@sikkuumiii/defuse 0.0.0-stage → 0.5.0

package/dist/src/report/json.d.ts

@@ -0,0 +1,24 @@
+/**
+ * MACHINE-READABLE REPORT
+ *
+ * Two rules for this format:
+ *
+ * 1. It is a SUPERSET of the human report. Anything the terminal shows must be
+ *    in here, including the gaps and the suppressions. A JSON consumer must not
+ *    be able to build a rosier picture than a human reading the same scan.
+ *
+ * 2. `confidence` is a top-level field on every finding, and the `honesty`
+ *    block at the document root explains what the values mean. A dashboard that
+ *    ingests this cannot accidentally present unverified matches as confirmed
+ *    vulnerabilities without deliberately discarding the field.
+ *
+ * RELATIONSHIP TO SARIF: this shape deliberately resembles SARIF (the OASIS
+ * standard GitHub code scanning consumes) without pretending to be it, because
+ * emitting invalid SARIF and calling it SARIF would be its own small lie. Real
+ * SARIF now exists behind `--sarif` (report/sarif.ts), typed against the
+ * official 2.1.0 definitions so the compiler rejects a malformed document.
+ * This format stays because it carries things SARIF has no room for - the
+ * coverage matrix, verified-clean lines, trace limits and the score gauges.
+ */
+import type { ScanResult } from '../engine/scan.js';
+export declare function renderJson(result: ScanResult, pretty?: boolean): string;

