swipium 1.5.0 → 2.0.1

package/dist/report/export.js

@@ -1,9 +1,39 @@
-// Report 2.0 exporters (PHASE3-PLAN §3.5). Turn the assembled report into formats a developer
+// Report 2.0 exporters. Turn the assembled report into formats a developer
 // can use without the agent transcript: an issue-ready Markdown doc and a CI-ready JUnit XML.
-// (a third-party-format exporter is deferred — out of scope here.)
+// (a third-party-format exporter is deferred and out of scope here.)
 //
-// These consume the already-redacted report object, so no secret ever reaches an export.
+// Callers pass the report through redactReportData() FIRST (B9): every string field (steps,
+// nextStep, missingPrecondition, workflow names, …) is scrubbed with the session redactor before
+// any format escapes it, so XML/JSON/Markdown escaping can never hide a secret from redaction.
+import { createHash } from 'node:crypto';
 import { evidenceTaxonomyForNotes } from './evidence.js';
+import { FAILURES } from '../oracle/failures.js';
+import { scrubVolatile } from '../issues/fingerprint.js';
+import { uniqueKey } from '../lib/redact.js';
+/**
+ * Deep-redact a report (B9): returns a copy where EVERY string value at any depth (and every string
+ * object key) has been passed through the session redactor. Run it once on the assembled report,
+ * before persisting it or rendering any export format. Escaping (`&` > `&`, `"` > `\"`) would
+ * otherwise turn a secret like `P@ss&w0rd"1` into text the redactor no longer matches.
+ */
+export function redactReportData(value, redact) {
+    const walk = (v) => {
+        if (typeof v === 'string')
+            return redact(v) ?? v;
+        if (Array.isArray(v))
+            return v.map(walk);
+        if (v && typeof v === 'object' && Object.getPrototypeOf(v) === Object.prototype) {
+            const out = {};
+            // Two keys that redact to the same spelling (e.g. "hunter22" and a literal "«redacted»")
+            // are disambiguated with a `#2` suffix instead of one silently overwriting the other.
+            for (const [k, val] of Object.entries(v))
+                out[uniqueKey(out, redact(k) ?? k)] = walk(val);
+            return out;
+        }
+        return v;
+    };
+    return walk(value);
+}
 function playwrightStatus(outcome) {
     if (outcome === 'pass')
         return 'passed';
@@ -201,7 +231,7 @@ function tableCell(s) {
 }
 function compactValue(value, maxLength = 180) {
     if (value == null)
-        return '—';
+        return '-';
     let raw;
     try {
         raw = typeof value === 'string' ? value : JSON.stringify(value);
@@ -210,11 +240,11 @@ function compactValue(value, maxLength = 180) {
         raw = String(value);
     }
     if (!raw)
-        return '—';
+        return '-';
     return raw.length > maxLength ? `${raw.slice(0, Math.max(0, maxLength - 1))}…` : raw;
 }
 function mutationTime(at) {
-    return typeof at === 'number' && Number.isFinite(at) ? new Date(at).toISOString() : '—';
+    return typeof at === 'number' && Number.isFinite(at) ? new Date(at).toISOString() : '-';
 }
 function mutationConsentSummary(m) {
     if (!m.consent)
@@ -229,7 +259,7 @@ function mutationEvidenceSummary(m) {
         m.ledgerUri ? `[ledger](${m.ledgerUri})` : '',
         m.consent?.payloadHash ? `payload ${m.consent.payloadHash.slice(0, 12)}` : '',
     ].filter(Boolean);
-    return parts.length ? parts.join('; ') : '—';
+    return parts.length ? parts.join('; ') : '-';
 }
 export function inlinePrSummary(r) {
     const problem = firstReportProblem(r);
@@ -245,7 +275,7 @@ export function inlinePrSummary(r) {
     if (r.automationBackend)
         lines.push(`Backend: ${r.automationBackend.description}.`);
     if (r.readiness?.length)
-        lines.push(`Readiness: ${r.readiness.join(' → ')}.`);
+        lines.push(`Readiness: ${r.readiness.join(' > ')}.`);
     if (r.automationReadiness)
         lines.push(`Automation readiness: ${r.automationReadiness.grade} (${r.automationReadiness.score}/100).`);
     lines.push(`Likely category: ${category}.`, `Evidence: ${evidenceSummary(r, problem)}.`, `Next action: ${r.executiveSummary.nextAction}`);
@@ -254,7 +284,7 @@ export function inlinePrSummary(r) {
 export function toMarkdown(r) {
     const L = [];
     const evidenceTaxonomy = r.evidenceTaxonomy ?? evidenceTaxonomyForNotes(r.testOutcomes);
-    L.push(`# QA report — ${r.appId ?? 'app'}`);
+    L.push(`# QA report: ${r.appId ?? 'app'}`);
     L.push('');
     L.push('## PR summary', '');
     L.push('```text');
@@ -278,7 +308,7 @@ export function toMarkdown(r) {
         for (const reason of r.executiveSummary.reasons)
             L.push(`- ${reason}`);
     }
-    // Issue memory (SWIPIUM-REQ-07): durable, cross-run issue ledger summary + recurrence warnings.
