synabun 2.0.10 → 2.1.0

package/lib/update-snapshot.js

@@ -0,0 +1,228 @@
+/**
+ * SynaBun — the desktop app's protection of the data before an update
+ * (`<entry> update-snapshot --json`, packaged/runtime/bootstrap.mjs).
+ *
+ * A new version never runs on user state without a verified pre-update
+ * snapshot that is still exact (lib/first-launch-protection.js). The desktop
+ * app takes that snapshot itself, before it replaces its own files, and hands it
+ * over to the new version's first start, which then takes none when nothing
+ * changed since: the slow part of an update happens while the old version still
+ * shows its window, never in a window that is gone.
+ *
+ *   prepare   while SynaBun still runs and the update waits for its moment (a
+ *             countdown, an idle minute after the download): the snapshot is
+ *             taken in the background, or the one taken earlier (--reuse) is
+ *             kept when it is still exact
+ *   install   after the app stopped its server, right before it replaces its
+ *             files: the prepared snapshot when it is still exact, otherwise a
+ *             new one; then the handoff in data/update-handoff.json (status
+ *             `prepared`, the install's id, the archive's stamp). The new copy
+ *             marks it `installed` once it runs
+ *             (packaging/desktop/src/updater/state.mjs); a swap that failed or
+ *             rolled back marks it `cancelled`
+ *
+ * "Still exact" is decided from the data itself, never from what one process
+ * saw: the snapshot records what it was taken from (every database's
+ * fingerprint, every other file's content) and checkUpgradeSnapshotFreshness
+ * compares the data home with it now. A memory saved meanwhile by any process
+ * (the server on its way out, an AI tool's own MCP server) makes it stale. The
+ * new version's first start makes the same check before its server, and so any
+ * migration, runs: a write during the swap is caught there.
+ *
+ * The snapshot is the backup service's upgrade snapshot (createUpgradeSnapshot:
+ * a clone of each database where the file system clones, stored uncompressed,
+ * checksummed as it is written, every database copy passing SQLite's integrity
+ * check, read back once), so Settings > restore and `synabun restore-backup`
+ * restore it as any backup. Its stamp (device, inode, size, modification time)
+ * lets the new version know the file is the one that was read back, without
+ * reading it again.
+ *
+ * Every step is one JSON line on stdout: { type: 'progress', phase, ... },
+ * then { type: 'done', ... } or { type: 'failed', code, message }. Phases:
+ * `check` (a prepared snapshot is compared with the data), `stale` (it is not
+ * used: `reason`), `reuse`, then those of createUpgradeSnapshot for a new one
+ * (collect, copy, archive, verify, integrity).
+ */
+
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { basename, dirname, relative, resolve, isAbsolute } from 'node:path';
+import { dataHomeHasState } from './data-home-migration.js';
+
+export const UPDATE_HANDOFF_FILE = 'update-handoff.json';
+export const handoffPathFor = (dataHome) => resolve(dataHome, 'data', UPDATE_HANDOFF_FILE);
+export const updateSnapshotFolder = (dataHome) => resolve(dataHome, 'backups', 'updates');
+
+const VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+const INSTALL_ID = /^[A-Za-z0-9_-]{6,64}$/;
+const SNAPSHOT_NAME = /^synabun-pre-update-[\dT:.\-Z]+\.zip$/;
+
+function readJson(path) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; }
+}
+
+function writeJsonAtomic(path, value) {
+  mkdirSync(dirname(path), { recursive: true });
+  const temp = `${path}.${process.pid}.tmp`;
+  writeFileSync(temp, JSON.stringify(value, null, 2) + '\n', 'utf8');
+  renameSync(temp, path);
+}
+
+function inside(folder, path) {
+  const rel = relative(resolve(folder), resolve(path));
+  return !!rel && !rel.startsWith('..') && !isAbsolute(rel);
+}
+
+/**
+ * The command line: --target <version> [--current <version>] [--install-id <id>] [--prepare]
+ * [--reuse <file> --reuse-stamp <json>] [--discard <file>] (a prepared snapshot that is no longer exact: its room
+ * goes to the new one).
