insa-check-core 0.1.0

package/dist/report/manual.js

@@ -0,0 +1,190 @@
+import { ANNEX_B, STANDARD } from "../annex-b.js";
+import { TOOL_NAME, TOOL_VERSION } from "../meta.js";
+import { summarize } from "./summary.js";
+/** Browser-safe Tier 3 helpers: guided manual review recorded on the same report rows. */
+export const MANUAL_VERDICTS = ["pass", "fail", "not-applicable", "untested"];
+/** Untested stays "manual" (pending), so an unreviewed item can never count as a pass. */
+export function verdictStatus(verdict) {
+    return verdict === "untested" ? "manual" : verdict;
+}
+/** A row needs (or received) a human verdict when automation left it undecided. */
+export function isReviewable(row) {
+    return row.manual !== undefined || row.status === "manual";
+}
+/** Attaches an "untested" review to every undecided row. Idempotent; existing verdicts are kept. */
+export function startManualReview(report) {
+    const results = report.results.map((r) => r.manual || r.status !== "manual" ? r : { ...r, evaluatedBy: "manual", manual: { verdict: "untested" } });
+    return { ...report, results, summary: summarize(results) };
+}
+export class ReviewError extends Error {
+    name = "ReviewError";
+}
+/** Note/evidence edits closer together than this are folded into one history entry. */
+const HISTORY_GAP_MS = 10 * 60 * 1000;
+function snapshot(m) {
+    const s = { verdict: m.verdict, at: m.reviewedAt };
+    if (m.note)
+        s.note = m.note;
+    if (m.evidenceText)
+        s.evidenceText = m.evidenceText;
+    if (m.reviewer)
+        s.reviewer = m.reviewer;
+    if (m.attachments?.length)
+        s.attachments = m.attachments;
+    if (m.carriedFrom)
+        s.carriedFrom = m.carriedFrom;
+    return s;
+}
+/** Fail and Not applicable must be justified: a verdict without a note keeps the report incomplete. */
+export function needsNote(row) {
+    const m = row.manual;
+    return !!m && (m.verdict === "fail" || m.verdict === "not-applicable") && !m.note?.trim();
+}
+/**
+ * Records (part of) a verdict for one item and recomputes the summary.
+ * The previous state goes into `history` when the verdict, reviewer or screenshots change, when a
+ * carried verdict is re-confirmed, or when note/evidence change more than 10 minutes after the last change.
+ * A carried verdict counts as re-confirmed only when a verdict is set; editing just the note keeps the mark.
+ */
+export function recordVerdict(report, id, patch, now = new Date()) {
+    const started = startManualReview(report);
+    const index = started.results.findIndex((r) => r.id === id);
+    const row = started.results[index];
+    if (!row)
+        throw new ReviewError(`No item ${id} in this report.`);
+    if (!row.manual)
+        throw new ReviewError(`Item ${id} was decided by an automated check and cannot take a manual verdict.`);
+    if (patch.verdict && !MANUAL_VERDICTS.includes(patch.verdict))
+        throw new ReviewError(`Unknown verdict "${patch.verdict}".`);
+    // History and carry-over state are maintained here, never set by callers.
+    const { history: _h, carriedFrom: _c, ...changes } = patch;
+    const prev = row.manual;
+    const review = { ...prev, ...changes, reviewedAt: now.toISOString() };
+    const reconfirmed = !!prev.carriedFrom && changes.verdict !== undefined;
+    if (reconfirmed)
+        delete review.carriedFrom;
+    if (prev.reviewedAt) {
+        const textChanged = (review.note ?? "") !== (prev.note ?? "") || (review.evidenceText ?? "") !== (prev.evidenceText ?? "");
+        const ids = (m) => (m.attachments ?? []).map((a) => a.id).sort().join(",");
+        const significant = review.verdict !== prev.verdict ||
+            (review.reviewer ?? "") !== (prev.reviewer ?? "") ||
+            ids(review) !== ids(prev) ||
+            reconfirmed ||
+            (textChanged && now.getTime() - Date.parse(prev.reviewedAt) > HISTORY_GAP_MS);
+        if (significant)
+            review.history = [...(prev.history ?? []), snapshot(prev)];
+    }
+    for (const key of ["note", "evidenceText", "reviewer"]) {
+        if (typeof review[key] === "string" && !review[key].trim())
+            delete review[key];
+    }
+    if (review.attachments?.length === 0)
+        delete review.attachments;
+    const results = [...started.results];
+    results[index] = { ...row, evaluatedBy: "manual", status: verdictStatus(review.verdict), manual: review };
+    return { ...started, results, summary: summarize(results) };
+}
+export function reviewProgress(report) {
