coverme-security-scanner 3.0.0 → 3.2.0

package/dist/pdf/generator.js

@@ -0,0 +1,1235 @@
+import PDFDocument from 'pdfkit';
+import { createWriteStream } from 'fs';
+import { colors, fonts, spacing, layout } from './styles.js';
+export class PDFGenerator {
+    doc;
+    y = spacing.page.top;
+    pageCount = 1;
+    constructor() {
+        this.doc = new PDFDocument({
+            size: 'A4',
+            margins: {
+                top: spacing.page.top,
+                bottom: spacing.page.bottom,
+                left: spacing.page.margin,
+                right: spacing.page.margin,
+            },
+            bufferPages: true,
+            autoFirstPage: true,
+        });
+    }
+    newPage() {
+        this.doc.addPage();
+        this.pageCount++;
+        this.y = spacing.page.top;
+    }
+    async generate(report, outputPath) {
+        return new Promise((resolve, reject) => {
+            const stream = createWriteStream(outputPath);
+            this.doc.pipe(stream);
+            this.renderCoverPage(report);
+            this.renderTableOfContents(report);
+            this.renderExecutiveSummary(report);
+            if (report.architecture) {
+                this.renderArchitecture(report);
+            }
+            if (report.network) {
+                this.renderNetwork(report);
+            }
+            if (report.attackChains?.length) {
+                this.renderAttackChains(report);
+            }
+            if (report.riskMatrix?.length) {
+                this.renderRiskMatrix(report);
+            }
+            this.renderFindings(report);
+            if (report.threatModel?.length) {
+                this.renderThreatModel(report);
+            }
+            if (report.positiveObservations?.length) {
+                this.renderPositiveObservations(report);
+            }
+            if (report.remediation) {
+                this.renderRemediation(report);
+            }
+            if (report.complianceMapping?.length) {
+                this.renderComplianceMapping(report);
+            }
+            if (report.qualityReview) {
+                this.renderQualityReview(report);
+            }
+            if (report.resolvedIssues?.length) {
+                this.renderResolvedIssues(report);
+            }
+            if (report.privacyAnalysis?.length) {
+                this.renderPrivacyAnalysis(report);
+            }
+            // Summary page at the end
+            this.renderSummaryPage(report);
+            // Add page numbers and footers to all pages
+            this.addPageNumbersAndFooters();
+            this.doc.end();
+            stream.on('finish', resolve);
+            stream.on('error', reject);
+        });
+    }
+    // ─────────────────────────────────────────────────────────────────
+    // Cover Page
+    // ─────────────────────────────────────────────────────────────────
+    renderCoverPage(report) {
+        this.y = 200;
+        // Title
+        this.doc
+            .font(fonts.weights.bold)
+            .fontSize(fonts.sizes.title)
+            .fillColor(colors.text.primary)
+            .text('Security Assessment Report', spacing.page.margin, this.y, {
+            align: 'center',
+            width: layout.content.width,
+        });
+        this.y += 50;
+        // Project name
+        this.doc
+            .font(fonts.weights.normal)
+            .fontSize(fonts.sizes.h1)
+            .fillColor(colors.text.secondary)
+            .text(report.project, spacing.page.margin, this.y, {
+            align: 'center',
+            width: layout.content.width,
+        });
+        this.y += 80;
+        // Summary boxes
+        this.renderSeverityBoxes(report.summary);
+        this.y += 100;
+        // Metadata
+        this.renderMetadata(report);
+        this.newPage();
+        this.y = spacing.page.top;
+    }
+    renderSeverityBoxes(summary) {
+        const boxWidth = 90;
+        const boxHeight = 50;
+        const gap = 20;
+        const totalWidth = (boxWidth * 4) + (gap * 3);
+        const startX = (layout.page.width - totalWidth) / 2;
+        const boxes = [
+            { label: 'CRITICAL', count: summary.critical, severity: 'critical' },
+            { label: 'HIGH', count: summary.high, severity: 'high' },
+            { label: 'MEDIUM', count: summary.medium, severity: 'medium' },
+            { label: 'LOW', count: summary.low, severity: 'low' },
+        ];
+        boxes.forEach((box, i) => {
+            const x = startX + (i * (boxWidth + gap));
+            const style = colors.severity[box.severity];
+            // Box with subtle border
+            this.doc
+                .rect(x, this.y, boxWidth, boxHeight)
+                .stroke(colors.border);
+            // Count in severity color
+            this.doc
+                .font(fonts.weights.bold)
+                .fontSize(22)
+                .fillColor(style.text)
+                .text(box.count.toString(), x, this.y + 8, {
+                width: boxWidth,
+                align: 'center',
+            });
+            // Label
+            this.doc
+                .font(fonts.weights.normal)
+                .fontSize(fonts.sizes.small)
+                .fillColor(colors.text.secondary)
+                .text(box.label, x, this.y + 32, {
+                width: boxWidth,
+                align: 'center',
+            });
+        });
+    }
+    renderMetadata(report) {
+        const metadata = [
+            { label: 'Date', value: report.date },
+            { label: 'Branch', value: report.branch || 'main' },
+            { label: 'Scope', value: report.scope || 'Full codebase' },
+        ];
+        const startX = layout.page.width / 2 - 100;
+        metadata.forEach((item, i) => {
+            this.doc
+                .font(fonts.weights.normal)
+                .fontSize(fonts.sizes.body)
+                .fillColor(colors.text.muted)
+                .text(item.label, startX, this.y + (i * 20), { continued: true })
+                .font(fonts.weights.bold)
+                .fillColor(colors.text.secondary)
+                .text(`  ${item.value}`);
+        });
+    }
+    // ─────────────────────────────────────────────────────────────────
+    // Table of Contents
+    // ─────────────────────────────────────────────────────────────────
+    renderTableOfContents(report) {
+        this.sectionTitle('Table of Contents');
+        // Build items with descriptions
