@secureport/core 1.0.0 → 2.2.0

package/dist/report/model.d.ts

@@ -36,7 +36,171 @@ export interface ReportOptions {
      * with the copy somebody was sent.
      */
     readonly now: Date;
+    /**
+     * Keep issues below this severity out of the detail sections.
+     *
+     * **The counts do not move, and that asymmetry is the whole design.**
+     * {@link ReportModel.outstanding}, the exposure score and the breach count
+     * describe the target, not the document, so a floor that changed them would
+     * let somebody produce a report saying "3 outstanding" about a target with
+     * forty. What the floor removes is pages, not facts: the header still sums
+     * everything, and {@link ReportModel.limitations} gains a sentence naming
+     * how many issues were left out.
+     *
+     * That is the same shape the suppressed appendix already uses — excluded
+     * from the sections, stated in the limitations — because it answers the
+     * same question, which is what a reader is not being shown.
+     *
+     * Omitted entirely by default: every issue is listed.
+     */
+    readonly severityFloor?: Severity;
+    /**
+     * Whether to list the issues this run resolved. Defaults to `true`.
+     *
+     * Off is a legitimate choice for a document that only needs to state what is
+     * outstanding, and unlike {@link ReportOptions.severityFloor} it needs no disclosure —
+     * omitting evidence of remediation understates the good news rather than the
+     * bad, so a reader cannot be misled about risk by its absence.
+     *
+     * It does not touch {@link ReportModel.retest}: a retest's `fixed` verdict is
+     * the document's entire point, and a caller asking for less detail about
+     * resolved issues is not asking for a retest that cannot do its job.
+     */
+    readonly includeResolved?: boolean;
+    /**
+     * How much of each issue's evidence to print. Defaults to `'summary'`.
+     *
+     * - `'none'` — no evidence at all. The issue, its severity, its location and
+     *   what to do about it. External references are still listed: an advisory is
+     *   reading, not evidence.
+     * - `'summary'` — how many findings support the issue, and nothing about any
+     *   one of them. What every report printed before this option existed.
+     * - `'full'` — each supporting finding in its own right: where it was seen,
+     *   when, at what severity, with its CVSS and CVE where the engine supplied
+     *   them, and pointers to any stored capture.
+     *
+     * **No verbosity names an engine, and that is not negotiable.** Which scanner
+     * produced a finding is an implementation detail of the assessment, and
+     * naming the stack in a customer-facing document gives away more than it
+     * explains — `00-DOMAIN.md` §7 and {@link TestingBasis.engines}. The engine
+     * name has leaked into rendered output twice already, so `'full'` prints
+     * what was found and never who found it.
+     */
+    readonly evidenceVerbosity?: EvidenceVerbosity;
+    /** Whose document this is. See {@link Branding}. */
+    readonly branding?: Branding;
+    /**
+     * Open the report with a cover page. Defaults to `false`.
+     *
+     * **On the options rather than on {@link Branding}, and the split is
+     * deliberate.** Branding is org-level configuration, stored once and the
+     * same for every document; whether a particular render wants a cover is a
+     * per-report layout decision — a PDF for a client does, a Markdown export
+     * piped into a terminal does not.
+     *
+     * Markdown has no pages, so there it is a block at the top rather than a
+     * page of its own. The statement is the same; the format has one form for
+     * it.
+     */
+    readonly coverPage?: boolean;
+    /**
+     * Open the body with a contents list, and give every section an anchor.
+     * Defaults to `false`.
+     *
+     * **The anchors are what a PDF needs, not the list.** Chromium derives a
+     * document outline from the heading structure, which is how a reader
+     * navigates a sixty-page report in a viewer's sidebar; the printed contents
+     * list is for whoever has it on paper. Both come from the same scan of the
+     * rendered headings, so a list entry cannot point at an anchor that is not
+     * there.
