@secureport/core 0.2.1 → 0.3.0

package/dist/fingerprint.js

@@ -0,0 +1,247 @@
+import { createHash } from 'node:crypto';
+/**
+ * Which fingerprint algorithm this build of the package implements.
+ *
+ * **A public contract, and the most consequential string in the package.** It
+ * is stored on every finding and every issue, everywhere, so that a fingerprint
+ * recorded a year ago can still be interpreted. Changing the algorithm means
+ * bumping this *and* running a per-organisation re-fingerprint migration that
+ * preserves history — never a silent recomputation, which would orphan every
+ * issue whose evidence no longer hashes to the same value.
+ *
+ * If you are tempted to "just tweak" the normaliser, that is this constant's
+ * job to prevent.
+ */
+export const FINGERPRINT_VERSION = 'fp_v1';
+/** A path segment that is entirely digits, e.g. the `123` in `/orders/123`. */
+const NUMERIC_SEGMENT = /^\d+$/u;
+/** A path segment that is a UUID in the canonical 8-4-4-4-12 form. */
+const UUID_SEGMENT = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
+/**
+ * The placeholder that a variable path segment collapses to.
+ *
+ * Exported because it appears in normalised locations, which appear in reports
+ * and in support conversations: someone reading `/orders/{id}` should be able
+ * to find out what produced it.
+ */
+export const PATH_PLACEHOLDER = '{id}';
+/**
+ * Decodes percent-encoding exactly once, and never throws.
+ *
+ * Once, not repeatedly: decoding until stable would make `%2541` and `%41`
+ * collapse to the same thing, so a target that double-encodes could be made to
+ * collide with one that does not.
+ *
+ * Malformed encoding is left alone rather than rejected. A fingerprint that
+ * throws on strange input is a fingerprint that loses a finding.
+ */
+function decodeOnce(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+/**
+ * Collapses one path segment to {@link PATH_PLACEHOLDER} if it identifies a
+ * record rather than a route.
+ */
+function collapseSegment(segment) {
+    if (NUMERIC_SEGMENT.test(segment) || UUID_SEGMENT.test(segment))
+        return PATH_PLACEHOLDER;
+    return segment;
+}
+/**
+ * Normalises a location so that the same weakness in the same place produces
+ * the same string, however the engine happened to write it down.
+ *
+ * This is the part of the fingerprint that decides whether `/orders/1` and
+ * `/orders/2` are one issue or two thousand. Applies, in order:
+ *
+ * - **Lowercases the host**, and converts an internationalised domain to
+ *   punycode, so `HTTPS://例え.テスト/x` and `https://xn--r8jz45g.xn--zckzah/x`
+ *   are one location.
+ * - **Drops a default port** (`:443` on https, `:80` on http) and keeps any
+ *   other, because `:8443` is a different service and `:443` is not.
+ * - **Decodes percent-encoding once.**
+ * - **Collapses numeric and UUID path segments** to `{id}`, so a per-record URL
+ *   does not open a per-record issue.
+ * - **Drops a trailing slash**, except on the root path where it is the path.
+ * - **Strips query values but keeps parameter names, sorted.** `?b=2&a=secret`
+ *   becomes `?a&b`. The names are structure and belong in identity; the values
+ *   are usually the payload that proved the weakness, which is evidence and
+ *   must never reach a fingerprint. Sorting means parameter order cannot split
+ *   one issue into two.
+ * - **Drops the fragment**, which the server never sees.
+ *
+ * Anything that is not a parseable absolute URL — a bare host, a file path, a
+ * `host:port` pair from a network scan — is normalised as a path alone. That is
+ * deliberate: refusing to fingerprint a non-HTTP finding would exclude whole
+ * classes of scanner from the model.
+ *
+ * @param location - Where the weakness was found.
+ * @returns The normalised location.
+ *
+ * @example
+ * ```ts
+ * normaliseLocation('HTTPS://API.Example.com:443/Orders/123/items/?b=2&a=secret#f');
+ * // 'https://api.example.com/Orders/{id}/items?a&b'
+ * ```
+ */
+export function normaliseLocation(location) {
+    const trimmed = location.trim();
+    let url;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        url = undefined;
+    }
+    // Not an absolute URL: normalise it as a bare path and stop. `new URL` would
+    // otherwise turn `example.com/x` into the `example.com:` protocol.