+    // Issue memory: durable, cross-run issue ledger summary + recurrence warnings.
     if (r.issuesMarkdown) {
         L.push('');
         L.push(r.issuesMarkdown);
@@ -290,7 +320,7 @@ export function toMarkdown(r) {
     }
     if (r.readiness?.length) {
         L.push('', '## Capability readiness', '');
-        L.push(`- Labels: ${r.readiness.join(' → ')}.`);
+        L.push(`- Labels: ${r.readiness.join(' > ')}.`);
         L.push(`- Highest: ${r.readiness.at(-1)}.`);
     }
     if (r.wda) {
@@ -350,7 +380,7 @@ export function toMarkdown(r) {
                 .filter(Boolean)
                 .join('; ')
                 .replace(/\|/g, '\\|');
-            L.push(`| ${n.workflow} | ${OUTCOME_MARK[n.outcome] ?? ''} ${n.outcome} | ${detail || '—'} |`);
+            L.push(`| ${n.workflow} | ${OUTCOME_MARK[n.outcome] ?? ''} ${n.outcome} | ${detail || '-'} |`);
         }
         L.push('', '## Evidence quality', '');
         L.push(`- Deterministic structured locator: ${evidenceTaxonomy.counts.structured_locator}.`);
@@ -360,7 +390,7 @@ export function toMarkdown(r) {
         L.push('', '| Workflow | Evidence | Authority | Notes |');
         L.push('| --- | --- | --- | --- |');
         for (const ev of evidenceTaxonomy.assessments) {
-            L.push(`| ${tableCell(ev.workflow)} | ${ev.kind} | ${ev.authority} | ${ev.warning ? tableCell(ev.warning) : '—'} |`);
+            L.push(`| ${tableCell(ev.workflow)} | ${ev.kind} | ${ev.authority} | ${ev.warning ? tableCell(ev.warning) : '-'} |`);
         }
     }
     if (r.flakeClassification && r.flakeClassification.repeat > 1) {
@@ -376,7 +406,7 @@ export function toMarkdown(r) {
         L.push('| Fixture | Field | Generator | Variable | Value | Evidence |');
         L.push('| --- | --- | --- | --- | --- | --- |');
         for (const g of r.generatedValues) {
-            L.push(`| ${tableCell(g.fixture)} | ${tableCell(g.field)} | ${tableCell(g.generator)} | \`${tableCell(g.varName)}\` | ${g.secret ? '<redacted>' : tableCell(g.value)} | ${g.artifactUri ? `[artifact](${g.artifactUri})` : '—'} |`);
+            L.push(`| ${tableCell(g.fixture)} | ${tableCell(g.field)} | ${tableCell(g.generator)} | \`${tableCell(g.varName)}\` | ${g.secret ? '<redacted>' : tableCell(g.value)} | ${g.artifactUri ? `[artifact](${g.artifactUri})` : '-'} |`);
         }
     }
     if (r.findings.length) {
@@ -386,7 +416,7 @@ export function toMarkdown(r) {
             const bucket = f.bucket ? ` ${f.bucket}` : '';
             const retry = f.retrySafe == null ? '' : ` retrySafe=${f.retrySafe}`;
             const next = f.nextStep ? ` Next: ${f.nextStep}` : '';
-            L.push(`- **[${f.severity}]**${code}${bucket}${retry} ${f.layer ?? '?'}/${f.kind}: ${f.detail}${f.evidence ? ` — _"${f.evidence}"_` : ''}${f.screenshotUri ? ` ([screenshot](${f.screenshotUri}))` : ''}${next}`);
+            L.push(`- **[${f.severity}]**${code}${bucket}${retry} ${f.layer ?? '?'}/${f.kind}: ${f.detail}${f.count && f.count > 1 ? ` (×${f.count})` : ''}${f.evidence ? `: _"${f.evidence}"_` : ''}${f.screenshotUri ? ` ([screenshot](${f.screenshotUri}))` : ''}${next}`);
         }
     }
     if (r.environmentChanges.length || r.guardrailOverrides.length) {
@@ -407,10 +437,14 @@ export function toMarkdown(r) {
         L.push('| Time | Tool | Action | Risk | Status | Consent | Evidence | Target / detail |');
         L.push('| --- | --- | --- | --- | --- | --- | --- | --- |');
         for (const m of r.mutationLedger) {
-            const targetDetail = [compactValue(m.target), m.detail ? compactValue(m.detail) : ''].filter((part) => part && part !== '—').join('; ') || '—';
+            const targetDetail = [compactValue(m.target), m.detail ? compactValue(m.detail) : ''].filter((part) => part && part !== '-').join('; ') || '-';