+     *
+     * Individual issues (`<h4>`) are left out on purpose: a report with sixty
+     * findings would have a contents list longer than its summary.
+     */
+    readonly tableOfContents?: boolean;
 }
+/**
+ * Whose document this is — the marks on it, and the name on it.
+ *
+ * Per `00-TIER-MATRIX.md`: free-tier reports are watermarked, branding is
+ * `[branding]`, and white-label is Enterprise only. **None of that is enforced
+ * here.** This package has no idea what anyone is paying, and a pure function
+ * that consulted an entitlement would be the wrong place to find out; the
+ * caller passes what the caller is entitled to.
+ */
+export interface Branding {
+    /**
+     * The name that appears where Secureport's otherwise would — on an
+     * Attestation Letter, as the party who carried out the testing.
+     *
+     * {@link ReportOptions.preparedBy} wins over it when both are given, because
+     * it is the more specific statement: branding is who owns the document,
+     * `preparedBy` is who did the work, and they are not always the same party.
+     */
+    readonly companyName?: string;
+    /**
+     * Accent colour for headings and rules, as a hex triplet — `#0a7`,
+     * `#00aa77`, or `#00aa77ff`.
+     *
+     * **Hex only, and the restriction is a security boundary rather than
+     * fussiness.** This value is interpolated into the document's `<style>`
+     * block, which is a context the HTML renderer's escaping does not protect:
+     * it escapes text nodes, and a colour of `red</style><script>…` would close
+     * the element and run. Anything that does not match the pattern is refused by
+     * {@link buildReportModel} rather than sanitised, because silently altering
+     * somebody's brand colour is its own kind of wrong.
+     */
+    readonly primaryColour?: string;
+    /**
+     * Remove Secureport's own marks from the document entirely.
+     *
+     * An Attestation Letter with this set and no name to put in Secureport's
+     * place is refused: a formal statement that testing was carried out has to
+     * say who carried it out, and an unattributed one is worth nothing to the
+     * auditor it exists for.
+     */
+    readonly whiteLabel?: boolean;
+    /**
+     * Text printed across every page — what the free tier stamps on a report.
+     *
+     * Rendered as an element rather than through CSS `content`, so it goes
+     * through the same escaping as every other value from outside.
+     */
+    readonly watermark?: string;
+    /**
+     * The logo, as a `data:` URI — never a URL.
+     *
+     * **The restriction is what keeps a report a single file.** `renderHtml`
+     * emits a self-contained document with its stylesheet inlined and nothing
+     * linked, which is what lets P7 render it through Chromium with no network
+     * and get the same bytes in CI as on a laptop. One `<img src="https://…">`
+     * would trade that for a logo, and trade it silently: the report would look
+     * right on the machine that rendered it and lose its mark for a reader
+     * offline, or three months later when the URL stops resolving.
+     *
+     * Refused by {@link buildReportModel} rather than fetched, because a pure
+     * function that reached the network would stop being one.
+     *
+     * Rendered into an `<img>`, which is also why an SVG data URI is allowed: an
+     * image context does not execute script, where inlining the same markup into
+     * the document would.
+     */
+    readonly logo?: string;
+    /**
+     * Address, registration number, contact — whatever belongs under the name on
+     * a cover page, one line each.
+     *
+     * Only shown when {@link ReportOptions.coverPage} is set, because there is
+     * nowhere else in the document these belong.
+     */
+    readonly companyDetails?: readonly string[];
+}
+/**
+ * How much of an issue's supporting evidence a report prints.
+ *
+ * See {@link ReportOptions.evidenceVerbosity} for what each level shows.
+ */
+export type EvidenceVerbosity = 'none' | 'summary' | 'full';
 /**
  * How the findings in a report were actually produced.
  *
@@ -81,6 +245,21 @@ export interface TestingBasis {
     /** One sentence, ready to print. */
     readonly statement: string;
 }
+/**
+ * What a severity floor kept out of a report's detail sections.
