checkly 8.14.1 → 8.15.0

package/dist/formatters/check-result-detail.js

@@ -1,5 +1,6 @@
 import chalk from 'chalk';
-import { formatMs, formatDate, resolveResultStatus, heading, escapeMdCell, renderDetailFields, renderCommandHints, renderAdaptiveTable, truncateSingleLine, } from './render.js';
+import { formatMs, formatDate, resolveResultStatus, heading, escapeMdCell, renderDetailFields, renderCommandHints, renderAdaptiveTable, truncateSingleLine, stripAnsi, } from './render.js';
+import { assertionSymbols, formatAssertionLine } from './assertion-line.js';
 // --- Helpers ---
 function label(text, width = 16) {
     return chalk.dim(text.padEnd(width));
@@ -53,6 +54,16 @@ function firstErrorMessage(result) {
         .find(m => m.length > 0);
     if (agenticErr)
         return agenticErr;
+    const tracerouteErr = result.tracerouteCheckResult?.requestError;
+    if (tracerouteErr)
+        return tracerouteErr;
+    const grpcErr = result.grpcCheckResult?.requestError
+        ?? result.grpcCheckResult?.response?.grpcStatusMessage;
+    if (grpcErr)
+        return grpcErr;
+    const sslErr = result.sslCheckResult?.requestError ?? result.sslCheckResult?.failureCategory;
+    if (sslErr)
+        return sslErr;
     return '';
 }
 // Renders the retry table for a sequence; `attempts` must be oldest-first.
@@ -147,6 +158,24 @@ export function formatResultDetail(result, format) {
             : formatAgenticResultTerminal(result.agenticCheckResult);
         parts.push(subLines.join('\n'));
     }
+    if (result.tracerouteCheckResult) {
+        const subLines = format === 'md'
+            ? formatTracerouteResultMd(result.tracerouteCheckResult)
+            : formatTracerouteResultTerminal(result.tracerouteCheckResult);
+        parts.push(subLines.join('\n'));
+    }
+    if (result.grpcCheckResult) {
+        const subLines = format === 'md'
+            ? formatGrpcResultMd(result.grpcCheckResult)
+            : formatGrpcResultTerminal(result.grpcCheckResult);
+        parts.push(subLines.join('\n'));
+    }
+    if (result.sslCheckResult) {
+        const subLines = format === 'md'
+            ? formatSslResultMd(result.sslCheckResult)
+            : formatSslResultTerminal(result.sslCheckResult);
+        parts.push(subLines.join('\n'));
+    }
     return parts.join('\n\n');
 }
 // --- API check result (terminal) ---
@@ -490,6 +519,580 @@ function formatAgenticResultMd(agentic) {
     }
     return lines;
 }
+// --- Traceroute check result ---
+//
+// The diagnostic objects (tracerouteCheckResult/grpcCheckResult/sslCheckResult)
+// carry documented top-level scalars plus a richer `response` artifact. The
+// renderers prefer the top-level scalar but fall back to the artifact so a
+// metadata-only uptime result still surfaces something useful.
+function num(...vals) {
+    for (const v of vals) {
+        if (typeof v === 'number' && !Number.isNaN(v))
+            return v;
+    }
+    return undefined;
+}
+function str(...vals) {
+    for (const v of vals) {
+        if (typeof v === 'string' && v.length > 0)
+            return v;
+    }
+    return undefined;
+}
+function boolFlag(...vals) {
+    for (const v of vals) {
+        if (typeof v === 'boolean')
+            return v;
+    }
+    return undefined;
+}
+function yesNo(value, { goodWhenTrue = true } = {}) {
+    if (value == null)
+        return chalk.dim('—');
+    const good = goodWhenTrue ? value : !value;
+    const text = value ? 'yes' : 'no';
+    return good ? chalk.green(text) : chalk.red(text);
+}
+// finalHopLatency / RTT objects come straight from the runner artifact, where
+// keys are snake_case (`avg_ms`/`best_ms`/`worst_ms`); accept the camelCase
+// variants too in case a consumer reshapes the payload.
