@secureport/core 2.1.0 → 2.3.0

package/dist/report/stream.js

@@ -0,0 +1,534 @@
+import { SEVERITY_ORDER } from '../severity.js';
+import { cell, formatDate, issueDetail, issueRow } from './markdown.js';
+import { brandingProblem, describeBasis, describeLimitations, DEFAULT_TITLES, resolveAttestor, verdictFor, VERDICT_LABELS, } from './model.js';
+function newFoldState(hasBaseline) {
+    return {
+        includesManual: false,
+        breached: 0,
+        omittedBelowFloor: 0,
+        suppressedCount: 0,
+        ...(hasBaseline
+            ? { retestCounts: { fixed: 0, still_present: 0, returned: 0, not_retested: 0, new: 0 } }
+            : {}),
+    };
+}
+/** `"key":value`, both run through `JSON.stringify` so nothing is hand-escaped. */
+function field(key, value) {
+    return `${JSON.stringify(key)}:${JSON.stringify(value)}`;
+}
+/**
+ * Open+regressed issues by severity, and their total — read straight off
+ * `RunSummary`, needing no pass over the issues at all.
+ *
+ * `new[sev] + stillOpen[sev] + regressed[sev]` is exactly what
+ * `buildReportModel` recomputes by iterating every issue, because every
+ * non-suppressed, non-resolved issue is counted into exactly one of those
+ * three buckets by `reconcile()` — verified equal on the shared fixture
+ * before either streaming renderer relied on it (`report-stream.test.ts`).
+ */
+function outstandingFrom(run) {
+    const by = {
+        critical: run.new.critical + run.stillOpen.critical + run.regressed.critical,
+        high: run.new.high + run.stillOpen.high + run.regressed.high,
+        medium: run.new.medium + run.stillOpen.medium + run.regressed.medium,
+        low: run.new.low + run.stillOpen.low + run.regressed.low,
+        advisory: run.new.advisory + run.stillOpen.advisory + run.regressed.advisory,
+    };
+    return { by, total: SEVERITY_ORDER.reduce((sum, s) => sum + by[s], 0) };
+}
+/**
+ * What a severity floor kept out of a streamed document, from the count a
+ * fold over the issues accumulated — the same statement
+ * `buildReportModel` composes, but from a running total rather than a
+ * `filter().length`.
+ */
+function describeOmitted(count, floor) {
+    if (count === 0 || floor === undefined)
+        return undefined;
+    return {
+        count,
+        floor,
+        statement: `${count} issue${count === 1 ? '' : 's'} below ${floor} severity ` +
+            `${count === 1 ? 'is' : 'are'} not listed individually in this document. ` +
+            `${count === 1 ? 'It remains' : 'They remain'} open and ` +
+            `${count === 1 ? 'is' : 'are'} included in every count above.`,
+    };
+}
+/**
+ * Renders a report as JSON, from a header and a cursor over its issues,
+ * rather than from a fully-assembled {@link Snapshot}.
+ *
+ * **This is the machine path's whole reason to exist (B124).** `renderJson`
+ * holds every issue in one array before `JSON.stringify` walks it — measured
+ * at 239 MiB for 25,000 issues — so memory scales with the result and three
+ * concurrent exports exhaust a 512 MiB instance. This function instead
+ * yields the document a fragment at a time: everything that does not depend
+ * on having seen every issue is emitted immediately, the `issues` and
+ * `suppressed` arrays are written one element per row as the cursors
+ * produce them, and the handful of fields that need a full pass —
+ * `basis.includesManual`, `breached`, `omitted`, the retest counts — are
+ * accumulated in a fold whose state is a few counters, never the issues
+ * themselves, and written once both cursors are exhausted. Concatenating
+ * every yielded chunk produces one JSON document; nothing here buffers it
+ * as a string first.
+ *
+ * **`sections` grouped by severity and the sorted `resolved` list do not
+ * exist here.** Both require holding the whole array to sort; this function
+ * instead trusts that `issues` and `suppressed` already arrive in the order
+ * the document should show them; a cursor-based caller supplies that with a
+ * SQL `ORDER BY`, not with an in-memory sort. `includeResolved` and
+ * `severityFloor` still apply, filtering rows out of the stream rather than
+ * out of an array.
+ *
+ * @param header - The run, its baseline, and the target. Never scales with
+ *   issue count.
+ * @param issues - Every issue in scope, most urgent first, in the order the
+ *   document should list them.
+ * @param suppressed - The accepted-risk register, in the order the appendix
+ *   should list it.
+ * @param options - Which report, attribution, and the render time.
+ * @returns Chunks of JSON text; concatenated, they are one document.
+ */
+export async function* renderJsonStream(header, issues, suppressed, options) {
+    const problem = brandingProblem(options.branding);
+    if (problem !== undefined)
+        throw new TypeError(problem);
+    // Rendering a retest of nothing is the over-claim `describeLimitations`'s
+    // caller in `model.ts` also refuses — the document's whole content is a
+    // comparison, and one run does not have one.