+    if (!url || url.protocol === '' || !url.host) {
+        return normalisePathOnly(trimmed);
+    }
+    // Not `decodeOnce` here: normalisePathOnly decodes, and decoding on the way
+    // in as well would decode twice — which would fold `%252F` into `%2F` into
+    // `/` and let a double-encoding target collide with a single-encoding one.
+    const path = normalisePathOnly(url.pathname);
+    // `url.host` already carries punycode and lower case, and omits a default
+    // port for the scheme.
+    const names = [...new Set([...url.searchParams.keys()].map(decodeOnce))].sort();
+    const query = names.length > 0 ? `?${names.join('&')}` : '';
+    return `${url.protocol}//${url.host}${path}${query}`;
+}
+/**
+ * Normalises a path with no scheme or host.
+ */
+function normalisePathOnly(path) {
+    const decoded = decodeOnce(path.trim());
+    if (decoded === '' || decoded === '/')
+        return decoded === '' ? '' : '/';
+    const collapsed = decoded
+        .split('/')
+        .map((segment) => collapseSegment(segment))
+        .join('/');
+    return collapsed.length > 1 && collapsed.endsWith('/') ? collapsed.slice(0, -1) : collapsed;
+}
+/**
+ * Maps `engine:ruleId` to a shared, engine-independent weakness key.
+ *
+ * **This table is the entire mechanism of cross-engine deduplication.** Without
+ * it a ZAP detection and a Nuclei detection of the same weakness fall back to
+ * CWE, and where either engine omits the CWE they never collide at all — you
+ * get per-engine tracking wearing the clothes of an issue tracker.
+ *
+ * **It is deliberately small, and that is not laziness.** A mapping asserts
+ * that a specific rule id means a specific weakness, and a wrong assertion
+ * silently merges two unrelated issues — worse than not mapping at all, because
+ * the merge is invisible. Rule ids cannot be known honestly until real scanner
+ * output has been parsed, which is what 4.4a and 4.4b do with committed
+ * fixtures. The table grows there, from evidence.
+ *
+ * **Entries must be added in pairs, per weakness, across engines — a half-filled
+ * table is worse than an empty one.** The mapping beats the CWE fallback, so
+ * mapping ZAP's HSTS rule while leaving Nuclei's unmapped gives them *different*
+ * keys, when falling back to `CWE-319` on both sides would have collided them
+ * correctly. Adding one engine's rule silently un-deduplicates the weakness.
+ * Found by importing a fixture from each engine and watching them stop
+ * agreeing.
+ *
+ * `00-DOMAIN.md` §10 leaves the eventual size open, leaning towards the top
+ * ~200 Nuclei templates plus ZAP's plugin list, with CWE fallback beyond.
+ *
+ * Keys are `${sourceEngine}:${sourceRuleId}`, both lowercased.
+ */
+export const VULN_KEY_MAP = Object.freeze({
+    // ZAP plugin ids are stable and documented, which is why the seed is ZAP's.
+    'zap:40012': 'xss-reflected',
+    'zap:40014': 'xss-persistent',
+    'zap:40018': 'sql-injection',
+    'zap:10038': 'csp-missing',
+    'zap:10035': 'hsts-missing',
+    'zap:10021': 'x-content-type-options-missing',
+    'zap:10020': 'x-frame-options-missing',
+    // Nuclei's side of the pairs above. Anything mapped for one engine and not
+    // the other stops the two agreeing, so these travel together.
+    'nuclei:xss-reflected': 'xss-reflected',
+    'nuclei:missing-hsts': 'hsts-missing',
+});
+/**
+ * The engine-independent key for a weakness class.
+ *
+ * Resolution order, per `00-DOMAIN.md` §4:
+ *
+ * 1. {@link VULN_KEY_MAP}, looked up by `engine:ruleId`.
+ * 2. `cwe` alone.
+ * 3. `category` alone.
+ * 4. `engine:ruleId` itself.
+ *
+ * **The spec says `cwe + '/' + category`, and that was tried and abandoned.**
+ * Engines do not share a category vocabulary: ZAP supplies no category at all,
+ * so reflected XSS there keys as `CWE-79`, while Nuclei tags the same finding
+ * `xss` and keys as `CWE-79/xss`. The two never collide — so the fallback
+ * actively prevented the cross-engine deduplication it exists to provide, which
+ * a fixture from each engine demonstrated immediately.
