B,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAC3B,QAAQ,CAAC,GAAG,CAAC,SAAS,EACtB,KAAK,EACL,QAAQ,CAAC,UAAU,CAAC,MAAM,EAC1B,OAAO,CACR;QACD,QAAQ;QACR,QAAQ,EAAE,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ;QAC3D,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,WAAW;QACX,gBAAgB;QAChB,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,aAAa;QACzC,QAAQ;QACR,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC"}

package/dist/report/sarif.d.ts

@@ -0,0 +1,60 @@
+import type { Severity } from '../severity.js';
+import type { SnapshotIssue } from '../snapshot.js';
+import type { ReportHeader } from './stream.js';
+/**
+ * What a SARIF export can be asked for.
+ *
+ * Deliberately its own type rather than {@link ReportOptions}: SARIF has no
+ * `kind` — it is always "the issues open right now", never a retest or an
+ * attestation — and no branding, cover page or evidence verbosity. Accepting
+ * `ReportOptions` and silently ignoring most of its fields would be a worse
+ * API than a type that only offers what SARIF actually uses.
+ */
+export interface SarifOptions {
+    /**
+     * Keep issues below this severity out of `results`.
+     *
+     * Unlike the other formats, there is no `omitted` count to report: SARIF
+     * has no prose to carry a disclosure sentence in, and a consumer asking
+     * for `critical` only is asking to scope a code-scanning feed, not
+     * reading a document that owes it an explanation of what it left out.
+     */
+    readonly severityFloor?: Severity;
+}
+/**
+ * Renders a snapshot's open issues as SARIF 2.1.0, from a header and a
+ * cursor — the machine path's format for GitHub code scanning (P8), and the
+ * streaming sibling of {@link renderJsonStream} and
+ * {@link renderMarkdownStream}. See {@link renderJsonStream} for the memory
+ * argument.
+ *
+ * **Resolved issues never appear, unconditionally — there is no
+ * `includeResolved` option.** SARIF is not a document a person reads; it is
+ * the input to GitHub's own diffing, which closes an alert when a new
+ * upload no longer contains it. Including a resolved issue would tell
+ * GitHub the finding is still open, which is the opposite of what resolving
+ * it meant.
+ *
+ * **Suppressed issues never appear either, and take no `suppressed`
+ * parameter at all.** An accepted risk is not a code-scanning alert; SARIF
+ * has no accepted-risk register to carry it in the way the appendix does
+ * for the human and other machine formats.
+ *
+ * **`ruleId` is `Issue.vulnKey`, not `Finding.sourceRuleId` or
+ * `sourceEngine`.** `vulnKey` is engine-independent by construction
+ * (`fingerprint.ts`), and naming a scanner in a customer-facing artefact is
+ * the thing this package's report options have twice had to stop doing
+ * (`ReportOptions.evidenceVerbosity`'s own TSDoc records it). `rules[]` is
+ * built from the same stream, deduplicated on `vulnKey` — bounded by the
+ * number of distinct weakness classes, not by issue count, so buffering it
+ * (unlike `results`) costs nothing worth avoiding.
+ *
+ * @param header - The run and the target. Never scales with issue count.
+ * @param issues - Every open issue, in any order — SARIF results are an
+ *   unordered set, so this format is the one place in the streaming
+ *   contract with no ordering requirement on its input.
+ * @param options - A severity floor, and nothing else.
+ * @returns Chunks of JSON text; concatenated, they are one SARIF document.
+ */
+export declare function renderSarifStream(header: ReportHeader, issues: AsyncIterable<SnapshotIssue>, options?: SarifOptions): AsyncGenerator<string>;
+//# sourceMappingURL=sarif.d.ts.map

package/dist/report/sarif.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../../src/report/sarif.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC;CACnC;AAyCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAuB,iBAAiB,CACtC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,EACpC,OAAO,GAAE,YAAiB,GACzB,cAAc,CAAC,MAAM,CAAC,CA8DxB"}