+    if (options.kind === 'retest' && header.baseline === undefined) {
+        throw new TypeError('a retest report needs a baseline: pass `baseline` on the header');
+    }
+    const attestor = resolveAttestor(options);
+    const floor = options.severityFloor;
+    const floorAt = floor === undefined ? SEVERITY_ORDER.length : SEVERITY_ORDER.indexOf(floor);
+    const state = newFoldState(header.baseline !== undefined);
+    yield '{';
+    yield field('reportVersion', 1);
+    yield ',' + field('kind', options.kind);
+    yield ',' + field('title', options.title ?? DEFAULT_TITLES[options.kind]);
+    yield ',' + field('generatedAt', options.now.toISOString());
+    if (options.preparedBy !== undefined)
+        yield ',' + field('preparedBy', options.preparedBy);
+    if (options.preparedFor !== undefined)
+        yield ',' + field('preparedFor', options.preparedFor);
+    yield ',' + field('attestor', attestor);
+    yield ',"target":' + JSON.stringify(header.target);
+    yield ',"run":' + JSON.stringify(header.run);
+    if (header.baseline !== undefined)
+        yield ',"baseline":' + JSON.stringify(header.baseline);
+    yield ',"issues":[';
+    let firstIssue = true;
+    for await (const entry of issues) {
+        if (entry.issue.origin === 'manual')
+            state.includesManual = true;
+        const status = entry.issue.status;
+        if (status === 'open' || status === 'regressed') {
+            if (entry.slaStatus === 'breached')
+                state.breached++;
+        }
+        let verdict;
+        if (state.retestCounts !== undefined) {
+            verdict = verdictFor(entry);
+            state.retestCounts[verdict]++;
+        }
+        // The floor decides what is *listed*, never what is *counted* — it was
+        // consulted above this line for exactly that reason, and it never
+        // applies to a resolved issue, which is filtered by `includeResolved`
+        // instead.
+        if (status === 'resolved') {
+            if (options.includeResolved === false)
+                continue;
+        }
+        else if (SEVERITY_ORDER.indexOf(entry.issue.effectiveSeverity) > floorAt) {
+            state.omittedBelowFloor++;
+            continue;
+        }
+        const row = verdict === undefined ? entry : { ...entry, retestVerdict: verdict };
+        yield (firstIssue ? '' : ',') + JSON.stringify(row);
+        firstIssue = false;
+    }
+    yield ']';
+    yield ',"suppressed":[';
+    let firstSuppressed = true;
+    for await (const entry of suppressed) {
+        state.suppressedCount++;
+        yield (firstSuppressed ? '' : ',') + JSON.stringify(entry);
+        firstSuppressed = false;
+    }
+    yield ']';
+    const basis = describeBasis(header.run.kind, header.run.engines, state.includesManual);
+    const omitted = describeOmitted(state.omittedBelowFloor, floor);
+    const limitations = describeLimitations(header.run.coverage.paths, header.run.createdAt, basis, state.suppressedCount, omitted);
+    yield ',"basis":' + JSON.stringify(basis);
+    yield ',"limitations":' + JSON.stringify(limitations);
+    const outstanding = outstandingFrom(header.run);
+    yield ',"outstanding":' + JSON.stringify({ ...outstanding.by, total: outstanding.total });
+    yield ',' + field('exposureScore', header.run.exposureScore);
+    yield ',' + field('breached', state.breached);
+    if (omitted !== undefined)
+        yield ',"omitted":' + JSON.stringify(omitted);
+    if (state.retestCounts !== undefined) {
+        const checkable = state.retestCounts.fixed + state.retestCounts.still_present + state.retestCounts.returned;
+        yield ',"retest":' +
+            JSON.stringify({
+                counts: state.retestCounts,
+                fixRate: checkable === 0 ? null : state.retestCounts.fixed / checkable,
+            });
+    }
+    yield '}';
+}
+/**
+ * Renders a report as Markdown, from a header and a cursor over its issues,
+ * rather than from a fully-assembled {@link Snapshot}. The streaming sibling
+ * of {@link renderJsonStream} — see it for the memory argument, which applies
+ * here identically: `renderMarkdown` holds every issue in one array before
+ * formatting any of it.
+ *
+ * **The document is reordered relative to `renderMarkdown`, and that is
+ * forced rather than stylistic.** The array-based renderer opens with "Basis
+ * of testing" and a "What changed" line naming how many issues are past
+ * their remediation deadline — both need to know something about *every*
+ * issue (`basis.includesManual`, `breached`) before the first line can be
+ * printed, which a forward-only stream cannot offer without buffering
+ * everything first. So this function prints what it already knows up front
+ * (title, scope, the New/Still open/Regressed/Resolved/Suppressed table,
+ * which all read straight off `RunSummary`) and moves everything that needs
+ * a full pass — the basis statement, the remediation-deadline count, what a
+ * severity floor omitted, the retest verdict counts — into a closing
+ * `## Summary` section, written once both cursors are exhausted.
+ *
+ * **`sections` grouped by severity do not exist here**, for the reason given
+ * in {@link renderJsonStream}: `issues` and `suppressed` are trusted to
+ * already arrive in the order the document should show them. For a `pen`
+ * report that means a severity sub-heading appears whenever the incoming
+ * severity changes, without the issue count that heading carries in
+ * `renderMarkdown` — the count is not known until the section ends. A
+ * `retest` report's per-issue table has no severity floor applied to it,
+ * matching `renderMarkdown`: the whole point of that table is showing what
+ * happened to every issue carried into the retest, not a curated subset.