+ *
+ * CWE alone is coarser, and the coarseness is bounded: the fingerprint also
+ * carries the normalised location and the parameter, so two findings only merge
+ * when they share a weakness class *and* a place. Two genuinely different
+ * weaknesses under one CWE, at the same URL and parameter, is the case this
+ * gets wrong — and `POST /issues/{a}/merge/{b}` exists because something will.
+ *
+ * Steps 3 and 4 keep a finding trackable when there is no CWE at all. **Step 4
+ * never deduplicates across engines**, which is the honest outcome for a rule
+ * nobody has mapped: it tracks correctly and merges nothing it should not.
+ *
+ * @param input - What the engine reported.
+ * @returns The weakness key.
+ * @throws TypeError If nothing identifying is present at all.
+ */
+export function vulnKey(input) {
+    const engine = input.sourceEngine.trim().toLowerCase();
+    const ruleId = input.sourceRuleId?.trim().toLowerCase();
+    if (engine !== '' && ruleId !== undefined && ruleId !== '') {
+        const mapped = VULN_KEY_MAP[`${engine}:${ruleId}`];
+        if (mapped !== undefined)
+            return mapped;
+    }
+    const cwe = input.cwe?.trim().toUpperCase();
+    const category = input.category?.trim().toLowerCase();
+    if (cwe !== undefined && cwe !== '')
+        return cwe;
+    if (category !== undefined && category !== '')
+        return category;
+    if (engine !== '' && ruleId !== undefined && ruleId !== '')
+        return `${engine}:${ruleId}`;
+    throw new TypeError('cannot derive a vuln_key: a finding needs a mapped rule, a CWE, a category, or an engine rule id');
+}
+/**
+ * The content address of a weakness: `sha256(targetId | vulnKey | normalised
+ * location | parameter ?? port ?? '')`.
+ *
+ * Deterministic and pure — the same input always gives the same digest, on any
+ * machine, in any order, at any time. That is what lets findings from different
+ * runs and different engines reconcile into one issue.
+ *
+ * Uses Node's `node:crypto`, which is a builtin rather than a dependency, so
+ * the package still installs nothing. It does mean fingerprinting requires
+ * Node; report rendering does not, and rendering is the only part of this
+ * package a browser was ever going to run.
+ *
+ * @param input - The identifying facts.
+ * @returns A lowercase hex SHA-256 digest.
+ *
+ * @example
+ * ```ts
+ * const key = vulnKey({ sourceEngine: 'zap', sourceRuleId: '40012' });
+ * fingerprint({ targetId: 'tgt_1', vulnKey: key, location: '/search', parameter: 'q' });
+ * ```
+ */
+export function fingerprint(input) {
+    const tail = input.parameter ?? (input.port !== undefined ? String(input.port) : '');
+    const material = [input.targetId, input.vulnKey, normaliseLocation(input.location), tail].join('|');
+    return createHash('sha256').update(material, 'utf8').digest('hex');
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAE3C,+EAA+E;AAC/E,MAAM,eAAe,GAAG,QAAQ,CAAC;AAEjC,sEAAsE;AACtE,MAAM,YAAY,GAAG,kEAAkE,CAAC;AAExF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC;;;;;;;;;GASG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACzF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAEhC,IAAI,GAAoB,CAAC;IACzB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC;IAED,6EAA6E;IAC7E,mEAAmE;IACnE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7C,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE7C,0EAA0E;IAC1E,uBAAuB;IACvB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5D,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAExE,MAAM,SAAS,GAAG,OAAO;SACtB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;SAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;IAEb,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9F,CAAC;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,YAAY,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC1E,4EAA4E;IAC5E,WAAW,EAAE,eAAe;IAC5B,WAAW,EAAE,gBAAgB;IAC7B,WAAW,EAAE,eAAe;IAC5B,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,cAAc;IAC3B,WAAW,EAAE,gCAAgC;IAC7C,WAAW,EAAE,yBAAyB;IAEtC,2EAA2E;IAC3E,8DAA8D;IAC9D,sBAAsB,EAAE,eAAe;IACvC,qBAAqB,EAAE,cAAc;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,OAAO,CAAC,KAAmB;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAExD,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;IAC1C,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEtD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC/D,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;IAEzF,MAAM,IAAI,SAAS,CACjB,kGAAkG,CACnG,CAAC;AACJ,CAAC;AAkCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,WAAW,CAAC,KAAuB;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAC5F,GAAG,CACJ,CAAC;IAEF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC"}

package/dist/import/nuclei.d.ts

@@ -0,0 +1,39 @@
+import type { Finding } from '../finding.js';
+/**
+ * What an importer needs that a scanner's output cannot tell it.