+ *
+ * The issues are still open, still counted and still the target's problem;
+ * only the pages describing them are gone. That distinction is the reason this
+ * is reported at all rather than silently applied.
+ */
+export interface OmittedIssues {
+    /** How many outstanding issues were left out. Never `0` — the field is absent instead. */
+    readonly count: number;
+    /** The floor that excluded them. */
+    readonly floor: Severity;
+    /** One sentence, ready to print, so no two renderers word it differently. */
+    readonly statement: string;
+}
 /** A group of issues sharing a severity, most urgent first. */
 export interface ReportSection {
     /** The severity this section covers. */
@@ -102,8 +281,32 @@ export interface ReportModel {
     readonly preparedBy?: string;
     /** Who it is for, if stated. */
     readonly preparedFor?: string;
+    /**
+     * Who the document says carried out the testing.
+     *
+     * Resolved once here from {@link ReportOptions.preparedBy},
+     * {@link Branding.companyName} and the default, because both renderers used
+     * to write `preparedBy ?? 'Secureport'` themselves — two copies of a default
+     * that white-labelling has to change in both places or not at all.
+     */
+    readonly attestor: string;
+    /** Whose document this is, as given. Absent when nothing was branded. */
+    readonly branding?: Branding;
+    /** Whether to open with a cover, resolved from {@link ReportOptions.coverPage}. */
+    readonly coverPage: boolean;
+    /** Whether to print a contents list, resolved from {@link ReportOptions.tableOfContents}. */
+    readonly tableOfContents: boolean;
     /** How the findings were produced. */
     readonly basis: TestingBasis;
+    /**
+     * How much of each issue's evidence to print, resolved from
+     * {@link ReportOptions.evidenceVerbosity}.
+     *
+     * On the model rather than read from the options by each renderer, so the
+     * Markdown and the HTML cannot disagree about how much of an issue they are
+     * showing — the same reason every number here is derived once.
+     */
+    readonly evidenceVerbosity: EvidenceVerbosity;
     /**
      * Outstanding issues grouped by severity, most urgent first, empties dropped.
      *
@@ -117,9 +320,21 @@ export interface ReportModel {
      *
      * Kept and shown rather than dropped: "what you fixed" is the story the
      * product exists to tell, and a report that silently omits it throws away its
-     * best evidence.
+     * best evidence. Empty when {@link ReportOptions.includeResolved} is `false`,
+     * which is the caller saying so deliberately.
      */
     readonly resolved: readonly SnapshotIssue[];
+    /**
+     * What {@link ReportOptions.severityFloor} kept out of {@link ReportModel.sections}.
+     * Absent when no floor was set, or when one was set and removed nothing.
+     *
+     * Carried as data and not only as prose, because `00-DOMAIN.md` §7 says what
+     * a report does not establish travels as data too — so a consumer rendering
+     * its own view cannot drop the disclosure simply by not printing a sentence.
+     * `statement` is that sentence, derived once here so the renderers and
+     * {@link ReportModel.limitations} cannot word it three different ways.
+     */
+    readonly omitted?: OmittedIssues;
     /** Open and regressed issues, by severity. What the reader owes work on. */
     readonly outstanding: Readonly<Record<Severity, number>>;
     /** Total outstanding, so a header does not have to sum a table. */
@@ -164,6 +379,17 @@ export interface ReportModel {
  * - `new` — this run's own finding, not part of what was being retested.
  */
 export type RetestVerdict = 'fixed' | 'still_present' | 'returned' | 'not_retested' | 'new';
+/**
+ * How each verdict is printed.
+ *
+ * Exported because it is printed, and a printed vocabulary is a contract —
+ * `00-DOMAIN.md` §7 says so of the verdicts themselves. It was defined
+ * identically in both renderers, which PDF and DOCX would have made four
+ * copies of, each one a chance for `not_retested` to be worded differently in
+ * the format somebody actually reads. The underscores are an implementation
+ * detail of the union and should never reach a page.
