@secureport/core 0.2.1 → 0.4.0

package/dist/import/generic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic.js","sourceRoot":"","sources":["../../src/import/generic.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAuF9E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,cAAc,CAAC,CAAC;AAEnD,8CAA8C;AAC9C,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAC7C,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAElE,mCAAmC;AACnC,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAC7C,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE9D;;;;;;;;;;;;;GAaG;AACH,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAU,EAAE,CACzC,KAAK;KACF,WAAW,EAAE;KACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;KAC5B,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAE5B,iDAAiD;AACjD,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAwB,EAAE;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAI,CAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAsB;IAChE,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,GAA8B,CAAC;IAE9C,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CAAC,yCAAyC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAQ,GAA0B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACrD,MAAM,KAAK,GAAG,YAAY,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;QAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,KAAK,GAAG,IAA+B,CAAC;QAE9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;QAC3E,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC;QAEjF,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,gCAAgC,MAAM,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACtC,IAAI,gBAA0B,CAAC;QAC/B,IAAI,cAA8B,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YACrD,gBAAgB,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAC3C,cAAc,GAAG,MAAM,CAAC;QAC1B,CAAC;aAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,gBAAgB,GAAG,MAAkB,CAAC;YACtC,iEAAiE;YACjE,iCAAiC;YACjC,cAAc,GAAG,UAAU,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,gBAAgB,GAAG,UAAU,CAAC;YAC9B,cAAc,GAAG,gBAAgB,CAAC;QACpC,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,SAAS,CAAC;QACjD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;QACtF,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAEhC,0EAA0E;QAC1E,2EAA2E;QAC3E,yDAAyD;QACzD,MAAM,GAAG,GACP,GAAG,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;YACjE,CAAC,CAAC,GAAG,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE;YAChC,CAAC,CAAC,OAAO,CAAC;gBACN,YAAY,EAAE,MAAM;gBACpB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;gBACzD,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;gBACrC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;aAChD,CAAC,CAAC;QAET,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,WAAW,CAAC;gBACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,GAAG;gBACZ,QAAQ;gBACR,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;gBACjD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;aACxC,CAAC;YACF,kBAAkB,EAAE,mBAAmB;YACvC,KAAK;YACL,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAE,EAAE,CAAC;YAChD,gBAAgB;YAChB,cAAc;YACd,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAE,EAAE,CAAC;YAC5F,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;YACrC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACrF,OAAO,EAAE,GAAG;YACZ,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YACvE,QAAQ;YACR,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;YACjD,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,KAAK,SAAS;gBAC9C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAE,EAAE,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,KAAK,SAAS;gBAC5C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAE,EAAE,CAAC;YACtD,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,SAAS;gBAC7C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAE,EAAE,CAAC;YACnD,YAAY,EAAE,MAAM;YACpB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;YACzD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAE,EAAE,CAAC;YAC5F,SAAS,EAAE,OAAO,CAAC,GAAG;SACL,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/import/nessus.d.ts

@@ -0,0 +1,32 @@
+import type { Finding } from '../finding.js';
+import type { ImportOptions } from './nuclei.js';
+/**
+ * Turns a `.nessus` export into {@link Finding}s.
+ *
+ * Nessus is host-oriented: every `ReportItem` hangs off a `ReportHost`, and the
+ * port and protocol are attributes rather than part of a URL. The location is
+ * assembled as `host:port`, which is **the only place the port survives** —
+ * `00-DOMAIN.md` §3 defines no `port` on a finding, so anything not in the
+ * location is lost. A network finding with no path still fingerprints
+ * distinctly per service because the port is inside its location.
+ *
+ * A consequence worth knowing: the fingerprint's last component is
+ * `parameter ?? port ?? ''`, so a Nessus port is counted twice — once inside
+ * the location and once as that component. Harmless, but it means a port
+ * cannot be recovered from a finding except by parsing its location. Recorded
+ * as backlog **B42**.
+ *
+ * Severity comes from the CVSS v3 base score where Nessus supplies one, and from
+ * its own numeric rating otherwise.
+ *
+ * A `ReportItem` with severity `0` and no port — Nessus's host-inventory
+ * plugins — still imports: an advisory is still a finding, and dropping it here
+ * would make coverage look narrower than it was.
+ *
+ * @param xml - The contents of a `.nessus` file.
+ * @param options - Ownership, and the injected clock and id source.
+ * @returns One finding per report item, in document order.
+ * @throws SyntaxError If the document is not well-formed XML.
+ */
+export declare function importNessus(xml: string, options: ImportOptions): Finding[];
+//# sourceMappingURL=nessus.d.ts.map