+    const rows = report.results.filter(isReviewable);
+    return { total: rows.length, reviewed: rows.filter((r) => r.manual && r.manual.verdict !== "untested").length };
+}
+/** Overall readiness across all three tiers. Untested items are counted as pending, never as pass. */
+export function readiness(report) {
+    const count = (s) => report.results.filter((r) => r.status === s).length;
+    const r = {
+        total: report.results.length,
+        pass: count("pass"),
+        fail: count("fail"),
+        notApplicable: count("not-applicable"),
+        pending: count("manual"),
+        error: count("error"),
+        needsNote: report.results.filter(needsNote).length,
+        carried: report.results.filter((x) => x.manual?.carriedFrom).length,
+    };
+    const complete = r.pending === 0 && r.error === 0 && r.needsNote === 0;
+    return { ...r, complete, state: !complete ? "incomplete" : r.fail > 0 ? "failures" : "clean" };
+}
+/** A report with every Annex B item pending manual review, for reviewing without any automated scan. */
+export function createManualReport(name, now = new Date()) {
+    const results = ANNEX_B.map((item) => ({
+        id: item.id,
+        section: item.section,
+        title: item.title,
+        tier: item.tier,
+        status: "manual",
+        evaluatedBy: "manual",
+        detail: item.manualNote,
+        manual: { verdict: "untested" },
+    }));
+    return {
+        tool: { name: TOOL_NAME, version: TOOL_VERSION },
+        standard: STANDARD,
+        target: name,
+        sources: {},
+        startedAt: now.toISOString(),
+        finishedAt: now.toISOString(),
+        summary: summarize(results),
+        results,
+    };
+}
+const sameTarget = (a, b) => {
+    const urlA = a.sources?.url;
+    const urlB = b.sources?.url;
+    const codeA = a.sources?.code?.name;
+    const codeB = b.sources?.code?.name;
+    const shared = (urlA && urlB ? [urlA === urlB] : []).concat(codeA && codeB ? [codeA === codeB] : []);
+    return shared.length > 0 && shared.every(Boolean);
+};
+/**
+ * Copies recorded manual verdicts from an earlier report of the same target into a newer one.
+ * Only rows still pending in the new report are filled; existing verdicts and automated results
+ * are never overridden. Carried verdicts are marked (`carriedFrom`) until someone re-records them.
+ */
+export function carryForwardReviews(previous, next) {
+    if (!sameTarget(previous, next)) {
+        throw new ReviewError("Verdicts can only be carried between reports of the same website or project.");
+    }
+    const old = new Map(previous.results.map((r) => [r.id, r]));
+    const carried = [];
+    const skippedFails = [];
+    const results = next.results.map((row) => {
+        const prev = old.get(row.id)?.manual;
+        if (!prev || prev.verdict === "untested")
+            return row;
+        const pending = row.status === "manual" && (!row.manual || row.manual.verdict === "untested");
+        if (!pending) {
+            if (prev.verdict === "fail" && !row.manual)
+                skippedFails.push(row.id);
+            return row;
+        }
+        carried.push(row.id);
+        return {
+            ...row,
+            evaluatedBy: "manual",
+            status: verdictStatus(prev.verdict),
+            manual: { ...prev, carriedFrom: prev.carriedFrom ?? previous.finishedAt },
+        };
+    });
+    const day = previous.finishedAt.slice(0, 10);
+    const notes = [
+        ...(next.notes ?? []),
+        ...(carried.length ? [`Manual verdicts for ${carried.length} item(s) were carried from the report of ${day}; re-confirm them.`] : []),
+        ...skippedFails.map((id) => `Item ${id}: an earlier manual Fail (${day}) was not carried because an automated check now decides this item; re-check it.`),
+    ];
+    // Bring along embedded screenshots referenced by carried verdicts (CLI / exported JSON reports).
+    const attachments = { ...(next.attachments ?? {}) };
+    for (const row of results) {
+        if (!row.manual?.carriedFrom)
+            continue;
+        for (const ref of row.manual.attachments ?? []) {
+            const file = previous.attachments?.[ref.id];
+            if (file && !attachments[ref.id])
+                attachments[ref.id] = file;
+        }
+    }
+    return {
+        report: { ...next, results, notes, summary: summarize(results), ...(Object.keys(attachments).length ? { attachments } : {}) },
+        carried,
+    };
+}
+//# sourceMappingURL=manual.js.map