package/dist/report/sarif.js

@@ -0,0 +1,125 @@
+const SARIF_LEVEL = Object.freeze({
+    critical: 'error',
+    high: 'error',
+    medium: 'warning',
+    low: 'note',
+    advisory: 'note',
+});
+/**
+ * The `security-severity` GitHub code scanning reads to rank an alert, as a
+ * string 0.0–10.0 — GitHub's convention, not part of the SARIF spec itself.
+ * Fixed bands rather than a CVSS score, because not every finding has one
+ * and two issues at the same {@link Severity} should rank the same.
+ */
+const SECURITY_SEVERITY = Object.freeze({
+    critical: '9.0',
+    high: '7.5',
+    medium: '5.0',
+    low: '3.0',
+    advisory: '1.0',
+});
+/** `SEVERITY_ORDER`, duplicated as an index rather than imported, to keep this file's only dependency on `severity.ts` the type. */
+const FLOOR_RANK = Object.freeze({
+    critical: 0,
+    high: 1,
+    medium: 2,
+    low: 3,
+    advisory: 4,
+});
+/** `"key":value`, run through `JSON.stringify` so nothing is hand-escaped. */
+function field(key, value) {
+    return `${JSON.stringify(key)}:${JSON.stringify(value)}`;
+}
+/**
+ * Renders a snapshot's open issues as SARIF 2.1.0, from a header and a
+ * cursor — the machine path's format for GitHub code scanning (P8), and the
+ * streaming sibling of {@link renderJsonStream} and
+ * {@link renderMarkdownStream}. See {@link renderJsonStream} for the memory
+ * argument.
+ *
+ * **Resolved issues never appear, unconditionally — there is no
+ * `includeResolved` option.** SARIF is not a document a person reads; it is
+ * the input to GitHub's own diffing, which closes an alert when a new
+ * upload no longer contains it. Including a resolved issue would tell
+ * GitHub the finding is still open, which is the opposite of what resolving
+ * it meant.
+ *
+ * **Suppressed issues never appear either, and take no `suppressed`
+ * parameter at all.** An accepted risk is not a code-scanning alert; SARIF
+ * has no accepted-risk register to carry it in the way the appendix does
+ * for the human and other machine formats.
+ *
+ * **`ruleId` is `Issue.vulnKey`, not `Finding.sourceRuleId` or
+ * `sourceEngine`.** `vulnKey` is engine-independent by construction
+ * (`fingerprint.ts`), and naming a scanner in a customer-facing artefact is
+ * the thing this package's report options have twice had to stop doing
+ * (`ReportOptions.evidenceVerbosity`'s own TSDoc records it). `rules[]` is
+ * built from the same stream, deduplicated on `vulnKey` — bounded by the
+ * number of distinct weakness classes, not by issue count, so buffering it
+ * (unlike `results`) costs nothing worth avoiding.
+ *
+ * @param header - The run and the target. Never scales with issue count.
+ * @param issues - Every open issue, in any order — SARIF results are an
+ *   unordered set, so this format is the one place in the streaming
+ *   contract with no ordering requirement on its input.
+ * @param options - A severity floor, and nothing else.
+ * @returns Chunks of JSON text; concatenated, they are one SARIF document.
+ */
+export async function* renderSarifStream(header, issues, options = {}) {
+    const floor = options.severityFloor;
+    const floorAt = floor === undefined ? 4 : FLOOR_RANK[floor];
+    // Small — bounded by distinct weakness classes, not by issue count — and
+    // known only once the stream is exhausted. So `results` (the one array
+    // that must never be buffered) is written first and `tool.driver.rules`
+    // last, the one key order that lets both be true without a second pass
+    // over `issues`: JSON does not care which key comes first.
+    const rules = new Map();
+    yield '{';
+    // The schema's own `id`, not a GitHub raw link — checked by hand, because
+    // an unreachable $schema is a broken document a validator would still call
+    // valid, and getting it wrong once cost the trip to the OASIS repo to
+    // learn its real path (`tests/fixtures/README.md` records that trip).
+    yield field('$schema', 'https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json');
+    yield ',' + field('version', '2.1.0');
+    yield ',"runs":[{"results":[';
+    let firstResult = true;
+    for await (const entry of issues) {
+        const { issue } = entry;
+        if (issue.status === 'resolved')
+            continue;
+        if (FLOOR_RANK[issue.effectiveSeverity] > floorAt)
+            continue;
+        if (!rules.has(issue.vulnKey)) {
+            rules.set(issue.vulnKey, { title: issue.title, cwe: issue.cwe });
+        }
+        const message = entry.findings[0]?.description ?? issue.title;
+        const result = {
+            ruleId: issue.vulnKey,
+            level: SARIF_LEVEL[issue.effectiveSeverity],
+            message: { text: message },
+            locations: [
+                {
+                    physicalLocation: {
+                        artifactLocation: { uri: issue.location },
+                    },
+                },
+            ],
+            partialFingerprints: { secureportFingerprint: issue.fingerprint },
+            properties: { 'security-severity': SECURITY_SEVERITY[issue.effectiveSeverity] },
+        };
+        yield (firstResult ? '' : ',') + JSON.stringify(result);
+        firstResult = false;
+    }
+    yield ']';
+    const ruleDefs = [...rules.entries()].map(([vulnKey, rule]) => ({
+        id: vulnKey,
+        shortDescription: { text: rule.title },
+        ...(rule.cwe === undefined ? {} : { properties: { tags: [rule.cwe] } }),
+    }));
+    yield ',"tool":{"driver":{';
+    yield field('name', 'Secureport');
+    yield ',' + field('informationUri', 'https://secureport.io/');
+    yield ',"rules":' + JSON.stringify(ruleDefs);
+    yield '}}}]}';
+}
+//# sourceMappingURL=sarif.js.map