package/dist/src/report/json.js

@@ -0,0 +1,178 @@
+/**
+ * MACHINE-READABLE REPORT
+ *
+ * Two rules for this format:
+ *
+ * 1. It is a SUPERSET of the human report. Anything the terminal shows must be
+ *    in here, including the gaps and the suppressions. A JSON consumer must not
+ *    be able to build a rosier picture than a human reading the same scan.
+ *
+ * 2. `confidence` is a top-level field on every finding, and the `honesty`
+ *    block at the document root explains what the values mean. A dashboard that
+ *    ingests this cannot accidentally present unverified matches as confirmed
+ *    vulnerabilities without deliberately discarding the field.
+ *
+ * RELATIONSHIP TO SARIF: this shape deliberately resembles SARIF (the OASIS
+ * standard GitHub code scanning consumes) without pretending to be it, because
+ * emitting invalid SARIF and calling it SARIF would be its own small lie. Real
+ * SARIF now exists behind `--sarif` (report/sarif.ts), typed against the
+ * official 2.1.0 definitions so the compiler rejects a malformed document.
+ * This format stays because it carries things SARIF has no room for - the
+ * coverage matrix, verified-clean lines, trace limits and the score gauges.
+ */
+import { LICENCE_SPDX } from '../core/licence.js';
+export function renderJson(result, pretty = true) {
+    const bySeverity = {};
+    for (const finding of result.findings) {
+        bySeverity[finding.severity] = (bySeverity[finding.severity] ?? 0) + 1;
+    }
+    const document = {
+        tool: {
+            name: 'Defuse',
+            version: result.coverage.engine.version,
+            analysis: result.coverage.engine.analysisLabel,
+            // Taken from the capability block rather than retyped here. This list was
+            // hand-written once and went stale immediately - it still claimed the
+            // tracer worked "within one function (JS/TS/Python)" long after it
+            // followed values across files in every language. A machine-readable
+            // report that overstates OR understates the engine is the same bug.
+            analysisTypes: result.coverage.engine.implemented,
+            // Machine-readable, because a consumer feeding this into a compliance
+            // pipeline should not have to read a README to learn the terms.
+            license: LICENCE_SPDX,
+        },
+        target: result.target,
+        scannedAt: new Date().toISOString(),
+        // Placed BEFORE findings on purpose: a consumer reading top-to-bottom meets
+        // the caveats before the results.
+        honesty: {
+            signatureBasedFindings: result.findings.filter((f) => f.confidence === 'signature-based')
+                .length,
+            flowVerifiedFindings: result.findings.filter((f) => f.confidence === 'flow-verified').length,
+            signatureGuessesSupersededByProof: result.stats.signaturesUpgraded,
+            signatureGuessesWithdrawnAsSanitised: result.stats.signaturesRetracted,
+            /*
+             * Withdrawn because every value spliced in is provably a fixed literal on
+             * every path that runs - a branch that cannot run, a condition decided at
+             * compile time, a same-file helper that only ever returns a literal. Each
+             * one is listed under diagnostics.verifiedClean with kind "constant" and
+             * the reason, so the reasoning can be checked line by line.
+             */
+            signatureGuessesWithdrawnAsConstant: result.stats.signaturesProvedConstant,
+            /*
+             * Branches and cases the tracer did not follow because a condition fixed
+             * at compile time means they cannot run. A flow that lived only inside one
+             * of them is not reported - so each is listed under
+             * diagnostics.unreachableCodeSkipped, with the decision, rather than
+             * leaving a missing finding with no explanation.
+             */
+            regionsProvedUnreachable: result.stats.regionsProvedUnreachable,
+            /*
+             * Reads from a local map or list answered by the key or the position,
+             * because every write the collection could receive is visible (see
+             * taint/local-map.ts) - each listed under diagnostics.collectionReadsResolved
+             * with the write that answers it.
+             */
+            collectionReadsResolved: result.stats.collectionReadsResolved,
+            /*
+             * Calls where a trace ENDED because the function returns new data - a
+             * database row, a file's contents - not its argument. Not a claim of
+             * safety: nothing is cleared by a stop, and a sink further on is still
+             * reported by its signature rule. Each is listed under
+             * diagnostics.tracesStoppedAtNewData with what the call returns instead.
+             */
+            tracesStoppedAtNewData: result.stats.tracesStoppedAtNewData,
+            meaningOfConfidence: result.coverage.engine.meaningOfConfidence,
+            notImplemented: result.coverage.engine.notImplemented,
+            dataFlowCoverageByLanguage: result.coverage.taint,
+            crossFileResolution: result.crossFile,
+            warning: 'Findings labelled signature-based are UNVERIFIED pattern matches - the data flow was ' +
+                'not traced and they may be false positives. Findings labelled flow-verified carry a ' +
+                'complete source-to-sink path in `flowPath`; check it rather than trusting the label. ' +
+                'Neither label proves exploitability in a running system.',
+        },
+        summary: {
+            total: result.findings.length,
+            bySeverity,
+            byConfidence: {
+                'signature-based': result.findings.filter((f) => f.confidence === 'signature-based').length,
+                'flow-verified': result.findings.filter((f) => f.confidence === 'flow-verified').length,
+            },
+            suppressed: result.suppressions.length,
+        },
+        findings: result.findings.map((finding) => ({
+            ruleId: finding.ruleId,
+            ruleName: finding.ruleName,
+            severity: finding.severity,
+            confidence: finding.confidence,
+            verified: finding.verified,
+            flowPath: finding.flowPath,
+            cwe: finding.cwe,
+            owasp: finding.owasp,
+            message: finding.message,
+            reasoning: finding.reasoning,
+            limitations: finding.limitations,
+            location: finding.location,
+            detectedAt: finding.detectedAt,
+        })),
+        coverage: {
+            counts: result.coverage.counts,
+            gaps: result.coverage.gaps,
+            matrix: result.coverage.matrix,
+            fileTypesPresentButNotScanned: result.coverage.unscannedExtensions,
+        },
+        diagnostics: {
+            stats: result.stats,
+            filesByLanguage: result.byLanguage,
+            parseProblems: result.parseProblems,
+            suppressions: result.suppressions,
+            /*
+             * Every line proved clean, each with `reason` - what cleaned it and on
+             * which line - and, when there were any, `assumes`: functions Defuse
+             * does not model that the value went through AFTER it was cleaned, each
+             * taken to hand back what it was given. A tool reading this file can
+             * hold the receipts that rest on trust to a different standard.
+             */
+            verifiedClean: result.verifiedClean,
+            unreachableCodeSkipped: result.unreachableCode,
+            collectionReadsResolved: result.collectionReadsResolved,
+            tracesStoppedAtNewData: result.tracesStoppedAtNewData,
+            /*
+             * Which PHP the project declares (Dockerfile, compose, composer.json,
+             * .php-version) and what php.net's facts say about each - with the date
+             * those facts were checked, and notes for what could not be checked.
+             * Null when --only left the check out.
+             */
+            runtimeVersions: result.runtimeVersions
+                ? {
+                    factsChecked: result.runtimeVersions.factsChecked,
+                    declared: result.runtimeVersions.declared,
+                    notes: result.runtimeVersions.notes,
+                }
+                : null,
+            /** What `--deps` read and asked osv.dev; null when it did not run. */
+            dependencies: result.dependencies ?? null,
+            oversizedFilesSkipped: result.oversizedFiles,
+            excludedByUser: result.excluded,
+            /**
+             * What the scan spent on syntax trees.
+             *
+             * `reparses` above zero means the project did not fit in the tree budget
+             * and files were parsed more than once. The findings are unaffected - a
+             * re-parse of the same bytes with the same grammar is the same tree - but
+             * the scan took longer than it needed to, and saying so is the difference
+             * between a user tuning the budget and a user assuming the tool is slow.
+             */
+            treeMemory: {
+                ...result.treeMemory,
+                note: result.treeMemory.reparses === 0
+                    ? 'Every file was parsed exactly once; the project fitted in the tree budget.'
+                    : `The project did not fit in the tree budget, so ${result.treeMemory.reparses} ` +
+                        'file(s) were parsed more than once. Answers are unchanged; the scan was slower. ' +
+                        'Raise DEFUSE_TREE_BUDGET_MB to trade memory back for speed.',
+            },
+        },
+    };
+    return JSON.stringify(document, null, pretty ? 2 : 0);
+}
+//# sourceMappingURL=json.js.map