package/dist/report/manual.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manual.js","sourceRoot":"","sources":["../../src/report/manual.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,0FAA0F;AAE1F,MAAM,CAAC,MAAM,eAAe,GAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;AAExG,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,OAAsB;IAClD,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AACrD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAAC,GAAgB;IAC3C,OAAO,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC;AAC7D,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAe,EAAE,CACpD,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,CACzG,CAAC;IACF,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,GAAG,aAAa,CAAC;CAC/B;AAED,uFAAuF;AACvF,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,SAAS,QAAQ,CAAC,CAAe;IAC/B,MAAM,CAAC,GAAmB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,UAAW,EAAE,CAAC;IACpE,IAAI,CAAC,CAAC,IAAI;QAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5B,IAAI,CAAC,CAAC,YAAY;QAAE,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IACpD,IAAI,CAAC,CAAC,QAAQ;QAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IACxC,IAAI,CAAC,CAAC,WAAW,EAAE,MAAM;QAAE,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IACzD,IAAI,CAAC,CAAC,WAAW;QAAE,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IACjD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,SAAS,CAAC,GAAgB;IACxC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,EAAU,EACV,KAA4B,EAC5B,GAAG,GAAS,IAAI,IAAI,EAAE;IAEtB,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IACjE,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,WAAW,CAAC,QAAQ,EAAE,sEAAsE,CAAC,CAAC;IACzH,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;IAC5H,0EAA0E;IAC1E,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC;IAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC;IACxB,MAAM,MAAM,GAAiB,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;IACpF,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC;IACxE,IAAI,WAAW;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC;IAC3C,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAC3H,MAAM,GAAG,GAAG,CAAC,CAAe,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzF,MAAM,WAAW,GACf,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;YAC/B,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YACjD,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC;YACzB,WAAW;YACX,CAAC,WAAW,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,cAAc,CAAC,CAAC;QAChF,IAAI,WAAW;YAAE,MAAM,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,CAAU,EAAE,CAAC;QAChE,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,CAAE,CAAC,IAAI,EAAE;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC;IAChE,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1G,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9D,CAAC;AASD,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACjD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC;AAClH,CAAC;AAqBD,sGAAsG;AACtG,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACjF,MAAM,CAAC,GAAG;QACR,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;QAC5B,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,KAAK,CAAC,gBAAgB,CAAC;QACtC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC;QACxB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM;QAClD,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,MAAM;KACpE,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC;IACvE,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;AACjG,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,GAAG,GAAS,IAAI,IAAI,EAAE;IACrE,MAAM,OAAO,GAAkB,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpD,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,IAAI,CAAC,UAAU;QACvB,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE;KAChC,CAAC,CAAC,CAAC;IACJ,OAAO;QACL,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE;QAChD,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,EAAE;QACX,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;QAC7B,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC;QAC3B,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;IACnD,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC;IAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrG,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC,CAAC;AAQF;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,IAAY;IAChE,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,WAAW,CAAC,8EAA8E,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAe,EAAE;QACpD,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU;YAAE,OAAO,GAAG,CAAC;QACrD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC;QAC9F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtE,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrB,OAAO;YACL,GAAG,GAAG;YACN,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;YACnC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAC,UAAU,EAAE;SAC1E,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,uBAAuB,OAAO,CAAC,MAAM,4CAA4C,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrI,GAAG,YAAY,CAAC,GAAG,CACjB,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,EAAE,6BAA6B,GAAG,kFAAkF,CACrI;KACF,CAAC;IACF,iGAAiG;IACjG,MAAM,WAAW,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW;YAAE,SAAS;QACvC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5C,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,OAAO;QACL,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAC7H,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/report/merge.d.ts