             L.push(`| ${tableCell(mutationTime(m.at))} | ${tableCell(m.tool)} | ${tableCell(m.action)} | ${tableCell(m.risk)} | ${tableCell(m.status)} | ${tableCell(mutationConsentSummary(m))} | ${tableCell(mutationEvidenceSummary(m))} | ${tableCell(targetDetail)} |`);
         }
     }
+    if (r.redactionDegraded) {
+        L.push('', '## Redaction notice', '');
+        L.push('- ⚠️ This session was restored after a server restart. Secrets registered before the restart are no longer in the redaction set, so artifacts written after the restart may contain those values unredacted.');
+    }
     L.push('', '## Timing & artifacts', '');
     const fmtS = (ms) => `${Math.round((ms ?? 0) / 1000)}s`;
     L.push(`- Total ${fmtS(r.phaseTimings.totalMs)} · setup ${fmtS(r.phaseTimings.setupMs)} · active ${fmtS(r.phaseTimings.activeMs)}${r.phaseTimings.timeToLoginMs != null ? ` · to-login ${fmtS(r.phaseTimings.timeToLoginMs)}` : ''}`);
@@ -444,35 +478,356 @@ export function toMarkdown(r) {
     L.push('', '---', '_Generated by Swipium._');
     return L.join('\n');
 }
-function xmlEscape(s) {
-    return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+/** Characters XML 1.0 forbids even as character references (https://www.w3.org/TR/xml/#charsets):
+ *  C0 controls except TAB/LF/CR, lone UTF-16 surrogates, and U+FFFE/U+FFFF. Logcat/Metro output
+ *  routinely carries ANSI escapes (\x1b) and NULs; one such byte makes CI reporters reject the whole
+ *  JUnit file, so each is replaced with U+FFFD (visible, and legal). */
+const XML_ILLEGAL = 
+// eslint-disable-next-line no-control-regex
+/[\u0000-\u0008\u000B\u000C\u000E-\u001F\uFFFE\uFFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
+export function stripXmlIllegal(s) {
+    return s.replace(XML_ILLEGAL, '\uFFFD');
+}
+/** Escape a string for XML text or attribute position. Newlines are entity-escaped too, so a
+ *  multi-line failure reason survives attribute position and round-trips through any XML parser. */
+export function escapeXml(s) {
+    return stripXmlIllegal(s)
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/\r/g, '&#13;')
+        .replace(/\n/g, '&#10;');
+}
+/** Map the report's failures onto policy FlowVerdicts (src/report/policy.ts): every recorded
+ *  workflow outcome plus every high-severity finding. This is the seam that lets the release-gate
+ *  policy (.swipium/policy.json blockOn/warnOn/ignoreKnown) decide the CI pass/fail verdict. */
+export function reportPolicyVerdicts(r) {
+    const verdicts = r.testOutcomes.map((n) => ({
+        flow: n.workflow,
+        passed: n.outcome !== 'fail',
+        failureCode: n.outcome === 'fail' ? workflowFailureCode(n) : undefined,
+    }));
+    for (const f of r.findings) {
+        if (f.severity === 'high')
+            verdicts.push({ flow: `finding:${f.kind}`, passed: false, failureCode: f.failureCode ?? f.kind });
+    }
+    return verdicts;
+}
+function junitTestcase(lines, name, classname, body, systemOut) {
+    if (!body.length && !systemOut.length) {
+        lines.push(`    <testcase name="${escapeXml(name)}" classname="${escapeXml(classname)}"></testcase>`);
+        return;
+    }
+    lines.push(`    <testcase name="${escapeXml(name)}" classname="${escapeXml(classname)}">`);
+    lines.push(...body);
+    if (systemOut.length)
+        lines.push(`      <system-out>${escapeXml(systemOut.join('\n'))}</system-out>`);
+    lines.push(`    </testcase>`);
+}
+/** The policy key reportPolicyVerdicts/applyPolicy use for a failing workflow / high finding
+ *  (`${flow}: ${code}`), so exporters can tell which failures the release gate did NOT block. */
+function workflowFailureCode(n) {
