@secureport/core 1.0.0 → 2.1.0

package/dist/refingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refingerprint.d.ts","sourceRoot":"","sources":["../src/refingerprint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEvE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAAC;IAC/C,SAAS,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAAC;CACxC;AAED,sCAAsC;AACtC,eAAO,MAAM,gBAAgB,EAAE,oBAI9B,CAAC;AAEF,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;CACvC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,aAAa,CAAC;AAE9F,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,sFAAsF;IACtF,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAC;CACjE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,SAAS,iBAAiB,EAAE,EACnC,SAAS,GAAE,oBAAuC,GACjD,iBAAiB,CA+GnB"}

package/dist/refingerprint.js

@@ -0,0 +1,190 @@
+import { FINGERPRINT_VERSION, fingerprint, vulnKey } from './fingerprint.js';
+/** The algorithm this build ships. */
+export const currentAlgorithm = {
+    version: FINGERPRINT_VERSION,
+    fingerprintOf: fingerprint,
+    vulnKeyOf: vulnKey,
+};
+/**
+ * Works out what re-fingerprinting every issue would do, and writes nothing.
+ *
+ * **Recomputed from inputs, never by comparing stored strings.** A stored
+ * `fp_v1` fingerprint and a stored `fp_v2` one are not comparable — that is
+ * the whole reason `reconcile()` refuses to run across versions (B45) — so
+ * the only honest question is "what does the new algorithm say about the same
+ * evidence?". That means re-deriving `vulnKey` too: B39's change was to the
+ * `vulnKey` fallback, and reading the stored value would miss precisely the
+ * class of change this migration exists for.
+ *
+ * **A manual issue is keyed from its own columns, evidence or not.** Findings
+ * can be attached to a human-raised issue after the fact; 24 of the 404 manual
+ * issues in the development database are. Re-deriving those from the evidence
+ * would replace the human's `vulnKey` with the scanner's and merge the issue
+ * into whichever upload-origin issue already holds that key — losing the
+ * issue a person raised, in a migration nobody expected to lose anything.
+ *
+ * **An issue an earlier merge retired keeps the key it has**, and this is what
+ * makes the plan reach a fixed point. A merge copies the duplicate's evidence
+ * to the survivor without removing it from the duplicate (B98), so re-deriving
+ * a retired issue from its evidence produces the survivor's key and proposes
+ * the merge that already happened — every run, forever. Checked before the
+ * manual rule, because an issue can be both and retirement is the later
+ * statement about its identity.
+ *
+ * **Findings are never touched, and this never needs them to be.** A finding
+ * is evidence (invariant 1) and `findings` rejects `UPDATE` at the database
+ * (B66); its `fingerprint_version` records which algorithm produced it and
+ * that stays true forever. Only `issues` are re-keyed. B69, 8 September.
+ *
+ * **A finding whose key cannot be re-derived makes its issue `undecidable`,
+ * and does not stop the report.** `vulnKey()` throws when a finding carries
+ * no mapped rule, CWE, category or engine rule id — so a row that was never
+ * produced by an importer at this version (or was produced by a different
+ * one) has no answer. Reporting that is the useful behaviour: a migration
+ * plan that dies on one row tells an operator nothing about the other
+ * thousand, and guessing a key from the stored value would defeat the whole
+ * purpose, since re-deriving `vulnKey` is the point.
+ */
+export function planRefingerprint(input, algorithm = currentAlgorithm) {
+    const recomputed = input.map(({ issue, findings }) => {
+        // Retirement is checked first, and the order is load-bearing. An issue an
+        // earlier merge retired is not re-keyed at all: its identity moved to the
+        // survivor, and its evidence — which the merge copied to that survivor —
+        // would re-derive the survivor's key and propose merging the two all over
+        // again, so the plan would never reach a fixed point. A *manual* issue
+        // that was later merged away is both things at once, and retirement is
+        // the later statement about its identity, so it wins. Measured: with the
+        // branches the other way round, 95 issues reported `moved` on every run
+        // while the executor left them alone on every run, forever.
+        if (issue.status === 'ignored' && issue.ignoreReason === 'duplicate') {
+            return { issue, evidence: findings.length, undecidable: false, to: [issue.fingerprint] };
+        }
+        // A manual issue is keyed from its own columns: its `vulnKey` and location
+        // were declared by a person, and evidence linked afterwards corroborates
+        // that issue rather than redefining it. Re-deriving would replace the