+function formatLatencyStats(obj) {
+    if (!obj || typeof obj !== 'object')
+        return undefined;
+    const o = obj;
+    const avg = num(o.avgMs, o.avg_ms, o.avg);
+    const best = num(o.bestMs, o.best_ms, o.best);
+    const worst = num(o.worstMs, o.worst_ms, o.worst);
+    const parts = [
+        avg != null ? `avg ${formatMs(avg)}` : null,
+        best != null ? `best ${formatMs(best)}` : null,
+        worst != null ? `worst ${formatMs(worst)}` : null,
+    ].filter(Boolean);
+    return parts.length > 0 ? parts.join(' / ') : undefined;
+}
+// A request that errored never evaluated its assertions, and the backend reports
+// those unevaluated entries without an `error`, which renders as a green success
+// mark. Suppress the whole section instead of claiming assertions passed.
+function assertionsToRender(result) {
+    if (result.requestError)
+        return;
+    if (!result.assertions || result.assertions.length === 0)
+        return;
+    return result.assertions;
+}
+function appendAssertionsTerminal(lines, result) {
+    const assertions = assertionsToRender(result);
+    if (!assertions)
+        return;
+    lines.push('');
+    lines.push(heading('ASSERTIONS', 2, 'terminal'));
+    for (const assertion of assertions) {
+        lines.push(`  ${formatAssertionLine(assertion)}`);
+    }
+}
+function appendAssertionsMd(lines, result) {
+    const assertions = assertionsToRender(result);
+    if (!assertions)
+        return;
+    lines.push('');
+    lines.push('## Assertions');
+    for (const assertion of assertions) {
+        lines.push(`- ${stripAnsi(formatAssertionLine(assertion))}`);
+    }
+}
+function formatTracerouteResultTerminal(tr) {
+    const lines = [];
+    const resp = tr.response ?? {};
+    lines.push(heading('TRACEROUTE RESULT', 2, 'terminal'));
+    const host = str(resp.hostname);
+    const ip = str(resp.resolvedIp);
+    if (host || ip) {
+        const dest = [host, ip ? `(${ip})` : null].filter(Boolean).join(' ');
+        lines.push(`${label('Destination:')}${dest}`);
+    }
+    const protocol = str(resp.protocol, resp.probeProtocol);
+    if (protocol)
+        lines.push(`${label('Protocol:')}${protocol}`);
+    const probeProtocol = str(resp.probeProtocol);
+    if (probeProtocol)
+        lines.push(`${label('Probe protocol:')}${probeProtocol}`);
+    const totalHops = num(tr.totalHops, resp.totalHops);
+    if (totalHops != null)
+        lines.push(`${label('Hops:')}${totalHops}`);
+    const reached = boolFlag(tr.destinationReached, resp.destinationReached);
+    lines.push(`${label('Reached:')}${yesNo(reached)}`);
+    const truncation = str(resp.truncationReason);
+    if (truncation)
+        lines.push(`${label('Truncated:')}${chalk.yellow(truncation)}`);
+    const finalHop = formatLatencyStats(tr.finalHopLatency ?? resp.finalHopLatency);
+    if (finalHop)
+        lines.push(`${label('Final hop:')}${finalHop}`);
+    const hops = Array.isArray(resp.hops) ? resp.hops : [];
+    if (hops.length > 0) {
+        lines.push('');
+        lines.push(heading('HOPS', 2, 'terminal'));
+        for (const hop of hops.slice(0, 40)) {
+            lines.push(`  ${formatTracerouteHop(hop)}`);
+        }
+        if (hops.length > 40) {
+            lines.push(chalk.dim(`  ... (${hops.length - 40} more hops)`));
+        }
+    }
+    const trDns = num(asObject(tr.timingPhases)?.dns);
+    if (trDns != null) {
+        lines.push('');
+        lines.push(heading('TIMING', 2, 'terminal'));
+        lines.push(`${label('DNS:')}${formatMs(trDns)}`);
+    }
+    appendAssertionsTerminal(lines, tr);
+    if (tr.requestError) {
+        lines.push('');
+        lines.push(heading('ERROR', 2, 'terminal'));
+        lines.push(chalk.red(`  ${tr.requestError}`));
+    }
+    return lines;
+}
+function formatTracerouteHop(hop) {
+    if (!hop || typeof hop !== 'object')
+        return String(hop);
+    const h = hop;
+    const n = num(h.hop_number, h.hopNumber, h.number, h.hop);
+    const addr = str(h.main_ip, h.mainIp, h.ip, h.address) ?? '*';
+    const host = str(h.main_host, h.mainHost, h.host);
+    const loss = num(h.loss_percentage, h.lossPercentage, h.loss);
