@secureport/core 0.3.0 → 1.0.0-rc.0

package/README.md

@@ -1,6 +1,6 @@
 # @secureport/core
 
-The shared domain model for [Secureport](https://github.com/agbjordan/secureport).
+The shared domain model for [Secureport](https://secureport.io/).
 The hosted API imports this package the same way a third party would — one
 model, one implementation.
 
@@ -24,12 +24,54 @@ comes back after being fixed is a regression, not a discovery.
 npm install @secureport/core
 ```
 
+## What it does
+
+Everything below is pure: no I/O, no clock, no randomness. Time and ids are
+arguments, which is what makes a report reproducible and a test a golden file.
+
+```ts
+import { buildSnapshot, importNuclei, renderMarkdown, parseSnapshot } from '@secureport/core';
+
+const findings = importNuclei(text, { orgId, runId, targetId, now, newId });
+
+const snapshot = buildSnapshot({
+  target,
+  run,
+  findings,
+  previous: parseSnapshot(lastTime), // optional — this is what makes a retest
+  now,
+  newId,
+});
+
+renderMarkdown(snapshot, { kind: 'retest', now });
+```
+
+|                    |                                                                            |
+| ------------------ | -------------------------------------------------------------------------- |
+| **Importers**      | `importNuclei`, `importZap`, `importBurp`, `importNessus`, `importGeneric` |
+| **Fingerprint**    | `fingerprint`, `vulnKey`, `normaliseLocation`, `FINGERPRINT_VERSION`       |
+| **Reconciliation** | `reconcile` — the only thing that changes issue state                      |
+| **Coverage**       | `coversLocation` — what makes auto-resolution safe                         |
+| **Snapshots**      | `buildSnapshot`, `parseSnapshot`                                           |
+| **Reports**        | `renderMarkdown`, `renderHtml`, `renderJson`, `buildReportModel`           |
+
+Rendered examples of all five report kinds are at
+[secureport.io](https://secureport.io/) — the source repository is private, so
+the site is where they live.
+
+For a command line rather than an API, see
+[`@secureport/cli`](https://www.npmjs.com/package/@secureport/cli):
+
+```sh
+npx @secureport/cli report pen scan.jsonl --url https://app.example.com
+```
+
 ## Status
 
-`0.3.x` ships the domain types, the severity model and the SLA policy.
-Still to come, in this order: the fingerprint, `reconcile()`, `SnapshotBuilder`
-and the scanner importers. Until `reconcile()` lands, this package describes the
-model rather than computing it.
+Pre-1.0. Every export is a semver contract already, and the shapes are settled
+by five report templates and five importers built on them — but below `1.0.0` a
+minor may still move something. See the deprecation policy below for what
+changes at `1.0.0`.
 
 `0.2.x` had a placeholder `reconcile()` that matched issues by title. It is gone
 rather than deprecated — matching by title is not a simplified version of
@@ -85,11 +127,74 @@ account.
 
 The snapshot is the artefact; a PDF is a view of it.
 
-## Contracts
+## Public contracts
+
+Every export is a semver contract. Two of them are worth stating separately,
+because they outlive any one version of this package.
 
-Every export is a semver contract. `fingerprintVersion` travels with every
-fingerprint everywhere, so a stored fingerprint can always be interpreted, and
-changing the algorithm means a migration that preserves history rather than a
-silent recomputation.
+### `fingerprint_version`
+
+An issue's identity is the pair `(fingerprintVersion, fingerprint)`, not the
+fingerprint alone. `FINGERPRINT_VERSION` is `fp_v1` and it travels with every
+fingerprint everywhere it is stored, so a fingerprint written today can always
+be interpreted — including by code that has moved on.
+
+```
+fingerprint = sha256(targetId + '|' + vulnKey + '|' + normalisedLocation + '|' + (parameter ?? port ?? ''))
+```
 
-A deprecation policy lands before `1.0.0`.
+`vulnKey` is the engine-independent name for a weakness: a mapping-table entry
+where one exists, then the CWE, then the category, then `engine:ruleId`. That
+chain is what makes two scanners reporting the same weakness one issue rather
+than two.
+
+**Changing any of this changes the version**, and a version change means a
+migration that recomputes fingerprints while preserving history — `firstSeen`
+is never reset — not a silent recomputation that orphans every issue. That is
+the whole reason the version exists, and it is why it is a contract rather than
+an implementation detail.