+ */
+export function parseUpdateSnapshotArgs(args = []) {
+  const value = (name) => {
+    const at = args.indexOf(name);
+    return at >= 0 && typeof args[at + 1] === 'string' ? args[at + 1] : null;
+  };
+  const target = value('--target');
+  const current = value('--current');
+  const installId = value('--install-id');
+  const reuse = value('--reuse');
+  const discard = value('--discard');
+  let reuseStamp = null;
+  try { reuseStamp = value('--reuse-stamp') ? JSON.parse(value('--reuse-stamp')) : null; } catch { reuseStamp = null; }
+  if (!target || !VERSION.test(target)) return { error: 'a --target version' };
+  if (current && !VERSION.test(current)) return { error: 'a --current version' };
+  if (installId && !INSTALL_ID.test(installId)) return { error: 'an --install-id of letters, digits, _ and -' };
+  const prepare = args.includes('--prepare');
+  if (!prepare && !installId) return { error: 'an --install-id (or --prepare)' };
+  return { target, current, installId, prepare, reuse, reuseStamp, discard };
+}
+
+/**
+ * Why the prepared snapshot at `path` cannot stand for this install, or null
+ * when it can: it is a pre-update snapshot in the update folder, the very file
+ * the preparation wrote and read back (its stamp is unchanged), its database
+ * passed SQLite's integrity check, and the data home is still what it was taken
+ * from (checkUpgradeSnapshotFreshness: whoever wrote since, it is stale).
+ */
+export async function preparedSnapshotProblem({ path, stamp, folderPath, service, dataHome = null, databasePath = null }) {
+  if (!path) return 'none was prepared';
+  if (!inside(folderPath, path) || !SNAPSHOT_NAME.test(basename(path))) return 'it is not a snapshot of the update folder';
+  if (!existsSync(path)) return 'its file is gone';
+  if (!service.sameBackupFile(path, stamp)) return 'its file changed after it was checked';
+  let manifest;
+  try {
+    manifest = await service.readBackupArchiveManifest(path);
+  } catch (error) {
+    return `its manifest cannot be read (${error?.message || error})`;
+  }
+  if (manifest?.kind !== 'pre-update' || manifest?.verified !== true) return 'it is not a verified pre-update snapshot';
+  if (manifest.database && manifest.database.integrity !== 'ok') return 'its database copy was not checked with SQLite\'s integrity check';
+  if (!dataHome) return null;
+  const freshness = await service.checkUpgradeSnapshotFreshness({ dataHome, manifest, ...(databasePath ? { databasePath } : {}) });
+  if (!freshness?.fresh) return `the data changed after it was taken (${freshness?.reason || 'unknown'})`;
+  return null;
+}
+
+/**
+ * Take (or reuse) the pre-update snapshot and, for an install, write the
+ * handoff. Everything that touches the system is a parameter, for the tests.
+ * Resolves the last event ({ type: 'done' | 'failed' }); `emit` gets every one.
+ */
+export async function runUpdateSnapshot({
+  dataHome,
+  current = null,
+  target,
+  installId = null,
+  prepare = false,
+  reuse = null,
+  reuseStamp = null,
+  discard = null,
+  emit = () => {},
+  loadBackupService = () => import('../neural-interface/lib/backup-service.js'),
+  now = () => new Date(),
+} = {}) {
+  const say = (event) => { try { emit(event); } catch { /* the caller went away: the work goes on */ } return event; };
+  const folderPath = updateSnapshotFolder(dataHome);
+  const databasePath = resolve(dataHome, 'mcp-data', 'memory.db');
+  const removable = (path) => !!path && existsSync(path) && inside(folderPath, path) && SNAPSHOT_NAME.test(basename(path));
+  // A data home with nothing of the user's in it needs no snapshot (the new version's first start agrees:
+  // lib/first-launch-protection.js), and gets no handoff.