+    const rtt = formatLatencyStats(h.rtt);
+    const asn = num(h.asn);
+    return [
+        n != null ? chalk.dim(String(n).padStart(2)) : chalk.dim(' ·'),
+        host ? `${addr} (${host})` : addr,
+        loss != null ? `loss ${loss.toFixed(0)}%` : null,
+        rtt ? `rtt ${rtt}` : null,
+        asn ? chalk.dim(`AS${asn}`) : null,
+    ].filter(Boolean).join('  ');
+}
+function formatTracerouteResultMd(tr) {
+    const lines = ['## Traceroute Result'];
+    const resp = tr.response ?? {};
+    const host = str(resp.hostname);
+    const ip = str(resp.resolvedIp);
+    if (host || ip)
+        lines.push(`- **Destination:** ${[host, ip ? `(${ip})` : null].filter(Boolean).join(' ')}`);
+    const probeProtocol = str(resp.probeProtocol);
+    if (probeProtocol)
+        lines.push(`- **Probe protocol:** ${probeProtocol}`);
+    const totalHops = num(tr.totalHops, resp.totalHops);
+    if (totalHops != null)
+        lines.push(`- **Hops:** ${totalHops}`);
+    const reached = boolFlag(tr.destinationReached, resp.destinationReached);
+    if (reached != null)
+        lines.push(`- **Reached:** ${reached ? 'yes' : 'no'}`);
+    const truncation = str(resp.truncationReason);
+    if (truncation)
+        lines.push(`- **Truncated:** ${truncation}`);
+    const finalHop = formatLatencyStats(tr.finalHopLatency ?? resp.finalHopLatency);
+    if (finalHop)
+        lines.push(`- **Final hop:** ${finalHop}`);
+    const trDns = num(asObject(tr.timingPhases)?.dns);
+    if (trDns != null) {
+        lines.push('');
+        lines.push('## Timing');
+        lines.push(`- **DNS:** ${formatMs(trDns)}`);
+    }
+    appendAssertionsMd(lines, tr);
+    if (tr.requestError) {
+        lines.push('');
+        lines.push('## Error');
+        lines.push(`- ${tr.requestError}`);
+    }
+    return lines;
+}
+// --- gRPC check result ---
+function formatGrpcResultTerminal(grpc) {
+    const lines = [];
+    const resp = grpc.response ?? {};
+    lines.push(heading('GRPC RESULT', 2, 'terminal'));
+    const host = str(resp.host);
+    const ip = str(resp.resolvedIp);
+    const port = num(resp.port);
+    if (host || ip || port != null) {
+        const target = [
+            host ?? ip,
+            port != null ? `:${port}` : '',
+        ].filter(Boolean).join('');
+        lines.push(`${label('Target:')}${target}`);
+    }
+    const method = str(resp.grpcMethod);
+    if (method)
+        lines.push(`${label('Method:')}${method}`);
+    const mode = str(resp.grpcMode);
+    if (mode)
+        lines.push(`${label('Mode:')}${mode}`);
+    const code = num(grpc.grpcStatusCode, resp.grpcStatusCode);
+    const statusMsg = str(resp.grpcStatusMessage);
+    if (code != null) {
+        const codeStr = code === 0 ? chalk.green(String(code)) : chalk.red(String(code));
+        lines.push(`${label('Status:')}${codeStr}${statusMsg ? ` ${statusMsg}` : ''}`);
+    }
+    const healthLabel = str(resp.healthStatusLabel);
+    const healthNum = num(grpc.healthStatus, resp.healthStatus);
+    if (healthLabel || healthNum != null) {
+        const display = healthLabel ?? String(healthNum);
+        const colored = healthLabel === 'SERVING' ? chalk.green(display) : chalk.red(display);
+        lines.push(`${label('Health:')}${colored}`);
+    }
+    const responseMessage = str(resp.responseMessage);
+    if (responseMessage)
+        lines.push(`${label('Response:')}${truncateSingleLine(responseMessage, 200)}`);
+    const methods = Array.isArray(resp.discoveredMethods) ? resp.discoveredMethods : [];
+    if (methods.length > 0) {
+        lines.push(`${label('Methods:')}${methods.slice(0, 20).join(', ')}${methods.length > 20 ? ', …' : ''}`);
+    }
+    const metadata = Array.isArray(resp.metadata) ? resp.metadata : [];
+    if (metadata.length > 0) {
+        lines.push(`${label('Metadata:')}`);
+        for (const entry of metadata.slice(0, 20)) {
+            lines.push(`  ${formatKeyValueEntry(entry)}`);
+        }
+    }
+    // Timing breakdown. gRPC exposes dns/connect/total (not the HTTP phases the
+    // API TIMING bar renders), so surface those directly for parity with the API
+    // result's timing detail instead of only the top-level total response time.