+ *
+ * A scanner knows what it found; it does not know which organisation, run or
+ * target the result belongs to, and it must not invent ids. All of it is
+ * supplied, so importing stays pure and repeatable.
+ */
+export interface ImportOptions {
+    /** Organisation the findings belong to. */
+    readonly orgId: string;
+    /** The run that produced them. */
+    readonly runId: string;
+    /** The target they are against. Part of every fingerprint. */
+    readonly targetId: string;
+    /** When the import happened. No importer reads the clock. */
+    readonly now: Date;
+    /** Supplies finding ids. Injected so importing is deterministic. */
+    readonly newId: () => string;
+}
+/**
+ * Turns Nuclei's JSONL output into {@link Finding}s.
+ *
+ * Nuclei writes **one JSON object per line** (`-jsonl`), so the file is not
+ * itself valid JSON. Blank lines are skipped, and a line that will not parse is
+ * skipped rather than thrown on: a single malformed record should not cost a
+ * user every other result in the file. Records with no `template-id` or no
+ * location are skipped for the same reason — there is nothing to fingerprint.
+ *
+ * Severity comes from the CVSS score where Nuclei supplies one, and from its own
+ * rating otherwise; `severitySource` records which, because a severity with no
+ * provenance is not evidence.
+ *
+ * @param jsonl - The contents of a Nuclei JSONL file.
+ * @param options - Ownership, and the injected clock and id source.
+ * @returns One finding per usable record, in file order.
+ */
+export declare function importNuclei(jsonl: string, options: ImportOptions): Finding[];
+//# sourceMappingURL=nuclei.d.ts.map

package/dist/import/nuclei.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nuclei.d.ts","sourceRoot":"","sources":["../../src/import/nuclei.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAK7C;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,kCAAkC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IAEnB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,MAAM,MAAM,CAAC;CAC9B;AAoDD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,EAAE,CA4E7E"}

package/dist/import/nuclei.js

@@ -0,0 +1,115 @@
+import { severityFromCvss } from '../severity.js';
+import { fingerprint, vulnKey, FINGERPRINT_VERSION } from '../fingerprint.js';
+/**
+ * Nuclei's severity vocabulary, mapped onto {@link Severity}.
+ *
+ * `info` and `unknown` both become `advisory`: this model has no
+ * "informational" category separate from the bottom of the scale, and an
+ * unrated finding is not evidence of low risk — it is evidence of nothing, which
+ * is what `advisory` means here.
+ */
+const NUCLEI_SEVERITY = Object.freeze({
+    critical: 'critical',
+    high: 'high',
+    medium: 'medium',
+    low: 'low',
+    info: 'advisory',
+    unknown: 'advisory',
+});
+const str = (v) => typeof v === 'string' && v.trim() !== '' ? v.trim() : undefined;
+const firstOf = (v) => (Array.isArray(v) ? str(v[0]) : str(v));
+const allOf = (v) => {
+    if (!Array.isArray(v))
+        return str(v) === undefined ? undefined : [str(v)];
+    const items = v.map(str).filter((x) => x !== undefined);
+    return items.length > 0 ? items : undefined;
+};
+/**
+ * Turns Nuclei's JSONL output into {@link Finding}s.
+ *
+ * Nuclei writes **one JSON object per line** (`-jsonl`), so the file is not
+ * itself valid JSON. Blank lines are skipped, and a line that will not parse is
+ * skipped rather than thrown on: a single malformed record should not cost a
+ * user every other result in the file. Records with no `template-id` or no
+ * location are skipped for the same reason — there is nothing to fingerprint.
+ *
+ * Severity comes from the CVSS score where Nuclei supplies one, and from its own
+ * rating otherwise; `severitySource` records which, because a severity with no
+ * provenance is not evidence.
+ *
+ * @param jsonl - The contents of a Nuclei JSONL file.
+ * @param options - Ownership, and the injected clock and id source.
+ * @returns One finding per usable record, in file order.
+ */
+export function importNuclei(jsonl, options) {
+    const findings = [];
+    for (const line of jsonl.split('\n')) {
+        const trimmed = line.trim();
+        if (trimmed === '')
+            continue;
+        let record;
+        try {
+            record = JSON.parse(trimmed);
+        }
+        catch {
+            // One unparseable line must not cost the user the rest of the file.