+  if (!dataHomeHasState(dataHome)) return say({ type: 'done', skipped: 'no-state', prepared: !!prepare, reused: false, path: null });
+  let service;
+  try {
+    service = await loadBackupService();
+  } catch (error) {
+    return say({ type: 'failed', code: 'BACKUP_SERVICE', message: `the backup code could not be loaded: ${error?.message || error}` });
+  }
+  try {
+    let snapshot = null;
+    let reused = false;
+    let stale = null;
+    if (discard && discard !== reuse && removable(discard)) {
+      say({ type: 'progress', phase: 'stale', reason: 'the app said it is no longer exact' });
+      try { rmSync(discard, { force: true }); } catch { /* left for retention */ }
+    }
+    if (reuse) {
+      // The copy made ahead, compared with the data as it is now.
+      say({ type: 'progress', phase: 'check', path: reuse });
+      const checkStarted = Date.now();
+      stale = await preparedSnapshotProblem({ path: reuse, stamp: reuseStamp, folderPath, service, dataHome, databasePath });
+      if (!stale) {
+        snapshot = { path: reuse, name: basename(reuse), stamp: reuseStamp, timings: { check: Date.now() - checkStarted } };
+        reused = true;
+        say({ type: 'progress', phase: 'reuse', path: reuse });
+      } else {
+        say({ type: 'progress', phase: 'stale', reason: stale });
+        // A snapshot of an earlier moment: its room goes to the new one (it is never a user's file: the name and the
+        // folder are SynaBun's own).
+        if (removable(reuse)) {
+          try { rmSync(reuse, { force: true }); } catch { /* left for retention */ }
+        }
+      }
+    }
+    if (!snapshot) {
+      const taken = await service.createUpgradeSnapshot({
+        dataHome,
+        databasePath,
+        folderPath,
+        kind: 'pre-update',
+        appVersion: current,
+        onProgress: (detail) => say({ type: 'progress', ...detail }),
+        now,
+      });
+      snapshot = { path: taken.path, name: taken.name, stamp: taken.stamp, sizeBytes: taken.sizeBytes, database: taken.database, timings: taken.timings };
+    }
+    if (prepare) {
+      return say({ type: 'done', prepared: true, reused, stale, path: snapshot.path, stamp: snapshot.stamp, sizeBytes: snapshot.sizeBytes ?? null, timings: snapshot.timings ?? null });
+    }
+
+    // Older snapshots go by the usual rules; the one just made is the newest, and so kept.
+    try { service.applyBackupRetention({ folderPath }); } catch { /* housekeeping never stops an update */ }
+    const handoff = {
+      version: 1,
+      status: 'prepared',
+      source: 'desktop',
+      preparedAt: now().toISOString(),
+      current,
+      target,
+      installId,
+      snapshotPath: snapshot.path,
+      verifiedStamp: snapshot.stamp,
+      verifiedAt: now().toISOString(),
+      reused,
+    };
+    writeJsonAtomic(handoffPathFor(dataHome), handoff);
+    return say({ type: 'done', prepared: false, reused, stale, path: snapshot.path, stamp: snapshot.stamp, handoff: handoffPathFor(dataHome), timings: snapshot.timings ?? null });
+  } catch (error) {
+    return say({
+      type: 'failed',
+      code: error?.code === 'ENOSPC' ? 'NO_SPACE' : error?.code === 'EBACKUPDRIVE' ? 'NO_DRIVE' : error?.code === 'EINTEGRITY' ? 'INTEGRITY' : 'SNAPSHOT_FAILED',
+      message: String(error?.message || error).split('\n')[0].slice(0, 400),
+    });
+  }
+}
+
+/** The handoff as it is now, or null. */
+export function readUpdateHandoff(dataHome) {