+
+### The JSON report
+
+`renderJson` emits a `JsonReport`, versioned by `reportVersion` (currently
+`1`), for consumers rendering their own view. It carries the derived answers
+beside the snapshot rather than only the snapshot, and two of its fields are
+there for a specific reason:
+
+- **`basis`** — how the findings were produced, as data. A consumer must not be
+  able to present automated results as manual testing simply by not reading the
+  prose.
+- **`limitations`** — what the report does not establish, as data, for the same
+  reason.
+
+`reportVersion` bumps when the shape changes incompatibly. Adding a field does
+not bump it, so read defensively.
+
+## Deprecation
+
+Nothing that works stops working inside a major version, and nothing is removed
+without having been deprecated in a release you could have seen: marked
+`@deprecated` with its replacement named, left working for at least one further
+minor and 90 days, then removed in a major.
+
+|           |                                                                                                                                          |
+| --------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
+| **Patch** | Behaviour unchanged, or a fix to behaviour that was already wrong. Never a signature change                                              |
+| **Minor** | Additions. New exports, new optional fields, new accepted input. **Adding a field to a returned object is a minor, so read defensively** |
+| **Major** | Anything that could break a build or change an answer — a removed or renamed export, a narrowed input, a changed default                 |
+
+Making an optional field required, or a required field optional, is a breaking
+change. Anything not reachable from this package's entry point is internal,
+whatever it looks like; reaching into `dist/` is not covered.
+
+**`fingerprint_version` never changes without a migration.** That is what the
+version is for: a change obliges a per-org re-fingerprint that preserves
+history — `firstSeen` is never reset — rather than a silent recomputation that
+orphans every issue.
+
+**A published version is immutable.** A mistake is corrected by publishing
+another one, not by changing or unpublishing that one.
+
+**If the only correct fix for a vulnerability is a breaking change, we make it
+and say so.** A policy that would rather leave a hole open than break a
+signature is not one worth having.

package/dist/import/burp.d.ts

@@ -0,0 +1,19 @@
+import type { Finding } from '../finding.js';
+import type { ImportOptions } from './nuclei.js';
+/**
+ * Turns a Burp Suite XML export into {@link Finding}s.
+ *
+ * Burp exports a flat `<issues>` document, one `<issue>` per detection, with the
+ * host and path in separate elements — so the location is assembled rather than
+ * read. Prose fields arrive as CDATA containing HTML, which is stripped.
+ *
+ * `<type>` is Burp's numeric issue type and is used as the rule id, because it
+ * is stable across versions where the human-readable `<name>` is not.
+ *
+ * @param xml - The contents of a Burp XML export.
+ * @param options - Ownership, and the injected clock and id source.
+ * @returns One finding per issue, in document order.
+ * @throws SyntaxError If the document is not well-formed XML.
+ */
+export declare function importBurp(xml: string, options: ImportOptions): Finding[];
+//# sourceMappingURL=burp.d.ts.map

package/dist/import/burp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"burp.d.ts","sourceRoot":"","sources":["../../src/import/burp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAI7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAwCjD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,EAAE,CA0DzE"}

package/dist/import/burp.js

@@ -0,0 +1,114 @@
+import { fingerprint, vulnKey, FINGERPRINT_VERSION } from '../fingerprint.js';
+import { childText, findAll, parseXml } from './xml.js';
+/**
+ * Burp's severity vocabulary, mapped onto {@link Severity}.
+ *
+ * **Burp has no "critical" either.** Like ZAP it tops out at High, and
+ * `Information` is the bottom of the scale rather than a separate category.
+ */
+const BURP_SEVERITY = Object.freeze({
+    high: 'high',
+    medium: 'medium',
+    low: 'low',
+    information: 'advisory',
+    info: 'advisory',
+});
+/**
+ * Burp reports confidence in words. Mapped to a number so the model does not
+ * have to carry a second vocabulary for it.
+ */
+const BURP_CONFIDENCE = Object.freeze({
+    certain: 1,
+    firm: 0.7,
+    tentative: 0.4,
+});
+/**
+ * Burp writes the affected parameter into the location, not a field of its own.
+ *
+ * `/search [q parameter]` means the `q` parameter of `/search`. Pulling it out
+ * matters: the parameter is part of the fingerprint, so leaving it embedded in
+ * the path would make Burp's finding a different issue from ZAP's finding of the
+ * same weakness in the same place.