+        const items = [
+            {
+                title: 'Executive Summary',
+                description: `Overall risk: ${report.overallRiskLevel.toUpperCase()}, ${report.summary.total} findings`
+            },
+            ...(report.architecture ? [{
+                    title: 'Architecture Overview',
+                    description: `${report.architecture.components?.length || 0} components, ${report.architecture.trustBoundaries?.length || 0} trust boundaries`
+                }] : []),
+            ...(report.network ? [{
+                    title: 'Network Topology',
+                    description: `${report.network.ports?.length || 0} ports, ${report.network.externalDeps?.length || 0} external deps`
+                }] : []),
+            ...(report.attackChains?.length ? [{
+                    title: 'Attack Chains',
+                    description: `${report.attackChains.length} chains identified`
+                }] : []),
+            {
+                title: 'Security Findings',
+                description: this.getFindingsSummary(report)
+            },
+            ...(report.threatModel?.length ? [{
+                    title: 'Threat Model',
+                    description: `STRIDE + DREAD analysis, ${report.threatModel.length} threats`
+                }] : []),
+            ...(report.qualityReview ? [{
+                    title: 'Quality Review',
+                    description: this.getQualitySummary(report)
+                }] : []),
+            ...(report.resolvedIssues?.length ? [{
+                    title: 'Previously Resolved',
+                    description: `${report.resolvedIssues.length} issues resolved`
+                }] : []),
+            ...(report.positiveObservations?.length ? [{
+                    title: 'Positive Observations',
+                    description: `${report.positiveObservations.length} security strengths`
+                }] : []),
+            ...(report.privacyAnalysis?.length ? [{
+                    title: 'Privacy Analysis (LINDDUN)',
+                    description: `${report.privacyAnalysis.length} privacy considerations`
+                }] : []),
+            ...(report.remediation ? [{
+                    title: 'Remediation Roadmap',
+                    description: this.getRemediationSummary(report)
+                }] : []),
+            ...(report.complianceMapping?.length ? [{
+                    title: 'Compliance Mapping',
+                    description: report.complianceMapping.map(c => c.framework).join(', ')
+                }] : []),
+        ];
+        // Render each item with description
+        items.forEach((item, i) => {
+            this.doc
+                .font(fonts.weights.bold)
+                .fontSize(fonts.sizes.body)
+                .fillColor(colors.text.primary)
+                .text(`${i + 1}. ${item.title}`, spacing.page.margin, this.y, { continued: true })
+                .font(fonts.weights.normal)
+                .fillColor(colors.text.muted)
+                .text(` - ${item.description}`);
+            this.y += 18;
+        });
+        this.y += spacing.paragraph;
+        // Summary table
+        this.renderTocSummaryTable(report);
+        this.newPage();
+        this.y = spacing.page.top;
+    }
+    getFindingsSummary(report) {
+        const parts = [];
+        if (report.summary.critical)
+            parts.push(`${report.summary.critical} critical`);
+        if (report.summary.high)
+            parts.push(`${report.summary.high} high`);
+        if (report.summary.medium)
+            parts.push(`${report.summary.medium} medium`);
+        if (report.summary.low)
+            parts.push(`${report.summary.low} low`);
+        return parts.join(', ') || 'No findings';
+    }
+    getQualitySummary(report) {
+        const q = report.qualityReview;
+        if (!q)
+            return '';
+        const parts = [];
+        if (q.deadCode?.length)
+            parts.push(`${q.deadCode.length} dead code`);
+        if (q.dryViolations?.length)
+            parts.push(`${q.dryViolations.length} DRY`);
+        if (q.deprecated?.length)
+            parts.push(`${q.deprecated.length} deprecated`);
+        return parts.join(', ') || 'Clean';
+    }
+    getRemediationSummary(report) {
+        const r = report.remediation;
+        if (!r)
+            return '';
+        const counts = [
+            r.p0?.length || 0,
+            r.p1?.length || 0,
+            r.p2?.length || 0,
+            r.p3?.length || 0,
+        ];
+        return `P0: ${counts[0]}, P1: ${counts[1]}, P2: ${counts[2]}, P3: ${counts[3]}`;
+    }
+    renderTocSummaryTable(report) {
+        const data = [
+            ['Source Reports', report.methodology || '-'],
+            ['Findings', report.summary.total.toString()],
+            ['Quality Items', this.getQualitySummary(report) || '0'],
+            ['Threat Model', report.threatModel?.length.toString() || '0'],
+        ];
+        const startX = spacing.page.margin;
+        const colWidths = [150, 345];
+        const rowHeight = 22;
+        data.forEach((row, i) => {
+            // Alternating background
+            if (i % 2 === 0) {
+                this.doc
+                    .rect(startX, this.y, layout.content.width, rowHeight)
+                    .fill(colors.table.altRow);
+            }
+            this.doc
+                .font(fonts.weights.bold)
+                .fontSize(fonts.sizes.small)
+                .fillColor(colors.text.primary)
+                .text(row[0], startX + 8, this.y + 6, { width: colWidths[0] - 16 });
+            this.doc
+                .font(fonts.weights.normal)
+                .fontSize(fonts.sizes.small)
+                .fillColor(colors.text.secondary)
+                .text(row[1], startX + colWidths[0] + 8, this.y + 6, { width: colWidths[1] - 16 });
+            this.y += rowHeight;
+        });
+    }
+    // ─────────────────────────────────────────────────────────────────
+    // Executive Summary
+    // ─────────────────────────────────────────────────────────────────
+    renderExecutiveSummary(report) {
+        this.sectionTitle('Executive Summary');
+        // Risk level with color badge
+        const riskStyle = colors.severity[report.overallRiskLevel];
+        this.doc
+            .font(fonts.weights.bold)
+            .fontSize(fonts.sizes.body)
+            .fillColor(colors.text.primary)