+  return readJson(handoffPathFor(dataHome));
+}

package/lib/virustotal.mjs

@@ -0,0 +1,192 @@
+/** Release-only VirusTotal API v3 client. No API calls occur on import. */
+import { createHash } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { stat } from 'node:fs/promises';
+import { basename } from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
+
+export const DIRECT_LIMIT = 32 * 1024 * 1024;
+export const UPLOAD_LIMIT = 650 * 1024 * 1024;
+export const API = 'https://www.virustotal.com/api/v3/';
+export const README_VERIFICATION = '<!-- synabun:verification:start -->\nPackage verification: [downloadable VirusTotal reports and SHA-256 hashes](https://github.com/danilokhury/Synabun/releases/latest). Match the report to your exact version and file hash. Reports record engine coverage and analysis dates; they are not a guarantee of safety. Website results describe URL reputation, not a vulnerability audit.\n<!-- synabun:verification:end -->';
+export function verificationReadme(text) {
+  return text.includes('<!-- synabun:verification:start -->')
+    ? text.replace(/<!-- synabun:verification:start -->[\s\S]*?<!-- synabun:verification:end -->/, README_VERIFICATION)
+    : `${text.trimEnd()}\n\n${README_VERIFICATION}\n`;
+}
+export async function hashFile(path) {
+  const hash = createHash('sha256');
+  for await (const chunk of createReadStream(path)) hash.update(chunk);
+  return hash.digest('hex');
+}
+export const digest = value => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+export function evidenceDigest(item) {
+  const { source, analysis_id, evidence_digest, review, ...evidence } = item;
+  return digest(evidence);
+}
+export function credentials(key = process.env.VIRUSTOTAL_API_KEY) {
+  if (typeof key !== 'string' || !key.trim()) throw new Error('Set VIRUSTOTAL_API_KEY locally or as a GitHub Actions secret. Eligible VirusTotal API access and public sample-sharing consent are required; see docs/release-pipeline.md.');
+  return key.trim();
+}
+const safeName = name => name.replace(/[^a-zA-Z0-9_.-]/g, '_');
+export function trustedUrl(value) {
+  const url = new URL(value);
+  if (url.protocol !== 'https:' || !(url.hostname === 'virustotal.com' || url.hostname.endsWith('.virustotal.com')) || url.username || url.password || (url.port && url.port !== '443')) throw new Error('VirusTotal returned an untrusted upload URL');
+  return url.href;
+}
+export async function* multipart(path, boundary) {
+  yield Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="file"; filename="${safeName(basename(path))}"\r\nContent-Type: application/octet-stream\r\n\r\n`);
+  yield* createReadStream(path);
+  yield Buffer.from(`\r\n--${boundary}--\r\n`);
+}
+
+export class VirusTotal {
+  constructor({ key, fetchImpl = globalThis.fetch, sleep = delay, now = Date.now, intervalMs = 15500, requestMs = 120000, uploadMs = 900000, scanMs = 1200000, pollMs = 30000, retries = 3 } = {}) {
+    this.key = credentials(key); this.fetch = fetchImpl; this.sleep = sleep; this.now = now;
+    Object.assign(this, { intervalMs, requestMs, uploadMs, scanMs, pollMs, retries }); this.nextRequest = 0; this.queue = Promise.resolve();
+  }
+  async wait(ms, deadline) {
+    if (this.now() + ms >= deadline) throw new Error('VirusTotal analysis deadline exceeded; retry the same bytes later');
+    if (ms > 0) await this.sleep(ms);
+  }
+  async pace(deadline) {
+    // Reserve request starts serially, even when library callers scan concurrently.