+    const timing = (grpc.timingPhases ?? resp.timingPhases);
+    const tDns = num(timing?.dns), tConnect = num(timing?.connect), tTotal = num(timing?.total);
+    if (tDns != null || tConnect != null || tTotal != null) {
+        lines.push('');
+        lines.push(heading('TIMING', 2, 'terminal'));
+        if (tDns != null)
+            lines.push(`${label('DNS:')}${formatMs(tDns)}`);
+        if (tConnect != null)
+            lines.push(`${label('Connect:')}${formatMs(tConnect)}`);
+        if (tTotal != null)
+            lines.push(`${label('Total:')}${formatMs(tTotal)}`);
+    }
+    appendAssertionsTerminal(lines, grpc);
+    if (grpc.requestError) {
+        lines.push('');
+        lines.push(heading('ERROR', 2, 'terminal'));
+        lines.push(chalk.red(`  ${grpc.requestError}`));
+    }
+    return lines;
+}
+function formatKeyValueEntry(entry) {
+    if (!entry || typeof entry !== 'object')
+        return String(entry);
+    const e = entry;
+    const key = str(e.key, e.name) ?? '(key)';
+    const value = e.value != null ? String(e.value) : '';
+    return `${chalk.dim(key + ':')} ${value}`;
+}
+function formatGrpcResultMd(grpc) {
+    const lines = ['## gRPC Result'];
+    const resp = grpc.response ?? {};
+    const code = num(grpc.grpcStatusCode, resp.grpcStatusCode);
+    const statusMsg = str(resp.grpcStatusMessage);
+    if (code != null)
+        lines.push(`- **Status:** ${code}${statusMsg ? ` ${statusMsg}` : ''}`);
+    const healthLabel = str(resp.healthStatusLabel);
+    if (healthLabel)
+        lines.push(`- **Health:** ${healthLabel}`);
+    const method = str(resp.grpcMethod);
+    if (method)
+        lines.push(`- **Method:** ${method}`);
+    const responseMessage = str(resp.responseMessage);
+    if (responseMessage)
+        lines.push(`- **Response:** \`${truncateSingleLine(responseMessage, 200)}\``);
+    const methods = Array.isArray(resp.discoveredMethods) ? resp.discoveredMethods : [];
+    if (methods.length > 0)
+        lines.push(`- **Discovered methods:** ${methods.join(', ')}`);
+    const timing = (grpc.timingPhases ?? resp.timingPhases);
+    const tDns = num(timing?.dns), tConnect = num(timing?.connect), tTotal = num(timing?.total);
+    if (tDns != null || tConnect != null || tTotal != null) {
+        lines.push('');
+        lines.push('## Timing');
+        lines.push('| Phase | Duration |');
+        lines.push('| --- | --- |');
+        if (tDns != null)
+            lines.push(`| DNS | ${formatMs(tDns)} |`);
+        if (tConnect != null)
+            lines.push(`| Connect | ${formatMs(tConnect)} |`);
+        if (tTotal != null)
+            lines.push(`| **Total** | **${formatMs(tTotal)}** |`);
+    }
+    appendAssertionsMd(lines, grpc);
+    if (grpc.requestError) {
+        lines.push('');
+        lines.push('## Error');
+        lines.push(`- ${grpc.requestError}`);
+    }
+    return lines;
+}
+// --- SSL check result ---
+// SSL security-baseline rules, in display order, mapped to humanized labels.
+// Each rule in `response.securityBaseline` is `{ violated, severity }`: a
+// non-violated rule renders as a pass, a violated one as a fail, with the
+// configured enforcement severity (fail / warn / ignore) shown alongside.