package/dist/report/sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../src/report/sarif.ts"],"names":[],"mappings":"AA4BA,MAAM,WAAW,GAA2C,MAAM,CAAC,MAAM,CAAC;IACxE,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,OAAO;IACb,MAAM,EAAE,SAAS;IACjB,GAAG,EAAE,MAAM;IACX,QAAQ,EAAE,MAAM;CACjB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,iBAAiB,GAAuC,MAAM,CAAC,MAAM,CAAC;IAC1E,QAAQ,EAAE,KAAK;IACf,IAAI,EAAE,KAAK;IACX,MAAM,EAAE,KAAK;IACb,GAAG,EAAE,KAAK;IACV,QAAQ,EAAE,KAAK;CAChB,CAAC,CAAC;AAEH,oIAAoI;AACpI,MAAM,UAAU,GAAuC,MAAM,CAAC,MAAM,CAAC;IACnE,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,QAAQ,EAAE,CAAC;CACZ,CAAC,CAAC;AAEH,8EAA8E;AAC9E,SAAS,KAAK,CAAC,GAAW,EAAE,KAAc;IACxC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,iBAAiB,CACtC,MAAoB,EACpB,MAAoC,EACpC,UAAwB,EAAE;IAE1B,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5D,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,2DAA2D;IAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwE,CAAC;IAE9F,MAAM,GAAG,CAAC;IACV,0EAA0E;IAC1E,2EAA2E;IAC3E,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,KAAK,CACT,SAAS,EACT,4FAA4F,CAC7F,CAAC;IACF,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtC,MAAM,uBAAuB,CAAC;IAE9B,IAAI,WAAW,GAAG,IAAI,CAAC;IACvB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QACxB,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU;YAAE,SAAS;QAC1C,IAAI,UAAU,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,OAAO;YAAE,SAAS;QAE5D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,KAAK,CAAC,KAAK,CAAC;QAC9D,MAAM,MAAM,GAAG;YACb,MAAM,EAAE,KAAK,CAAC,OAAO;YACrB,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAC3C,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAC1B,SAAS,EAAE;gBACT;oBACE,gBAAgB,EAAE;wBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE;qBAC1C;iBACF;aACF;YACD,mBAAmB,EAAE,EAAE,qBAAqB,EAAE,KAAK,CAAC,WAAW,EAAE;YACjE,UAAU,EAAE,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE;SAChF,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxD,WAAW,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,MAAM,GAAG,CAAC;IAEV,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9D,EAAE,EAAE,OAAO;QACX,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;QACtC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;KACxE,CAAC,CAAC,CAAC;IACJ,MAAM,qBAAqB,CAAC;IAC5B,MAAM,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,OAAO,CAAC;AAChB,CAAC"}