+    const turn = this.queue.then(async () => {
+      await this.wait(Math.max(0, this.nextRequest - this.now()), deadline);
+      if (this.now() >= deadline) throw new Error('VirusTotal analysis deadline exceeded');
+      this.nextRequest = this.now() + this.intervalMs;
+    });
+    this.queue = turn.catch(() => {});
+    await turn;
+  }
+  async request(path, { method = 'GET', body, headers = {}, deadline = this.now() + this.scanMs, notFound = false, timeoutMs = this.requestMs } = {}) {
+    const url = trustedUrl(path.startsWith('https:') ? path : API + path);
+    for (let attempt = 0; attempt <= this.retries; attempt++) {
+      await this.pace(deadline);
+      let response;
+      let payload;
+      try {
+        response = await this.fetch(url, { method, headers: { ...headers, 'x-apikey': this.key },
+          body: typeof body === 'function' ? body() : body, duplex: 'half', redirect: 'error',
+          signal: AbortSignal.timeout(Math.max(1, Math.min(timeoutMs, deadline - this.now()))) });
+        // Read a bounded JSON response, including its body in the HTTP timeout.
+        const chunks = []; let size = 0;
+        for await (const chunk of response.body || []) {
+          size += chunk.length;
+          if (size > 4 * 1024 * 1024) throw new Error('response too large');
+          chunks.push(Buffer.from(chunk));
+        }
+        payload = Buffer.concat(chunks).toString('utf8');
+      } catch {
+        if (attempt === this.retries) throw new Error('VirusTotal request failed or timed out; no verdict available');
+        await this.wait(1000 * 2 ** attempt, deadline); continue;
+      }
+      if (response.status === 404 && notFound) return null;
+      if (response.status === 429 || response.status >= 500) {
+        if (attempt === this.retries) throw new Error(`VirusTotal HTTP ${response.status}; retry budget exhausted`);
+        const retry = response.headers.get('retry-after');
+        const ms = retry && /^\d+(\.\d+)?$/.test(retry) ? Number(retry) * 1000 : retry ? Date.parse(retry) - this.now() : 1000 * 2 ** attempt;
+        await this.wait(Math.max(1000, Number.isFinite(ms) ? ms : 1000), deadline); continue;
+      }
+      if (!response.ok) throw new Error(`VirusTotal HTTP ${response.status}; no verdict available`);
+      try { return JSON.parse(payload); } catch { throw new Error('VirusTotal returned invalid JSON'); }
+    }
+  }
+  async poll(id, deadline) {
+    if (typeof id !== 'string' || !id) throw new Error('VirusTotal did not return an analysis ID');
+    for (let count = 0; count < 40; count++) {
+      const result = await this.request(`analyses/${encodeURIComponent(id)}`, { deadline });
+      const status = result?.data?.attributes?.status;
+      if (status === 'completed') return result;
+      if (!['queued', 'in-progress'].includes(status)) throw new Error('VirusTotal returned an unknown analysis status');
+      await this.wait(this.pollMs, deadline);
+    }
+    throw new Error('VirusTotal analysis unfinished after 40 polls; retry later');
+  }
+  async file(path, expectedHash) {
+    const size = (await stat(path)).size;
+    if (size > UPLOAD_LIMIT) throw new Error(`VirusTotal 650 MB upload limit exceeded: ${basename(path)}`);
+    const sha256 = await hashFile(path);
+    if (expectedHash && sha256 !== expectedHash) throw new Error(`SHA-256 mismatch: ${basename(path)}`);
+    const deadline = this.now() + this.scanMs;
+    const cached = await this.request(`files/${sha256}`, { deadline, notFound: true });
+    let report;
+    const a = cached?.data?.attributes;
+    if (cached && (cached.data.id !== sha256 || a?.sha256 !== sha256)) throw new Error('VirusTotal file SHA-256 mismatch');
+    if (cached && this.fresh(a?.last_analysis_date)) {