package/dist/import/nessus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nessus.d.ts","sourceRoot":"","sources":["../../src/import/nessus.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAK7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAgBjD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,EAAE,CAsF3E"}

package/dist/import/nessus.js

@@ -0,0 +1,125 @@
+import { severityFromCvss } from '../severity.js';
+import { fingerprint, vulnKey, FINGERPRINT_VERSION } from '../fingerprint.js';
+import { childText, findAll, parseXml } from './xml.js';
+/**
+ * Nessus reports severity as a number on the `ReportItem`.
+ *
+ * `0` is Info, which is the bottom of the scale here rather than a separate
+ * category. Nessus does reach `4` (Critical), unlike ZAP and Burp.
+ */
+const NESSUS_SEVERITY = Object.freeze({
+    '4': 'critical',
+    '3': 'high',
+    '2': 'medium',
+    '1': 'low',
+    '0': 'advisory',
+});
+/**
+ * Turns a `.nessus` export into {@link Finding}s.
+ *
+ * Nessus is host-oriented: every `ReportItem` hangs off a `ReportHost`, and the
+ * port and protocol are attributes rather than part of a URL. The location is
+ * assembled as `host:port`, which is **the only place the port survives** —
+ * `00-DOMAIN.md` §3 defines no `port` on a finding, so anything not in the
+ * location is lost. A network finding with no path still fingerprints
+ * distinctly per service because the port is inside its location.
+ *
+ * A consequence worth knowing: the fingerprint's last component is
+ * `parameter ?? port ?? ''`, so a Nessus port is counted twice — once inside
+ * the location and once as that component. Harmless, but it means a port
+ * cannot be recovered from a finding except by parsing its location. Recorded
+ * as backlog **B42**.
+ *
+ * Severity comes from the CVSS v3 base score where Nessus supplies one, and from
+ * its own numeric rating otherwise.
+ *
+ * A `ReportItem` with severity `0` and no port — Nessus's host-inventory
+ * plugins — still imports: an advisory is still a finding, and dropping it here
+ * would make coverage look narrower than it was.
+ *
+ * @param xml - The contents of a `.nessus` file.
+ * @param options - Ownership, and the injected clock and id source.
+ * @returns One finding per report item, in document order.
+ * @throws SyntaxError If the document is not well-formed XML.
+ */
+export function importNessus(xml, options) {
+    const root = parseXml(xml);
+    const findings = [];
+    for (const host of findAll(root, 'ReportHost')) {
+        const hostName = host.attrs['name'] ?? '';
+        for (const item of findAll(host, 'ReportItem')) {
+            const pluginId = item.attrs['pluginID'];
+            const title = item.attrs['pluginName'];
+            if (pluginId === undefined || title === undefined)
+                continue;
+            const portText = item.attrs['port'];
+            const port = portText !== undefined && portText !== '0' ? Number(portText) : undefined;
+            const location = port === undefined ? hostName : `${hostName}:${String(port)}`;
+            if (location === '')
+                continue;
+            const scoreText = childText(item, 'cvss3_base_score') ?? childText(item, 'cvss_base_score');
+            const score = scoreText === undefined ? undefined : Number(scoreText);
+            let detectedSeverity;
+            let severitySource;
+            if (score !== undefined && Number.isFinite(score) && score >= 0 && score <= 10) {
+                detectedSeverity = severityFromCvss(score);
+                severitySource = 'cvss';
+            }
+            else {
+                detectedSeverity = NESSUS_SEVERITY[item.attrs['severity'] ?? ''] ?? 'advisory';
+                severitySource = 'engine_default';
+            }
+            // Nessus writes the bare number, e.g. `79`.
+            const rawCwe = childText(item, 'cwe');
+            const cwe = rawCwe === undefined ? undefined : `CWE-${rawCwe.replace(/^CWE-/iu, '')}`;
+            const family = item.attrs['pluginFamily'];
+            const key = vulnKey({
+                sourceEngine: 'nessus',
+                sourceRuleId: pluginId,
+                ...(cwe === undefined ? {} : { cwe }),
+                ...(family === undefined ? {} : { category: family }),
+            });
+            const references = childText(item, 'see_also')
+                ?.split(/\s+/u)
+                .filter((token) => token.startsWith('http'));
+            findings.push({
+                id: options.newId(),
+                orgId: options.orgId,
+                runId: options.runId,
+                fingerprint: fingerprint({
+                    targetId: options.targetId,
+                    vulnKey: key,
+                    location,
+                    ...(port === undefined ? {} : { port }),
+                }),
+                fingerprintVersion: FINGERPRINT_VERSION,
+                title,
+                ...(childText(item, 'description') === undefined
+                    ? {}
+                    : { description: childText(item, 'description') }),
+                detectedSeverity,
+                severitySource,
+                ...(score === undefined || !Number.isFinite(score) ? {} : { cvssScore: score }),
+                ...(childText(item, 'cvss3_vector') === undefined
+                    ? {}
+                    : { cvssVector: childText(item, 'cvss3_vector') }),
+                ...(cwe === undefined ? {} : { cwe }),
+                ...(childText(item, 'cve') === undefined
+                    ? {}
+                    : { cve: childText(item, 'cve').toUpperCase() }),
+                vulnKey: key,
+                ...(family === undefined ? {} : { category: family.toLowerCase() }),
+                location,
+                ...(childText(item, 'solution') === undefined
+                    ? {}
+                    : { recommendation: childText(item, 'solution') }),
+                ...(references === undefined || references.length === 0 ? {} : { references }),
+                sourceEngine: 'nessus',
+                sourceRuleId: pluginId,
+                createdAt: options.now,
+            });
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=nessus.js.map