package/dist/report/stream.d.ts

@@ -0,0 +1,108 @@
+import type { RunSummary } from '../run.js';
+import type { SnapshotIssue, SuppressedIssue, Target } from '../snapshot.js';
+import { type ReportOptions } from './model.js';
+/**
+ * Everything a streaming machine-readable report needs that is not per-issue.
+ *
+ * **Deliberately not a {@link Snapshot}.** A `Snapshot`'s `issues` and
+ * `suppressed` are eagerly-materialised arrays — the right shape for PDF and
+ * HTML, which are queued, capped at 500 issues, and fully in memory before
+ * Chromium ever runs. The machine formats have no such cap, so their
+ * assembler must never hold every issue at once; a `ReportHeader` carries
+ * only the handful of fields that do not scale with issue count, and the
+ * issues themselves arrive as an `AsyncIterable`.
+ */
+export interface ReportHeader {
+    /** The run this report describes. */
+    readonly run: RunSummary;
+    /** What to compare against, for a retest. Absent for a first run. */
+    readonly baseline?: RunSummary;
+    /** The system under test. */
+    readonly target: Target;
+}
+/**
+ * Renders a report as JSON, from a header and a cursor over its issues,
+ * rather than from a fully-assembled {@link Snapshot}.
+ *
+ * **This is the machine path's whole reason to exist (B124).** `renderJson`
+ * holds every issue in one array before `JSON.stringify` walks it — measured
+ * at 239 MiB for 25,000 issues — so memory scales with the result and three
+ * concurrent exports exhaust a 512 MiB instance. This function instead
+ * yields the document a fragment at a time: everything that does not depend
+ * on having seen every issue is emitted immediately, the `issues` and
+ * `suppressed` arrays are written one element per row as the cursors
+ * produce them, and the handful of fields that need a full pass —
+ * `basis.includesManual`, `breached`, `omitted`, the retest counts — are
+ * accumulated in a fold whose state is a few counters, never the issues
+ * themselves, and written once both cursors are exhausted. Concatenating
+ * every yielded chunk produces one JSON document; nothing here buffers it
+ * as a string first.
+ *
+ * **`sections` grouped by severity and the sorted `resolved` list do not
+ * exist here.** Both require holding the whole array to sort; this function
+ * instead trusts that `issues` and `suppressed` already arrive in the order
+ * the document should show them; a cursor-based caller supplies that with a
+ * SQL `ORDER BY`, not with an in-memory sort. `includeResolved` and
+ * `severityFloor` still apply, filtering rows out of the stream rather than
+ * out of an array.
+ *
+ * @param header - The run, its baseline, and the target. Never scales with
+ *   issue count.
+ * @param issues - Every issue in scope, most urgent first, in the order the
+ *   document should list them.
+ * @param suppressed - The accepted-risk register, in the order the appendix
+ *   should list it.
+ * @param options - Which report, attribution, and the render time.
+ * @returns Chunks of JSON text; concatenated, they are one document.
+ */
+export declare function renderJsonStream(header: ReportHeader, issues: AsyncIterable<SnapshotIssue>, suppressed: AsyncIterable<SuppressedIssue>, options: ReportOptions): AsyncGenerator<string>;
+/**
+ * Renders a report as Markdown, from a header and a cursor over its issues,
+ * rather than from a fully-assembled {@link Snapshot}. The streaming sibling
+ * of {@link renderJsonStream} — see it for the memory argument, which applies
+ * here identically: `renderMarkdown` holds every issue in one array before
+ * formatting any of it.
+ *
+ * **The document is reordered relative to `renderMarkdown`, and that is
