// engine/security-analyzer/report-builder.ts — Full security report builder
// SPEC-029
import { generateOwaspCriteria } from './criteria-generator.js';
import { calculateSecurityScore, scanCodeForViolations } from './scoring.js';
// === Full security report builder ===
export async function buildSecurityReport(specId, _specContent, profiles, codeFiles) {
    const gaps = await generateOwaspCriteria(profiles);
    const violations = codeFiles.length > 0 ? await scanCodeForViolations(codeFiles) : [];
    const score = calculateSecurityScore(gaps, violations);
    const recommendations = buildRecommendations(gaps, violations);
    return {
        specId,
        score,
        gaps,
        violations,
        recommendations,
    };
}
function buildRecommendations(gaps, violations) {
    const recs = [];
    const criticalViolations = violations.filter((v) => v.severity === 'critical');
    if (criticalViolations.length > 0) {
        recs.push(`Fix ${criticalViolations.length} critical code security violation(s) before release`);
    }
    const missingHighPriority = gaps.filter((g) => g.verificationStatus === 'missing' &&
        (g.owasp === 'A01-broken-access-control' || g.owasp === 'A03-injection'));
    if (missingHighPriority.length > 0) {
        recs.push(`Add ${missingHighPriority.length} missing high-priority security acceptance criteria (A01/A03)`);
    }
    /* v8 ignore next 3 */
    if (gaps.length > 5) {
        recs.push('Consider running a threat modeling session (STRIDE) for this feature');
    }
    if (recs.length === 0) {
        recs.push('Security posture looks good — maintain current standards for future features');
    }
    return recs;
}
//# sourceMappingURL=report-builder.js.map