package/dist/src/report/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../../src/report/json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,UAAU,UAAU,CAAC,MAAkB,EAAE,MAAM,GAAG,IAAI;IAC1D,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO;YACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa;YAC9C,0EAA0E;YAC1E,sEAAsE;YACtE,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW;YACjD,sEAAsE;YACtE,gEAAgE;YAChE,OAAO,EAAE,YAAY;SACtB;QACD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAEnC,4EAA4E;QAC5E,kCAAkC;QAClC,OAAO,EAAE;YACP,sBAAsB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,iBAAiB,CAAC;iBACtF,MAAM;YACT,oBAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,eAAe,CAAC,CAAC,MAAM;YAC5F,iCAAiC,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB;YAClE,oCAAoC,EAAE,MAAM,CAAC,KAAK,CAAC,mBAAmB;YACtE;;;;;;eAMG;YACH,mCAAmC,EAAE,MAAM,CAAC,KAAK,CAAC,wBAAwB;YAC1E;;;;;;eAMG;YACH,wBAAwB,EAAE,MAAM,CAAC,KAAK,CAAC,wBAAwB;YAC/D;;;;;eAKG;YACH,uBAAuB,EAAE,MAAM,CAAC,KAAK,CAAC,uBAAuB;YAC7D;;;;;;eAMG;YACH,sBAAsB,EAAE,MAAM,CAAC,KAAK,CAAC,sBAAsB;YAC3D,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB;YAC/D,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc;YACrD,0BAA0B,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;YACjD,mBAAmB,EAAE,MAAM,CAAC,SAAS;YACrC,OAAO,EACL,uFAAuF;gBACvF,sFAAsF;gBACtF,uFAAuF;gBACvF,0DAA0D;SAC7D;QAED,OAAO,EAAE;YACP,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;YAC7B,UAAU;YACV,YAAY,EAAE;gBACZ,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,iBAAiB,CAAC,CAAC,MAAM;gBAC3F,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,eAAe,CAAC,CAAC,MAAM;aACxF;YACD,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM;SACvC;QAED,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QAEH,QAAQ,EAAE;YACR,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;YAC9B,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI;YAC1B,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;YAC9B,6BAA6B,EAAE,MAAM,CAAC,QAAQ,CAAC,mBAAmB;SACnE;QAED,WAAW,EAAE;YACX,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,eAAe,EAAE,MAAM,CAAC,UAAU;YAClC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC;;;;;;eAMG;YACH,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,sBAAsB,EAAE,MAAM,CAAC,eAAe;YAC9C,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;YACvD,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;YACrD;;;;;eAKG;YACH,eAAe,EAAE,MAAM,CAAC,eAAe;gBACrC,CAAC,CAAC;oBACE,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC,YAAY;oBACjD,QAAQ,EAAE,MAAM,CAAC,eAAe,CAAC,QAAQ;oBACzC,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,KAAK;iBACpC;gBACH,CAAC,CAAC,IAAI;YACR,sEAAsE;YACtE,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;YACzC,qBAAqB,EAAE,MAAM,CAAC,cAAc;YAC5C,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B;;;;;;;;eAQG;YACH,UAAU,EAAE;gBACV,GAAG,MAAM,CAAC,UAAU;gBACpB,IAAI,EACF,MAAM,CAAC,UAAU,CAAC,QAAQ,KAAK,CAAC;oBAC9B,CAAC,CAAC,4EAA4E;oBAC9E,CAAC,CAAC,kDAAkD,MAAM,CAAC,UAAU,CAAC,QAAQ,GAAG;wBAC/E,kFAAkF;wBAClF,6DAA6D;aACpE;SACF;KACF,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/src/report/mark.d.ts