+const SSL_BASELINE_RULES = [
+    ['minTLSVersion', 'min TLS version'],
+    ['minKeySizeBits', 'min key size'],
+    ['weakSignatureAlgorithm', 'weak signature algorithm'],
+    ['weakCipherSuite', 'weak cipher suite'],
+    ['knownBadCA', 'known bad CA'],
+    ['recommendedTLSVersion', 'recommended TLS version'],
+    ['recommendedKeySizeBits', 'recommended key size'],
+    ['ocspMustStapleRespected', 'OCSP must-staple respected'],
+    ['sctPresent', 'SCT present'],
+];
+// Join SANs with a cap so a wildcard cert with dozens of names stays readable.
+function formatSans(sans) {
+    if (!Array.isArray(sans))
+        return undefined;
+    const list = sans.filter((s) => typeof s === 'string' && s.length > 0);
+    if (list.length === 0)
+        return undefined;
+    const cap = 10;
+    if (list.length <= cap)
+        return list.join(', ');
+    return `${list.slice(0, cap).join(', ')}, +${list.length - cap} more`;
+}
+function asObject(value) {
+    return value && typeof value === 'object' ? value : undefined;
+}
+function appendSslCertificateTerminal(lines, resp) {
+    const cert = asObject(resp.certificate);
+    const ocspStapled = boolFlag(resp.ocspStapled);
+    const body = [];
+    if (cert) {
+        const subjectCN = str(cert.subjectCN);
+        if (subjectCN)
+            body.push(`${label('Subject CN:')}${subjectCN}`);
+        const issuerCN = str(cert.issuerCN);
+        if (issuerCN)
+            body.push(`${label('Issuer CN:')}${issuerCN}`);
+        const notBefore = str(cert.notBefore);
+        const notAfter = str(cert.notAfter);
+        if (notBefore || notAfter)
+            body.push(`${label('Valid:')}${[notBefore, notAfter].filter(Boolean).join(' → ')}`);
+        const keyAlgorithm = str(cert.keyAlgorithm);
+        const keySizeBits = num(cert.keySizeBits);
+        if (keyAlgorithm || keySizeBits != null) {
+            body.push(`${label('Key:')}${[keyAlgorithm, keySizeBits != null ? `${keySizeBits}-bit` : null].filter(Boolean).join(' ')}`);
+        }
+        const signatureAlgorithm = str(cert.signatureAlgorithm);
+        if (signatureAlgorithm)
+            body.push(`${label('Signature:')}${signatureAlgorithm}`);
+        const fingerprint = str(cert.fingerprintSha256);
+        if (fingerprint)
+            body.push(`${label('SHA-256:')}${fingerprint}`);
+        const sans = formatSans(cert.sans);
+        if (sans)
+            body.push(`${label('SANs:')}${sans}`);
+        const serial = str(cert.serialNumber);
+        if (serial)
+            body.push(`${label('Serial:')}${serial}`);
+        if (boolFlag(cert.selfSigned) === true)
+            body.push(`${label('Self-signed:')}${chalk.yellow('yes')}`);
+        if (boolFlag(cert.isCA) === true)
+            body.push(`${label('CA:')}yes`);
+    }
+    if (ocspStapled != null)
+        body.push(`${label('OCSP stapled:')}${yesNo(ocspStapled)}`);
+    if (body.length === 0)
+        return;
+    lines.push('');
+    lines.push(heading('CERTIFICATE', 2, 'terminal'));
+    lines.push(...body);
+}
+function appendSslCertificateMd(lines, resp) {
+    const cert = asObject(resp.certificate);
+    const ocspStapled = boolFlag(resp.ocspStapled);
+    const body = [];
+    if (cert) {
+        const subjectCN = str(cert.subjectCN);
+        if (subjectCN)
+            body.push(`- **Subject CN:** ${subjectCN}`);
+        const issuerCN = str(cert.issuerCN);
+        if (issuerCN)
+            body.push(`- **Issuer CN:** ${issuerCN}`);
+        const notBefore = str(cert.notBefore);
+        const notAfter = str(cert.notAfter);
+        if (notBefore || notAfter)
+            body.push(`- **Valid:** ${[notBefore, notAfter].filter(Boolean).join(' → ')}`);
+        const keyAlgorithm = str(cert.keyAlgorithm);
+        const keySizeBits = num(cert.keySizeBits);
+        if (keyAlgorithm || keySizeBits != null) {