+ *
+ * **`attest` buffers its suppressed list; nothing else buffers issues.** An
+ * Attestation Letter states counts and names nobody's individual issue, so
+ * it folds the whole `issues` cursor for those counts without printing a
+ * row — but it also prints the suppressed appendix *after* that letter body,
+ * by which point the `suppressed` cursor would already be exhausted. Holding
+ * that one list (the accepted-risk register, ordinarily a minority of the
+ * total) is the one deliberate exception to "never hold more than a row".
+ *
+ * @param header - The run, its baseline, and the target. Never scales with
+ *   issue count.
+ * @param issues - Every issue in scope, most urgent first: open/regressed
+ *   before resolved, each group by severity then most-recently-seen first —
+ *   the order the document lists them in.
+ * @param suppressed - The accepted-risk register, in the order the appendix
+ *   should list it.
+ * @param options - Which report, attribution, and the render time.
+ * @returns Chunks of Markdown text; concatenated, they are one document.
+ */
+export async function* renderMarkdownStream(header, issues, suppressed, options) {
+    const problem = brandingProblem(options.branding);
+    if (problem !== undefined)
+        throw new TypeError(problem);
+    if (options.kind === 'retest' && header.baseline === undefined) {
+        throw new TypeError('a retest report needs a baseline: pass `baseline` on the header');
+    }
+    const attestor = resolveAttestor(options);
+    const { target } = header;
+    const floor = options.severityFloor;
+    const floorAt = floor === undefined ? SEVERITY_ORDER.length : SEVERITY_ORDER.indexOf(floor);
+    const state = newFoldState(header.baseline !== undefined);
+    const outstanding = outstandingFrom(header.run);
+    const preamble = [];
+    if (options.branding?.watermark !== undefined) {
+        preamble.push(`**${options.branding.watermark}**`, '');
+    }
+    preamble.push(`# ${options.title ?? DEFAULT_TITLES[options.kind]}`, '', `**${target.name}** — ${target.url}`);
+    if (options.coverPage === true) {
+        preamble.push('', ...[
+            attestor,
+            ...(options.branding?.companyDetails ?? []),
+            ...(options.preparedFor === undefined ? [] : [`Prepared for ${options.preparedFor}`]),
+        ].map((line, i) => (i === 0 ? line : `_${line}_`)));
+    }
+    preamble.push('', '| | |', '| --- | --- |', `| Generated | ${formatDate(options.now)} |`);
+    preamble.push(`| Run | ${header.run.runId} (${header.run.trigger}) |`);
+    if (options.preparedFor !== undefined)
+        preamble.push(`| Prepared for | ${cell(options.preparedFor)} |`);
+    if (options.preparedBy !== undefined)
+        preamble.push(`| Prepared by | ${cell(options.preparedBy)} |`);
+    preamble.push('');
+    yield preamble.join('\n') + '\n';
+    if (options.kind === 'attest') {
+        // No per-row content: an Attestation Letter names counts, not issues. The
+        // whole `issues` cursor is folded for `state` and never printed; the
+        // suppressed one is folded *and* buffered, since it is printed after the
+        // letter body, by which point it would otherwise be exhausted.
+        let totalFound = 0;
+        for await (const entry of issues) {
+            totalFound++;
+            if (entry.issue.origin === 'manual')
+                state.includesManual = true;
+            // An Attestation Letter never lists issues individually regardless of
+            // the floor, but `buildReportModel` still folds `omitted` into
+            // `limitations` whenever one is set, kind notwithstanding — matched
+            // here rather than silently diverging.