+            .text('Overall Risk: ', spacing.page.margin, this.y, { continued: true })
+            .fillColor(riskStyle.text)
+            .text(report.overallRiskLevel.toUpperCase());
+        this.y += 24;
+        // Summary text
+        this.doc
+            .font(fonts.weights.normal)
+            .fontSize(fonts.sizes.body)
+            .fillColor(colors.text.primary)
+            .text(report.executiveSummary, spacing.page.margin, this.y, {
+            width: layout.content.width,
+            lineGap: 4,
+        });
+        this.y = this.doc.y + spacing.paragraph;
+        // Previously resolved section (if exists)
+        if (report.resolvedIssues?.length) {
+            this.y += 8;
+            this.doc
+                .font(fonts.weights.bold)
+                .fontSize(fonts.sizes.small)
+                .fillColor(colors.severity.low.text)
+                .text('Previously Resolved:', spacing.page.margin, this.y);
+            this.y += 14;
+            const resolvedText = report.resolvedIssues
+                .slice(0, 3)
+                .map(r => `${r.id}: ${r.title}`)
+                .join(', ');
+            this.doc
+                .font(fonts.weights.normal)
+                .fontSize(fonts.sizes.body)
+                .fillColor(colors.text.secondary)
+                .text(resolvedText + (report.resolvedIssues.length > 3 ? ` (+${report.resolvedIssues.length - 3} more)` : ''), spacing.page.margin, this.y, {
+                width: layout.content.width,
+            });
+            this.y = this.doc.y + spacing.paragraph;
+        }
+        // Most significant issues callout
+        const criticalFindings = report.findings.filter(f => f.severity === 'critical');
+        if (criticalFindings.length > 0) {
+            this.y += 8;
+            this.doc
+                .font(fonts.weights.bold)
+                .fontSize(fonts.sizes.small)
+                .fillColor(colors.severity.critical.text)
+                .text('Most Significant Issues:', spacing.page.margin, this.y);
+            this.y += 14;
+            criticalFindings.slice(0, 3).forEach(f => {
+                this.doc
+                    .font(fonts.weights.normal)
+                    .fontSize(fonts.sizes.body)
+                    .fillColor(colors.text.primary)
+                    .text(`[${f.id}] ${f.title}`, spacing.page.margin, this.y);
+                this.y += 14;
+            });
+        }
+        this.y += spacing.paragraph;
+        // Top priorities table
+        if (report.topPriorities?.length) {
+            this.subTitle('Top Priorities');
+            this.renderSimpleTable(['#', 'Finding', 'Severity', 'Action'], report.topPriorities.map((p, i) => [
+                (i + 1).toString(),
+                p.finding,
+                p.severity.toUpperCase(),
+                p.action,
+            ]), [30, 200, 70, 195]);
+        }
+        this.checkPageBreak();
+    }
+    // ─────────────────────────────────────────────────────────────────
+    // Architecture
+    // ─────────────────────────────────────────────────────────────────
+    renderArchitecture(report) {
+        this.newPage();
+        this.y = spacing.page.top;
+        this.sectionTitle('Architecture Overview');
+        if (report.architecture?.overview) {
+            this.doc
+                .font(fonts.weights.normal)
+                .fontSize(fonts.sizes.body)
+                .fillColor(colors.text.primary)
+                .text(report.architecture.overview, spacing.page.margin, this.y, {
+                width: layout.content.width,
+                lineGap: 4,
+            });
+            this.y = this.doc.y + spacing.paragraph;
+        }
+        if (report.architecture?.components?.length) {
+            this.subTitle('Components');
+            this.renderSimpleTable(['Component', 'Technology', 'Description'], report.architecture.components.map(c => [c.name, c.technology, c.description]), [100, 150, 245]);
+        }
+        // Trust Boundaries
+        if (report.architecture?.trustBoundaries?.length) {
+            this.checkPageBreak(150);
+            this.subTitle('Trust Boundaries');
+            report.architecture.trustBoundaries.forEach(tb => {
+                this.checkPageBreak(60);
+                // TB-ID with colored badge based on trust level
+                const trustColor = tb.trustLevel === 'untrusted' ? colors.severity.critical.text :
+                    tb.trustLevel === 'semi-trusted' ? colors.severity.medium.text :
+                        colors.severity.low.text;
+                this.doc
+                    .font(fonts.weights.bold)
+                    .fontSize(fonts.sizes.body)
+                    .fillColor(colors.accent)
+                    .text(tb.id, spacing.page.margin, this.y, { continued: true })
+                    .fillColor(colors.text.primary)
+                    .text(` ${tb.boundary}`, { continued: true })
+                    .font(fonts.weights.normal)
+                    .fillColor(trustColor)
+                    .text(` [${tb.trustLevel.toUpperCase()}]`);
+                this.y += 14;
+                this.doc
+                    .font(fonts.weights.normal)
+                    .fontSize(fonts.sizes.small)
+                    .fillColor(colors.text.secondary)
+                    .text(tb.description, spacing.page.margin + 20, this.y);
+                this.y += 18;
+            });
+        }
+        this.checkPageBreak();
+    }
+    // ─────────────────────────────────────────────────────────────────
+    // Network
+    // ─────────────────────────────────────────────────────────────────
+    renderNetwork(report) {
+        this.newPage();
+        this.y = spacing.page.top;
+        this.sectionTitle('Network Topology');
+        // ASCII diagram
+        if (report.network?.diagram) {
+            this.doc
+                .font(fonts.mono)
+                .fontSize(7)
+                .fillColor(colors.text.secondary)
+                .text(report.network.diagram, spacing.page.margin, this.y, {
+                width: layout.content.width,
+            });
+            this.y = this.doc.y + spacing.section;
+        }
+        // Ports table
+        if (report.network?.ports?.length) {
+            this.subTitle('Port Reference');
+            this.renderSimpleTable(['Port', 'Protocol', 'Component', 'Binding', 'Purpose'], report.network.ports.map(p => [
+                p.port.toString(),
+                p.protocol,