+        // human's key with the scanner's and dissolve the issue into whichever
+        // upload-origin issue already holds it.
+        //
+        // A *merge survivor* is deliberately not handled here, though it is also
+        // an identity a person asserted. Keying one from its own columns carries a
+        // stale `vulnKey` — written before the mapping table knew the engine's
+        // rule — so the migrated issue stops matching what the importer now
+        // produces, auto-resolves and comes back as new. `gatherForOrg` excludes
+        // the absorbed evidence instead, so a survivor re-derives correctly from
+        // what was always its own.
+        if (issue.origin === 'manual') {
+            return {
+                issue,
+                evidence: findings.length,
+                undecidable: false,
+                to: [fromOwnColumns(issue, algorithm)],
+            };
+        }
+        const keys = findings.map((f) => fingerprintOfFinding(issue, f, algorithm));
+        return {
+            issue,
+            evidence: findings.length,
+            undecidable: keys.some((k) => k === undefined),
+            to: [...new Set(keys.filter((k) => k !== undefined))].sort(),
+        };
+    });
+    // A scanner-origin issue whose evidence has since been detached has nothing
+    // left to re-derive from, so it falls back to its own columns rather than
+    // vanishing from the report.
+    for (const row of recomputed) {
+        if (row.to.length === 0 && !row.undecidable) {
+            row.to = [fromOwnColumns(row.issue, algorithm)];
+        }
+    }
+    const owners = new Map();
+    for (const row of recomputed) {
+        if (row.undecidable)
+            continue;
+        for (const fp of row.to) {
+            const list = owners.get(fp);
+            if (list)
+                list.push(row.issue.id);
+            else
+                owners.set(fp, [row.issue.id]);
+        }
+    }
+    const counts = {
+        unchanged: 0,
+        moved: 0,
+        merged: 0,
+        split: 0,
+        undecidable: 0,
+    };
+    const issues = recomputed.map(({ issue, evidence, to, undecidable }) => {
+        const mergesWith = [
+            ...new Set(to.flatMap((fp) => owners.get(fp) ?? []).filter((id) => id !== issue.id)),
+        ].sort();
+        // Split first: an issue that fragments is the most disruptive outcome
+        // and stays visible even when one of its fragments also collides.
+        const outcome = undecidable
+            ? 'undecidable'
+            : to.length > 1
+                ? 'split'
+                : mergesWith.length > 0
+                    ? 'merged'
+                    : to[0] === issue.fingerprint
+                        ? 'unchanged'
+                        : 'moved';
+        counts[outcome] += 1;
+        return {
+            issueId: issue.id,
+            targetId: issue.targetId,
+            title: issue.title,
+            from: issue.fingerprint,
+            fromVersion: issue.fingerprintVersion,
+            to,
+            outcome,
+            mergesWith,
+            evidence,
+        };
+    });
+    const fromVersions = [...new Set(input.map(({ issue }) => issue.fingerprintVersion))].sort();
+    return {
+        fromVersion: fromVersions.join(', ') || algorithm.version,
+        toVersion: algorithm.version,
+        issues,
+        counts,
+    };
+}
+/** An issue's fingerprint at the new version, from the issue's own columns. */
+function fromOwnColumns(issue, algorithm) {
+    return algorithm.fingerprintOf({
+        targetId: issue.targetId,
+        vulnKey: issue.vulnKey,
+        location: issue.location,
+        ...(issue.parameter === undefined ? {} : { parameter: issue.parameter }),
+    });
+}
+/**
+ * One finding's fingerprint at the new version, `vulnKey` re-derived and all,
+ * or `undefined` when the key cannot be derived from what the finding holds.
+ */
+function fingerprintOfFinding(issue, finding, algorithm) {
+    let key;
+    try {
+        key = algorithm.vulnKeyOf({
+            sourceEngine: finding.sourceEngine,
+            ...(finding.sourceRuleId === undefined ? {} : { sourceRuleId: finding.sourceRuleId }),
+            ...(finding.cwe === undefined ? {} : { cwe: finding.cwe }),
+            ...(finding.category === undefined ? {} : { category: finding.category }),
+        });
+    }
+    catch {
+        return undefined;
+    }
+    return algorithm.fingerprintOf({
+        // The target is the issue's: a finding records the run it came from, and
+        // every run of an issue's evidence is against the same target anyway.
+        targetId: issue.targetId,
+        vulnKey: key,
+        location: finding.location,
+        ...(finding.parameter === undefined ? {} : { parameter: finding.parameter }),
+        ...(finding.port === undefined ? {} : { port: finding.port }),
+    });
+}
+//# sourceMappingURL=refingerprint.js.map

