/**
 * `@hover-dev/pentest` — the discovery half of Hover security.
 *
 * Where `@hover-dev/security` crystallizes confirmed findings into a durable
 * `.security.spec.ts` (regression, CI), this package turns a session's recorded
 * checks into a **findings report** (Markdown). The agent sweeps broadly with
 * the security MCP tools (suggest_probes / replay_flow); pentest renders the
 * result. A finding can still be locked into a regression test via
 * @hover-dev/security — discovery feeds crystallization.
 *
 * v0 ships the report renderer. The sweep orchestration + a dev-time
 * "run a scan" entry point land next.
 */
import { mkdir, writeFile } from 'node:fs/promises';
import { join } from 'node:path';
import type { SecurityCheckStep } from '@hover-dev/probe-engine';
import { renderFindingsReport, type ReportOptions } from './renderReport.js';

export { renderFindingsReport, type ReportOptions } from './renderReport.js';
export { buildScanObjective, type ScanObjectiveOptions } from './objective.js';

export interface WriteReportOptions extends ReportOptions {
  devRoot: string;
  /** Slug for the output file. */
  slug?: string;
  checks: SecurityCheckStep[];
}

export interface WriteReportResult {
  path: string;
  slug: string;
  markdown: string;
}

/** Render + write a findings report to
 *  `<devRoot>/__vibe_tests__/<slug>.security-report.md`. */
export async function writeFindingsReport(opts: WriteReportOptions): Promise<WriteReportResult> {
  const markdown = renderFindingsReport(opts.checks, {
    name: opts.name,
    findings: opts.findings,
    notTested: opts.notTested,
  });
  const slug = (opts.slug ?? opts.name ?? 'scan').replace(/[^a-z0-9-]+/gi, '-').toLowerCase();
  const dir = join(opts.devRoot, '__vibe_tests__');
  await mkdir(dir, { recursive: true });
  const path = join(dir, `${slug}.security-report.md`);
  await writeFile(path, markdown, 'utf-8');
  return { path, slug, markdown };
}