+            if (entry.issue.status !== 'resolved' &&
+                SEVERITY_ORDER.indexOf(entry.issue.effectiveSeverity) > floorAt) {
+                state.omittedBelowFloor++;
+            }
+        }
+        const suppressedRows = [];
+        for await (const entry of suppressed) {
+            totalFound++;
+            state.suppressedCount++;
+            suppressedRows.push(entry);
+        }
+        const basis = describeBasis(header.run.kind, header.run.engines, state.includesManual);
+        const letter = [
+            '## Statement',
+            '',
+            `${attestor} carried out security testing of **${target.name}**`,
+            `(${target.url}) on ${formatDate(header.run.createdAt)}.`,
+            '',
+            basis.statement,
+            '',
+            `The testing identified ${totalFound} issue${totalFound === 1 ? '' : 's'} in total, of which`,
+            `${outstanding.total} ${outstanding.total === 1 ? 'remains' : 'remain'} outstanding at the date of this letter:`,
+            '',
+            '| Severity | Outstanding |',
+            '| --- | --- |',
+            ...SEVERITY_ORDER.map((sev) => `| ${sev} | ${outstanding.by[sev]} |`),
+            '',
+            '## What this letter does not establish',
+            '',
+            ...describeLimitations(header.run.coverage.paths, header.run.createdAt, basis, state.suppressedCount, describeOmitted(state.omittedBelowFloor, floor)).map((l) => `- ${l}`),
+            '',
+            '## Scope tested',
+            '',
+            ...header.run.coverage.paths.map((p) => `- \`${cell(p)}\``),
+            '',
+            '## Suppressed findings',
+            '',
+        ];
+        yield letter.join('\n') + '\n';
+        yield suppressedTable(suppressedRows);
+        return;
+    }
+    yield [
+        '## Scope',
+        '',
+        `This report covers only what the run exercised: ${header.run.coverage.paths.map((p) => `\`${cell(p)}\``).join(', ')}.`,
+        'Anything outside that was not tested and is not described here.',
+        '',
+    ].join('\n') + '\n';
+    const changeRows = SEVERITY_ORDER.map((severity) => {
+        const cells = [
+            severity,
+            header.run.new[severity],
+            header.run.stillOpen[severity],
+            header.run.regressed[severity],
+            header.run.resolved[severity],
+            header.run.ignored[severity],
+        ];
+        return `| ${cells.join(' | ')} |`;
+    });
+    yield [
+        '## What changed',
+        '',
+        header.baseline === undefined
+            ? '_First run against this target, so every issue is new._'
+            : `_Compared with the run of ${formatDate(header.baseline.createdAt)}._`,
+        '',
+        '| Severity | New | Still open | Regressed | Resolved | Suppressed |',
+        '| --- | --- | --- | --- | --- | --- |',
+        ...changeRows,
+        '',
+    ].join('\n') + '\n';
+    const notable = [];
+    let openedFindings = false;
+    let lastSeverity;
+    let anyListed = false;
+    const resolvedRows = [];
+    for await (const entry of issues) {
+        if (entry.issue.origin === 'manual')
+            state.includesManual = true;
+        const status = entry.issue.status;
+        if (status === 'open' || status === 'regressed') {
+            if (entry.slaStatus === 'breached')
+                state.breached++;
+        }
+        let verdict;
+        if (state.retestCounts !== undefined) {
+            verdict = verdictFor(entry);
+            state.retestCounts[verdict]++;
+        }
+        if (options.kind === 'retest') {
+            // No severity floor and no `includeResolved` filter: every issue
+            // carried into the retest gets a row, matching `renderMarkdown`.
+            if (!openedFindings) {
+                yield [
+                    '## Issue by issue',
+                    '',
+                    '| Issue | Severity | Verdict | Location | Open for |',
+                    '| --- | --- | --- | --- | --- |',
+                ].join('\n') + '\n';
+                openedFindings = true;
+            }
+            const { issue } = entry;
+            const location = issue.parameter === undefined ? issue.location : `${issue.location} (${issue.parameter})`;
+            yield `| ${cell(issue.title)} | ${issue.effectiveSeverity} | ${VERDICT_LABELS[verdict]} | \`${cell(location)}\` | ${entry.daysOpen} days |\n`;
+            continue;
+        }
+        if (status === 'resolved') {
+            if (options.includeResolved === false)
+                continue;
+            resolvedRows.push(`| ${cell(entry.issue.title)} | ${entry.issue.effectiveSeverity} | \`${cell(entry.issue.location)}\` | ${entry.daysOpen} days |`);
+            continue;
+        }
+        if (SEVERITY_ORDER.indexOf(entry.issue.effectiveSeverity) > floorAt) {
+            state.omittedBelowFloor++;
+            continue;
+        }
+        anyListed = true;
+        if (options.kind === 'exec') {
+            if (['critical', 'high'].includes(entry.issue.effectiveSeverity) && notable.length < 10) {
+                notable.push(entry);
+            }
+            continue;
+        }
+        if (options.kind === 'pen') {
+            if (!openedFindings) {
+                yield '## Findings\n\n';
+                openedFindings = true;
+            }
+            if (entry.issue.effectiveSeverity !== lastSeverity) {
+                lastSeverity = entry.issue.effectiveSeverity;
+                yield `### ${lastSeverity}\n\n`;
+            }
+            yield issueDetail(entry, options.evidenceVerbosity ?? 'summary').join('\n') + '\n';
+        }
+        else {
+            // `vap`, the tabulated presentation — the default for any kind not
+            // handled above.