+ */
+export declare const VERDICT_LABELS: Readonly<Record<RetestVerdict, string>>;
 /** One issue, with what the retest established about it. */
 export interface RetestEntry {
     /** The issue as the snapshot sees it. */

package/dist/report/model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/report/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE9D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEtE,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B,8BAA8B;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B,mCAAmC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,gFAAgF;IAChF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,qBAAqB;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,YAAY;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IAEjC,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAE5B,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAEpC,oCAAoC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAE5B,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAC3C;AAED,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B,4BAA4B;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAE5B,4BAA4B;IAC5B,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAE3B,kCAAkC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,gCAAgC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,sCAAsC;IACtC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAE7B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAE5C;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAE5C,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAEzD,mEAAmE;IACnE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC,sCAAsC;IACtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,eAAe,GAAG,UAAU,GAAG,cAAc,GAAG,KAAK,CAAC;AAE5F,4DAA4D;AAC5D,MAAM,WAAW,WAAW;IAC1B,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAE9B,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAE9B,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IAEzC,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IAEzD;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA6ID;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,GAAG,WAAW,CAwExF"}
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/report/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE9D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEtE,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B,8BAA8B;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B,mCAAmC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,gFAAgF;IAChF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,qBAAqB;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IAEnB;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC;IAElC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IAEnC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAE/C,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAE7B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAQ;IACvB;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,YAAY;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IAEjC,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAE5B,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAEpC,oCAAoC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,0FAA0F;IAC1F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,oCAAoC;IACpC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAEzB,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAE5B,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAC3C;AAED,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B,4BAA4B;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAE5B,4BAA4B;IAC5B,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAE3B,kCAAkC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,gCAAgC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAE7B,mFAAmF;IACnF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAE5B,6FAA6F;IAC7F,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAElC,sCAAsC;IACtC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAE7B;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAE9C;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAE5C;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAE5C;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IAEjC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAEzD,mEAAmE;IACnE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC,sCAAsC;IACtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,eAAe,GAAG,UAAU,GAAG,cAAc,GAAG,KAAK,CAAC;AAE5F;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAMjE,CAAC;AAEH,4DAA4D;AAC5D,MAAM,WAAW,WAAW;IAC1B,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAE9B,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAE9B,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IAEzC,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IAEzD;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA4JD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,GAAG,WAAW,CA2IxF"}

package/dist/report/model.js

@@ -1,4 +1,21 @@
 import { SEVERITY_ORDER } from '../severity.js';
+/**
+ * How each verdict is printed.
+ *
+ * Exported because it is printed, and a printed vocabulary is a contract —
+ * `00-DOMAIN.md` §7 says so of the verdicts themselves. It was defined
+ * identically in both renderers, which PDF and DOCX would have made four
+ * copies of, each one a chance for `not_retested` to be worded differently in
+ * the format somebody actually reads. The underscores are an implementation
+ * detail of the union and should never reach a page.
+ */
+export const VERDICT_LABELS = Object.freeze({
+    fixed: 'fixed',
+    still_present: 'still present',
+    returned: 'returned',
+    not_retested: 'not retested',
+    new: 'new since',
+});
 /** Works out what a run established about the issues carried into it. */
 function describeRetest(snapshot) {
     const { baseline } = snapshot;
@@ -54,7 +71,7 @@ function verdictFor(entry) {
     return entry.findings.length > 0 ? 'still_present' : 'not_retested';
 }
 /** Works out what a report cannot establish, from the run rather than a template. */
-function describeLimitations(snapshot, basis) {
+function describeLimitations(snapshot, basis, omitted) {
     const limitations = [];
     if (!basis.includesManual) {
         limitations.push('This is evidence of automated security testing. It is not a human-led penetration ' +
@@ -73,9 +90,20 @@ function describeLimitations(snapshot, basis) {
         limitations.push(`${snapshot.suppressed.length} finding${snapshot.suppressed.length === 1 ? ' has' : 's have'} been ` +
             'suppressed and excluded from the counts above. They are listed in full in the appendix.');
     }
+    // Immediately after the suppression sentence and before the compliance one,
+    // because it answers the same question a reader is entitled to ask: what am
+    // I not being shown? A floor that removed pages silently would be the
+    // over-claim §7 exists to stop, in a quieter form than the appendix one.