package/dist/refingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refingerprint.js","sourceRoot":"","sources":["../src/refingerprint.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAqB7E,sCAAsC;AACtC,MAAM,CAAC,MAAM,gBAAgB,GAAyB;IACpD,OAAO,EAAE,mBAAmB;IAC5B,aAAa,EAAE,WAAW;IAC1B,SAAS,EAAE,OAAO;CACnB,CAAC;AA0DF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAmC,EACnC,YAAkC,gBAAgB;IAElD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;QACnD,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,4DAA4D;QAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;YACrE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3F,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,wCAAwC;QACxC,EAAE;QACF,yEAAyE;QACzE,2EAA2E;QAC3E,uEAAuE;QACvE,oEAAoE;QACpE,yEAAyE;QACzE,yEAAyE;QACzE,2BAA2B;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,QAAQ,CAAC,MAAM;gBACzB,WAAW,EAAE,KAAK;gBAClB,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;aACvC,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAC5E,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,MAAM;YACzB,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;YAC9C,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;SAC1E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,0EAA0E;IAC1E,6BAA6B;IAC7B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAC5C,GAAG,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,WAAW;YAAE,SAAS;QAC9B,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;;gBAC7B,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAyC;QACnD,SAAS,EAAE,CAAC;QACZ,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,CAAC;QACT,KAAK,EAAE,CAAC;QACR,WAAW,EAAE,CAAC;KACf,CAAC;IAEF,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,EAAa,EAAE;QAChF,MAAM,UAAU,GAAG;YACjB,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;SACrF,CAAC,IAAI,EAAE,CAAC;QAET,sEAAsE;QACtE,kEAAkE;QAClE,MAAM,OAAO,GAAyB,WAAW;YAC/C,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC;gBACb,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;oBACrB,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,WAAW;wBAC3B,CAAC,CAAC,WAAW;wBACb,CAAC,CAAC,OAAO,CAAC;QAElB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,WAAW;YACvB,WAAW,EAAE,KAAK,CAAC,kBAAkB;YACrC,EAAE;YACF,OAAO;YACP,UAAU;YACV,QAAQ;SACT,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7F,OAAO;QACL,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,OAAO;QACzD,SAAS,EAAE,SAAS,CAAC,OAAO;QAC5B,MAAM;QACN,MAAM;KACP,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,cAAc,CAAC,KAAY,EAAE,SAA+B;IACnE,OAAO,SAAS,CAAC,aAAa,CAAC;QAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;KACzE,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,KAAY,EACZ,OAAgB,EAChB,SAA+B;IAE/B,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC;YACxB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;YACrF,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;SAC1E,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC,aAAa,CAAC;QAC7B,yEAAyE;QACzE,sEAAsE;QACtE,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,GAAG;QACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC5E,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;KAC9D,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secureport/core",
-  "version": "1.0.0",
+  "version": "2.1.0",
   "description": "Shared domain model for Secureport. Imported by the hosted API the same way a third party would.",
   "keywords": [
     "security",