+            if (!openedFindings) {
+                yield [
+                    '## Findings',
+                    '',
+                    '| Issue | Severity | Location | Change | Days open | Remediation |',
+                    '| --- | --- | --- | --- | --- | --- |',
+                ].join('\n') + '\n';
+                openedFindings = true;
+            }
+            yield issueRow(entry) + '\n';
+        }
+    }
+    if (options.kind === 'exec') {
+        yield executiveSummary(outstanding, state, notable).join('\n') + '\n';
+    }
+    else if (options.kind !== 'retest') {
+        if (!anyListed) {
+            yield [
+                '## Findings',
+                '',
+                floor === undefined
+                    ? '_No issues were found._'
+                    : '_No issues at or above the reporting threshold were found._',
+                '',
+            ].join('\n') + '\n';
+        }
+        if (resolvedRows.length > 0) {
+            const n = resolvedRows.length;
+            yield [
+                '## Resolved since the last run',
+                '',
+                `${n} issue${n === 1 ? ' was' : 's were'} no longer detected by a run that covered ${n === 1 ? 'it' : 'them'}.`,
+                '',
+                '| Issue | Severity | Location | Open for |',
+                '| --- | --- | --- | --- |',
+                ...resolvedRows,
+                '',
+            ].join('\n') + '\n';
+        }
+    }
+    yield '## Suppressed findings\n\n';
+    yield suppressedTable(await drain(suppressed, state));
+    const basis = describeBasis(header.run.kind, header.run.engines, state.includesManual);
+    const summary = ['## Summary', '', '## Basis of testing', '', basis.statement, ''];
+    if (state.breached > 0) {
+        summary.push(`**${state.breached} issue${state.breached === 1 ? '' : 's'} past ${state.breached === 1 ? 'its' : 'their'} remediation deadline.**`, '');
+    }
+    const omitted = describeOmitted(state.omittedBelowFloor, floor);
+    if (omitted !== undefined)
+        summary.push(omitted.statement, '');
+    if (options.kind === 'retest' && state.retestCounts !== undefined) {
+        const counts = state.retestCounts;
+        const carried = counts.fixed + counts.still_present + counts.returned + counts.not_retested;
+        const checkable = counts.fixed + counts.still_present + counts.returned;
+        const fixRate = checkable === 0 ? null : counts.fixed / checkable;
+        summary.push('## Retest verdict', '', carried === 0
+            ? 'No issues were carried into this retest.'
+            : `Of the ${carried} issue${carried === 1 ? '' : 's'} carried into this retest, ` +
+                `**${counts.fixed} ${counts.fixed === 1 ? 'is' : 'are'} confirmed fixed**, ` +
+                `${counts.still_present} ${counts.still_present === 1 ? 'is' : 'are'} still present, ` +
+                `${counts.returned} returned, and ${counts.not_retested} could not be retested.` +
+                (counts.new === 0
+                    ? ''
+                    : ` A further ${counts.new} ${counts.new === 1 ? 'issue was' : 'issues were'} found for the first time by this run.`), '');
+        if (fixRate !== null) {
+            summary.push(`${Math.round(fixRate * 100)}% of the issues this run could check are fixed.`, '');
+        }
+        summary.push('| Verdict | Issues |', '| --- | --- |', ...Object.keys(VERDICT_LABELS).map((v) => `| ${VERDICT_LABELS[v]} | ${counts[v]} |`), '');
+        // **Its own heading, not just a sentence.** The array renderer gives this
+        // a `## Not retested` section because it is the part of a retest that
+        // stops a coverage gap reading as remediation; the first draft of this
+        // one kept the sentence and dropped the heading, which a test comparing
+        // the two formats caught.
+        if (counts.not_retested > 0) {
+            summary.push('## Not retested', '', `${counts.not_retested} issue${counts.not_retested === 1 ? '' : 's'} could not be retested by this run:`, 'the run did not cover where they were found, or has not missed them often enough to', 'call them resolved. **They are not fixed.** An issue nobody looked at is neither fixed', 'nor unfixed, and it is excluded from the percentage above rather than counted either way.', '');
+        }
+    }
+    yield summary.join('\n') + '\n';
+}
+/** Reads the rest of an `AsyncIterable<SuppressedIssue>`, folding as it goes. */
+async function drain(suppressed, state) {
+    const rows = [];
+    for await (const entry of suppressed) {
+        state.suppressedCount++;
+        rows.push(entry);
+    }
+    return rows;
+}
+/** The suppressed-findings table. On by default, never optional (invariant 7). */
+function suppressedTable(rows) {
+    if (rows.length === 0)
+        return '_None._\n';
+    return ([
+        'Accepted, out of scope or dismissed. Listed because an accepted risk that',
+        'nobody can see is not an accepted risk.',
+        '',
+        '| Issue | Severity when suppressed | Reason | By | Expires | Justification |',
+        '| --- | --- | --- | --- | --- | --- |',
+        ...rows.map((s) => `| ${cell(s.issue.title)} | ${s.severityAtIgnore} | ${s.reason.replace('_', ' ')} | ${cell(s.ignoredBy)} | ${s.expiresAt === undefined ? 'never' : formatDate(s.expiresAt)} | ${cell(s.comment)} |`),
+    ].join('\n') + '\n');
+}
+/** The Executive Summary body, once the fold and the top-10 buffer are complete. */
+function executiveSummary(outstanding, state, notable) {
+    const headline = outstanding.total === 0
+        ? 'Nothing is currently outstanding on this target.'