package/dist/import/nessus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nessus.js","sourceRoot":"","sources":["../../src/import/nessus.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAGxD;;;;;GAKG;AACH,MAAM,eAAe,GAAuC,MAAM,CAAC,MAAM,CAAC;IACxE,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,UAAU;CAChB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,OAAsB;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAE1C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAE5D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvF,MAAM,QAAQ,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/E,IAAI,QAAQ,KAAK,EAAE;gBAAE,SAAS;YAE9B,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;YAC5F,MAAM,KAAK,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAEtE,IAAI,gBAA0B,CAAC;YAC/B,IAAI,cAA8B,CAAC;YACnC,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;gBAC/E,gBAAgB,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBAC3C,cAAc,GAAG,MAAM,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,gBAAgB,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,UAAU,CAAC;gBAC/E,cAAc,GAAG,gBAAgB,CAAC;YACpC,CAAC;YAED,4CAA4C;YAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;YACtF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAE1C,MAAM,GAAG,GAAG,OAAO,CAAC;gBAClB,YAAY,EAAE,QAAQ;gBACtB,YAAY,EAAE,QAAQ;gBACtB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;gBACrC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;aACtD,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC;gBAC5C,EAAE,KAAK,CAAC,MAAM,CAAC;iBACd,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YAE/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE;gBACnB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,WAAW,EAAE,WAAW,CAAC;oBACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,OAAO,EAAE,GAAG;oBACZ,QAAQ;oBACR,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;iBACxC,CAAC;gBACF,kBAAkB,EAAE,mBAAmB;gBACvC,KAAK;gBACL,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,KAAK,SAAS;oBAC9C,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,EAAE,aAAa,CAAE,EAAE,CAAC;gBACrD,gBAAgB;gBAChB,cAAc;gBACd,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;gBAC/E,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,KAAK,SAAS;oBAC/C,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,IAAI,EAAE,cAAc,CAAE,EAAE,CAAC;gBACrD,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;gBACrC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,SAAS;oBACtC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBACnD,OAAO,EAAE,GAAG;gBACZ,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;gBACnE,QAAQ;gBACR,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,SAAS;oBAC3C,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,IAAI,EAAE,UAAU,CAAE,EAAE,CAAC;gBACrD,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;gBAC9E,YAAY,EAAE,QAAQ;gBACtB,YAAY,EAAE,QAAQ;gBACtB,SAAS,EAAE,OAAO,CAAC,GAAG;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/import/nuclei.d.ts