+            continue;
+        }
+        const templateId = str(record['template-id']);
+        const location = str(record['matched-at']) ?? str(record.host);
+        if (templateId === undefined || location === undefined)
+            continue;
+        const info = record.info ?? {};
+        const classification = info.classification ?? {};
+        const cvss = typeof classification['cvss-score'] === 'number' ? classification['cvss-score'] : undefined;
+        const rated = NUCLEI_SEVERITY[str(info.severity)?.toLowerCase() ?? ''];
+        let detectedSeverity;
+        let severitySource;
+        if (cvss !== undefined && cvss >= 0 && cvss <= 10) {
+            detectedSeverity = severityFromCvss(cvss);
+            severitySource = 'cvss';
+        }
+        else {
+            detectedSeverity = rated ?? 'advisory';
+            severitySource = 'engine_default';
+        }
+        // Nuclei writes CWE as `cwe-502`; the rest of the model uses `CWE-502`.
+        const cwe = firstOf(classification['cwe-id'])?.toUpperCase();
+        const category = firstOf(info.tags);
+        const key = vulnKey({
+            sourceEngine: 'nuclei',
+            sourceRuleId: templateId,
+            ...(cwe === undefined ? {} : { cwe }),
+            ...(category === undefined ? {} : { category }),
+        });
+        findings.push({
+            id: options.newId(),
+            orgId: options.orgId,
+            runId: options.runId,
+            fingerprint: fingerprint({ targetId: options.targetId, vulnKey: key, location }),
+            fingerprintVersion: FINGERPRINT_VERSION,
+            title: str(info.name) ?? templateId,
+            ...(str(info.description) === undefined ? {} : { description: str(info.description) }),
+            detectedSeverity,
+            severitySource,
+            ...(cvss === undefined ? {} : { cvssScore: cvss }),
+            ...(str(classification['cvss-metrics']) === undefined
+                ? {}
+                : { cvssVector: str(classification['cvss-metrics']) }),
+            ...(cwe === undefined ? {} : { cwe }),
+            ...(firstOf(classification['cve-id']) === undefined
+                ? {}
+                : { cve: firstOf(classification['cve-id']).toUpperCase() }),
+            vulnKey: key,
+            ...(category === undefined ? {} : { category }),
+            location,
+            ...(str(info.remediation) === undefined ? {} : { recommendation: str(info.remediation) }),
+            ...(allOf(info.reference) === undefined ? {} : { references: allOf(info.reference) }),
+            sourceEngine: 'nuclei',
+            sourceRuleId: templateId,
+            createdAt: options.now,
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=nuclei.js.map

package/dist/import/nuclei.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nuclei.js","sourceRoot":"","sources":["../../src/import/nuclei.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AA0B9E;;;;;;;GAOG;AACH,MAAM,eAAe,GAAuC,MAAM,CAAC,MAAM,CAAC;IACxE,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,UAAU;CACpB,CAAC,CAAC;AAwBH,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAC7C,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAElE,MAAM,OAAO,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5F,MAAM,KAAK,GAAG,CAAC,CAAU,EAAwB,EAAE;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,OAAsB;IAChE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,EAAE;YAAE,SAAS;QAE7B,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAiB,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,SAAS;QACX,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,UAAU,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QAEjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;QAEjD,MAAM,IAAI,GACR,OAAO,cAAc,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9F,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvE,IAAI,gBAA0B,CAAC;QAC/B,IAAI,cAA8B,CAAC;QACnC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAClD,gBAAgB,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC1C,cAAc,GAAG,MAAM,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,gBAAgB,GAAG,KAAK,IAAI,UAAU,CAAC;YACvC,cAAc,GAAG,gBAAgB,CAAC;QACpC,CAAC;QAED,wEAAwE;QACxE,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,OAAO,CAAC;YAClB,YAAY,EAAE,QAAQ;YACtB,YAAY,EAAE,UAAU;YACxB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;YACrC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;SAChD,CAAC,CAAC;QAEH,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;YAChF,kBAAkB,EAAE,mBAAmB;YACvC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU;YACnC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAE,EAAE,CAAC;YACvF,gBAAgB;YAChB,cAAc;YACd,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,KAAK,SAAS;gBACnD,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,cAAc,CAAC,cAAc,CAAC,CAAE,EAAE,CAAC;YACzD,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;YACrC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,KAAK,SAAS;gBACjD,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9D,OAAO,EAAE,GAAG;YACZ,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,QAAQ;YACR,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAE,EAAE,CAAC;YAC1F,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAE,EAAE,CAAC;YACtF,YAAY,EAAE,QAAQ;YACtB,YAAY,EAAE,UAAU;YACxB,SAAS,EAAE,OAAO,CAAC,GAAG;SACvB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/import/zap.d.ts

@@ -0,0 +1,26 @@
+import type { Finding } from '../finding.js';
+import type { ImportOptions } from './nuclei.js';
+/**
+ * Turns a ZAP JSON report into {@link Finding}s.