+ */
+function splitLocation(location) {
+    const match = /^(.*?)\s*\[\s*(.+?)\s+parameter\s*\]\s*$/iu.exec(location);
+    if (match)
+        return { path: match[1].trim(), parameter: match[2].trim() };
+    return { path: location.trim() };
+}
+/**
+ * Turns a Burp Suite XML export into {@link Finding}s.
+ *
+ * Burp exports a flat `<issues>` document, one `<issue>` per detection, with the
+ * host and path in separate elements — so the location is assembled rather than
+ * read. Prose fields arrive as CDATA containing HTML, which is stripped.
+ *
+ * `<type>` is Burp's numeric issue type and is used as the rule id, because it
+ * is stable across versions where the human-readable `<name>` is not.
+ *
+ * @param xml - The contents of a Burp XML export.
+ * @param options - Ownership, and the injected clock and id source.
+ * @returns One finding per issue, in document order.
+ * @throws SyntaxError If the document is not well-formed XML.
+ */
+export function importBurp(xml, options) {
+    const root = parseXml(xml);
+    const findings = [];
+    for (const issue of findAll(root, 'issue')) {
+        const name = childText(issue, 'name');
+        const type = childText(issue, 'type');
+        if (name === undefined || type === undefined)
+            continue;
+        const host = childText(issue, 'host') ?? '';
+        const raw = childText(issue, 'location') ?? childText(issue, 'path') ?? '';
+        const { path, parameter } = splitLocation(raw);
+        const location = path.startsWith('http') ? path : `${host}${path}`;
+        if (location === '')
+            continue;
+        const cwe = childText(issue, 'vulnerabilityClassifications')
+            ?.match(/CWE-\d+/iu)?.[0]
+            ?.toUpperCase();
+        const key = vulnKey({
+            sourceEngine: 'burp',
+            sourceRuleId: type,
+            ...(cwe === undefined ? {} : { cwe }),
+        });
+        const confidence = BURP_CONFIDENCE[childText(issue, 'confidence')?.toLowerCase() ?? ''];
+        const background = childText(issue, 'issueBackground');
+        const remediation = childText(issue, 'remediationBackground');
+        findings.push({
+            id: options.newId(),
+            orgId: options.orgId,
+            runId: options.runId,
+            fingerprint: fingerprint({
+                targetId: options.targetId,
+                vulnKey: key,
+                location,
+                ...(parameter === undefined ? {} : { parameter }),
+            }),
+            fingerprintVersion: FINGERPRINT_VERSION,
+            title: name,
+            ...(background === undefined ? {} : { description: stripHtml(background) }),
+            detectedSeverity: BURP_SEVERITY[childText(issue, 'severity')?.toLowerCase() ?? ''] ?? 'advisory',
+            severitySource: 'engine_default',
+            ...(cwe === undefined ? {} : { cwe }),
+            vulnKey: key,
+            location,
+            ...(parameter === undefined ? {} : { parameter }),
+            ...(remediation === undefined ? {} : { recommendation: stripHtml(remediation) }),
+            sourceEngine: 'burp',
+            sourceRuleId: type,
+            ...(confidence === undefined ? {} : { confidence }),
+            createdAt: options.now,
+        });
+    }
+    return findings;
+}
+/** Burp's prose fields are HTML inside CDATA. */
+function stripHtml(value) {
+    return value
+        .replace(/<[^>]*>/gu, ' ')
+        .replace(/\s+/gu, ' ')
+        .trim();
+}
+//# sourceMappingURL=burp.js.map

package/dist/import/burp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"burp.js","sourceRoot":"","sources":["../../src/import/burp.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAGxD;;;;;GAKG;AACH,MAAM,aAAa,GAAuC,MAAM,CAAC,MAAM,CAAC;IACtE,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,WAAW,EAAE,UAAU;IACvB,IAAI,EAAE,UAAU;CACjB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,eAAe,GAAqC,MAAM,CAAC,MAAM,CAAC;IACtE,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,GAAG;IACT,SAAS,EAAE,GAAG;CACf,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,KAAK,GAAG,4CAA4C,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1E,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACxE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,OAAsB;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QAEvD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3E,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QACnE,IAAI,QAAQ,KAAK,EAAE;YAAE,SAAS;QAE9B,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,8BAA8B,CAAC;YAC1D,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