+        : `${outstanding.total} issue${outstanding.total === 1 ? '' : 's'} ${outstanding.total === 1 ? 'is' : 'are'} currently outstanding, of which ${outstanding.by.critical + outstanding.by.high} ` +
+            `${outstanding.by.critical + outstanding.by.high === 1 ? 'is' : 'are'} critical or high.`;
+    const lines = ['## Where things stand', '', headline, ''];
+    if (state.breached > 0) {
+        lines.push(`**${state.breached} ${state.breached === 1 ? 'is' : 'are'} past the remediation deadline** ` +
+            'set by the severity policy.', '');
+    }
+    lines.push('## Outstanding by severity', '', '| Severity | Outstanding |', '| --- | --- |', ...SEVERITY_ORDER.filter((sev) => outstanding.by[sev] > 0).map((sev) => `| ${sev} | ${outstanding.by[sev]} |`), '');
+    if (outstanding.total === 0)
+        lines.push('_Nothing outstanding._', '');
+    if (notable.length > 0) {
+        lines.push('## What needs attention first', '', ...notable.map((entry) => `- **${entry.issue.effectiveSeverity}** — ${entry.issue.title} (open ${entry.daysOpen} days)`), '', '_Full detail, including evidence, is in the accompanying technical report._', '');
+    }
+    return lines;
+}
+//# sourceMappingURL=stream.js.map

package/dist/report/stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.js","sourceRoot":"","sources":["../../src/report/stream.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EACL,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,UAAU,EACV,cAAc,GAIf,MAAM,YAAY,CAAC;AAiCpB,SAAS,YAAY,CAAC,WAAoB;IACxC,OAAO;QACL,cAAc,EAAE,KAAK;QACrB,QAAQ,EAAE,CAAC;QACX,iBAAiB,EAAE,CAAC;QACpB,eAAe,EAAE,CAAC;QAClB,GAAG,CAAC,WAAW;YACb,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;YACxF,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,KAAK,CAAC,GAAW,EAAE,KAAc;IACxC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,GAAe;IACtC,MAAM,EAAE,GAA6B;QACnC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ;QAC5E,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI;QAC5D,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM;QACpE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG;QACxD,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ;KAC7E,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAa,EAAE,KAA2B;IACjE,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzD,OAAO;QACL,KAAK;QACL,KAAK;QACL,SAAS,EACP,GAAG,KAAK,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,KAAK,YAAY;YAClE,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,6CAA6C;YAC1E,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,YAAY;YACzD,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,iCAAiC;KACjE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,gBAAgB,CACrC,MAAoB,EACpB,MAAoC,EACpC,UAA0C,EAC1C,OAAsB;IAEtB,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;IAExD,0EAA0E;IAC1E,wEAAwE;IACxE,6CAA6C;IAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/D,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAE1D,MAAM,GAAG,CAAC;IACV,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1F,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE1F,MAAM,aAAa,CAAC;IACpB,IAAI,UAAU,GAAG,IAAI,CAAC;IACtB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ;YAAE,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;QAEjE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QAClC,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAChD,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU;gBAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvD,CAAC;QAED,IAAI,OAAkC,CAAC;QACvC,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YAC5B,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,CAAC;QAED,uEAAuE;QACvE,kEAAkE;QAClE,sEAAsE;QACtE,WAAW;QACX,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,eAAe,KAAK,KAAK;gBAAE,SAAS;QAClD,CAAC;aAAM,IAAI,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,OAAO,EAAE,CAAC;YAC3E,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;QACjF,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACpD,UAAU,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,MAAM,GAAG,CAAC;IAEV,MAAM,iBAAiB,CAAC;IACxB,IAAI,eAAe,GAAG,IAAI,CAAC;IAC3B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QACrC,KAAK,CAAC,eAAe,EAAE,CAAC;QACxB,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3D,eAAe,GAAG,KAAK,CAAC;IAC1B,CAAC;IACD,MAAM,GAAG,CAAC;IAEV,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,mBAAmB,CACrC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EACzB,MAAM,CAAC,GAAG,CAAC,SAAS,EACpB,KAAK,EACL,KAAK,CAAC,eAAe,EACrB,OAAO,CACR,CAAC;IAEF,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAEtD,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAEzE,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,SAAS,GACb,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,aAAa,GAAG,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC;QAC5F,MAAM,YAAY;YAChB,IAAI,CAAC,SAAS,CAAC;gBACb,MAAM,EAAE,KAAK,CAAC,YAAY;gBAC1B,OAAO,EAAE,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,SAAS;aACvE,CAAC,CAAC;IACP,CAAC;IAED,MAAM,GAAG,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,oBAAoB,CACzC,MAAoB,EACpB,MAAoC,EACpC,UAA0C,EAC1C,OAAsB;IAEtB,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/D,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAEhD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,QAAQ,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,QAAQ,CAAC,IAAI,CACX,KAAK,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EACpD,EAAE,EACF,KAAK,MAAM,CAAC,IAAI,QAAQ,MAAM,CAAC,GAAG,EAAE,CACrC,CAAC;IACF,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CACX,EAAE,EACF,GAAG;YACD,QAAQ;YACR,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,cAAc,IAAI,EAAE,CAAC;YAC3C,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;SACtF,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CACnD,