@@ -0,0 +1,8 @@
+import type { Report } from "../types.js";
+/** Browser-safe. Combines a URL (Tier 1) report and a code (Tier 2) report into one 102-row report. */
+export declare class MergeError extends Error {
+    name: string;
+}
+export declare function reportKind(report: Report): "url" | "code" | "combined";
+export declare function mergeReports(a: Report, b: Report): Report;
+//# sourceMappingURL=merge.d.ts.map

package/dist/report/merge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../src/report/merge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA0C,MAAM,EAAU,MAAM,aAAa,CAAC;AAI1F,uGAAuG;AAEvG,qBAAa,UAAW,SAAQ,KAAK;IAC1B,IAAI,SAAgB;CAC9B;AA8CD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,UAAU,CAKtE;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA8EzD"}

package/dist/report/merge.js

@@ -0,0 +1,135 @@
+import { verdictStatus } from "./manual.js";
+import { summarize } from "./summary.js";
+/** Browser-safe. Combines a URL (Tier 1) report and a code (Tier 2) report into one 102-row report. */
+export class MergeError extends Error {
+    name = "MergeError";
+}
+const evaluatedByOf = (r) => r.evaluatedBy ?? (r.status === "manual" ? "manual" : "url");
+/** fail > error > pass > not-applicable > manual: a failure from either source wins; an error means the row is incomplete. */
+const PRIORITY = ["fail", "error", "pass", "not-applicable", "manual"];
+const STATUS_TEXT = {
+    pass: "Pass",
+    fail: "Fail",
+    manual: "Manual review",
+    error: "Error",
+    "not-applicable": "Not applicable",
+};
+/** Decided by an automated check (not pending, not a human verdict). */
+const automated = (r) => evaluatedByOf(r) !== "manual" && !r.manual && r.status !== "manual";
+const recorded = (m) => (m && m.verdict !== "untested" ? m : undefined);
+const newer = (a, b) => ((a.reviewedAt ?? "") >= (b.reviewedAt ?? "") ? a : b);
+/**
+ * A recorded verdict beats "untested". Between two recorded verdicts a Fail always wins
+ * (as it does against automated results); otherwise the newer one wins.
+ */
+function pickReview(a, b) {
+    const ra = recorded(a);
+    const rb = recorded(b);
+    if (ra && rb) {
+        const failA = ra.verdict === "fail";
+        const failB = rb.verdict === "fail";
+        const kept = failA !== failB ? (failA ? ra : rb) : newer(ra, rb);
+        const other = kept === ra ? rb : ra;
+        return { review: kept, ...(other.verdict !== kept.verdict ? { overridden: other } : {}) };
+    }
+    return { review: ra ?? rb ?? a ?? b };
+}
+const VERDICT_LABEL = {
+    pass: "Pass",
+    fail: "Fail",
+    "not-applicable": "Not applicable",
+    untested: "Untested",
+};
+export function reportKind(report) {
+    const s = report.sources;
+    if (s?.url && s.code)
+        return "combined";
+    if (s?.code)
+        return "code";
+    return "url";
+}
+export function mergeReports(a, b) {
+    const kinds = [reportKind(a), reportKind(b)];
+    if (!(kinds.includes("url") && kinds.includes("code"))) {
+        throw new MergeError("Merge needs one URL report and one code report.");
+    }
+    const [urlReport, codeReport] = reportKind(a) === "url" ? [a, b] : [b, a];
+    const codeById = new Map(codeReport.results.map((r) => [r.id, r]));
+    const replacedReviews = [];
+    const conflicts = [];
+    const results = urlReport.results.map((u) => {
+        const c = codeById.get(u.id);
+        if (!c)
+            return { ...u, evaluatedBy: evaluatedByOf(u) };
+        const uAuto = automated(u);
+        const cAuto = automated(c);
+        if (!uAuto && !cAuto) {
+            // Still undecided by automation: keep the more informative detail and the best human verdict.
+            const base = evaluatedByOf(c) !== "manual" || c.manual ? c : u;
+            const { review, overridden } = pickReview(u.manual, c.manual);
+            if (review && overridden) {
+                conflicts.push(`Item ${u.id}: manual verdicts differed; ${VERDICT_LABEL[review.verdict]} kept over ${VERDICT_LABEL[overridden.verdict]}.`);
+            }
+            const { manual: _drop, ...rest } = base;
+            return review
+                ? { ...rest, evaluatedBy: "manual", status: verdictStatus(review.verdict), manual: review }
+                : { ...rest, evaluatedBy: evaluatedByOf(base), status: "manual" };
+        }
+        if (!uAuto || !cAuto) {
+            // Automation decides the row, except that a human Fail recorded on the other side wins;
+            // any other human verdict is superseded.
+            const [winner, other] = uAuto ? [u, c] : [c, u];
+            if (other.manual?.verdict === "fail") {
+                // Keep the automated detail, evidence and findings; the manual Fail decides the status.
+                const source = winner === u ? "URL" : "Code";
+                if (winner.status !== "fail") {
+                    conflicts.push(`Item ${u.id}: manual Fail kept over automated ${STATUS_TEXT[winner.status]} (${source}).`);
+                }
+                return {
+                    ...winner,
+                    status: "fail",
+                    evaluatedBy: winner.status === "fail" ? evaluatedByOf(winner) : "manual",
+                    detail: `${source}: ${winner.detail} | Manual: Fail`,
+                    manual: other.manual,
+                };
+            }
+            if (recorded(other.manual))
+                replacedReviews.push(u.id);
+            return { ...winner, evaluatedBy: evaluatedByOf(winner) };
+        }
+        const status = PRIORITY.find((s) => s === u.status || s === c.status);
+        return {
+            ...u,
+            status,
+            evaluatedBy: "url+code",
+            detail: `URL: ${u.detail} | Code: ${c.detail}`,
+            ...(u.evidence || c.evidence ? { evidence: [...(u.evidence ?? []), ...(c.evidence ?? [])] } : {}),
+            ...(c.findings ? { findings: c.findings } : {}),
+        };
+    });
+    return {
+        tool: urlReport.tool,
+        standard: urlReport.standard,
+        target: `${urlReport.target} + ${codeReport.target}`,
+        sources: { url: urlReport.sources?.url ?? urlReport.target, code: codeReport.sources?.code },
+        notes: [
+            ...(urlReport.notes ?? []),
+            ...(codeReport.notes ?? []),
+            ...(replacedReviews.length
+                ? [`Manual verdicts for item(s) ${replacedReviews.join(", ")} were replaced by automated results from the merged report.`]
+                : []),
+            ...conflicts,
+        ],
+        ...mergeAttachments(urlReport, codeReport),
+        startedAt: [urlReport.startedAt, codeReport.startedAt].sort()[0],
+        finishedAt: [urlReport.finishedAt, codeReport.finishedAt].sort().at(-1),
+        summary: summarize(results),
+        results,
+    };
+}
+/** Embedded evidence files from both reports (ids are unique per attachment). */
+function mergeAttachments(a, b) {
+    const all = { ...(a.attachments ?? {}), ...(b.attachments ?? {}) };
+    return Object.keys(all).length ? { attachments: all } : {};
+}
+//# sourceMappingURL=merge.js.map