+      report = this.evidence({ kind: 'file', name: basename(path), sha256, size }, a.last_analysis_stats, a.last_analysis_results, a.last_analysis_date, 'cached');
+    } else {
+      let analysis;
+      if (cached) analysis = await this.request(`files/${sha256}/analyse`, { method: 'POST', deadline });
+      else {
+        const upload = size > DIRECT_LIMIT ? (await this.request('files/upload_url', { deadline }))?.data : API + 'files';
+        if (typeof upload !== 'string') throw new Error('VirusTotal did not return an upload URL');
+        const boundary = `synabun-${sha256}`;
+        const head = `--${boundary}\r\nContent-Disposition: form-data; name="file"; filename="${safeName(basename(path))}"\r\nContent-Type: application/octet-stream\r\n\r\n`;
+        const tail = `\r\n--${boundary}--\r\n`;
+        analysis = await this.request(upload, { method: 'POST', deadline, timeoutMs: this.uploadMs, body: () => multipart(path, boundary),
+          headers: { 'content-type': `multipart/form-data; boundary=${boundary}`, 'content-length': String(Buffer.byteLength(head) + size + Buffer.byteLength(tail)) } });
+      }
+      const result = await this.poll(analysis?.data?.id, deadline);
+      if (result.meta?.file_info?.sha256 !== sha256) throw new Error('VirusTotal analysis SHA-256 mismatch');
+      const attrs = result.data.attributes;
+      report = this.evidence({ kind: 'file', name: basename(path), sha256, size }, attrs.stats, attrs.results, attrs.date, cached ? 'reanalysed' : 'uploaded', analysis.data.id);
+    }
+    if (await hashFile(path) !== sha256 || (await stat(path)).size !== size) throw new Error(`Artifact changed during scanning: ${basename(path)}`);
+    return report;
+  }
+  fresh(date) { return Number.isInteger(date) && date > 0 && date * 1000 <= this.now() + 300000 && this.now() - date * 1000 <= 7 * 86400000; }
+  async url(value) {
+    const url = new URL(value);
+    if (url.protocol !== 'https:' || url.username || url.password) throw new Error('Website reputation scan requires a public HTTPS URL');
+    const subject = url.href; const id = Buffer.from(subject).toString('base64url');
+    const deadline = this.now() + this.scanMs;
+    const submitted = await this.request('urls', { method: 'POST', body: new URLSearchParams({ url: subject }), deadline });
+    const result = await this.poll(submitted?.data?.id, deadline);
+    // Verify the URL object too; do not attribute an analysis to an unrelated URL.
+    const object = await this.request(`urls/${id}`, { deadline });
+    if (object?.data?.attributes?.url !== subject) throw new Error('VirusTotal URL mismatch');
+    if (result.meta?.url_info?.url !== subject || !/^[a-f0-9]{64}$/.test(object.data.id)) throw new Error('VirusTotal URL analysis identity mismatch');
+    const a = result.data.attributes;
+    return this.evidence({ kind: 'url', name: subject, sha256: createHash('sha256').update(subject).digest('hex'), url: subject }, a.stats, a.results, a.date, 'submitted', submitted.data.id, object.data.id);
+  }
+  evidence(subject, stats, results, date, source, analysisId = null, urlId = null) {
+    if (!stats || !results || typeof results !== 'object' || !this.fresh(date)) throw new Error('VirusTotal evidence missing or stale; no verdict available');
+    const counts = Object.fromEntries(Object.keys(stats).sort().map(key => [key, stats[key]]));
+    if (!Object.values(counts).every(n => Number.isInteger(n) && n >= 0)) throw new Error('VirusTotal invalid engine counts');
+    const engines = Object.keys(results).sort().map(key => ({ id: key, category: results[key].category ?? null, engine: results[key].engine_name ?? key, version: results[key].engine_version ?? null, update: results[key].engine_update ?? null, result: results[key].result ?? null }));