@@ -0,0 +1,17 @@
+/**
+ * THE MARK, AS A VECTOR.
+ *
+ * docs/defuse-mark.png is the source of truth for the mark, and it is not in
+ * the npm package - so a report written by an installed copy of the CLI could
+ * not include it. This is the same shape traced to a path (potrace, from the PNG
+ * at 4x), small enough to inline, so a report file carries its own mark and
+ * loads nothing from anywhere.
+ */
+/** #792CF7 - the mark's own colour, sampled from the PNG. */
+export declare const MARK_COLOUR = "#792CF7";
+/** An inline <svg> of the mark, `width` pixels wide; height follows the 262:240 shape. */
+export declare function markSvg(width: number, title?: string): string;
+/** Columns the banner needs. */
+export declare const BANNER_WIDTH: number;
+/** The banner as plain lines. */
+export declare function bannerLines(): string[];

package/dist/src/report/mark.js

@@ -0,0 +1,39 @@
+/**
+ * THE MARK, AS A VECTOR.
+ *
+ * docs/defuse-mark.png is the source of truth for the mark, and it is not in
+ * the npm package - so a report written by an installed copy of the CLI could
+ * not include it. This is the same shape traced to a path (potrace, from the PNG
+ * at 4x), small enough to inline, so a report file carries its own mark and
+ * loads nothing from anywhere.
+ */
+/** #792CF7 - the mark's own colour, sampled from the PNG. */
+export const MARK_COLOUR = '#792CF7';
+const MARK_PATH = 'M162 9580 c-7 -11 -18 -20 -26 -20 -17 0 -96 -78 -96 -95 0 -6 -9 -20 -20 -30 -20 -18 -20 -31 -20 -2350 0 -2009 2 -2334 14 -2338 8 -3 22 -22 31 -41 22 -47 83 -94 142 -112 40 -12 240 -14 1227 -14 1123 1 1181 0 1187 -17 12 -29 10 -1733 -1 -1754 -10 -18 -51 -18 -1203 -19 l-1192 0 -55 -28 c-37 -18 -66 -42 -87 -72 -18 -25 -39 -53 -48 -62 -13 -16 -15 -154 -15 -1231 0 -1201 0 -1214 20 -1232 11 -10 20 -22 20 -27 0 -20 48 -72 88 -95 23 -14 42 -29 42 -34 0 -5 501 -9 1225 -9 l1224 0 25 23 c14 12 41 35 61 51 20 16 47 51 61 77 l24 48 0 1018 c0 560 4 1024 8 1031 7 10 249 12 1208 13 l1199 0 5 -1028 c5 -1108 3 -1061 58 -1128 14 -16 41 -41 61 -55 20 -14 40 -31 44 -37 13 -20 702 -18 749 2 19 7 84 19 144 25 172 16 341 48 589 111 186 48 206 54 515 164 25 8 54 20 65 25 11 5 72 31 135 59 134 59 386 186 478 241 17 11 47 29 65 40 17 11 48 29 67 40 59 35 154 98 271 182 163 115 355 277 559 468 283 266 641 727 833 1073 9 18 35 64 57 102 59 104 220 441 220 460 0 4 8 26 19 49 21 48 28 65 91 251 60 180 90 277 90 293 0 8 8 44 19 80 43 153 83 375 102 567 6 61 17 125 25 144 20 49 20 757 0 816 -8 22 -19 92 -25 155 -26 275 -107 634 -210 935 -67 197 -79 229 -95 260 -9 17 -16 34 -16 39 0 5 -9 30 -21 55 -12 25 -29 64 -39 86 -41 90 -123 254 -160 320 -22 39 -48 84 -57 102 -66 118 -166 273 -293 451 -220 311 -578 681 -920 952 -162 129 -178 140 -340 247 -63 42 -127 84 -142 94 -15 11 -30 19 -34 19 -4 0 -15 6 -23 14 -52 45 -492 262 -676 333 -22 8 -55 21 -72 29 -29 12 -228 79 -353 118 -25 8 -94 26 -155 40 -60 15 -137 33 -170 42 -91 22 -279 52 -406 65 -63 6 -129 17 -148 25 -28 12 -472 14 -2985 14 -2940 0 -2951 0 -2964 -20z m5648 -2648 c153 -13 203 -20 340 -51 111 -25 188 -48 227 -66 17 -8 35 -15 40 -15 47 0 389 -183 494 -265 15 -11 39 -29 55 -40 114 -80 352 -322 434 -441 36 -52 108 -162 127 -194 42 -70 153 -303 153 -323 1 -6 9 -30 20 -52 11 -22 19 -46 20 -54 0 -8 9 -44 20 -80 98 -330 97 -754 -2 -1111 -113 -409 -365 -796 -693 -1068 -44 -37 -82 -69 -85 -72 -3 -3 -16 -13 -30 -22 -14 -10 -44 -31 -67 -47 -163 -116 -433 -240 -628 -290 -235 -60 -306 -68 -645 -73 l-185 -3 -5 1095 -5 1095 -27 52 c-33 61 -103 122 -155 134 -21 5 -572 9 -1225 9 l-1188 0 -5 23 c-3 12 -4 435 -3 940 3 803 5 919 18 927 23 14 2817 7 3000 -8z';
+/** An inline <svg> of the mark, `width` pixels wide; height follows the 262:240 shape. */
+export function markSvg(width, title = '') {
+    const height = Math.round(((width * 240) / 262) * 100) / 100;
+    const label = title ? ` role="img" aria-label="${title}"` : ' aria-hidden="true"';
+    return (`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1048.12 960.13" width="${width}" height="${height}"${label}>` +
+        `<g transform="translate(0,960) scale(0.1,-0.1)" fill="${MARK_COLOUR}"><path d="${MARK_PATH}"/></g></svg>`);
+}
+/*
+ * THE MARK, AS BLOCKS - the terminal banner.
+ *
+ * "DEFUSE" in chunky block letters with a box-drawing shadow.
+ */
+const BANNER = [
+    '██████╗ ███████╗███████╗██╗   ██╗███████╗███████╗',
+    '██╔══██╗██╔════╝██╔════╝██║   ██║██╔════╝██╔════╝',
+    '██║  ██║█████╗  █████╗  ██║   ██║███████╗█████╗',
+    '██║  ██║██╔══╝  ██╔══╝  ██║   ██║╚════██║██╔══╝',
+    '██████╔╝███████╗██║     ╚██████╔╝███████║███████╗',
+    '╚═════╝ ╚══════╝╚═╝      ╚═════╝ ╚══════╝╚══════╝',
+];
+/** Columns the banner needs. */
+export const BANNER_WIDTH = Math.max(...BANNER.map((l) => l.length));
+/** The banner as plain lines. */
+export function bannerLines() {
+    return [...BANNER];
+}
+//# sourceMappingURL=mark.js.map