+            body.push(`- **Key:** ${[keyAlgorithm, keySizeBits != null ? `${keySizeBits}-bit` : null].filter(Boolean).join(' ')}`);
+        }
+        const signatureAlgorithm = str(cert.signatureAlgorithm);
+        if (signatureAlgorithm)
+            body.push(`- **Signature:** ${signatureAlgorithm}`);
+        const fingerprint = str(cert.fingerprintSha256);
+        if (fingerprint)
+            body.push(`- **SHA-256:** \`${fingerprint}\``);
+        const sans = formatSans(cert.sans);
+        if (sans)
+            body.push(`- **SANs:** ${sans}`);
+        const serial = str(cert.serialNumber);
+        if (serial)
+            body.push(`- **Serial:** ${serial}`);
+        if (boolFlag(cert.selfSigned) === true)
+            body.push('- **Self-signed:** yes');
+        if (boolFlag(cert.isCA) === true)
+            body.push('- **CA:** yes');
+    }
+    if (ocspStapled != null)
+        body.push(`- **OCSP stapled:** ${ocspStapled ? 'yes' : 'no'}`);
+    if (body.length === 0)
+        return;
+    lines.push('');
+    lines.push('## Certificate');
+    lines.push(...body);
+}
+// Build the per-rule baseline breakdown as [symbol, humanLabel, severity, violated]
+// tuples so terminal and markdown can render the same rules with format-specific
+// styling. A rule that carries neither a `violated` flag nor a scalar value is
+// skipped.
+function sslBaselineRules(resp) {
+    const baseline = asObject(resp.securityBaseline);
+    if (!baseline)
+        return [];
+    const rules = [];
+    for (const [key, human] of SSL_BASELINE_RULES) {
+        const rule = baseline[key];
+        if (rule == null)
+            continue;
+        const obj = asObject(rule);
+        if (obj) {
+            const violated = boolFlag(obj.violated);
+            const severity = str(obj.severity);
+            if (violated == null && severity == null)
+                continue;
+            rules.push({ human, violated, severity });
+        }
+        else if (typeof rule === 'string' || typeof rule === 'number' || typeof rule === 'boolean') {
+            rules.push({ human, scalar: String(rule) });
+        }
+    }
+    return rules;
+}
+function appendSslBaselineTerminal(lines, resp) {
+    const rules = sslBaselineRules(resp);
+    if (rules.length === 0)
+        return;
+    lines.push('');
+    lines.push(heading('SECURITY BASELINE', 2, 'terminal'));
+    for (const rule of rules) {
+        if (rule.violated == null && rule.scalar == null) {
+            lines.push(`  ${chalk.dim('·')} ${rule.human}${rule.severity ? chalk.dim(` (${rule.severity})`) : ''}`);
+            continue;
+        }
+        if (rule.scalar != null) {
+            lines.push(`  ${chalk.dim('·')} ${rule.human}: ${rule.scalar}`);
+            continue;
+        }
+        const head = `${rule.violated ? assertionSymbols.error : assertionSymbols.success} ${rule.human}`;
+        const coloredHead = rule.violated ? chalk.red(head) : chalk.green(head);
+        lines.push(`  ${coloredHead}${rule.severity ? chalk.dim(` (${rule.severity})`) : ''}`);
+    }
+}
+function appendSslBaselineMd(lines, resp) {
+    const rules = sslBaselineRules(resp);
+    if (rules.length === 0)
+        return;
+    lines.push('');
+    lines.push('## Security Baseline');
+    for (const rule of rules) {
+        if (rule.scalar != null) {
+            lines.push(`- ${rule.human}: ${rule.scalar}`);
+            continue;
+        }
+        if (rule.violated == null) {
+            lines.push(`- ${rule.human}${rule.severity ? ` (${rule.severity})` : ''}`);
+            continue;
+        }
+        const sym = rule.violated ? assertionSymbols.error : assertionSymbols.success;
+        lines.push(`- ${sym} ${rule.human}${rule.severity ? ` (${rule.severity})` : ''}`);
+    }
+}
+function formatSslResultTerminal(ssl) {
+    const lines = [];