+ *
+ * **One finding per instance, not per alert.** ZAP groups every occurrence of a
+ * weakness under a single alert with an `instances` array, so an alert is a
+ * class and an instance is a detection. Flattening is what lets two URLs
+ * affected by the same rule become two issues, and lets one of them be fixed
+ * without closing the other.
+ *
+ * An alert with no instances still produces one finding, against the site — a
+ * detection with no location is still a detection.
+ *
+ * Severity comes from ZAP's `riskcode`; see {@link ZAP_RISK} for why nothing
+ * here is ever `critical`.
+ *
+ * @param json - The contents of a ZAP JSON report.
+ * @param options - Ownership, and the injected clock and id source.
+ * @returns One finding per instance, in report order.
+ * @throws SyntaxError If the report is not valid JSON. Unlike Nuclei's JSONL,
+ * where one bad line costs one record, a ZAP report is a single document: if it
+ * will not parse there is nothing to salvage and silence would be a lie.
+ */
+export declare function importZap(json: string, options: ImportOptions): Finding[];
+//# sourceMappingURL=zap.d.ts.map

package/dist/import/zap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zap.d.ts","sourceRoot":"","sources":["../../src/import/zap.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAG7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAoEjD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,EAAE,CAmEzE"}

package/dist/import/zap.js

@@ -0,0 +1,119 @@
+import { fingerprint, vulnKey, FINGERPRINT_VERSION } from '../fingerprint.js';
+/**
+ * ZAP's `riskcode` mapped onto {@link Severity}.
+ *
+ * **ZAP has no "critical".** Its scale tops out at High (`3`), so nothing this
+ * importer produces is ever `critical` — a `critical` issue in a report that
+ * ZAP also detected got there from another engine, a CVSS score or a human.
+ * Worth knowing before wondering why a ZAP-only target has none.
+ */
+const ZAP_RISK = Object.freeze({
+    '3': 'high',
+    '2': 'medium',
+    '1': 'low',
+    '0': 'advisory',
+});
+const str = (v) => {
+    if (typeof v === 'number')
+        return String(v);
+    return typeof v === 'string' && v.trim() !== '' ? v.trim() : undefined;
+};
+/** ZAP embeds HTML in its description and solution fields. */
+const stripHtml = (v) => v
+    .replace(/<[^>]*>/gu, ' ')
+    .replace(/\s+/gu, ' ')
+    .trim();
+/** ZAP's reference field is one string of newline-separated URLs. */
+const splitReferences = (v) => {
+    const text = str(v);
+    if (text === undefined)
+        return undefined;
+    const urls = stripHtml(text)
+        .split(/\s+/u)
+        .filter((token) => token.startsWith('http'));
+    return urls.length > 0 ? urls : undefined;
+};
+/**
+ * Turns a ZAP JSON report into {@link Finding}s.
+ *
+ * **One finding per instance, not per alert.** ZAP groups every occurrence of a
+ * weakness under a single alert with an `instances` array, so an alert is a
+ * class and an instance is a detection. Flattening is what lets two URLs
+ * affected by the same rule become two issues, and lets one of them be fixed
+ * without closing the other.
+ *
+ * An alert with no instances still produces one finding, against the site — a
+ * detection with no location is still a detection.
+ *
+ * Severity comes from ZAP's `riskcode`; see {@link ZAP_RISK} for why nothing
+ * here is ever `critical`.
+ *
+ * @param json - The contents of a ZAP JSON report.
+ * @param options - Ownership, and the injected clock and id source.
+ * @returns One finding per instance, in report order.
+ * @throws SyntaxError If the report is not valid JSON. Unlike Nuclei's JSONL,
+ * where one bad line costs one record, a ZAP report is a single document: if it
+ * will not parse there is nothing to salvage and silence would be a lie.