+    return n.steps?.find((s) => s.failureCode)?.failureCode ?? n.category ?? 'UNKNOWN';
+}
+function workflowPolicyKey(n) {
+    return `${n.workflow}: ${workflowFailureCode(n)}`;
 }
-export function toJUnit(r) {
-    // One <testcase> per recorded outcome. fail → <failure>; blocked/skipped/not_applicable → <skipped>.
+function findingPolicyKey(f) {
+    return `finding:${f.kind}: ${f.failureCode ?? f.kind}`;
+}
+/** Failures the gate let through (warnOn / ignoreKnown), keyed like PolicyDecision entries. */
+function nonBlockingFailures(policy) {
+    const out = new Map();
+    for (const k of policy?.warned ?? [])
+        out.set(k, 'warned');
+    for (const k of policy?.suppressed ?? [])
+        out.set(k, 'suppressed');
+    return out;
+}
+/** JUnit XML for CI test-report sinks. Two suites: recorded workflow outcomes (fail > <failure>;
+ *  blocked/skipped/not_applicable > <skipped>) and findings (high > <failure>, medium/low pass with
+ *  the detail in system-out). Evidence URIs are listed in each testcase's system-out. When a
+ *  release-gate PolicyDecision is provided, it is recorded as testsuite <properties> AND it shapes
+ *  the verdicts (D5): a failure the policy only warns on or ignores (warnOn / ignoreKnown) is
+ *  emitted as <skipped message="policy …"> rather than <failure>, so "gate PASS" never fails CI. */
+export function toJUnit(r, policy) {
     const cases = r.testOutcomes;
-    const failures = cases.filter((n) => n.outcome === 'fail').length;
-    const skipped = cases.filter((n) => n.outcome === 'blocked' || n.outcome === 'skipped' || n.outcome === 'not_applicable').length;
+    const lenient = nonBlockingFailures(policy);
+    const caseVerdict = (n) => {
+        if (n.outcome === 'pass')
+            return 'pass';
+        if (n.outcome !== 'fail')
+            return 'skipped';
+        return lenient.has(workflowPolicyKey(n)) ? 'skipped' : 'failure';
+    };
+    const findingVerdict = (f) => f.severity !== 'high' ? 'pass' : lenient.has(findingPolicyKey(f)) ? 'skipped' : 'failure';
+    const failures = cases.filter((n) => caseVerdict(n) === 'failure').length;
+    const skipped = cases.filter((n) => caseVerdict(n) === 'skipped').length;
+    const findingFailures = r.findings.filter((f) => findingVerdict(f) === 'failure').length;
+    const findingSkipped = r.findings.filter((f) => findingVerdict(f) === 'skipped').length;
     const suiteName = `swipium.${r.appId ?? 'app'}`;
+    const timeSec = (r.phaseTimings.totalMs ?? 0) / 1000;
     const lines = ['<?xml version="1.0" encoding="UTF-8"?>'];
-    lines.push(`<testsuite name="${xmlEscape(suiteName)}" tests="${cases.length}" failures="${failures}" skipped="${skipped}" time="${(r.phaseTimings.totalMs ?? 0) / 1000}">`);
+    lines.push(`<testsuites name="${escapeXml(suiteName)}" tests="${cases.length + r.findings.length}" failures="${failures + findingFailures}" skipped="${skipped + findingSkipped}" time="${timeSec}">`);
+    lines.push(`  <testsuite name="${escapeXml(suiteName)}" tests="${cases.length}" failures="${failures}" skipped="${skipped}" time="${timeSec}">`);
+    if (policy) {
+        lines.push('    <properties>');
+        lines.push(`      <property name="swipium.releaseGate" value="${policy.block ? 'fail' : 'pass'}"></property>`);
+        lines.push(`      <property name="swipium.releaseGate.reason" value="${escapeXml(policy.reason)}"></property>`);
+        lines.push('    </properties>');
+    }
     for (const n of cases) {
-        const name = xmlEscape(n.workflow);
-        const msg = xmlEscape([n.category, n.reason, n.missingPrecondition].filter(Boolean).join(': ') || n.outcome);
-        if (n.outcome === 'fail') {
-            lines.push(`  <testcase name="${name}" classname="${xmlEscape(suiteName)}">`);