package/src/finding.ts

@@ -94,15 +94,16 @@ export interface Finding {
    *
    * **Recorded, not addressed.** The port is already inside
    * {@link Finding.location} for host-oriented engines (Nessus assembles
-   * `host:port`) and is already a fingerprint component, so this field changes
-   * neither. It exists because a port was otherwise unrecoverable from a
-   * finding except by parsing its location, which is not something a consumer
-   * should have to do.
+   * `host:port`), and that location is what the fingerprint reads. It exists
+   * because a port was otherwise unrecoverable from a finding except by
+   * parsing its location, which is not something a consumer should have to do.
    *
-   * Deliberately **not** added to the fingerprint inputs: doing so would move
-   * every existing Nessus fingerprint and force a re-fingerprint migration,
-   * which is a far worse outcome than a field being merely inconvenient to
-   * read.
+   * **No longer a fingerprint component at all, as of `fp_v2`.** It used to
+   * fill the last slot when no parameter was named, which counted a Nessus
+   * port twice and stopped a network scan ever matching a web scan of the same
+   * endpoint. The location carries the port now, canonicalised — so a default
+   * port drops and any other is kept, which is the distinction that actually
+   * matters.
    */
   readonly port?: number;
 

package/src/fingerprint.ts

@@ -13,7 +13,7 @@ import { createHash } from 'node:crypto';
  * If you are tempted to "just tweak" the normaliser, that is this constant's
  * job to prevent.
  */
-export const FINGERPRINT_VERSION = 'fp_v1';
+export const FINGERPRINT_VERSION = 'fp_v2';
 
 /** A path segment that is entirely digits, e.g. the `123` in `/orders/123`. */
 const NUMERIC_SEGMENT = /^\d+$/u;
@@ -80,10 +80,17 @@ function collapseSegment(segment: string): string {
  *   one issue into two.
  * - **Drops the fragment**, which the server never sees.
  *
- * Anything that is not a parseable absolute URL — a bare host, a file path, a
- * `host:port` pair from a network scan — is normalised as a path alone. That is
- * deliberate: refusing to fingerprint a non-HTTP finding would exclude whole
- * classes of scanner from the model.
+ * - **Reads `host:443` and `host:80` as the URL the port implies**, so a
+ *   network scanner's `app.example.com:443` and a web scanner's
+ *   `https://app.example.com/` are one endpoint (B102, `fp_v2`). Only those two
+ *   ports: any other is left alone rather than guessed at, because
+ *   `host:8443` could be TLS or plaintext and inventing a scheme to force a
+ *   match would assert something nobody measured.
+ *
+ * Anything else that is not a parseable absolute URL — a bare host, a file
+ * path — is normalised as a path alone. That is deliberate: refusing to
+ * fingerprint a non-HTTP finding would exclude whole classes of scanner from
+ * the model.
  *
  * @param location - Where the weakness was found.
  * @returns The normalised location.
@@ -107,7 +114,9 @@ export function normaliseLocation(location: string): string {
   // Not an absolute URL: normalise it as a bare path and stop. `new URL` would
   // otherwise turn `example.com/x` into the `example.com:` protocol.
   if (!url || url.protocol === '' || !url.host) {
-    return normalisePathOnly(trimmed);
+    const implied = impliedSchemeUrl(trimmed);
+    if (implied === undefined) return normalisePathOnly(trimmed);
+    url = implied;
   }
 
   // Not `decodeOnce` here: normalisePathOnly decodes, and decoding on the way
@@ -123,6 +132,32 @@ export function normaliseLocation(location: string): string {
   return `${url.protocol}//${url.host}${path}${query}`;
 }
 