@@ -0,0 +1,39 @@
+import type { Finding } from '../finding.js';
+/**
+ * What an importer needs that a scanner's output cannot tell it.
+ *
+ * A scanner knows what it found; it does not know which organisation, run or
+ * target the result belongs to, and it must not invent ids. All of it is
+ * supplied, so importing stays pure and repeatable.
+ */
+export interface ImportOptions {
+    /** Organisation the findings belong to. */
+    readonly orgId: string;
+    /** The run that produced them. */
+    readonly runId: string;
+    /** The target they are against. Part of every fingerprint. */
+    readonly targetId: string;
+    /** When the import happened. No importer reads the clock. */
+    readonly now: Date;
+    /** Supplies finding ids. Injected so importing is deterministic. */
+    readonly newId: () => string;
+}
+/**
+ * Turns Nuclei's JSONL output into {@link Finding}s.
+ *
+ * Nuclei writes **one JSON object per line** (`-jsonl`), so the file is not
+ * itself valid JSON. Blank lines are skipped, and a line that will not parse is
+ * skipped rather than thrown on: a single malformed record should not cost a
+ * user every other result in the file. Records with no `template-id` or no
+ * location are skipped for the same reason — there is nothing to fingerprint.
+ *
+ * Severity comes from the CVSS score where Nuclei supplies one, and from its own
+ * rating otherwise; `severitySource` records which, because a severity with no
+ * provenance is not evidence.
+ *
+ * @param jsonl - The contents of a Nuclei JSONL file.
+ * @param options - Ownership, and the injected clock and id source.
+ * @returns One finding per usable record, in file order.
+ */
+export declare function importNuclei(jsonl: string, options: ImportOptions): Finding[];
+//# sourceMappingURL=nuclei.d.ts.map

package/dist/import/nuclei.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nuclei.d.ts","sourceRoot":"","sources":["../../src/import/nuclei.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAK7C;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,kCAAkC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IAEnB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,MAAM,MAAM,CAAC;CAC9B;AAoDD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,EAAE,CA4E7E"}