;YACzB,EAAE,WAAW,EAAE,CAAC;QAElB,MAAM,GAAG,GAAG,OAAO,CAAC;YAClB,YAAY,EAAE,MAAM;YACpB,YAAY,EAAE,IAAI;YAClB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;SACtC,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QAE9D,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,WAAW,CAAC;gBACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,GAAG;gBACZ,QAAQ;gBACR,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;aAClD,CAAC;YACF,kBAAkB,EAAE,mBAAmB;YACvC,KAAK,EAAE,IAAI;YACX,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3E,gBAAgB,EACd,aAAa,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,IAAI,UAAU;YAChF,cAAc,EAAE,gBAAgB;YAChC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;YACrC,OAAO,EAAE,GAAG;YACZ,QAAQ;YACR,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;YACjD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YAChF,YAAY,EAAE,MAAM;YACpB,YAAY,EAAE,IAAI;YAClB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;YACnD,SAAS,EAAE,OAAO,CAAC,GAAG;SACvB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,iDAAiD;AACjD,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK;SACT,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC;SACzB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,IAAI,EAAE,CAAC;AACZ,CAAC"}

package/dist/import/generic.d.ts

@@ -0,0 +1,90 @@
+import type { Finding } from '../finding.js';
+import type { Severity } from '../severity.js';
+import type { ImportOptions } from './nuclei.js';
+/**
+ * One finding in the generic Secureport format.
+ *
+ * **Written last, on purpose.** This is the shape the four scanner importers
+ * turned out to have in common, rather than a format designed in advance and
+ * then argued with. Everything an engine reliably supplies is here; everything
+ * only one of them had is not.
+ *
+ * Only `title` and `location` are required. A tool that knows nothing but "this
+ * is wrong, and it is here" can still produce a trackable finding — which is the
+ * point of having a generic format at all.
+ */
+export interface GenericFinding {
+    /** What is wrong. */
+    readonly title: string;
+    /** Where it is — a URL, a host, a `host:port`, or a file path. */
+    readonly location: string;
+    /** Fuller explanation. */
+    readonly description?: string;
+    /**
+     * Severity, if the tool rates it.
+     *
+     * Ignored when `cvssScore` is present: a score is more precise than a word,
+     * and `severitySource` records which was used.
+     */
+    readonly severity?: Severity;
+    /** CVSS base score, 0–10. Preferred over `severity` when both are given. */
+    readonly cvssScore?: number;
+    /** CVSS vector string. */
+    readonly cvssVector?: string;
+    /** CWE identifier, with or without the `CWE-` prefix. */
+    readonly cwe?: string;
+    /** CVE identifier. */
+    readonly cve?: string;
+    /** Broad grouping, e.g. `injection`. */
+    readonly category?: string;
+    /** The parameter implicated, where the weakness has one. */
+    readonly parameter?: string;
+    /** The port, for findings about a service rather than a path. */
+    readonly port?: number;
+    /** What produced it. Defaults to `generic`. */
+    readonly engine?: string;
+    /** The producing tool's own identifier for the rule. */
+    readonly ruleId?: string;
+    /** What to do about it. */
+    readonly recommendation?: string;
+    /** Further reading. */
+    readonly references?: readonly string[];
+    /** Pointers to stored evidence. */
+    readonly evidenceUri?: readonly string[];
+    /** The tool's confidence, 0–1. */
+    readonly confidence?: number;
+}
+/** A generic findings document. */
+export interface GenericDocument {
+    /**
+     * Format version.
+     *
+     * Present so this file can change shape later without guessing. An unknown
+     * version is refused rather than parsed optimistically.
+     */
+    readonly version: 1;
+    /** The findings. */
+    readonly findings: readonly GenericFinding[];
+}
+/**
+ * Turns the generic Secureport format into {@link Finding}s.
+ *
+ * The escape hatch for everything with no importer of its own: a manual test, an
+ * internal tool, a scanner nobody has written a parser for. Fingerprinting,
+ * reconciliation and reports then work identically — a finding that arrives this
+ * way is not a second-class finding.
+ *
+ * Refuses the document rather than salvaging part of it. Unlike Nuclei's JSONL,
+ * where one bad line costs one record, this is a single document a human or a
+ * script wrote deliberately: a field in the wrong shape is a mistake worth
+ * hearing about, not one to route around silently.