+/**
+ * A bare `host:port` read as the URL its port implies, or `undefined`.
+ *
+ * **Only `:443` and `:80`, and that restraint is the point.** A network scanner
+ * reports `app.example.com:443` for the weakness a web scanner reports at
+ * `https://app.example.com/`, and those are one endpoint: 443 means TLS and an
+ * empty path means the root. Both are convention rather than guarantee, but
+ * they are conventions every scanner in this model already relies on, and
+ * leaving the two unmatched means a network scan and a web scan of one host
+ * can never agree about anything — which is the duplication P6 exists to
+ * remove (B102).
+ *
+ * Any other port is left alone rather than guessed at. `app.example.com:8443`
+ * could be TLS or plaintext, and inventing a scheme to make a match happen
+ * would be asserting something nobody measured.
+ */
+function impliedSchemeUrl(location: string): URL | undefined {
+  const match = /^([a-z0-9.\-_]+|\[[0-9a-f:]+\]):(443|80)$/iu.exec(location);
+  if (!match) return undefined;
+  try {
+    return new URL(`${match[2] === '443' ? 'https' : 'http'}://${location}`);
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Normalises a path with no scheme or host.
  */
@@ -197,6 +232,15 @@ export const VULN_KEY_MAP: Readonly<Record<string, string>> = Object.freeze({
   // the other stops the two agreeing, so these travel together.
   'nuclei:xss-reflected': 'xss-reflected',
   'nuclei:missing-hsts': 'hsts-missing',
+
+  // Burp and Nessus, added in `fp_v2`. Neither had a single entry, so both fell
+  // through to the CWE for every finding — which is worse than no table at all:
+  // ZAP and Nuclei keyed `hsts-missing` while Burp and Nessus keyed `CWE-319`
+  // for the same weakness, so half a table was actively splitting issues that a
+  // plain CWE fallback would have kept together.
+  'burp:5244160': 'xss-reflected',
+  'burp:6234880': 'hsts-missing',
+  'nessus:42822': 'hsts-missing',
 });
 