package/dist/report/merge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge.js","sourceRoot":"","sources":["../../src/report/merge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,uGAAuG;AAEvG,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,IAAI,GAAG,YAAY,CAAC;CAC9B;AAED,MAAM,aAAa,GAAG,CAAC,CAAc,EAAe,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAEnH,8HAA8H;AAC9H,MAAM,QAAQ,GAAa,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;AAEjF,MAAM,WAAW,GAA2B;IAC1C,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,eAAe;IACvB,KAAK,EAAE,OAAO;IACd,gBAAgB,EAAE,gBAAgB;CACnC,CAAC;AAEF,wEAAwE;AACxE,MAAM,SAAS,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;AAE1G,MAAM,QAAQ,GAAG,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAEvF,MAAM,KAAK,GAAG,CAAC,CAAe,EAAE,CAAe,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3G;;;GAGG;AACH,SAAS,UAAU,CAAC,CAAgB,EAAE,CAAgB;IACpD,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,KAAK,MAAM,CAAC;QACpC,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,KAAK,MAAM,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,aAAa,GAA4C;IAC7D,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,gBAAgB,EAAE,gBAAgB;IAClC,QAAQ,EAAE,UAAU;CACrB,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC;IACxC,IAAI,CAAC,EAAE,IAAI;QAAE,OAAO,MAAM,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAS,EAAE,CAAS;IAC/C,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,UAAU,CAAC,iDAAiD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,MAAM,OAAO,GAAkB,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACzD,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YACrB,8FAA8F;YAC9F,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/D,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,MAAM,IAAI,UAAU,EAAE,CAAC;gBACzB,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,+BAA+B,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7I,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;YACxC,OAAO,MAAM;gBACX,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE;gBAC3F,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YACrB,wFAAwF;YACxF,yCAAyC;YACzC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChD,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,EAAE,CAAC;gBACrC,wFAAwF;gBACxF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC7B,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,qCAAqC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC;gBAC7G,CAAC;gBACD,OAAO;oBACL,GAAG,MAAM;oBACT,MAAM,EAAE,MAAM;oBACd,WAAW,EAAE,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ;oBACxE,MAAM,EAAE,GAAG,MAAM,KAAK,MAAM,CAAC,MAAM,iBAAiB;oBACpD,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;gBAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvD,OAAO,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAE,CAAC;QACvE,OAAO;YACL,GAAG,CAAC;YACJ,MAAM;YACN,WAAW,EAAE,UAAU;YACvB,MAAM,EAAE,QAAQ,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,MAAM,EAAE;YAC9C,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,MAAM,UAAU,CAAC,MAAM,EAAE;QACpD,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE;QAC5F,KAAK,EAAE;YACL,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1B,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;YAC3B,GAAG,CAAC,eAAe,CAAC,MAAM;gBACxB,CAAC,CAAC,CAAC,+BAA+B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,6DAA6D,CAAC;gBAC1H,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,SAAS;SACb;QACD,GAAG,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC;QAC1C,SAAS,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAE;QACjE,UAAU,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE;QACxE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC;QAC3B,OAAO;KACR,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;IACnE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC"}