package/dist/import/nuclei.js

@@ -0,0 +1,115 @@
+import { severityFromCvss } from '../severity.js';
+import { fingerprint, vulnKey, FINGERPRINT_VERSION } from '../fingerprint.js';
+/**
+ * Nuclei's severity vocabulary, mapped onto {@link Severity}.
+ *
+ * `info` and `unknown` both become `advisory`: this model has no
+ * "informational" category separate from the bottom of the scale, and an
+ * unrated finding is not evidence of low risk — it is evidence of nothing, which
+ * is what `advisory` means here.
+ */
+const NUCLEI_SEVERITY = Object.freeze({
+    critical: 'critical',
+    high: 'high',
+    medium: 'medium',
+    low: 'low',
+    info: 'advisory',
+    unknown: 'advisory',
+});
+const str = (v) => typeof v === 'string' && v.trim() !== '' ? v.trim() : undefined;
+const firstOf = (v) => (Array.isArray(v) ? str(v[0]) : str(v));
+const allOf = (v) => {
+    if (!Array.isArray(v))
+        return str(v) === undefined ? undefined : [str(v)];
+    const items = v.map(str).filter((x) => x !== undefined);
+    return items.length > 0 ? items : undefined;
+};
+/**
+ * Turns Nuclei's JSONL output into {@link Finding}s.
+ *
+ * Nuclei writes **one JSON object per line** (`-jsonl`), so the file is not
+ * itself valid JSON. Blank lines are skipped, and a line that will not parse is
+ * skipped rather than thrown on: a single malformed record should not cost a
+ * user every other result in the file. Records with no `template-id` or no
+ * location are skipped for the same reason — there is nothing to fingerprint.
+ *
+ * Severity comes from the CVSS score where Nuclei supplies one, and from its own
+ * rating otherwise; `severitySource` records which, because a severity with no
+ * provenance is not evidence.
+ *
+ * @param jsonl - The contents of a Nuclei JSONL file.
+ * @param options - Ownership, and the injected clock and id source.
+ * @returns One finding per usable record, in file order.
+ */
+export function importNuclei(jsonl, options) {
+    const findings = [];
+    for (const line of jsonl.split('\n')) {
+        const trimmed = line.trim();
+        if (trimmed === '')
+            continue;
+        let record;
+        try {
+            record = JSON.parse(trimmed);
+        }
+        catch {
+            // One unparseable line must not cost the user the rest of the file.
+            continue;
+        }
+        const templateId = str(record['template-id']);
+        const location = str(record['matched-at']) ?? str(record.host);
+        if (templateId === undefined || location === undefined)
+            continue;
+        const info = record.info ?? {};
+        const classification = info.classification ?? {};
+        const cvss = typeof classification['cvss-score'] === 'number' ? classification['cvss-score'] : undefined;
+        const rated = NUCLEI_SEVERITY[str(info.severity)?.toLowerCase() ?? ''];
+        let detectedSeverity;
+        let severitySource;
+        if (cvss !== undefined && cvss >= 0 && cvss <= 10) {
+            detectedSeverity = severityFromCvss(cvss);
+            severitySource = 'cvss';
+        }
+        else {
+            detectedSeverity = rated ?? 'advisory';
+            severitySource = 'engine_default';
+        }
+        // Nuclei writes CWE as `cwe-502`; the rest of the model uses `CWE-502`.
+        const cwe = firstOf(classification['cwe-id'])?.toUpperCase();
+        const category = firstOf(info.tags);
+        const key = vulnKey({
+            sourceEngine: 'nuclei',
+            sourceRuleId: templateId,
+            ...(cwe === undefined ? {} : { cwe }),
+            ...(category === undefined ? {} : { category }),
+        });
+        findings.push({
+            id: options.newId(),
+            orgId: options.orgId,
+            runId: options.runId,
+            fingerprint: fingerprint({ targetId: options.targetId, vulnKey: key, location }),
+            fingerprintVersion: FINGERPRINT_VERSION,
+            title: str(info.name) ?? templateId,
+            ...(str(info.description) === undefined ? {} : { description: str(info.description) }),
+            detectedSeverity,
+            severitySource,
+            ...(cvss === undefined ? {} : { cvssScore: cvss }),
+            ...(str(classification['cvss-metrics']) === undefined
+                ? {}
+                : { cvssVector: str(classification['cvss-metrics']) }),
+            ...(cwe === undefined ? {} : { cwe }),
+            ...(firstOf(classification['cve-id']) === undefined
+                ? {}
+                : { cve: firstOf(classification['cve-id']).toUpperCase() }),
+            vulnKey: key,
+            ...(category === undefined ? {} : { category }),
+            location,
+            ...(str(info.remediation) === undefined ? {} : { recommendation: str(info.remediation) }),
+            ...(allOf(info.reference) === undefined ? {} : { references: allOf(info.reference) }),
+            sourceEngine: 'nuclei',
+            sourceRuleId: templateId,
+            createdAt: options.now,
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=nuclei.js.map

package/dist/import/nuclei.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nuclei.js","sourceRoot":"","sources":["../../src/import/nuclei.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AA0B9E;;;;;;;GAOG;AACH,MAAM,eAAe,GAAuC,MAAM,CAAC,MAAM,CAAC;IACxE,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,UAAU;CACpB,CAAC,CAAC;AAwBH,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAC7C,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAElE,MAAM,OAAO,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5F,MAAM,KAAK,GAAG,CAAC,CAAU,EAAwB,EAAE;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,OAAsB;IAChE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,EAAE;YAAE,SAAS;QAE7B,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAiB,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,SAAS;QACX,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,UAAU,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QAEjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;QAEjD,MAAM,IAAI,GACR,OAAO,cAAc,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9F,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvE,IAAI,gBAA0B,CAAC;QAC/B,IAAI,cAA8B,CAAC;QACnC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAClD,gBAAgB,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC1C,cAAc,GAAG,MAAM,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,gBAAgB,GAAG,KAAK,IAAI,UAAU,CAAC;YACvC,cAAc,GAAG,gBAAgB,CAAC;QACpC,CAAC;QAED,wEAAwE;QACxE,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,OAAO,CAAC;YAClB,YAAY,EAAE,QAAQ;YACtB,YAAY,EAAE,UAAU;YACxB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;YACrC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;SAChD,CAAC,CAAC;QAEH,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;YAChF,kBAAkB,EAAE,mBAAmB;YACvC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU;YACnC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAE,EAAE,CAAC;YACvF,gBAAgB;YAChB,cAAc;YACd,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,KAAK,SAAS;gBACnD,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,cAAc,CAAC,cAAc,CAAC,CAAE,EAAE,CAAC;YACzD,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;YACrC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,KAAK,SAAS;gBACjD,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9D,OAAO,EAAE,GAAG;YACZ,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,QAAQ;YACR,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAE,EAAE,CAAC;YAC1F,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAE,EAAE,CAAC;YACtF,YAAY,EAAE,QAAQ;YACtB,YAAY,EAAE,UAAU;YACxB,SAAS,EAAE,OAAO,CAAC,GAAG;SACvB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/import/xml.d.ts