+                p.component,
+                p.binding,
+                p.purpose,
+            ]), [40, 50, 100, 70, 235]);
+        }
+        this.checkPageBreak();
+    }
+    // ─────────────────────────────────────────────────────────────────
+    // Attack Chains
+    // ─────────────────────────────────────────────────────────────────
+    renderAttackChains(report) {
+        this.newPage();
+        this.y = spacing.page.top;
+        this.sectionTitle('Attack Chains');
+        this.doc
+            .font(fonts.weights.normal)
+            .fontSize(fonts.sizes.body)
+            .fillColor(colors.text.secondary)
+            .text('These attack chains show how individual vulnerabilities can be combined for greater impact.', spacing.page.margin, this.y, {
+            width: layout.content.width,
+        });
+        this.y = this.doc.y + spacing.paragraph;
+        report.attackChains?.forEach((chain, idx) => {
+            this.checkPageBreak(200);
+            this.renderAttackChain(chain, idx + 1);
+        });
+    }
+    renderAttackChain(chain, num) {
+        // Calculate minimum height for header + description
+        const descHeight = this.estimateTextHeight(chain.description, layout.content.width);
+        const headerHeight = 32 + descHeight + 20;
+        this.checkPageBreak(headerHeight);
+        // Simple header line
+        this.doc
+            .font(fonts.weights.bold)
+            .fontSize(fonts.sizes.h3)
+            .fillColor(colors.text.primary)
+            .text(`AC-${num.toString().padStart(2, '0')}: ${chain.name}`, spacing.page.margin, this.y);
+        this.y += 16;
+        // Likelihood/Impact as simple text with color
+        const impactStyle = colors.severity[chain.impact] || colors.severity.high;
+        this.doc
+            .font(fonts.weights.normal)
+            .fontSize(fonts.sizes.small)
+            .fillColor(colors.text.secondary)
+            .text('Likelihood: ', spacing.page.margin, this.y, { continued: true })
+            .fillColor(impactStyle.text)
+            .text(chain.likelihood.toUpperCase(), { continued: true })
+            .fillColor(colors.text.secondary)
+            .text(' | Impact: ', { continued: true })
+            .fillColor(impactStyle.text)
+            .text(chain.impact.toUpperCase());
+        this.y += 16;
+        // Description
+        this.doc
+            .font(fonts.weights.normal)
+            .fontSize(fonts.sizes.body)
+            .fillColor(colors.text.primary)
+            .text(chain.description, spacing.page.margin, this.y, {
+            width: layout.content.width,
+            lineGap: 3,
+        });
+        this.y = this.doc.y + spacing.paragraph;
+        // Attack steps - simple list
+        this.renderAttackSteps(chain.steps);
+        // Mitigation strategy - keep together
+        if (chain.mitigationStrategy) {
+            const mitigationHeight = this.estimateTextHeight(chain.mitigationStrategy, layout.content.width) + 20;
+            this.checkPageBreak(mitigationHeight);
+            this.doc
+                .font(fonts.weights.bold)
+                .fontSize(fonts.sizes.small)
+                .fillColor(colors.severity.low.text)
+                .text('Mitigation:', spacing.page.margin, this.y);
+            this.y += 12;
+            this.doc
+                .font(fonts.weights.normal)
+                .fontSize(fonts.sizes.body)
+                .fillColor(colors.text.secondary)
+                .text(chain.mitigationStrategy, spacing.page.margin, this.y, {
+                width: layout.content.width,
+            });
+            this.y = this.doc.y + 8;
+        }
+        this.y += spacing.section;
+    }
+    renderAttackSteps(steps) {
+        steps.forEach((step, idx) => {
+            // Keep step together (action + outcome)
+            const stepHeight = 35;
+            this.checkPageBreak(stepHeight);
+            // Step with finding ID in accent color
+            this.doc
+                .font(fonts.weights.bold)
+                .fontSize(fonts.sizes.body)
+                .fillColor(colors.text.primary)
+                .text(`${step.order}. `, spacing.page.margin, this.y, { continued: true })
+                .fillColor(colors.accent)
+                .text(`[${step.findingId}]`, { continued: true })
+                .fillColor(colors.text.primary)
+                .text(` ${step.action}`);
+            this.y += 14;
+            this.doc
+                .font(fonts.weights.normal)
+                .fontSize(fonts.sizes.small)
+                .fillColor(colors.text.secondary)
+                .text(`   Outcome: ${step.outcome}`, spacing.page.margin, this.y);
+            this.y += 16;
+        });
+    }
+    // ─────────────────────────────────────────────────────────────────
+    // Risk Matrix
+    // ─────────────────────────────────────────────────────────────────
+    renderRiskMatrix(report) {
+        this.checkPageBreak(200);
+        this.subTitle('Risk by Category');
+        const matrix = report.riskMatrix || [];
+        this.renderSimpleTable(['Category', 'Current Risk', 'After Fixes', 'Trend'], matrix.map(r => [
+            r.category,
+            r.currentRisk.toUpperCase(),
+            r.residualRisk.toUpperCase(),
+            this.getTrendIndicator(r.trend),
+        ]), [150, 100, 100, 145]);
+        this.y += spacing.paragraph;
+    }
+    getTrendIndicator(trend) {
+        switch (trend) {
+            case 'improving': return '↑ Improving';
+            case 'worsening': return '↓ Worsening';
+            default: return '→ Stable';
+        }
+    }
+    // ─────────────────────────────────────────────────────────────────
+    // Findings
+    // ─────────────────────────────────────────────────────────────────
+    renderFindings(report) {
+        const severities = ['critical', 'high', 'medium', 'low'];
+        severities.forEach(severity => {
+            const findings = report.findings.filter(f => f.severity === severity);
+            if (!findings.length)
+                return;
+            this.newPage();
+            this.y = spacing.page.top;
+            this.sectionTitle(`${severity.toUpperCase()} Findings`);
+            findings.forEach(finding => {
+                this.renderFinding(finding);
+            });
+        });
+    }
+    renderFinding(finding) {
+        this.checkPageBreak(150);
+        const boxPadding = 12;