package/dist/report/summary.d.ts

@@ -0,0 +1,10 @@
+import type { CheckResult, ReportSummary, Status } from "../types.js";
+export declare function summarize(results: readonly CheckResult[]): ReportSummary;
+export interface SectionGroup {
+    section: string;
+    results: CheckResult[];
+}
+/** Groups results by Annex B section, preserving the standard's order. */
+export declare function groupBySection(results: readonly CheckResult[]): SectionGroup[];
+export declare const STATUS_LABEL: Record<Status, string>;
+//# sourceMappingURL=summary.d.ts.map

package/dist/report/summary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"summary.d.ts","sourceRoot":"","sources":["../../src/report/summary.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAEtE,wBAAgB,SAAS,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,GAAG,aAAa,CAIxE;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,GAAG,YAAY,EAAE,CAW9E;AAED,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAM/C,CAAC"}

package/dist/report/summary.js

@@ -0,0 +1,27 @@
+export function summarize(results) {
+    const summary = { total: results.length, pass: 0, fail: 0, manual: 0, error: 0, "not-applicable": 0 };
+    for (const r of results)
+        summary[r.status] = (summary[r.status] ?? 0) + 1;
+    return summary;
+}
+/** Groups results by Annex B section, preserving the standard's order. */
+export function groupBySection(results) {
+    const groups = [];
+    for (const r of results) {
+        let group = groups.at(-1);
+        if (!group || group.section !== r.section) {
+            group = { section: r.section, results: [] };
+            groups.push(group);
+        }
+        group.results.push(r);
+    }
+    return groups;
+}
+export const STATUS_LABEL = {
+    pass: "Pass",
+    fail: "Fail",
+    manual: "Manual review",
+    error: "Error",
+    "not-applicable": "Not applicable",
+};
+//# sourceMappingURL=summary.js.map

package/dist/report/summary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"summary.js","sourceRoot":"","sources":["../../src/report/summary.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,SAAS,CAAC,OAA+B;IACvD,MAAM,OAAO,GAAkB,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;IACrH,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1E,OAAO,OAAO,CAAC;AACjB,CAAC;AAOD,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAAC,OAA+B;IAC5D,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1C,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAA2B;IAClD,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,eAAe;IACvB,KAAK,EAAE,OAAO;IACd,gBAAgB,EAAE,gBAAgB;CACnC,CAAC"}

package/dist/report/validate.d.ts

@@ -0,0 +1,3 @@
+import type { Report } from "../types.js";
+export declare function isReport(value: unknown): value is Report;
+//# sourceMappingURL=validate.d.ts.map

package/dist/report/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/report/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAiF1C,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAcxD"}