@@ -0,0 +1,47 @@
+/**
+ * A parsed XML element.
+ *
+ * Deliberately minimal: a name, its attributes, its child elements and its
+ * text. No namespaces, no processing instructions, no mixed-content ordering —
+ * none of which appears in a Burp or Nessus export.
+ */
+export interface XmlNode {
+    /** The element name, as written. */
+    readonly name: string;
+    /** Attributes, with entities decoded. */
+    readonly attrs: Readonly<Record<string, string>>;
+    /** Child elements, in document order. */
+    readonly children: readonly XmlNode[];
+    /** All direct text and CDATA of this element, concatenated and trimmed. */
+    readonly text: string;
+}
+/**
+ * Parses the subset of XML that scanner exports actually use.
+ *
+ * **Deliberately narrow, and it throws rather than guesses.** Burp and Nessus
+ * both export machine-generated XML with a fixed shape: elements, attributes,
+ * text and CDATA. This handles exactly that, plus comments, the XML
+ * declaration, a DOCTYPE, self-closing tags and the five named entities with
+ * numeric character references.
+ *
+ * It does **not** handle namespaces, entity definitions or mixed-content
+ * ordering, and it has no opinion about schemas. Anything structurally
+ * unexpected — an unclosed element, a mismatched end tag, two root elements —
+ * is an error, because a parser that guesses at broken input produces findings
+ * that are quietly wrong, and a wrong finding is worse than a failed import.
+ *
+ * Hand-written rather than taken from a library because `@secureport/core` ships
+ * with zero runtime dependencies: it is imported by the hosted API and by third
+ * parties on equal terms, and a domain model that drags an XML parser in with it
+ * is a supply-chain decision made on everyone's behalf.
+ *
+ * @param source - The XML document.
+ * @returns The root element.
+ * @throws SyntaxError If the document is not well-formed, or has no root.
+ */
+export declare function parseXml(source: string): XmlNode;
+/** Every descendant with this name, at any depth. */
+export declare function findAll(node: XmlNode, name: string): XmlNode[];
+/** The text of the first direct child with this name, if it has any. */
+export declare function childText(node: XmlNode, name: string): string | undefined;
+//# sourceMappingURL=xml.d.ts.map

package/dist/import/xml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xml.d.ts","sourceRoot":"","sources":["../../src/import/xml.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,oCAAoC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEjD,yCAAyC;IACzC,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IAEtC,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AA0CD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAmFhD;AAED,qDAAqD;AACrD,wBAAgB,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAQ9D;AAED,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIzE"}