-            lines.push(`    <failure message="${msg}"></failure>`);
-            lines.push(`  </testcase>`);
+        const text = [n.category, n.reason, n.missingPrecondition].filter(Boolean).join(': ') || n.outcome;
+        const body = [];
+        const verdict = caseVerdict(n);
+        if (verdict === 'failure')
+            body.push(`      <failure message="${escapeXml(text)}">${escapeXml(text)}</failure>`);
+        else if (verdict === 'skipped') {
+            const why = n.outcome === 'fail' ? `policy ${lenient.get(workflowPolicyKey(n))} (release gate not blocked): ${text}` : text;
+            body.push(`      <skipped message="${escapeXml(why)}"></skipped>`);
         }
-        else if (n.outcome === 'blocked' || n.outcome === 'skipped' || n.outcome === 'not_applicable') {
-            lines.push(`  <testcase name="${name}" classname="${xmlEscape(suiteName)}">`);
-            lines.push(`    <skipped message="${msg}"></skipped>`);
-            lines.push(`  </testcase>`);
-        }
-        else {
-            lines.push(`  <testcase name="${name}" classname="${xmlEscape(suiteName)}"></testcase>`);
+        junitTestcase(lines, n.workflow, suiteName, body, n.artifactUris ?? []);
+    }
+    lines.push('  </testsuite>');
+    if (r.findings.length) {
+        const findingsSuite = `${suiteName}.findings`;
+        lines.push(`  <testsuite name="${escapeXml(findingsSuite)}" tests="${r.findings.length}" failures="${findingFailures}" skipped="${findingSkipped}" time="0">`);
+        for (const f of r.findings) {
+            const name = `[${f.severity}] ${f.layer ?? '?'}/${f.kind}`;
+            const detail = `${f.detail}${f.evidence ? `: "${f.evidence}"` : ''}${f.nextStep ? ` Next: ${f.nextStep}` : ''}`;
+            const body = [];
+            const systemOut = f.screenshotUri ? [f.screenshotUri] : [];
+            const verdict = findingVerdict(f);
+            if (verdict === 'failure')
+                body.push(`      <failure message="${escapeXml(f.failureCode ?? f.kind)}">${escapeXml(detail)}</failure>`);
+            else if (verdict === 'skipped') {
+                body.push(`      <skipped message="${escapeXml(`policy ${lenient.get(findingPolicyKey(f))} (release gate not blocked): ${f.failureCode ?? f.kind}`)}"></skipped>`);
+                systemOut.unshift(detail);
+            }
+            else
+                systemOut.unshift(detail);
+            junitTestcase(lines, name, findingsSuite, body, systemOut);
         }
+        lines.push('  </testsuite>');
     }
-    lines.push('</testsuite>');
+    lines.push('</testsuites>');
     return lines.join('\n');
 }
+function sarifLevel(severity) {
+    return severity === 'high' ? 'error' : severity === 'medium' ? 'warning' : 'note';
+}
+/** Stable 16-hex digest (volatile ids/timestamps scrubbed) for SARIF partialFingerprints. */
+function stableHash(...parts) {
+    return createHash('sha256')
+        .update(parts.map((p) => scrubVolatile(p.toLowerCase())).join('|'))
+        .digest('hex')
+        .slice(0, 16);
+}
+/** SARIF 2.1.0 for code-scanning sinks (GitHub `upload-sarif`). Findings > results with
+ *  ruleId = failureCode/kind and level from severity (high > error, medium > warning, low > note); failed
+ *  workflows are results too. Per GitHub's SARIF requirements
+ *  (https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning):
+ *   - every result has locations[0] > a REAL repo-relative file (`uriBaseId: %SRCROOT%`, full
+ *     region at line 1): the app-map source of the screen/workflow when known, else the project
+ *     manifest (`options.sources`, built by resolveSarifSources). Results without one are dropped
+ *     by code scanning ("at least one location is required").