package/dist/report/validate.js

@@ -0,0 +1,78 @@
+/**
+ * Browser-safe shape check for reports loaded from files (dashboard import, CLI --merge / --carry-from),
+ * so a malformed or hand-edited file is rejected instead of crashing rendering later.
+ */
+const VERDICTS = ["pass", "fail", "not-applicable", "untested"];
+const STATUSES = ["pass", "fail", "manual", "error", "not-applicable"];
+const isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const optString = (v) => v === undefined || typeof v === "string";
+const stringArray = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
+function isAttachmentRef(v) {
+    return isObj(v) && typeof v.id === "string" && typeof v.name === "string" && typeof v.type === "string" && typeof v.size === "number";
+}
+function isSnapshot(v) {
+    return (isObj(v) &&
+        VERDICTS.includes(v.verdict) &&
+        typeof v.at === "string" &&
+        optString(v.note) &&
+        optString(v.evidenceText) &&
+        optString(v.reviewer) &&
+        optString(v.carriedFrom) &&
+        (v.attachments === undefined || (Array.isArray(v.attachments) && v.attachments.every(isAttachmentRef))));
+}
+function isManualReview(v) {
+    return (isObj(v) &&
+        VERDICTS.includes(v.verdict) &&
+        optString(v.note) &&
+        optString(v.evidenceText) &&
+        optString(v.reviewer) &&
+        optString(v.reviewedAt) &&
+        optString(v.carriedFrom) &&
+        (v.attachments === undefined || (Array.isArray(v.attachments) && v.attachments.every(isAttachmentRef))) &&
+        (v.history === undefined || (Array.isArray(v.history) && v.history.every(isSnapshot))));
+}
+function isFinding(v) {
+    return isObj(v) && typeof v.file === "string" && typeof v.line === "number" && typeof v.snippet === "string";
+}
+function isRow(v) {
+    return (isObj(v) &&
+        typeof v.id === "string" &&
+        typeof v.section === "string" &&
+        typeof v.title === "string" &&
+        typeof v.detail === "string" &&
+        STATUSES.includes(v.status) &&
+        (v.evidence === undefined || stringArray(v.evidence)) &&
+        (v.findings === undefined || (Array.isArray(v.findings) && v.findings.every(isFinding))) &&
+        (v.manual === undefined || isManualReview(v.manual)));
+}
+function isSources(v) {
+    if (v === undefined)
+        return true;
+    if (!isObj(v) || !optString(v.url))
+        return false;
+    const c = v.code;
+    return (c === undefined ||
+        (isObj(c) &&
+            typeof c.name === "string" &&
+            stringArray(c.frameworks) &&
+            typeof c.filesAnalyzed === "number" &&
+            Array.isArray(c.parseErrors)));
+}
+function isEmbedded(v) {
+    return isObj(v) && typeof v.name === "string" && typeof v.type === "string" && typeof v.size === "number" && typeof v.base64 === "string";
+}
+export function isReport(value) {
+    if (!isObj(value))
+        return false;
+    const r = value;
+    return (typeof r.target === "string" &&
+        typeof r.startedAt === "string" &&
+        typeof r.finishedAt === "string" &&
+        isObj(r.summary) &&
+        Array.isArray(r.results) &&
+        r.results.every(isRow) &&
+        isSources(r.sources) &&
+        (r.notes === undefined || stringArray(r.notes)) &&
+        (r.attachments === undefined || (isObj(r.attachments) && Object.values(r.attachments).every(isEmbedded))));
+}
+//# sourceMappingURL=validate.js.map

package/dist/report/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/report/validate.ts"],"names":[],"mappings":"AAEA;;;GAGG;AAEH,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;AAChE,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAEvE,MAAM,KAAK,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACrH,MAAM,SAAS,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;AAC3E,MAAM,WAAW,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAE9F,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;AACxI,CAAC;AAED,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,CACL,KAAK,CAAC,CAAC,CAAC;QACR,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAiB,CAAC;QACtC,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QACjB,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;QACzB,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QACrB,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;QACxB,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CACxG,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,CAAU;IAChC,OAAO,CACL,KAAK,CAAC,CAAC,CAAC;QACR,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAiB,CAAC;QACtC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QACjB,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;QACzB,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QACrB,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;QACvB,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;QACxB,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;QACvG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CACvF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC;AAC/G,CAAC;AAED,SAAS,KAAK,CAAC,CAAU;IACvB,OAAO,CACL,KAAK,CAAC,CAAC,CAAC;QACR,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAgB,CAAC;QACrC,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACrD,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IACjB,OAAO,CACL,CAAC,KAAK,SAAS;QACf,CAAC,KAAK,CAAC,CAAC,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAC1B,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;YACzB,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;YACnC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;AAC5I,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,CAAC,GAAG,KAAK,CAAC;IAChB,OAAO,CACL,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;QAChB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACxB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QACtB,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAC1G,CAAC;AACJ,CAAC"}