+        const boxInnerWidth = layout.content.width - (boxPadding * 2);
+        const style = colors.severity[finding.severity];
+        // ID in severity color, title in black
+        this.doc
+            .font(fonts.weights.bold)
+            .fontSize(fonts.sizes.body)
+            .fillColor(style.text)
+            .text(`[${finding.id}]`, spacing.page.margin, this.y, { continued: true })
+            .fillColor(colors.text.primary)
+            .text(` ${finding.title}`);
+        this.y += 18;
+        // Cross-references and DREAD score line
+        const hasRefs = finding.relatedFindings?.length || finding.dreadScore || finding.cwe;
+        if (hasRefs) {
+            const parts = [];
+            if (finding.dreadScore)
+                parts.push(`DREAD: ${finding.dreadScore.toFixed(1)}`);
+            if (finding.cwe)
+                parts.push(finding.cwe);
+            if (finding.relatedFindings?.length) {
+                parts.push(`Related: ${finding.relatedFindings.join(', ')}`);
+            }
+            this.doc
+                .font(fonts.weights.normal)
+                .fontSize(fonts.sizes.small)
+                .fillColor(colors.text.muted)
+                .text(parts.join(' | '), spacing.page.margin, this.y);
+            this.y += 14;
+        }
+        // File reference (if present)
+        if (finding.file) {
+            this.doc
+                .font(fonts.mono)
+                .fontSize(fonts.sizes.small)
+                .fillColor(colors.accent)
+                .text(`${finding.file}${finding.line ? `:${finding.line}` : ''}`, spacing.page.margin, this.y);
+            this.y += 18;
+        }
+        // ─────────────────────────────────────────────────────────────
+        // Check for structured format (issue/why/fix) vs legacy format
+        // ─────────────────────────────────────────────────────────────
+        const hasStructuredFormat = finding.issue || finding.why || finding.fix;
+        if (hasStructuredFormat) {
+            // Render structured code-box style
+            this.renderStructuredFinding(finding, boxPadding, boxInnerWidth);
+        }
+        else {
+            // Render legacy format
+            this.renderLegacyFinding(finding);
+        }
+        this.y += spacing.section;
+    }
+    // Clean structured finding
+    renderStructuredFinding(finding, padding, innerWidth) {
+        // Calculate heights to keep sections together
+        const issueHeight = finding.issue ? this.estimateTextHeight(finding.issue, layout.content.width) + 22 : 0;
+        const whyHeight = finding.why ? this.estimateTextHeight(finding.why, layout.content.width) + 22 : 0;
+        const fixHeight = finding.fix ? this.estimateTextHeight(finding.fix, layout.content.width) + 22 : 0;
+        // Issue
+        if (finding.issue) {
+            this.checkPageBreak(issueHeight);
+            this.doc
+                .font(fonts.weights.bold)
+                .fontSize(fonts.sizes.small)
+                .fillColor(colors.text.primary)
+                .text('Issue:', spacing.page.margin, this.y);
+            this.y += 12;
+            this.doc
+                .font(fonts.weights.normal)
+                .fontSize(fonts.sizes.body)
+                .fillColor(colors.text.primary)
+                .text(finding.issue, spacing.page.margin, this.y, {
+                width: layout.content.width,
+                lineGap: 3,
+            });
+            this.y = this.doc.y + 10;
+        }
+        // Why
+        if (finding.why) {
+            this.checkPageBreak(whyHeight);
+            this.doc
+                .font(fonts.weights.bold)
+                .fontSize(fonts.sizes.small)
+                .fillColor(colors.text.primary)
+                .text('Why:', spacing.page.margin, this.y);
+            this.y += 12;
+            this.doc
+                .font(fonts.weights.normal)
+                .fontSize(fonts.sizes.body)
+                .fillColor(colors.text.secondary)
+                .text(finding.why, spacing.page.margin, this.y, {
+                width: layout.content.width,
+                lineGap: 3,
+            });
+            this.y = this.doc.y + 10;
+        }
+        // Fix
+        if (finding.fix) {
+            this.checkPageBreak(fixHeight);
+            this.doc
+                .font(fonts.weights.bold)
+                .fontSize(fonts.sizes.small)
+                .fillColor(colors.text.primary)
+                .text('Fix:', spacing.page.margin, this.y);
+            this.y += 12;
+            this.doc
+                .font(fonts.weights.normal)
+                .fontSize(fonts.sizes.body)
+                .fillColor(colors.text.secondary)
+                .text(finding.fix, spacing.page.margin, this.y, {
+                width: layout.content.width,
+                lineGap: 3,
+            });
+            this.y = this.doc.y + 10;
+        }
+        // Code evidence (if present)
+        if (finding.codeEvidence?.length) {
+            this.y += 4;
+            finding.codeEvidence.forEach(evidence => {
+                this.renderCodeEvidence(evidence);
+            });
+        }
+        // Proof of concept (if present)
+        if (finding.proofOfConcept) {
+            this.y += 4;
+            this.renderProofOfConcept(finding.proofOfConcept);
+        }
+    }
+    // Estimate text height for page break calculations
+    estimateTextHeight(text, width) {
+        const avgCharsPerLine = width / 5; // rough estimate for 10pt font
+        const lines = Math.ceil(text.length / avgCharsPerLine);
+        return lines * 14 + 10; // 14px per line + padding
+    }
+    renderCodeEvidence(evidence) {
+        // Calculate total height needed for code block + annotation
+        const codeLines = evidence.code.split('\n');
+        const lineHeight = 12;
+        const codeHeight = Math.min(codeLines.length * lineHeight + 12, 120);
+        const annotationHeight = evidence.annotation ? 20 : 0;
+        const totalHeight = 14 + codeHeight + annotationHeight + 10; // file path + code + annotation + padding
+        this.checkPageBreak(totalHeight);
+        // File path
+        this.doc
+            .font(fonts.mono)
+            .fontSize(fonts.sizes.small)
+            .fillColor(colors.text.muted)
+            .text(`${evidence.file}:${evidence.startLine}${evidence.endLine ? `-${evidence.endLine}` : ''}`, spacing.page.margin, this.y);
+        this.y += 14;
+        // Code block - simple gray background