 /**
@@ -306,10 +350,32 @@ export interface FingerprintInput {
  * ```
  */
 export function fingerprint(input: FingerprintInput): string {
-  const tail = input.parameter ?? (input.port !== undefined ? String(input.port) : '');
-  const material = [input.targetId, input.vulnKey, normaliseLocation(input.location), tail].join(
-    '|',
-  );
+  // The port is no longer part of the tail. `normaliseLocation` now canonicalises
+  // a `host:port` location, so a non-default port is already in the location and
+  // a default one is deliberately absent from it — counting the port again here
+  // made a Nessus finding on 443 unable to match a web scanner's finding on the
+  // same endpoint. `import/nessus.ts` recorded this double-count as something
+  // that had to stay because removing it would force a re-fingerprint migration;
+  // `fp_v2` is that migration.
+  const tail = input.parameter ?? '';
+
+  // A named parameter makes the query string redundant: both describe the same
+  // input, and keeping the query too means a scanner that reports the parameter
+  // separately (Burp: `/search`, parameter `q`) can never match one that leaves
+  // it in the URL (ZAP: `/search?q=test`, parameter `q`). When no parameter is
+  // named the query names stay, because then they are the only thing
+  // distinguishing one page from another — and Nuclei never names a parameter,
+  // so dropping them unconditionally would merge `/view?id` with `/view?page`.
+  const location = normaliseLocation(input.location);
+  const addressed = input.parameter === undefined ? location : stripQuery(location);
+
+  const material = [input.targetId, input.vulnKey, addressed, tail].join('|');
 
   return createHash('sha256').update(material, 'utf8').digest('hex');
 }
+
+/** Everything before the `?` of an already-normalised location. */
+function stripQuery(location: string): string {
+  const at = location.indexOf('?');
+  return at === -1 ? location : location.slice(0, at);
+}

package/src/import/nessus.ts

@@ -28,12 +28,15 @@ const NESSUS_SEVERITY: Readonly<Record<string, Severity>> = Object.freeze({
  * fingerprints distinctly per service.
  *
  * The port is also recorded on {@link Finding.port} (**B42**), which is a
- * record and nothing more. The location assembly and the fingerprint inputs are
- * deliberately unchanged: the fingerprint's last component is
- * `parameter ?? port ?? ''`, so a Nessus port is still counted twice — once
- * inside the location and once as that component. That double-count is
- * harmless and **must stay**, because removing it would move every existing
- * Nessus fingerprint and force a re-fingerprint migration.
+ * record and nothing more. **The double-count is gone in `fp_v2`** (6.9c): the
+ * fingerprint's last component was `parameter ?? port ?? ''`, so a Nessus port
+ * was counted twice — once inside the location and once as that component —
+ * and this comment said it had to stay because removing it would force a
+ * re-fingerprint migration. 6.9b built that migration, so it went. The tail is
+ * now `parameter ?? ''`, and the port is carried by the location alone, which
+ * `normaliseLocation` canonicalises: `app.example.com:443` and
+ * `https://app.example.com/` are one endpoint (B102), and a non-default port
+ * stays in the location where it belongs.
  *
  * Severity comes from the CVSS v3 base score where Nessus supplies one, and from
  * its own numeric rating otherwise.

package/src/index.ts

@@ -16,6 +16,15 @@
 
 export type { Finding } from './finding.js';
 export type { FingerprintInput, VulnKeyInput } from './fingerprint.js';
+export type {
+  FingerprintAlgorithm,
+  IssuePlan,
+  IssueWithEvidence,
+  RefingerprintOutcome,
+  RefingerprintPlan,
+} from './refingerprint.js';
+export { currentAlgorithm, planRefingerprint } from './refingerprint.js';
+export { exposureOf } from './reconcile.js';
 export {
   FINGERPRINT_VERSION,
   PATH_PLACEHOLDER,

package/src/reconcile.ts

@@ -146,6 +146,40 @@ function defaultThreshold(kind: RunKind): number {
   return kind === 'upload' ? 1 : 2;
 }
 
+/**
+ * How much a single issue contributes to an exposure score.
+ *
+ * **Severity times age in days, capped at ninety.** The cap is the load-bearing
+ * part: without it a two-year-old advisory eventually outweighs a critical
+ * found this morning, and the number stops being about risk and starts being
+ * about how long you have had the account. Ninety days is where an unfixed
+ * issue stops getting worse and simply *is* bad.
+ *
+ * **Only `open` and `regressed` count.** A resolved issue is not exposure, and
+ * an ignored one is excluded from exposure exactly as it is excluded from
+ * every count but its own (invariant 7) — suppressing an issue is a statement
+ * that it is not currently risk, and a score that disagreed with that would
+ * make the suppression pointless.
+ *
+ * Exported because `reconcile()` is not the only thing that needs it: the
+ * nightly rollup scores a whole organisation across every target, and two
+ * implementations of this would be two definitions of exposure.
+ *
+ * @param issue - The issue to score.
+ * @param now - When the score is being taken. An argument, so the same issue
+ *   and the same clock always give the same number.
+ * @returns The contribution, which is zero for anything not currently open.
+ */
+export function exposureOf(
+  issue: Pick<Issue, 'status' | 'effectiveSeverity' | 'firstSeen'>,
+  now: Date,
+): number {
+  if (issue.status !== 'open' && issue.status !== 'regressed') return 0;
+  return (
+    SEVERITY_WEIGHTS[issue.effectiveSeverity] * Math.min(daysBetween(issue.firstSeen, now), 90)
+  );
+}
+
 /** An all-zero count, so a report never has to decide what a missing key means. */
 function emptyCounts(): Record<string, number> {
   return Object.fromEntries(SEVERITY_ORDER.map((s) => [s, 0]));
@@ -446,9 +480,7 @@ export function reconcile(input: ReconcileInput): ReconcileResult {
     else if (regressedNow.has(key)) counts.regressed[severity]++;
     else if (updated.has(key)) counts.stillOpen[severity]++;
 
-    if (issue.status === 'open' || issue.status === 'regressed') {
-      exposureScore += SEVERITY_WEIGHTS[severity] * Math.min(daysBetween(issue.firstSeen, now), 90);
-    }
+    exposureScore += exposureOf(issue, now);
   }
 
   const summary: RunSummary = {