+    const resp = ssl.response ?? {};
+    lines.push(heading('SSL RESULT', 2, 'terminal'));
+    const ip = str(resp.resolvedIp);
+    if (ip)
+        lines.push(`${label('Resolved IP:')}${ip}`);
+    const tls = str(ssl.tlsVersion, resp.protocol);
+    const cipher = str(ssl.cipherSuite, resp.cipherSuite);
+    if (tls || cipher)
+        lines.push(`${label('TLS:')}${[tls, cipher].filter(Boolean).join(' / ')}`);
+    const days = num(ssl.daysUntilExpiry, resp.daysUntilExpiry);
+    if (days != null) {
+        const text = days < 0 ? `expired ${-days} day(s) ago` : `${days} day(s)`;
+        lines.push(`${label('Expires in:')}${days <= 0 ? chalk.red(text) : days < 14 ? chalk.yellow(text) : chalk.green(text)}`);
+    }
+    const handshake = num(ssl.handshakeTimeMs, resp.handshakeTimeMs);
+    if (handshake != null)
+        lines.push(`${label('Handshake:')}${formatMs(handshake)}`);
+    const chainTrusted = boolFlag(ssl.chainTrusted, resp.chainTrusted);
+    if (chainTrusted != null)
+        lines.push(`${label('Chain trusted:')}${yesNo(chainTrusted)}`);
+    const hostnameVerified = boolFlag(ssl.hostnameVerified, resp.hostnameVerified);
+    if (hostnameVerified != null)
+        lines.push(`${label('Hostname:')}${yesNo(hostnameVerified)}`);
+    const verdict = str(ssl.baselineVerdict);
+    const grade = str(ssl.baselineGrade);
+    if (verdict || grade) {
+        const verdictStr = verdict ? (verdict === 'PASS' ? chalk.green(verdict) : chalk.red(verdict)) : '';
+        lines.push(`${label('Baseline:')}${[verdictStr, grade ? `grade ${grade}` : ''].filter(Boolean).join(' ')}`);
+    }
+    const failure = str(ssl.failureCategory);
+    if (failure)
+        lines.push(`${label('Failure:')}${chalk.red(failure)}`);
+    appendSslCertificateTerminal(lines, resp);
+    appendSslBaselineTerminal(lines, resp);
+    appendAssertionsTerminal(lines, ssl);
+    if (ssl.requestError) {
+        lines.push('');
+        lines.push(heading('ERROR', 2, 'terminal'));
+        lines.push(chalk.red(`  ${ssl.requestError}`));
+    }
+    return lines;
+}
+function formatSslResultMd(ssl) {
+    const lines = ['## SSL Result'];
+    const resp = ssl.response ?? {};
+    const tls = str(ssl.tlsVersion, resp.protocol);
+    const cipher = str(ssl.cipherSuite, resp.cipherSuite);
+    if (tls || cipher)
+        lines.push(`- **TLS:** ${[tls, cipher].filter(Boolean).join(' / ')}`);
+    const days = num(ssl.daysUntilExpiry, resp.daysUntilExpiry);
+    if (days != null)
+        lines.push(`- **Expires in:** ${days < 0 ? `expired ${-days} day(s) ago` : `${days} day(s)`}`);
+    const handshake = num(ssl.handshakeTimeMs, resp.handshakeTimeMs);
+    if (handshake != null)
+        lines.push(`- **Handshake:** ${formatMs(handshake)}`);
+    const chainTrusted = boolFlag(ssl.chainTrusted, resp.chainTrusted);
+    if (chainTrusted != null)
+        lines.push(`- **Chain trusted:** ${chainTrusted ? 'yes' : 'no'}`);
+    const hostnameVerified = boolFlag(ssl.hostnameVerified, resp.hostnameVerified);
+    if (hostnameVerified != null)
+        lines.push(`- **Hostname verified:** ${hostnameVerified ? 'yes' : 'no'}`);
+    const verdict = str(ssl.baselineVerdict);
+    const grade = str(ssl.baselineGrade);
+    if (verdict || grade)
+        lines.push(`- **Baseline:** ${[verdict, grade ? `grade ${grade}` : ''].filter(Boolean).join(' ')}`);
+    const failure = str(ssl.failureCategory);
+    if (failure)
+        lines.push(`- **Failure:** ${failure}`);
+    appendSslCertificateMd(lines, resp);
+    appendSslBaselineMd(lines, resp);
+    appendAssertionsMd(lines, ssl);
+    if (ssl.requestError) {
+        lines.push('');
+        lines.push('## Error');
+        lines.push(`- ${ssl.requestError}`);
+    }
+    return lines;
+}
 // --- Shared internal helpers ---
 function colorStatus(code) {
     if (code >= 200 && code < 300)