+        this.doc
+            .rect(spacing.page.margin, this.y, layout.content.width, codeHeight)
+            .fill(colors.accentMuted);
+        let codeY = this.y + 6;
+        codeLines.forEach((line, idx) => {
+            if (codeY > this.y + codeHeight - lineHeight)
+                return;
+            const lineNum = evidence.startLine + idx;
+            // Line number
+            this.doc
+                .font(fonts.mono)
+                .fontSize(8)
+                .fillColor(colors.text.muted)
+                .text(lineNum.toString().padStart(4, ' '), spacing.page.margin + 6, codeY);
+            // Code
+            this.doc
+                .font(fonts.mono)
+                .fontSize(8)
+                .fillColor(colors.text.primary)
+                .text(line.slice(0, 80), spacing.page.margin + 40, codeY);
+            codeY += lineHeight;
+        });
+        this.y += codeHeight + 4;
+        // Annotation (if present)
+        if (evidence.annotation) {
+            this.doc
+                .font(fonts.weights.normal)
+                .fontSize(fonts.sizes.small)
+                .fillColor(colors.text.secondary)
+                .text('Note: ' + evidence.annotation, spacing.page.margin, this.y);
+            this.y += 14;
+        }
+    }
+    renderProofOfConcept(poc) {
+        this.checkPageBreak(30);
+        this.doc
+            .font(fonts.weights.bold)
+            .fontSize(fonts.sizes.small)
+            .fillColor(colors.text.primary)
+            .text('Proof of Concept:', spacing.page.margin, this.y);
+        this.y += 12;
+        this.doc
+            .font(fonts.mono)
+            .fontSize(8)
+            .fillColor(colors.text.secondary)
+            .text(poc, spacing.page.margin, this.y, {
+            width: layout.content.width,
+        });
+        this.y = this.doc.y + 8;
+    }
+    // Legacy format rendering (description + impact + recommendation)
+    renderLegacyFinding(finding) {
+        // Description
+        if (finding.description) {
+            this.doc
+                .font(fonts.weights.normal)
+                .fontSize(fonts.sizes.body)
+                .fillColor(colors.text.primary)
+                .text(finding.description, spacing.page.margin, this.y, {
+                width: layout.content.width,
+                lineGap: 3,
+            });
+            this.y = this.doc.y + spacing.paragraph;
+        }
+        // Impact
+        if (finding.impact) {
+            this.doc
+                .font(fonts.weights.bold)
+                .fontSize(fonts.sizes.small)
+                .fillColor('#D97706')
+                .text('Impact', spacing.page.margin, this.y);
+            this.y += 14;
+            this.doc
+                .font(fonts.weights.normal)
+                .fontSize(fonts.sizes.body)
+                .fillColor(colors.text.primary)
+                .text(finding.impact, spacing.page.margin, this.y, {
+                width: layout.content.width,
+                lineGap: 3,
+            });
+            this.y = this.doc.y + spacing.paragraph;
+        }
+        // Recommendation
+        if (finding.recommendation) {
+            this.doc
+                .font(fonts.weights.bold)
+                .fontSize(fonts.sizes.small)
+                .fillColor('#059669')
+                .text('Recommendation', spacing.page.margin, this.y);
+            this.y += 14;
+            this.doc
+                .font(fonts.weights.normal)
+                .fontSize(fonts.sizes.body)
+                .fillColor(colors.text.primary)
+                .text(finding.recommendation, spacing.page.margin, this.y, {
+                width: layout.content.width,
+                lineGap: 3,
+            });
+            this.y = this.doc.y + spacing.paragraph;
+        }
+    }
+    // ─────────────────────────────────────────────────────────────────
+    // Threat Model
+    // ─────────────────────────────────────────────────────────────────
+    renderThreatModel(report) {
+        this.newPage();
+        this.y = spacing.page.top;
+        this.sectionTitle('Threat Model (STRIDE + DREAD)');
+        if (report.threatModel?.length) {
+            this.renderSimpleTable(['ID', 'Severity', 'DREAD', 'Status', 'Finding'], report.threatModel.map(t => [
+                t.id,
+                t.severity.toUpperCase(),
+                t.dread?.toFixed(1) || '-',
+                t.status,
+                t.finding,
+            ]), [60, 60, 50, 70, 255]);
+        }
+        this.checkPageBreak();
+    }
+    // ─────────────────────────────────────────────────────────────────
+    // Positive Observations
+    // ─────────────────────────────────────────────────────────────────
+    renderPositiveObservations(report) {
+        this.newPage();
+        this.y = spacing.page.top;
+        this.sectionTitle('Positive Security Observations');
+        report.positiveObservations?.forEach(obs => {
+            this.checkPageBreak(60);
+            this.doc
+                .font(fonts.weights.bold)
+                .fontSize(fonts.sizes.body)
+                .fillColor(colors.text.primary)
+                .text(obs.title, spacing.page.margin, this.y);
+            this.y += 14;
+            this.doc
+                .font(fonts.weights.normal)
+                .fontSize(fonts.sizes.body)
+                .fillColor(colors.text.secondary)
+                .text(obs.description, spacing.page.margin, this.y, {
+                width: layout.content.width,
+                lineGap: 3,
+            });
+            this.y = this.doc.y + spacing.paragraph;
+        });
+    }
+    // ─────────────────────────────────────────────────────────────────
+    // Remediation
+    // ─────────────────────────────────────────────────────────────────
+    renderRemediation(report) {
+        this.newPage();
+        this.y = spacing.page.top;
+        this.sectionTitle('Remediation Roadmap');
+        const priorities = [
+            { key: 'p0', label: 'P0 - Within 24-48 Hours' },
+            { key: 'p1', label: 'P1 - Within 1 Week' },
+            { key: 'p2', label: 'P2 - Within 1 Month' },
+            { key: 'p3', label: 'P3 - Within 1 Quarter' },
+        ];
+        priorities.forEach(({ key, label }) => {
+            const items = report.remediation?.[key];
+            if (!items?.length)
+                return;
+            this.checkPageBreak(100);
+            this.subTitle(label);