package/dist/import/xml.js

@@ -0,0 +1,157 @@
+const ENTITIES = Object.freeze({
+    amp: '&',
+    lt: '<',
+    gt: '>',
+    quot: '"',
+    apos: "'",
+});
+/** Decodes the five XML entities and numeric character references. */
+function decodeEntities(text) {
+    return text.replace(/&(#x?[0-9a-f]+|[a-z]+);/giu, (whole, body) => {
+        if (body.startsWith('#')) {
+            const code = body[1]?.toLowerCase() === 'x' ? parseInt(body.slice(2), 16) : parseInt(body.slice(1), 10);
+            return Number.isFinite(code) && code >= 0 && code <= 0x10ffff
+                ? String.fromCodePoint(code)
+                : whole;
+        }
+        return ENTITIES[body.toLowerCase()] ?? whole;
+    });
+}
+/** Reads the attributes out of a start tag's body. */
+function parseAttrs(body) {
+    const attrs = {};
+    const pattern = /([\w:.-]+)\s*=\s*("([^"]*)"|'([^']*)')/gu;
+    let match;
+    while ((match = pattern.exec(body)) !== null) {
+        attrs[match[1]] = decodeEntities(match[3] ?? match[4] ?? '');
+    }
+    return attrs;
+}
+/**
+ * Parses the subset of XML that scanner exports actually use.
+ *
+ * **Deliberately narrow, and it throws rather than guesses.** Burp and Nessus
+ * both export machine-generated XML with a fixed shape: elements, attributes,
+ * text and CDATA. This handles exactly that, plus comments, the XML
+ * declaration, a DOCTYPE, self-closing tags and the five named entities with
+ * numeric character references.
+ *
+ * It does **not** handle namespaces, entity definitions or mixed-content
+ * ordering, and it has no opinion about schemas. Anything structurally
+ * unexpected — an unclosed element, a mismatched end tag, two root elements —
+ * is an error, because a parser that guesses at broken input produces findings
+ * that are quietly wrong, and a wrong finding is worse than a failed import.
+ *
+ * Hand-written rather than taken from a library because `@secureport/core` ships
+ * with zero runtime dependencies: it is imported by the hosted API and by third
+ * parties on equal terms, and a domain model that drags an XML parser in with it
+ * is a supply-chain decision made on everyone's behalf.
+ *
+ * @param source - The XML document.
+ * @returns The root element.
+ * @throws SyntaxError If the document is not well-formed, or has no root.
+ */
+export function parseXml(source) {
+    const stack = [];
+    let root;
+    let i = 0;
+    while (i < source.length) {
+        const lt = source.indexOf('<', i);
+        if (lt === -1)
+            break;
+        // Text before this tag belongs to the element currently open.
+        if (lt > i && stack.length > 0) {
+            stack[stack.length - 1].text += decodeEntities(source.slice(i, lt));
+        }
+        if (source.startsWith('<!--', lt)) {
+            const end = source.indexOf('-->', lt);
+            if (end === -1)
+                throw new SyntaxError('unterminated comment');
+            i = end + 3;
+            continue;
+        }
+        if (source.startsWith('<![CDATA[', lt)) {
+            const end = source.indexOf(']]>', lt);
+            if (end === -1)
+                throw new SyntaxError('unterminated CDATA section');
+            // CDATA is literal: no entity decoding, which is the whole point of it.
+            if (stack.length > 0)
+                stack[stack.length - 1].text += source.slice(lt + 9, end);
+            i = end + 3;
+            continue;
+        }
+        if (source.startsWith('<?', lt) || source.startsWith('<!', lt)) {
+            const end = source.indexOf('>', lt);
+            if (end === -1)
+                throw new SyntaxError('unterminated declaration');
+            i = end + 1;
+            continue;
+        }
+        const gt = source.indexOf('>', lt);
+        if (gt === -1)
+            throw new SyntaxError('unterminated tag');
+        const raw = source.slice(lt + 1, gt);
+        if (raw.startsWith('/')) {
+            const name = raw.slice(1).trim();
+            const open = stack.pop();
+            if (open === undefined)
+                throw new SyntaxError(`unexpected closing tag </${name}>`);
+            if (open.name !== name) {
+                throw new SyntaxError(`closing tag </${name}> does not match <${open.name}>`);
+            }
+            i = gt + 1;
+            continue;
+        }
+        const selfClosing = raw.endsWith('/');
+        const body = selfClosing ? raw.slice(0, -1) : raw;
+        const nameEnd = body.search(/[\s/]/u);
+        const name = (nameEnd === -1 ? body : body.slice(0, nameEnd)).trim();
+        if (name === '')
+            throw new SyntaxError('tag with no name');
+        const node = {
+            name,
+            attrs: parseAttrs(nameEnd === -1 ? '' : body.slice(nameEnd)),
+            children: [],
+            text: '',
+        };
+        if (stack.length > 0)
+            stack[stack.length - 1].children.push(node);
+        else if (root === undefined)
+            root = node;
+        else
+            throw new SyntaxError('more than one root element');
+        if (!selfClosing)
+            stack.push(node);
+        i = gt + 1;
+    }
+    if (stack.length > 0)
+        throw new SyntaxError(`unclosed element <${stack[stack.length - 1].name}>`);
+    if (root === undefined)
+        throw new SyntaxError('no root element');
+    const finish = (node) => ({
+        name: node.name,
+        attrs: node.attrs,
+        children: node.children.map(finish),
+        text: node.text.trim(),
+    });
+    return finish(root);
+}
+/** Every descendant with this name, at any depth. */
+export function findAll(node, name) {
+    const found = [];
+    const walk = (current) => {
+        if (current.name === name)
+            found.push(current);
+        for (const child of current.children)
+            walk(child);
+    };
+    walk(node);
+    return found;
+}
+/** The text of the first direct child with this name, if it has any. */
+export function childText(node, name) {
+    const child = node.children.find((c) => c.name === name);
+    const text = child?.text.trim();
+    return text === undefined || text === '' ? undefined : text;
+}
+//# sourceMappingURL=xml.js.map