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,iBAAiB,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1F,QAAQ,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QACnC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAClC,QAAQ,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClB,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAEjC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,+DAA+D;QAC/D,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC;YACb,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ;gBAAE,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;YACjE,sEAAsE;YACtE,+DAA+D;YAC/D,oEAAoE;YACpE,uCAAuC;YACvC,IACE,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU;gBACjC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,OAAO,EAC/D,CAAC;gBACD,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,cAAc,GAAsB,EAAE,CAAC;QAC7C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YACrC,UAAU,EAAE,CAAC;YACb,KAAK,CAAC,eAAe,EAAE,CAAC;YACxB,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QAEvF,MAAM,MAAM,GAAa;YACvB,cAAc;YACd,EAAE;YACF,GAAG,QAAQ,sCAAsC,MAAM,CAAC,IAAI,IAAI;YAChE,IAAI,MAAM,CAAC,GAAG,QAAQ,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG;YACzD,EAAE;YACF,KAAK,CAAC,SAAS;YACf,EAAE;YACF,0BAA0B,UAAU,SAAS,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,qBAAqB;YAC7F,GAAG,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,0CAA0C;YAChH,EAAE;YACF,4BAA4B;YAC5B,eAAe;YACf,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;YACrE,EAAE;YACF,wCAAwC;YACxC,EAAE;YACF,GAAG,mBAAmB,CACpB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EACzB,MAAM,CAAC,GAAG,CAAC,SAAS,EACpB,KAAK,EACL,KAAK,CAAC,eAAe,EACrB,eAAe,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAChD,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,EAAE;YACF,iBAAiB;YACjB,EAAE;YACF,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC3D,EAAE;YACF,wBAAwB;YACxB,EAAE;SACH,CAAC;QACF,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAC/B,MAAM,eAAe,CAAC,cAAc,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IAED,MAAM;QACJ,UAAU;QACV,EAAE;QACF,mDAAmD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACvH,iEAAiE;QACjE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAEpB,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACjD,MAAM,KAAK,GAAG;YACZ,QAAQ;YACR,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;SAC7B,CAAC;QACF,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,MAAM;QACJ,iBAAiB;QACjB,EAAE;QACF,MAAM,CAAC,QAAQ,KAAK,SAAS;YAC3B,CAAC,CAAC,yDAAyD;YAC3D,CAAC,CAAC,6BAA6B,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI;QAC1E,EAAE;QACF,qEAAqE;QACrE,uCAAuC;QACvC,GAAG,UAAU;QACb,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAEpB,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,YAAkC,CAAC;IACvC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ;YAAE,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;QACjE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QAClC,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAChD,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU;gBAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvD,CAAC;QAED,IAAI,OAAkC,CAAC;QACvC,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YAC5B,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,iEAAiE;YACjE,iEAAiE;YACjE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM;oBACJ,mBAAmB;oBACnB,EAAE;oBACF,sDAAsD;oBACtD,iCAAiC;iBAClC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;gBACpB,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;YACxB,MAAM,QAAQ,GACZ,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,SAAS,GAAG,CAAC;YAC5F,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,iBAAiB,MAAM,cAAc,CAAC,OAAwB,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,CAAC,QAAQ,WAAW,CAAC;YAC/J,SAAS;QACX,CAAC;QAED,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,eAAe,KAAK,KAAK;gBAAE,SAAS;YAChD,YAAY,CAAC,IAAI,CACf,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,iBAAiB,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,KAAK,CAAC,QAAQ,SAAS,CACjI,CAAC;YACF,SAAS;QACX,CAAC;QAED,IAAI,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,OAAO,EAAE,CAAC;YACpE,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,SAAS,GAAG,IAAI,CAAC;QAEjB,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBACxF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC3B,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,iBAAiB,CAAC;gBACxB,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,IAAI,KAAK,CAAC,KAAK,CAAC,iBAAiB,KAAK,YAAY,EAAE,CAAC;gBACnD,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC;gBAC7C,MAAM,OAAO,YAAY,MAAM,CAAC;YAClC,CAAC;YACD,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,iBAAiB,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACrF,CAAC;aAAM,CAAC;YACN,mEAAmE;YACnE,iBAAiB;YACjB,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM;oBACJ,aAAa;oBACb,EAAE;oBACF,oEAAoE;oBACpE,uCAAuC;iBACxC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;gBACpB,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACxE,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM;gBACJ,aAAa;gBACb,EAAE;gBACF,KAAK,KAAK,SAAS;oBACjB,CAAC,CAAC,yBAAyB;oBAC3B,CAAC,CAAC,6DAA6D;gBACjE,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACtB,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC;YAC9B,MAAM;gBACJ,gCAAgC;gBAChC,EAAE;gBACF,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,6CAA6C,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG;gBAC/G,EAAE;gBACF,4CAA4C;gBAC5C,2BAA2B;gBAC3B,GAAG,YAAY;gBACf,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;IAED,MAAM,4BAA4B,CAAC;IACnC,MAAM,eAAe,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACvF,MAAM,OAAO,GAAa,CAAC,YAAY,EAAE,EAAE,EAAE,qBAAqB,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7F,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