+ *
+ * @param json - The contents of a generic findings document.
+ * @param options - Ownership, and the injected clock and id source.
+ * @returns One finding per entry, in document order.
+ * @throws SyntaxError If the text is not valid JSON.
+ * @throws TypeError If the document is not the expected shape, naming the entry
+ * and field at fault.
+ */
+export declare function importGeneric(json: string, options: ImportOptions): Finding[];
+//# sourceMappingURL=generic.d.ts.map

package/dist/import/generic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic.d.ts","sourceRoot":"","sources":["../../src/import/generic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,QAAQ,EAAkB,MAAM,gBAAgB,CAAC;AAG/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,qBAAqB;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,0BAA0B;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAE7B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B,0BAA0B;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,yDAAyD;IACzD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,sBAAsB;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B,iEAAiE;IACjE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,wDAAwD;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,2BAA2B;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAEjC,uBAAuB;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC,mCAAmC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEzC,kCAAkC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,mCAAmC;AACnC,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAEpB,oBAAoB;IACpB,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;CAC9C;AAuCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,EAAE,CA8G7E"}

package/dist/import/generic.js

@@ -0,0 +1,159 @@
+import { SEVERITY_ORDER, severityFromCvss } from '../severity.js';
+import { fingerprint, vulnKey, FINGERPRINT_VERSION } from '../fingerprint.js';
+const SEVERITIES = new Set(SEVERITY_ORDER);
+/** A non-empty trimmed string, or nothing. */
+const str = (v) => typeof v === 'string' && v.trim() !== '' ? v.trim() : undefined;
+/** A finite number, or nothing. */
+const num = (v) => typeof v === 'number' && Number.isFinite(v) ? v : undefined;
+/**
+ * A title reduced to something usable as a weakness key.
+ *
+ * The last resort, and only for the generic format. A tool that reports nothing
+ * but "this is wrong, and it is here" has no CWE, no category and no rule id —
+ * and `vulnKey` would rightly refuse, because there is nothing to key on.
+ * Refusing would mean the minimal case cannot be imported at all, which defeats
+ * the point of having a generic format.
+ *
+ * **Titles are a poor key and this is not pretending otherwise:** reword the
+ * title and the issue becomes a different issue, and two tools describing the
+ * same weakness differently never collide. Supplying a `ruleId`, a `cwe` or a
+ * `category` is strictly better and all three are preferred over this.
+ */
+const titleKey = (title) => title
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/gu, '-')
+    .replace(/^-|-$/gu, '');
+/** An array of non-empty strings, or nothing. */
+const strArray = (v) => {
+    if (!Array.isArray(v))
+        return undefined;
+    const items = v.map(str).filter((x) => x !== undefined);
+    return items.length > 0 ? items : undefined;
+};
+/**
+ * Turns the generic Secureport format into {@link Finding}s.
+ *
+ * The escape hatch for everything with no importer of its own: a manual test, an
+ * internal tool, a scanner nobody has written a parser for. Fingerprinting,
+ * reconciliation and reports then work identically — a finding that arrives this
+ * way is not a second-class finding.
+ *
+ * Refuses the document rather than salvaging part of it. Unlike Nuclei's JSONL,
+ * where one bad line costs one record, this is a single document a human or a
+ * script wrote deliberately: a field in the wrong shape is a mistake worth
+ * hearing about, not one to route around silently.
+ *
+ * @param json - The contents of a generic findings document.
+ * @param options - Ownership, and the injected clock and id source.
+ * @returns One finding per entry, in document order.
+ * @throws SyntaxError If the text is not valid JSON.
+ * @throws TypeError If the document is not the expected shape, naming the entry
+ * and field at fault.