+ *   - partialFingerprints carry a stable per-result hash (own `primaryLocationLineHash`, so results
+ *     anchored to the same manifest line don't collapse into one alert) plus `swipium/v1`.
+ *   - rules carry short/full descriptions + help from the failure catalog.
+ *  swipium:// evidence URIs stay in relatedLocations / properties. invocations[0].executionSuccessful
+ *  means "the tool ran" (always true here); the release-gate verdict lives in run.properties. */
+export function toSarif(r, policy, options = {}) {
+    const sources = options.sources ?? { defaultUri: 'package.json' };
+    const anchor = (file) => ({
+        physicalLocation: {
+            artifactLocation: { uri: file, uriBaseId: '%SRCROOT%' },
+            region: { startLine: 1, startColumn: 1, endLine: 1, endColumn: 2 },
+        },
+    });
+    const evidenceLocations = (uris) => uris.length
+        ? {
+            relatedLocations: uris.map((uri, i) => ({
+                id: i + 1,
+                physicalLocation: { artifactLocation: { uri } },
+                message: { text: 'Swipium evidence artifact (resolve with qa_get_artifact)' },
+            })),
+        }
+        : {};
+    const seen = new Map();
+    const fingerprints = (ruleId, ...identity) => {
+        const base = stableHash(ruleId, ...identity);
+        // Two genuinely identical results in one run still need distinct alerts-per-occurrence ids.
+        const n = (seen.get(base) ?? 0) + 1;
+        seen.set(base, n);
+        return { primaryLocationLineHash: `${base}:${n}`, 'swipium/v1': `${base}:${n}` };
+    };
+    const results = r.findings.map((f) => {
+        const ruleId = f.failureCode ?? f.kind;
+        const file = (f.screen && sources.byScreen?.[f.screen.toLowerCase()]) || sources.defaultUri;
+        return {
+            ruleId,
+            level: sarifLevel(f.severity),
+            message: { text: `${f.detail}${f.evidence ? `: "${f.evidence}"` : ''}${f.nextStep ? ` Next: ${f.nextStep}` : ''}` },
+            locations: [anchor(file)],
+            partialFingerprints: fingerprints(ruleId, f.kind, f.screen ?? '', f.detail),
+            ...evidenceLocations(f.screenshotUri ? [f.screenshotUri] : []),
+            properties: {
+                severity: f.severity,
+                ...(f.layer ? { layer: f.layer } : {}),
+                ...(f.bucket ? { bucket: f.bucket } : {}),
+                ...(f.screen ? { screen: f.screen } : {}),
+                ...(f.retrySafe == null ? {} : { retrySafe: f.retrySafe }),
+                ...(f.screenshotUri ? { evidenceUris: [f.screenshotUri] } : {}),
+            },
+        };
+    });
+    for (const n of r.testOutcomes) {
+        if (n.outcome !== 'fail')
+            continue;
+        const ruleId = n.steps?.find((s) => s.failureCode)?.failureCode ?? n.category ?? 'WORKFLOW_FAILED';
+        const file = sources.byWorkflow?.[n.workflow.toLowerCase()] ?? sources.defaultUri;
+        results.push({
+            ruleId,
+            level: 'error',
+            message: { text: `${n.workflow}: ${[n.reason, n.missingPrecondition].filter(Boolean).join('; ') || 'workflow failed'}` },
+            locations: [anchor(file)],
+            partialFingerprints: fingerprints(ruleId, 'workflow', n.workflow),
+            ...evidenceLocations(n.artifactUris ?? []),
+            properties: {
+                workflow: n.workflow,
+                outcome: n.outcome,
+                ...(n.category ? { category: n.category } : {}),