+            this.renderSimpleTable(['Action', 'Finding', 'Owner'], items.map(item => [item.action, item.finding, item.owner]), [280, 80, 135]);
+            this.y += spacing.paragraph;
+        });
+    }
+    // ─────────────────────────────────────────────────────────────────
+    // Compliance Mapping
+    // ─────────────────────────────────────────────────────────────────
+    renderComplianceMapping(report) {
+        this.newPage();
+        this.y = spacing.page.top;
+        this.sectionTitle('Compliance Mapping');
+        report.complianceMapping?.forEach(framework => {
+            this.checkPageBreak(100);
+            this.subTitle(framework.framework);
+            framework.controls.forEach(control => {
+                this.checkPageBreak(24);
+                // Control ID and name
+                this.doc
+                    .font(fonts.weights.bold)
+                    .fontSize(fonts.sizes.small)
+                    .fillColor(colors.text.primary)
+                    .text(control.controlId, spacing.page.margin, this.y, { continued: true })
+                    .font(fonts.weights.normal)
+                    .fillColor(colors.text.secondary)
+                    .text(` ${control.name}`, { continued: true })
+                    .text(` [${control.status.toUpperCase()}]`);
+                // Related findings
+                if (control.relatedFindings?.length) {
+                    this.doc
+                        .font(fonts.mono)
+                        .fontSize(7)
+                        .fillColor(colors.text.muted)
+                        .text(`  Related: ${control.relatedFindings.join(', ')}`, spacing.page.margin, this.y + 12);
+                    this.y += 24;
+                }
+                else {
+                    this.y += 16;
+                }
+            });
+            this.y += spacing.paragraph;
+        });
+    }
+    // ─────────────────────────────────────────────────────────────────
+    // Quality Review
+    // ─────────────────────────────────────────────────────────────────
+    renderQualityReview(report) {
+        this.newPage();
+        this.y = spacing.page.top;
+        this.sectionTitle('Quality Review');
+        const q = report.qualityReview;
+        if (!q)
+            return;
+        // Dead Code
+        if (q.deadCode?.length) {
+            this.subTitle('Dead Code');
+            this.renderQualityTable(q.deadCode);
+        }
+        // DRY Violations
+        if (q.dryViolations?.length) {
+            this.checkPageBreak(150);
+            this.subTitle('DRY Violations');
+            this.renderQualityTable(q.dryViolations);
+        }
+        // Deprecated
+        if (q.deprecated?.length) {
+            this.checkPageBreak(150);
+            this.subTitle('Deprecated Code');
+            this.renderQualityTable(q.deprecated);
+        }
+    }
+    renderQualityTable(items) {
+        this.renderSimpleTable(['Action', 'File', 'Description'], items.map(item => [
+            item.action,
+            `${item.file}${item.line ? `:${item.line}` : ''}`,
+            item.description,
+        ]), [60, 180, 255]);
+    }
+    // ─────────────────────────────────────────────────────────────────
+    // Previously Resolved Issues
+    // ─────────────────────────────────────────────────────────────────
+    renderResolvedIssues(report) {
+        this.newPage();
+        this.y = spacing.page.top;
+        this.sectionTitle('Previously Resolved Issues');
+        report.resolvedIssues?.forEach(issue => {
+            this.checkPageBreak(50);
+            const style = colors.severity[issue.severity];
+            // Checkmark + ID + Title
+            this.doc
+                .font(fonts.weights.bold)
+                .fontSize(fonts.sizes.body)
+                .fillColor(colors.severity.low.text)
+                .text('OK', spacing.page.margin, this.y, { continued: true })
+                .fillColor(style.text)
+                .text(` [${issue.id}]`, { continued: true })
+                .fillColor(colors.text.primary)
+                .text(` ${issue.title}`);
+            this.y += 16;
+            this.doc
+                .font(fonts.weights.normal)
+                .fontSize(fonts.sizes.small)
+                .fillColor(colors.text.secondary)
+                .text(`Resolution: ${issue.resolution}`, spacing.page.margin + 30, this.y);
+            this.y += 20;
+        });
+    }
+    // ─────────────────────────────────────────────────────────────────
+    // Privacy Analysis (LINDDUN)
+    // ─────────────────────────────────────────────────────────────────
+    renderPrivacyAnalysis(report) {
+        this.newPage();
+        this.y = spacing.page.top;
+        this.sectionTitle('Privacy Analysis (LINDDUN)');
+        this.renderSimpleTable(['Category', 'Risk', 'Description', 'Mitigation'], (report.privacyAnalysis || []).map(p => [
+            p.category,
+            p.risk.toUpperCase(),
+            p.description,
+            p.mitigation || '-',
+        ]), [90, 50, 200, 155]);
+    }
+    // ─────────────────────────────────────────────────────────────────
+    // Summary Page
+    // ─────────────────────────────────────────────────────────────────
+    renderSummaryPage(report) {
+        this.newPage();
+        this.y = spacing.page.top;
+        this.sectionTitle('Summary');
+        // Findings by severity table
+        this.subTitle('Findings by Severity');
+        this.renderSimpleTable(['Severity', 'Count', 'Open', 'Partial', 'Resolved'], this.getSeveritySummary(report), [100, 80, 80, 80, 155]);
+        this.y += spacing.section;
+        // Risk by category table
+        if (report.riskMatrix?.length) {
+            this.subTitle('Risk by Category');
+            this.renderSimpleTable(['Category', 'Current', 'After Fixes', 'Trend'], report.riskMatrix.map(r => [
+                r.category,
+                r.currentRisk.toUpperCase(),
+                r.residualRisk.toUpperCase(),
+                this.getTrendIndicator(r.trend),
+            ]), [150, 100, 100, 145]);
+        }
+        this.y += spacing.section;
+        // Key metrics
+        this.subTitle('Key Metrics');
+        const metrics = [
+            ['Total Findings', report.summary.total.toString()],
+            ['Critical + High', (report.summary.critical + report.summary.high).toString()],
+            ['Attack Chains', (report.attackChains?.length || 0).toString()],