+ */
+export function importGeneric(json, options) {
+    const doc = JSON.parse(json);
+    if (typeof doc !== 'object' || doc === null) {
+        throw new TypeError('generic findings document must be an object');
+    }
+    const record = doc;
+    if (record['version'] !== 1) {
+        throw new TypeError(`unsupported generic findings version: ${String(record['version'])}`);
+    }
+    const raw = record['findings'];
+    if (!Array.isArray(raw)) {
+        throw new TypeError('generic findings document has no `findings` array');
+    }
+    return raw.map((item, index) => {
+        const where = `findings[${String(index)}]`;
+        if (typeof item !== 'object' || item === null) {
+            throw new TypeError(`${where} is not an object`);
+        }
+        const entry = item;
+        const title = str(entry['title']);
+        const location = str(entry['location']);
+        if (title === undefined)
+            throw new TypeError(`${where}.title is required`);
+        if (location === undefined)
+            throw new TypeError(`${where}.location is required`);
+        const stated = str(entry['severity']);
+        if (stated !== undefined && !SEVERITIES.has(stated)) {
+            throw new TypeError(`${where}.severity is not a severity: ${stated}`);
+        }
+        const score = num(entry['cvssScore']);
+        let detectedSeverity;
+        let severitySource;
+        if (score !== undefined && score >= 0 && score <= 10) {
+            detectedSeverity = severityFromCvss(score);
+            severitySource = 'cvss';
+        }
+        else if (stated !== undefined) {
+            detectedSeverity = stated;
+            // Somebody stated it for this finding specifically, which is the
+            // strongest provenance there is.
+            severitySource = 'explicit';
+        }
+        else {
+            detectedSeverity = 'advisory';
+            severitySource = 'engine_default';
+        }
+        const engine = str(entry['engine']) ?? 'generic';
+        const ruleId = str(entry['ruleId']);
+        const rawCwe = str(entry['cwe']);
+        const cwe = rawCwe === undefined ? undefined : `CWE-${rawCwe.replace(/^CWE-/iu, '')}`;
+        const category = str(entry['category']);
+        const parameter = str(entry['parameter']);
+        const port = num(entry['port']);
+        // Nothing classifies this finding, so key on the title rather than refuse
+        // it. `sourceRuleId` stays absent: the tool supplied none, and recording a
+        // slug as though it had would be a lie about provenance.
+        const key = cwe === undefined && category === undefined && ruleId === undefined
+            ? `${engine}:${titleKey(title)}`
+            : vulnKey({
+                sourceEngine: engine,
+                ...(ruleId === undefined ? {} : { sourceRuleId: ruleId }),
+                ...(cwe === undefined ? {} : { cwe }),
+                ...(category === undefined ? {} : { category }),
+            });
+        return {
+            id: options.newId(),
+            orgId: options.orgId,
+            runId: options.runId,
+            fingerprint: fingerprint({
+                targetId: options.targetId,
+                vulnKey: key,
+                location,
+                ...(parameter === undefined ? {} : { parameter }),
+                ...(port === undefined ? {} : { port }),
+            }),
+            fingerprintVersion: FINGERPRINT_VERSION,
+            title,
+            ...(str(entry['description']) === undefined
+                ? {}
+                : { description: str(entry['description']) }),
+            detectedSeverity,
+            severitySource,
+            ...(score === undefined ? {} : { cvssScore: score }),
+            ...(str(entry['cvssVector']) === undefined ? {} : { cvssVector: str(entry['cvssVector']) }),
+            ...(cwe === undefined ? {} : { cwe }),
+            ...(str(entry['cve']) === undefined ? {} : { cve: str(entry['cve']).toUpperCase() }),
+            vulnKey: key,
+            ...(category === undefined ? {} : { category: category.toLowerCase() }),
+            location,
+            ...(parameter === undefined ? {} : { parameter }),
+            ...(strArray(entry['evidenceUri']) === undefined
+                ? {}
+                : { evidenceUri: strArray(entry['evidenceUri']) }),
+            ...(str(entry['recommendation']) === undefined
+                ? {}
+                : { recommendation: str(entry['recommendation']) }),
+            ...(strArray(entry['references']) === undefined
+                ? {}
+                : { references: strArray(entry['references']) }),
+            sourceEngine: engine,
+            ...(ruleId === undefined ? {} : { sourceRuleId: ruleId }),
+            ...(num(entry['confidence']) === undefined ? {} : { confidence: num(entry['confidence']) }),
+            createdAt: options.now,
+        };
+    });
+}
+//# sourceMappingURL=generic.js.map