+ * forced rather than stylistic.** The array-based renderer opens with "Basis
+ * of testing" and a "What changed" line naming how many issues are past
+ * their remediation deadline — both need to know something about *every*
+ * issue (`basis.includesManual`, `breached`) before the first line can be
+ * printed, which a forward-only stream cannot offer without buffering
+ * everything first. So this function prints what it already knows up front
+ * (title, scope, the New/Still open/Regressed/Resolved/Suppressed table,
+ * which all read straight off `RunSummary`) and moves everything that needs
+ * a full pass — the basis statement, the remediation-deadline count, what a
+ * severity floor omitted, the retest verdict counts — into a closing
+ * `## Summary` section, written once both cursors are exhausted.
+ *
+ * **`sections` grouped by severity do not exist here**, for the reason given
+ * in {@link renderJsonStream}: `issues` and `suppressed` are trusted to
+ * already arrive in the order the document should show them. For a `pen`
+ * report that means a severity sub-heading appears whenever the incoming
+ * severity changes, without the issue count that heading carries in
+ * `renderMarkdown` — the count is not known until the section ends. A
+ * `retest` report's per-issue table has no severity floor applied to it,
+ * matching `renderMarkdown`: the whole point of that table is showing what
+ * happened to every issue carried into the retest, not a curated subset.
+ *
+ * **`attest` buffers its suppressed list; nothing else buffers issues.** An
+ * Attestation Letter states counts and names nobody's individual issue, so
+ * it folds the whole `issues` cursor for those counts without printing a
+ * row — but it also prints the suppressed appendix *after* that letter body,
+ * by which point the `suppressed` cursor would already be exhausted. Holding
+ * that one list (the accepted-risk register, ordinarily a minority of the
+ * total) is the one deliberate exception to "never hold more than a row".
+ *
+ * @param header - The run, its baseline, and the target. Never scales with
+ *   issue count.
+ * @param issues - Every issue in scope, most urgent first: open/regressed
+ *   before resolved, each group by severity then most-recently-seen first —
+ *   the order the document lists them in.
+ * @param suppressed - The accepted-risk register, in the order the appendix
+ *   should list it.
+ * @param options - Which report, attribution, and the render time.
+ * @returns Chunks of Markdown text; concatenated, they are one document.
+ */
+export declare function renderMarkdownStream(header: ReportHeader, issues: AsyncIterable<SnapshotIssue>, suppressed: AsyncIterable<SuppressedIssue>, options: ReportOptions): AsyncGenerator<string>;
+//# sourceMappingURL=stream.d.ts.map

package/dist/report/stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/report/stream.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE7E,OAAO,EASL,KAAK,aAAa,EAEnB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAC3B,qCAAqC;IACrC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IAEzB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;IAE/B,6BAA6B;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAoED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAuB,gBAAgB,CACrC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,EACpC,UAAU,EAAE,aAAa,CAAC,eAAe,CAAC,EAC1C,OAAO,EAAE,aAAa,GACrB,cAAc,CAAC,MAAM,CAAC,CAoGxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAuB,oBAAoB,CACzC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,EACpC,UAAU,EAAE,aAAa,CAAC,eAAe,CAAC,EAC1C,OAAO,EAAE,aAAa,GACrB,cAAc,CAAC,MAAM,CAAC,CA6TxB"}