+            ['Compliance Frameworks', (report.complianceMapping?.length || 0).toString()],
+        ];
+        const startX = spacing.page.margin;
+        const boxWidth = 120;
+        const boxHeight = 50;
+        const gap = 10;
+        metrics.forEach((metric, i) => {
+            const x = startX + (i * (boxWidth + gap));
+            this.doc
+                .rect(x, this.y, boxWidth, boxHeight)
+                .stroke(colors.border);
+            this.doc
+                .font(fonts.weights.bold)
+                .fontSize(18)
+                .fillColor(colors.accent)
+                .text(metric[1], x, this.y + 10, { width: boxWidth, align: 'center' });
+            this.doc
+                .font(fonts.weights.normal)
+                .fontSize(fonts.sizes.small)
+                .fillColor(colors.text.secondary)
+                .text(metric[0], x, this.y + 32, { width: boxWidth, align: 'center' });
+        });
+    }
+    getSeveritySummary(report) {
+        const severities = ['critical', 'high', 'medium', 'low'];
+        return severities.map(sev => {
+            const findings = report.findings.filter(f => f.severity === sev);
+            const open = findings.filter(f => f.status === 'open' || !f.status).length;
+            const partial = findings.filter(f => f.status === 'partial').length;
+            const resolved = findings.filter(f => f.status === 'resolved').length;
+            return [
+                sev.toUpperCase(),
+                findings.length.toString(),
+                open.toString(),
+                partial.toString(),
+                resolved.toString(),
+            ];
+        });
+    }
+    // ─────────────────────────────────────────────────────────────────
+    // Helpers
+    // ─────────────────────────────────────────────────────────────────
+    sectionTitle(title) {
+        this.doc
+            .font(fonts.weights.bold)
+            .fontSize(fonts.sizes.h1)
+            .fillColor(colors.text.primary)
+            .text(title, spacing.page.margin, this.y);
+        // Subtle underline
+        this.y += 28;
+        this.doc
+            .moveTo(spacing.page.margin, this.y)
+            .lineTo(spacing.page.margin + layout.content.width, this.y)
+            .strokeColor(colors.borderLight)
+            .lineWidth(1)
+            .stroke();
+        this.y += spacing.paragraph;
+    }
+    subTitle(title) {
+        this.doc
+            .font(fonts.weights.bold)
+            .fontSize(fonts.sizes.h3)
+            .fillColor(colors.text.secondary)
+            .text(title, spacing.page.margin, this.y);
+        this.y += 20;
+    }
+    renderSimpleTable(headers, rows, colWidths) {
+        const rowHeight = 24;
+        const x = spacing.page.margin;
+        // Header
+        this.doc
+            .rect(x, this.y, layout.content.width, rowHeight)
+            .fill(colors.table.header);
+        let colX = x;
+        headers.forEach((header, i) => {
+            this.doc
+                .font(fonts.weights.bold)
+                .fontSize(fonts.sizes.small)
+                .fillColor(colors.table.headerText)
+                .text(header, colX + 8, this.y + 7, {
+                width: colWidths[i] - 16,
+            });
+            colX += colWidths[i];
+        });
+        this.y += rowHeight;
+        // Rows
+        rows.forEach((row, rowIndex) => {
+            this.checkPageBreak(rowHeight + 20);
+            // Alternating background
+            if (rowIndex % 2 === 1) {
+                this.doc
+                    .rect(x, this.y, layout.content.width, rowHeight)
+                    .fill(colors.table.altRow);
+            }
+            // Border
+            this.doc
+                .moveTo(x, this.y + rowHeight)
+                .lineTo(x + layout.content.width, this.y + rowHeight)
+                .strokeColor(colors.table.border)
+                .lineWidth(0.5)
+                .stroke();
+            colX = x;
+            row.forEach((cell, i) => {
+                this.doc
+                    .font(fonts.weights.normal)
+                    .fontSize(fonts.sizes.small)
+                    .fillColor(colors.text.primary)
+                    .text(cell, colX + 8, this.y + 7, {
+                    width: colWidths[i] - 16,
+                    ellipsis: true,
+                });
+                colX += colWidths[i];
+            });
+            this.y += rowHeight;
+        });
+        this.y += spacing.paragraph;
+    }
+    checkPageBreak(requiredSpace = 100) {
+        if (this.y > layout.page.height - spacing.page.bottom - requiredSpace) {
+            this.newPage();
+        }
+    }
+    addPageNumbersAndFooters() {
+        // Get the actual page range from PDFKit's buffer BEFORE adding footers
+        const range = this.doc.bufferedPageRange();
+        const totalPages = range.count;
+        for (let i = 0; i < totalPages; i++) {
+            this.doc.switchToPage(i);
+            // Save the current position and set a safe position for footer
+            // This prevents PDFKit from creating new pages when adding text
+            this.doc.save();
+            // Move to footer position without triggering page creation
+            this.doc.x = spacing.page.margin;
+            this.doc.y = layout.page.height - 30;
+            // Add CONFIDENTIAL footer on left using simple text without width constraints
+            this.doc
+                .font(fonts.weights.normal)
+                .fontSize(fonts.sizes.caption)
+                .fillColor(colors.text.muted);
+            // Use _fragment to add text without triggering page breaks
+            this.doc.text('CONFIDENTIAL', spacing.page.margin, layout.page.height - 30, {
+                lineBreak: false
+            });
+            // Add page number on right - position it manually
+            const pageNumText = `${i + 1}`;
+            const pageNumWidth = this.doc.widthOfString(pageNumText);
+            this.doc.text(pageNumText, layout.page.width - spacing.page.margin - pageNumWidth, layout.page.height - 30, { lineBreak: false });
+            this.doc.restore();
+        }
+        // Switch back to the last real page
+        if (totalPages > 0) {
+            this.doc.switchToPage(totalPages - 1);
+        }
+    }
+}
+export async function generatePDF(report, outputPath) {
+    const generator = new PDFGenerator();
+    await generator.generate(report, outputPath);
+}