package/dist/import/generic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic.js","sourceRoot":"","sources":["../../src/import/generic.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAuF9E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,cAAc,CAAC,CAAC;AAEnD,8CAA8C;AAC9C,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAC7C,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAElE,mCAAmC;AACnC,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAC7C,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE9D;;;;;;;;;;;;;GAaG;AACH,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAU,EAAE,CACzC,KAAK;KACF,WAAW,EAAE;KACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;KAC5B,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAE5B,iDAAiD;AACjD,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAwB,EAAE;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAI,CAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAsB;IAChE,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,GAA8B,CAAC;IAE9C,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CAAC,yCAAyC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAQ,GAA0B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACrD,MAAM,KAAK,GAAG,YAAY,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;QAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,KAAK,GAAG,IAA+B,CAAC;QAE9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;QAC3E,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC;QAEjF,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,gCAAgC,MAAM,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACtC,IAAI,gBAA0B,CAAC;QAC/B,IAAI,cAA8B,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YACrD,gBAAgB,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAC3C,cAAc,GAAG,MAAM,CAAC;QAC1B,CAAC;aAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,gBAAgB,GAAG,MAAkB,CAAC;YACtC,iEAAiE;YACjE,iCAAiC;YACjC,cAAc,GAAG,UAAU,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,gBAAgB,GAAG,UAAU,CAAC;YAC9B,cAAc,GAAG,gBAAgB,CAAC;QACpC,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,SAAS,CAAC;QACjD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;QACtF,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAEhC,0EAA0E;QAC1E,2EAA2E;QAC3E,yDAAyD;QACzD,MAAM,GAAG,GACP,GAAG,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;YACjE,CAAC,CAAC,GAAG,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE;YAChC,CAAC,CAAC,OAAO,CAAC;gBACN,YAAY,EAAE,MAAM;gBACpB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;gBACzD,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;gBACrC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;aAChD,CAAC,CAAC;QAET,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,WAAW,CAAC;gBACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,GAAG;gBACZ,QAAQ;gBACR,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;gBACjD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;aACxC,CAAC;YACF,kBAAkB,EAAE,mBAAmB;YACvC,KAAK;YACL,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAE,EAAE,CAAC;YAChD,gBAAgB;YAChB,cAAc;YACd,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAE,EAAE,CAAC;YAC5F,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;YACrC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACrF,OAAO,EAAE,GAAG;YACZ,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YACvE,QAAQ;YACR,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;YACjD,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,KAAK,SAAS;gBAC9C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAE,EAAE,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,KAAK,SAAS;gBAC5C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAE,EAAE,CAAC;YACtD,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,SAAS;gBAC7C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAE,EAAE,CAAC;YACnD,YAAY,EAAE,MAAM;YACpB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;YACzD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAE,EAAE,CAAC;YAC5F,SAAS,EAAE,OAAO,CAAC,GAAG;SACL,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/import/nessus.d.ts

@@ -0,0 +1,32 @@
+import type { Finding } from '../finding.js';
+import type { ImportOptions } from './nuclei.js';
+/**
+ * Turns a `.nessus` export into {@link Finding}s.
+ *
+ * Nessus is host-oriented: every `ReportItem` hangs off a `ReportHost`, and the
+ * port and protocol are attributes rather than part of a URL. The location is
+ * assembled as `host:port`, which is **the only place the port survives** —
+ * `00-DOMAIN.md` §3 defines no `port` on a finding, so anything not in the
+ * location is lost. A network finding with no path still fingerprints
+ * distinctly per service because the port is inside its location.
+ *
+ * A consequence worth knowing: the fingerprint's last component is
+ * `parameter ?? port ?? ''`, so a Nessus port is counted twice — once inside
+ * the location and once as that component. Harmless, but it means a port
+ * cannot be recovered from a finding except by parsing its location. Recorded
+ * as backlog **B42**.
+ *
+ * Severity comes from the CVSS v3 base score where Nessus supplies one, and from
+ * its own numeric rating otherwise.
+ *
+ * A `ReportItem` with severity `0` and no port — Nessus's host-inventory
+ * plugins — still imports: an advisory is still a finding, and dropping it here
+ * would make coverage look narrower than it was.
+ *
+ * @param xml - The contents of a `.nessus` file.
+ * @param options - Ownership, and the injected clock and id source.
+ * @returns One finding per report item, in document order.
+ * @throws SyntaxError If the document is not well-formed XML.
+ */
+export declare function importNessus(xml: string, options: ImportOptions): Finding[];
+//# sourceMappingURL=nessus.d.ts.map

package/dist/import/nessus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nessus.d.ts","sourceRoot":"","sources":["../../src/import/nessus.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAK7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAgBjD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,EAAE,CAsF3E"}