CACV,KAAK,KAAK,CAAC,QAAQ,SAAS,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,SAAS,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,0BAA0B,EACpI,EAAE,CACH,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAChE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAE/D,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC;QAC5F,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;QACxE,MAAM,OAAO,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC;QAClE,OAAO,CAAC,IAAI,CACV,mBAAmB,EACnB,EAAE,EACF,OAAO,KAAK,CAAC;YACX,CAAC,CAAC,0CAA0C;YAC5C,CAAC,CAAC,UAAU,OAAO,SAAS,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,6BAA6B;gBAC7E,KAAK,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,sBAAsB;gBAC5E,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,kBAAkB;gBACtF,GAAG,MAAM,CAAC,QAAQ,kBAAkB,MAAM,CAAC,YAAY,yBAAyB;gBAChF,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;oBACf,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,cAAc,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,wCAAwC,CAAC,EAC7H,EAAE,CACH,CAAC;QACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CACV,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,iDAAiD,EAC7E,EAAE,CACH,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CACV,sBAAsB,EACtB,eAAe,EACf,GAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAqB,CAAC,GAAG,CACrD,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,IAAI,CACjD,EACD,EAAE,CACH,CAAC;QACF,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,0BAA0B;QAC1B,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CACV,iBAAiB,EACjB,EAAE,EACF,GAAG,MAAM,CAAC,YAAY,SAAS,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,qCAAqC,EACxG,qFAAqF,EACrF,wFAAwF,EACxF,2FAA2F,EAC3F,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAClC,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,KAAK,CAClB,UAA0C,EAC1C,KAAgB;IAEhB,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QACrC,KAAK,CAAC,eAAe,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,SAAS,eAAe,CAAC,IAAgC;IACvD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAC1C,OAAO,CACL;QACE,2EAA2E;QAC3E,yCAAyC;QACzC,EAAE;QACF,8EAA8E;QAC9E,uCAAuC;QACvC,GAAG,IAAI,CAAC,GAAG,CACT,CAAC,CAAC,EAAE,EAAE,CACJ,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,gBAAgB,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MACrG,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAC9D,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAC5B;KACF,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CACpB,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,gBAAgB,CACvB,WAA4D,EAC5D,KAAgB,EAChB,OAAiC;IAEjC,MAAM,QAAQ,GACZ,WAAW,CAAC,KAAK,KAAK,CAAC;QACrB,CAAC,CAAC,kDAAkD;QACpD,CAAC,CAAC,GAAG,WAAW,CAAC,KAAK,SAAS,WAAW,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAC7D,WAAW,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KACnC,oCAAoC,WAAW,CAAC,EAAE,CAAC,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,IAAI,GAAG;YACpF,GAAG,WAAW,CAAC,EAAE,CAAC,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC;IAEhG,MAAM,KAAK,GAAG,CAAC,uBAAuB,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,KAAK,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,mCAAmC;YAC3F,6BAA6B,EAC/B,EAAE,CACH,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CACR,4BAA4B,EAC5B,EAAE,EACF,4BAA4B,EAC5B,eAAe,EACf,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAC5D,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAC/C,EACD,EAAE,CACH,CAAC;IACF,IAAI,WAAW,CAAC,KAAK,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;IAEtE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,+BAA+B,EAC/B,EAAE,EACF,GAAG,OAAO,CAAC,GAAG,CACZ,CAAC,KAAK,EAAE,EAAE,CACR,OAAO,KAAK,CAAC,KAAK,CAAC,iBAAiB,QAAQ,KAAK,CAAC,KAAK,CAAC,KAAK,UAAU,KAAK,CAAC,QAAQ,QAAQ,CAChG,EACD,EAAE,EACF,6EAA6E,EAC7E,EAAE,CACH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secureport/core",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "description": "Shared domain model for Secureport. Imported by the hosted API the same way a third party would.",
   "keywords": [
     "security",
@@ -37,7 +37,9 @@
     "LICENSE"
   ],
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^22.20.2",
+    "ajv": "^8.20.0",
+    "ajv-draft-04": "^1.0.0",
     "typescript": "^5.7.2"
   },
   "license": "MIT",

package/src/index.ts

@@ -53,6 +53,9 @@ export { importGeneric } from './import/generic.js';
 export type { BuildSnapshotInput } from './snapshot-builder.js';
 export { buildSnapshot, parseSnapshot } from './snapshot-builder.js';
 export type {
+  Branding,
+  EvidenceVerbosity,
+  OmittedIssues,
   ReportKind,
   ReportModel,
   ReportOptions,
@@ -62,12 +65,18 @@ export type {
   RetestVerdict,
   TestingBasis,
 } from './report/model.js';
-export { buildReportModel } from './report/model.js';
+export { brandingProblem, buildReportModel, VERDICT_LABELS } from './report/model.js';
 export { renderMarkdown } from './report/markdown.js';
 export { renderHtml } from './report/html.js';
+export type { ReportHeader } from './report/stream.js';
+export { renderJsonStream, renderMarkdownStream } from './report/stream.js';
+export type { SarifOptions } from './report/sarif.js';
+export { renderSarifStream } from './report/sarif.js';
+export type { CsvOptions } from './report/csv.js';
+export { renderCsvStream } from './report/csv.js';
 export type { JsonReport } from './report/json.js';
 export { renderJson } from './report/json.js';
-export type { ReconcileInput, ReconcileResult } from './reconcile.js';
+export type { ReconcileInput, ReconcileResult, SuppressionDecision } from './reconcile.js';
 export { reconcile } from './reconcile.js';
 export type {
   Coverage,

package/src/issue.ts

@@ -216,6 +216,7 @@ export type IssueEventType =
   | 'commented'
   | 'assigned'
   | 'merged'
+  | 'retitled'
   | 'exported';
 
 /**