+                ...(n.artifactUris?.length ? { evidenceUris: n.artifactUris } : {}),
+            },
+        });
+    }
+    const catalog = FAILURES;
+    const rules = [...new Set(results.map((res) => res.ruleId))].map((id) => {
+        const info = catalog[id];
+        const short = info?.summary ?? `Swipium ${id.replace(/_/g, ' ').toLowerCase()}`;
+        const full = info ? `${info.summary}. Bucket: ${info.bucket}.` : `Swipium mobile QA result "${id}" observed on a device run.`;
+        const help = info?.recovery ?? 'Open the linked Swipium evidence (screenshots, logs) for this run and reproduce on a device.';
+        return {
+            id,
+            name: id,
+            shortDescription: { text: short.slice(0, 1024) },
+            fullDescription: { text: full.slice(0, 1024) },
+            help: { text: help, markdown: help },
+            properties: { tags: ['swipium', 'mobile-qa', ...(info?.bucket ? [info.bucket] : [])] },
+        };
+    });
+    const sarif = {
+        $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+        version: '2.1.0',
+        runs: [
+            {
+                tool: { driver: { name: 'swipium', informationUri: 'https://github.com/GeroPalombo/swipium', rules } },
+                automationDetails: { id: `swipium/${r.appId ?? 'app'}/` },
+                originalUriBaseIds: {
+                    '%SRCROOT%': { description: { text: 'The project root Swipium ran against (repository checkout root in CI).' } },
+                },
+                invocations: [{ executionSuccessful: true }],
+                results,
+                properties: {
+                    sessionId: r.sessionId,
+                    appId: r.appId,
+                    device: r.device,
+                    releaseRisk: r.executiveSummary.risk,
+                    nextAction: r.executiveSummary.nextAction,
+                    releaseGateVerdict: policy ? (policy.block ? 'block' : 'pass') : r.executiveSummary.risk === 'block' ? 'block' : 'pass',
+                    ...(policy ? { releaseGate: policy } : {}),
+                },
+            },
+        ],
+    };
+    return JSON.stringify(sarif, null, 2);
+}
+/** Longest free-text cell in the job summary; one giant log dump must not eat the 1 MiB budget. */
+const SUMMARY_CELL_MAX = 2000;
+function summaryCell(s) {
+    const clipped = s.length > SUMMARY_CELL_MAX ? `${s.slice(0, SUMMARY_CELL_MAX - 1)}…` : s;
+    return tableCell(mdText(clipped)).replace(/\r?\n/g, '<br>');
+}
+/** Neutralize Markdown/HTML in free text shown in the job summary (app ids, device names, policy
+ *  reasons, next actions come from the device / project and are not trusted Markdown). */
+export function mdText(s) {
+    return s
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/([\\`*_[\]#|~])/g, '\\$1');
+}
+/** Inline-code span that survives backticks/newlines in the value. */
+function mdCode(s) {
+    const flat = s.replace(/\r?\n/g, ' ');
+    return flat.includes('`') ? `\`\` ${flat.replace(/``+/g, '`')} \`\`` : `\`${flat}\``;
+}
+/** GitHub caps a step summary at 1 MiB (larger uploads are rejected with an error annotation). We
+ *  stop at ~900 KB so the verdict survives, and say so. */
+export const GITHUB_SUMMARY_MAX_BYTES = 900 * 1024;
+/** Concise GitHub Actions job-summary Markdown (write it to $GITHUB_STEP_SUMMARY): verdict,
+ *  counts by severity, top findings table, workflow outcomes, and evidence links. Capped at
+ *  GITHUB_SUMMARY_MAX_BYTES with a truncation note. */
+export function toGithubSummary(r, policy) {