+ */
+export function importZap(json, options) {
+    const report = JSON.parse(json);
+    const sites = Array.isArray(report.site) ? report.site : [];
+    const findings = [];
+    for (const site of sites) {
+        const siteName = str(site['@name']);
+        const alerts = Array.isArray(site.alerts) ? site.alerts : [];
+        for (const alert of alerts) {
+            const pluginId = str(alert.pluginid);
+            const title = str(alert.alert) ?? str(alert.name);
+            if (pluginId === undefined || title === undefined)
+                continue;
+            // ZAP writes `0` for "no CWE", which is not a CWE.
+            const rawCwe = str(alert.cweid);
+            const cwe = rawCwe !== undefined && rawCwe !== '0' && rawCwe !== '-1' ? `CWE-${rawCwe}` : undefined;
+            const key = vulnKey({
+                sourceEngine: 'zap',
+                sourceRuleId: pluginId,
+                ...(cwe === undefined ? {} : { cwe }),
+            });
+            const instances = Array.isArray(alert.instances) ? alert.instances : [];
+            const targets = instances.length > 0 ? instances : [{ uri: siteName }];
+            for (const instance of targets) {
+                const location = str(instance.uri) ?? siteName;
+                if (location === undefined)
+                    continue;
+                const parameter = str(instance.param);
+                findings.push({
+                    id: options.newId(),
+                    orgId: options.orgId,
+                    runId: options.runId,
+                    fingerprint: fingerprint({
+                        targetId: options.targetId,
+                        vulnKey: key,
+                        location,
+                        ...(parameter === undefined ? {} : { parameter }),
+                    }),
+                    fingerprintVersion: FINGERPRINT_VERSION,
+                    title,
+                    ...(str(alert.desc) === undefined ? {} : { description: stripHtml(str(alert.desc)) }),
+                    detectedSeverity: ZAP_RISK[str(alert.riskcode) ?? ''] ?? 'advisory',
+                    severitySource: 'engine_default',
+                    ...(cwe === undefined ? {} : { cwe }),
+                    vulnKey: key,
+                    location,
+                    ...(parameter === undefined ? {} : { parameter }),
+                    ...(str(alert.solution) === undefined
+                        ? {}
+                        : { recommendation: stripHtml(str(alert.solution)) }),
+                    ...(splitReferences(alert.reference) === undefined
+                        ? {}
+                        : { references: splitReferences(alert.reference) }),
+                    sourceEngine: 'zap',
+                    sourceRuleId: pluginId,
+                    createdAt: options.now,
+                });
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=zap.js.map

package/dist/import/zap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zap.js","sourceRoot":"","sources":["../../src/import/zap.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAG9E;;;;;;;GAOG;AACH,MAAM,QAAQ,GAAuC,MAAM,CAAC,MAAM,CAAC;IACjE,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,UAAU;CAChB,CAAC,CAAC;AA+BH,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE;IAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC,CAAC;AAEF,8DAA8D;AAC9D,MAAM,SAAS,GAAG,CAAC,CAAS,EAAU,EAAE,CACtC,CAAC;KACE,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC;KACzB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;KACrB,IAAI,EAAE,CAAC;AAEZ,qEAAqE;AACrE,MAAM,eAAe,GAAG,CAAC,CAAU,EAAwB,EAAE;IAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;SACzB,KAAK,CAAC,MAAM,CAAC;SACb,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,OAAsB;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,IAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,MAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAE7E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAE5D,mDAAmD;YACnD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,GAAG,GACP,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAE1F,MAAM,GAAG,GAAG,OAAO,CAAC;gBAClB,YAAY,EAAE,KAAK;gBACnB,YAAY,EAAE,QAAQ;gBACtB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;aACtC,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,SAA2B,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,MAAM,OAAO,GAAkB,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YAEtF,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;gBAC/C,IAAI,QAAQ,KAAK,SAAS;oBAAE,SAAS;gBACrC,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAEtC,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE;oBACnB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,WAAW,EAAE,WAAW,CAAC;wBACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,OAAO,EAAE,GAAG;wBACZ,QAAQ;wBACR,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;qBAClD,CAAC;oBACF,kBAAkB,EAAE,mBAAmB;oBACvC,KAAK;oBACL,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC,EAAE,CAAC;oBACtF,gBAAgB,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,UAAU;oBACnE,cAAc,EAAE,gBAAgB;oBAChC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;oBACrC,OAAO,EAAE,GAAG;oBACZ,QAAQ;oBACR,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;oBACjD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS;wBACnC,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAE,CAAC,EAAE,CAAC;oBACxD,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS;wBAChD,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC,SAAS,CAAE,EAAE,CAAC;oBACtD,YAAY,EAAE,KAAK;oBACnB,YAAY,EAAE,QAAQ;oBACtB,SAAS,EAAE,OAAO,CAAC,GAAG;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/index.d.ts

@@ -1,3 +1,32 @@
-export * from './issue.js';
-export * from './reconcile.js';
+/**
+ * The Secureport domain model.