package/dist/import/xml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xml.js","sourceRoot":"","sources":["../../src/import/xml.ts"],"names":[],"mappings":"AAqBA,MAAM,QAAQ,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC/D,GAAG,EAAE,GAAG;IACR,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,GAAG;IACP,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,GAAG;CACV,CAAC,CAAC;AAEH,sEAAsE;AACtE,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QACxE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,GACR,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7F,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,QAAQ;gBAC3D,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;gBAC5B,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC;AASD,sDAAsD;AACtD,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,0CAA0C,CAAC;IAC3D,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAc;IACrC,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAClC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,MAAM;QAErB,8DAA8D;QAC9D,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,CAAC,CAAC;YAC9D,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;YACZ,SAAS;QACX,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,WAAW,CAAC,4BAA4B,CAAC,CAAC;YACpE,wEAAwE;YACxE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;YAChF,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;YACZ,SAAS;QACX,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;YAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,WAAW,CAAC,0BAA0B,CAAC,CAAC;YAClE,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;YACZ,SAAS;QACX,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAErC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,4BAA4B,IAAI,GAAG,CAAC,CAAC;YACnF,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,WAAW,CAAC,iBAAiB,IAAI,qBAAqB,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YAChF,CAAC;YACD,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,IAAI,IAAI,KAAK,EAAE;YAAE,MAAM,IAAI,WAAW,CAAC,kBAAkB,CAAC,CAAC;QAE3D,MAAM,IAAI,GAAgB;YACxB,IAAI;YACJ,KAAK,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5D,QAAQ,EAAE,EAAE;YACZ,IAAI,EAAE,EAAE;SACT,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAC7D,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,GAAG,IAAI,CAAC;;YACpC,MAAM,IAAI,WAAW,CAAC,4BAA4B,CAAC,CAAC;QAEzD,IAAI,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACb,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,qBAAqB,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAClG,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAEjE,MAAM,MAAM,GAAG,CAAC,IAAiB,EAAW,EAAE,CAAC,CAAC;QAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QACnC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;KACvB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,OAAO,CAAC,IAAa,EAAE,IAAY;IACjD,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,OAAgB,EAAE,EAAE;QAChC,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ;YAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,SAAS,CAAC,IAAa,EAAE,IAAY;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC"}

package/dist/import/zap.d.ts

@@ -0,0 +1,26 @@
+import type { Finding } from '../finding.js';
+import type { ImportOptions } from './nuclei.js';
+/**
+ * Turns a ZAP JSON report into {@link Finding}s.
+ *
+ * **One finding per instance, not per alert.** ZAP groups every occurrence of a
+ * weakness under a single alert with an `instances` array, so an alert is a
+ * class and an instance is a detection. Flattening is what lets two URLs
+ * affected by the same rule become two issues, and lets one of them be fixed
+ * without closing the other.
+ *
+ * An alert with no instances still produces one finding, against the site — a
+ * detection with no location is still a detection.
+ *
+ * Severity comes from ZAP's `riskcode`; see `ZAP_RISK` below for why nothing
+ * here is ever `critical`.
+ *
+ * @param json - The contents of a ZAP JSON report.
+ * @param options - Ownership, and the injected clock and id source.
+ * @returns One finding per instance, in report order.
+ * @throws SyntaxError If the report is not valid JSON. Unlike Nuclei's JSONL,
+ * where one bad line costs one record, a ZAP report is a single document: if it
+ * will not parse there is nothing to salvage and silence would be a lie.
+ */
+export declare function importZap(json: string, options: ImportOptions): Finding[];
+//# sourceMappingURL=zap.d.ts.map

package/dist/import/zap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zap.d.ts","sourceRoot":"","sources":["../../src/import/zap.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAG7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAoEjD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,EAAE,CAmEzE"}