+    const L = [];
+    L.push(`## Swipium QA: ${RISK_BADGE[r.executiveSummary.risk] ?? mdText(r.executiveSummary.risk.toUpperCase())}`);
+    L.push('');
+    L.push(`App ${mdCode(r.appId ?? 'unknown')} on ${mdCode(r.device ?? 'device')}, session ${mdCode(r.sessionId)}.`);
+    L.push('');
+    if (policy)
+        L.push(`**Release gate (policy):** ${policy.block ? '❌ FAIL' : '✅ PASS'}: ${mdText(policy.reason)}`, '');
+    L.push(`**Next action:** ${mdText(r.executiveSummary.nextAction)}`);
+    L.push('');
+    const sevCount = (sev) => r.findings.filter((f) => f.severity === sev).length;
+    const outcomes = Object.entries(r.outcomeTally)
+        .map(([k, v]) => `${OUTCOME_MARK[k] ?? ''} ${mdText(k)}=${v}`)
+        .join(' · ');
+    L.push(`Findings: **${sevCount('high')} high** · ${sevCount('medium')} medium · ${sevCount('low')} low. Workflows: ${outcomes || 'none recorded'}.`);
+    if (r.findings.length) {
+        L.push('', '### Top findings', '', '| Severity | Code | Detail | Evidence |', '| --- | --- | --- | --- |');
+        const bySeverity = { high: 0, medium: 1, low: 2 };
+        const top = [...r.findings].sort((a, b) => (bySeverity[a.severity] ?? 3) - (bySeverity[b.severity] ?? 3)).slice(0, 10);
+        for (const f of top) {
+            const evidence = f.screenshotUri ? `[screenshot](${f.screenshotUri})` : '-';
+            const times = f.count && f.count > 1 ? ` (×${f.count})` : '';
+            L.push(`| ${summaryCell(f.severity)} | ${tableCell(mdCode(f.failureCode ?? f.kind))} | ${summaryCell(f.detail)}${times} | ${evidence} |`);
+        }
+    }
+    const problems = r.testOutcomes.filter((n) => n.outcome !== 'pass');
+    if (problems.length) {
+        L.push('', '### Failed / blocked workflows', '', '| Workflow | Outcome | Reason | Evidence |', '| --- | --- | --- | --- |');
+        for (const n of problems) {
+            const reason = [n.category, n.reason, n.missingPrecondition].filter(Boolean).join(': ') || '-';
+            const evidence = (n.artifactUris ?? []).map((uri, i) => `[${i + 1}](${uri})`).join(' ') || '-';
+            L.push(`| ${summaryCell(n.workflow)} | ${OUTCOME_MARK[n.outcome] ?? ''} ${n.outcome} | ${summaryCell(reason)} | ${evidence} |`);
+        }
+    }
+    const evidenceArtifacts = r.artifacts.filter((a) => ['screenshot', 'recording', 'report'].includes(a.kind)).slice(0, 10);
+    if (evidenceArtifacts.length) {
+        L.push('', '### Evidence', '');
+        for (const a of evidenceArtifacts)
+            L.push(`- ${mdCode(a.uri)} (${mdText(a.kind)}${a.label ? `: ${mdText(a.label)}` : ''})`);
+    }
+    L.push('', '_Generated by Swipium._');
+    return capSummary(L);
+}
+/** Join lines, dropping trailing ones (whole lines, never mid-table-row) past the byte cap. */
+function capSummary(lines) {
+    const full = lines.join('\n');
+    if (Buffer.byteLength(full, 'utf8') <= GITHUB_SUMMARY_MAX_BYTES)
+        return full;
+    const note = `\n\n> ⚠️ Summary truncated at ${Math.round(GITHUB_SUMMARY_MAX_BYTES / 1024)} KB (GitHub's step-summary limit is 1 MiB). See the JUnit/SARIF/Markdown exports for the full report.`;
+    const budget = GITHUB_SUMMARY_MAX_BYTES - Buffer.byteLength(note, 'utf8');
+    const kept = [];
+    let used = 0;
+    for (const line of lines) {
+        const size = Buffer.byteLength(line, 'utf8') + 1;
+        if (used + size > budget)
+            break;
+        kept.push(line);
+        used += size;
+    }
+    return kept.join('\n') + note;
+}
 //# sourceMappingURL=export.js.map