+    if (omitted !== undefined)
+        limitations.push(omitted.statement);
     limitations.push('This document does not certify compliance with any standard, framework or regulation.');
     return limitations;
 }
+/**
+ * Hex triplets only. See {@link Branding.primaryColour} for why this is a
+ * refusal rather than a sanitisation.
+ */
+const HEX_COLOUR = /^#(?:[0-9a-f]{3}|[0-9a-f]{6}|[0-9a-f]{8})$/iu;
 const DEFAULT_TITLES = Object.freeze({
     pen: 'Penetration Test Report',
     vap: 'Vulnerability Assessment Report',
@@ -138,22 +166,36 @@ export function buildReportModel(snapshot, options) {
     const bySeverity = new Map();
     const resolved = [];
     let breached = 0;
+    let omittedBelowFloor = 0;
+    // `SEVERITY_ORDER` is most-severe-first, so "at or above the floor" is a
+    // *lower* index. Same trap `describeRetest` records above, from the other
+    // direction: `severityRank` counts the opposite way and using it here would
+    // floor out everything except the advisories.
+    const floorAt = options.severityFloor === undefined
+        ? SEVERITY_ORDER.length
+        : SEVERITY_ORDER.indexOf(options.severityFloor);
     for (const entry of snapshot.issues) {
         if (entry.issue.status === 'resolved') {
             resolved.push(entry);
             continue;
         }
         const severity = entry.issue.effectiveSeverity;
-        const group = bySeverity.get(severity);
-        if (group)
-            group.push(entry);
-        else
-            bySeverity.set(severity, [entry]);
+        // Counted before the floor is consulted, deliberately: the floor decides
+        // what is *listed*, never what is *counted*.
         if (entry.issue.status === 'open' || entry.issue.status === 'regressed') {
             outstanding[severity]++;
             if (entry.slaStatus === 'breached')
                 breached++;
         }
+        if (SEVERITY_ORDER.indexOf(severity) > floorAt) {
+            omittedBelowFloor++;
+            continue;
+        }
+        const group = bySeverity.get(severity);
+        if (group)
+            group.push(entry);
+        else
+            bySeverity.set(severity, [entry]);
     }
     resolved.sort((a, b) => b.issue.lastSeen.getTime() - a.issue.lastSeen.getTime());
     const sections = [];
@@ -168,6 +210,17 @@ export function buildReportModel(snapshot, options) {
             issues: [...issues].sort((a, b) => b.issue.lastSeen.getTime() - a.issue.lastSeen.getTime()),
         });
     }
+    const floor = options.severityFloor;
+    const omitted = omittedBelowFloor === 0 || floor === undefined
+        ? undefined
+        : {
+            count: omittedBelowFloor,
+            floor,
+            statement: `${omittedBelowFloor} issue${omittedBelowFloor === 1 ? '' : 's'} below ${floor} severity ` +
+                `${omittedBelowFloor === 1 ? 'is' : 'are'} not listed individually in this document. ` +
+                `${omittedBelowFloor === 1 ? 'It remains' : 'They remain'} open and ` +
+                `${omittedBelowFloor === 1 ? 'is' : 'are'} included in every count above.`,
+        };
     const outstandingTotal = SEVERITY_ORDER.reduce((sum, s) => sum + outstanding[s], 0);
     const basis = describeBasis(snapshot);
     const retest = describeRetest(snapshot);
@@ -176,6 +229,26 @@ export function buildReportModel(snapshot, options) {
     if (options.kind === 'retest' && retest === undefined) {
         throw new TypeError('a retest report needs a baseline: build the snapshot with `previous` set to the run being retested');
     }
+    const branding = options.branding;
+    const colour = branding?.primaryColour;
+    if (colour !== undefined && !HEX_COLOUR.test(colour)) {
+        throw new TypeError(`primaryColour must be a hex triplet such as #0a7 or #00aa77, not ${JSON.stringify(colour)}: ` +