+    for (const [category, count] of Object.entries(counts)) if (engines.filter(engine => engine.category === category).length !== count) throw new Error('VirusTotal engine counts do not match evidence');
+    if (Object.values(counts).reduce((sum, count) => sum + count, 0) !== engines.length || engines.some(engine => !Object.hasOwn(counts, engine.category))) throw new Error('VirusTotal engine counts do not match evidence');
+    const supported = ['harmless', 'undetected', 'malicious', 'suspicious'].reduce((n, key) => n + (counts[key] || 0), 0);
+    const detections = (counts.malicious || 0) + (counts.suspicious || 0);
+    const status = supported < (subject.kind === 'file' ? 10 : 20) ? 'inconclusive' : detections ? 'detections' : 'no-detections';
+    const evidence = { ...subject, status, analysis_status: 'completed', analysis_date: new Date(date * 1000).toISOString(), source, analysis_id: analysisId,
+      supported_engines: supported, total_engines: engines.length, counts, engines,
+      permalink: `https://www.virustotal.com/gui/${subject.kind === 'file' ? 'file/' + subject.sha256 : 'url/' + urlId}` };
+    return { ...evidence, evidence_digest: evidenceDigest(evidence), review: null };
+  }
+}
+
+export function applyReviews(items, reviews = [], now = Date.now()) {
+  if (!Array.isArray(reviews)) throw new Error('Review file must contain an array');
+  return items.map(item => {
+    if (item.status !== 'detections') return item;
+    const review = reviews.find(r => r.sha256 === item.sha256 && r.name === item.name && r.evidence_digest === item.evidence_digest);
+    if (!review) return item;
+    const at = Date.parse(review.reviewed_at), expires = Date.parse(review.expires_at);
+    if (![review.reviewer, review.reason, review.reference].every(v => typeof v === 'string' && v.trim().length >= 3) || !Number.isFinite(at) || !Number.isFinite(expires) || at > now || expires <= now || expires - at > 7 * 86400000) throw new Error('Matching VirusTotal review is incomplete or expired');
+    return { ...item, review: { reviewer: review.reviewer, reason: review.reason, reference: review.reference, reviewed_at: review.reviewed_at, expires_at: review.expires_at } };
+  });
+}
+export const approved = items => items.length > 0 && items.every(item => item.status === 'no-detections' || (item.status === 'detections' && item.review));
+const md = value => String(value).replace(/[|\r\n<>`\[\]\\]/g, ' ');
+export function reports(items) {
+  const sorted = [...items].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  const report = { schema: 1, policy: { minimum_file_engines: 10, minimum_url_engines: 20, max_age_days: 7 }, approved: approved(sorted), items: sorted };
+  const markdown = ['## VirusTotal verification', '', 'Match the exact file and SHA-256. Results describe engine detections and coverage at the analysis date, not a guarantee of safety. Website results describe URL reputation, not a vulnerability audit.', '',
+    '| Package / URL | SHA-256 | Status | Supported / total engines | Analysis date | Report |', '| --- | --- | --- | --- | --- | --- |',
+    ...sorted.map(i => `| ${md(i.name)} | ${i.sha256} | ${i.status}${i.review ? ' (owner reviewed)' : ''} | ${i.supported_engines ?? 0} / ${i.total_engines ?? 0} | ${md(i.analysis_date ?? 'unavailable')} | ${i.permalink ? `[VirusTotal](${i.permalink})` : 'unavailable'} |`), '',
+    ...sorted.filter(i => i.review).map(i => `Review for ${md(i.name)} (${i.sha256}), evidence ${i.evidence_digest}: ${md(i.review.reviewer)}; ${md(i.review.reason)}; reference ${md(i.review.reference)}; expires ${md(i.review.expires_at)}.`),
+    ...sorted.filter(i => i.error).map(i => `${md(i.name)}: ${md(i.error)}`), ''].join('\n');
+  return { json: JSON.stringify(report, null, 2) + '\n', markdown, report };
+}