package/dist/src/report/mark.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mark.js","sourceRoot":"","sources":["../../../src/report/mark.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;AAErC,MAAM,SAAS,GACb,wpEAAwpE,CAAC;AAE3pE,0FAA0F;AAC1F,MAAM,UAAU,OAAO,CAAC,KAAa,EAAE,KAAK,GAAG,EAAE;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,2BAA2B,KAAK,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC;IAClF,OAAO,CACL,+EAA+E,KAAK,aAAa,MAAM,IAAI,KAAK,GAAG;QACnH,yDAAyD,WAAW,cAAc,SAAS,eAAe,CAC3G,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,MAAM,GAAG;IACb,mDAAmD;IACnD,mDAAmD;IACnD,iDAAiD;IACjD,iDAAiD;IACjD,mDAAmD;IACnD,mDAAmD;CACpD,CAAC;AAEF,gCAAgC;AAChC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAErE,iCAAiC;AACjC,MAAM,UAAU,WAAW;IACzB,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC"}

package/dist/src/report/pricing.d.ts

@@ -0,0 +1,33 @@
+import type { BenchmarkResult } from './coverage-table.js';
+export interface PlanFeature {
+    readonly name: string;
+    readonly detail: string;
+}
+export interface Plan {
+    readonly name: string;
+    readonly status: 'available' | 'coming-soon';
+    /** Shown only for an available plan. */
+    readonly price?: {
+        readonly amount: string;
+        readonly unit: string;
+        readonly note?: string;
+    };
+    readonly forWhom: string;
+    /**
+     * A fact about the plan, shown in the corner of its card. A fact, never a
+     * ranking: "open source", "from 5 developers". See the note above on badges.
+     */
+    readonly badge?: string;
+    /** "Everything in Pro, and:" - the plan below this one. */
+    readonly builds?: string;
+    readonly features: readonly PlanFeature[];
+    readonly cta: {
+        readonly label: string;
+        readonly href: string;
+        readonly primary?: boolean;
+    };
+}
+/** Team is priced per developer with a floor of this many. */
+export declare const TEAM_MIN_SEATS = 5;
+export declare function plans(): Plan[];
+export declare function renderPricing(benchmark: BenchmarkResult): string;