+ *
+ * The tracked entity is the **issue**, not the finding. A {@link Run} produces
+ * {@link Finding}s, which are immutable evidence. Findings are fingerprinted
+ * and reconciled into {@link Issue}s, which persist across runs and carry
+ * status, severity, age and history. A {@link Snapshot} is issue state as of a
+ * run, and is the only thing a report ever reads.
+ *
+ * Zero runtime dependencies, by design: this package is imported by the hosted
+ * API and by third parties on equal terms, and a domain model should not drag
+ * anything in with it.
+ *
+ * @packageDocumentation
+ */
+export type { Finding } from './finding.js';
+export type { FingerprintInput, VulnKeyInput } from './fingerprint.js';
+export { FINGERPRINT_VERSION, PATH_PLACEHOLDER, VULN_KEY_MAP, fingerprint, normaliseLocation, vulnKey, } from './fingerprint.js';
+export type { IgnoreReason, IgnoreScope, Issue, IssueEvent, IssueEventType, IssueOrigin, IssueStatus, } from './issue.js';
+export { coversLocation } from './coverage.js';
+export type { ImportOptions } from './import/nuclei.js';
+export { importNuclei } from './import/nuclei.js';
+export { importZap } from './import/zap.js';
+export type { BuildSnapshotInput } from './snapshot-builder.js';
+export { buildSnapshot, parseSnapshot } from './snapshot-builder.js';
+export type { ReconcileInput, ReconcileResult } from './reconcile.js';
+export { reconcile } from './reconcile.js';
+export type { Coverage, Run, RunKind, RunSummary, RunTrigger, SeverityCounts } from './run.js';
+export type { IssueChange, Snapshot, SnapshotIssue, SuppressedIssue, Target } from './snapshot.js';
+export type { Severity, SeveritySource, SlaPolicy, SlaStatus } from './severity.js';
+export { DEFAULT_SLA_POLICY, SEVERITY_ORDER, SEVERITY_SOURCE_PRECEDENCE, SEVERITY_WEIGHTS, severityFromCvss, severityRank, slaDueAt, slaStatus, } from './severity.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,OAAO,GACR,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,YAAY,EACZ,WAAW,EACX,KAAK,EACL,UAAU,EACV,cAAc,EACd,WAAW,EACX,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACrE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/F,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACnG,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACpF,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACR,SAAS,GACV,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -1,3 +1,23 @@
-export * from './issue.js';
-export * from './reconcile.js';
+/**
+ * The Secureport domain model.
+ *
+ * The tracked entity is the **issue**, not the finding. A {@link Run} produces
+ * {@link Finding}s, which are immutable evidence. Findings are fingerprinted
+ * and reconciled into {@link Issue}s, which persist across runs and carry
+ * status, severity, age and history. A {@link Snapshot} is issue state as of a
+ * run, and is the only thing a report ever reads.
+ *
+ * Zero runtime dependencies, by design: this package is imported by the hosted
+ * API and by third parties on equal terms, and a domain model should not drag
+ * anything in with it.
+ *
+ * @packageDocumentation
+ */
+export { FINGERPRINT_VERSION, PATH_PLACEHOLDER, VULN_KEY_MAP, fingerprint, normaliseLocation, vulnKey, } from './fingerprint.js';
+export { coversLocation } from './coverage.js';
+export { importNuclei } from './import/nuclei.js';
+export { importZap } from './import/zap.js';
+export { buildSnapshot, parseSnapshot } from './snapshot-builder.js';
+export { reconcile } from './reconcile.js';
+export { DEFAULT_SLA_POLICY, SEVERITY_ORDER, SEVERITY_SOURCE_PRECEDENCE, SEVERITY_WEIGHTS, severityFromCvss, severityRank, slaDueAt, slaStatus, } from './severity.js';
 //# sourceMappingURL=index.js.map