+            'it is interpolated into the document stylesheet, where anything else could end the element');
+    }
+    const logo = branding?.logo;
+    if (logo !== undefined && !logo.startsWith('data:image/')) {
+        throw new TypeError(`logo must be a data: URI, not ${JSON.stringify(logo.slice(0, 40))}: ` +
+            'a linked image would make the report depend on a network at render time, ' +
+            'which is the guarantee that lets it be rendered to PDF reproducibly');
+    }
+    const attestor = options.preparedBy ?? branding?.companyName;
+    // An attestation is a statement that a named party carried out testing. With
+    // Secureport's name removed and nothing put in its place there is no such
+    // party, and the document would assert something on nobody's behalf.
+    if (attestor === undefined && branding?.whiteLabel === true && options.kind === 'attest') {
+        throw new TypeError('a white-labelled attestation must name who carried out the testing: ' +
+            'set branding.companyName or preparedBy');
+    }
     return {
         kind: options.kind,
         title: options.title ?? DEFAULT_TITLES[options.kind],
@@ -183,10 +256,16 @@ export function buildReportModel(snapshot, options) {
         generatedAt: options.now,
         ...(options.preparedBy === undefined ? {} : { preparedBy: options.preparedBy }),
         ...(options.preparedFor === undefined ? {} : { preparedFor: options.preparedFor }),
+        attestor: attestor ?? 'Secureport',
+        coverPage: options.coverPage === true,
+        tableOfContents: options.tableOfContents === true,
+        ...(branding === undefined ? {} : { branding }),
         basis,
-        limitations: describeLimitations(snapshot, basis),
+        evidenceVerbosity: options.evidenceVerbosity ?? 'summary',
+        limitations: describeLimitations(snapshot, basis, omitted),
         sections,
-        resolved,
+        resolved: options.includeResolved === false ? [] : resolved,
+        ...(omitted === undefined ? {} : { omitted }),
         outstanding,
         outstandingTotal,
         exposureScore: snapshot.run.exposureScore,

package/dist/report/model.js.map

@@ -1 +1 @@
-{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/report/model.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAwOhD,yEAAyE;AACzE,SAAS,cAAc,CAAC,QAAkB;IACxC,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAC9B,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE7C,MAAM,OAAO,GAAkB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7D,KAAK;QACL,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC;KAC3B,CAAC,CAAC,CAAC;IACJ,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,qDAAqD;IACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,MAAM,UAAU,GACd,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACvD,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC1D,OAAO,UAAU,KAAK,CAAC;YACrB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE;YACrE,CAAC,CAAC,UAAU,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAkC;QAC5C,KAAK,EAAE,CAAC;QACR,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,CAAC;QACX,YAAY,EAAE,CAAC;QACf,GAAG,EAAE,CAAC;KACP,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,OAAO;QAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IAErD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;IACxE,OAAO;QACL,QAAQ;QACR,OAAO;QACP,MAAM;QACN,OAAO,EAAE,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,SAAS;KAC3D,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,KAAoB;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,UAAU,CAAC;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;AACtE,CAAC;AAED,qFAAqF;AACrF,SAAS,mBAAmB,CAAC,QAAkB,EAAE,KAAmB;IAClE,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,WAAW,CAAC,IAAI,CACd,oFAAoF;YAClF,+CAA+C,CAClD,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,IAAI,CACd,uFAAuF;QACrF,yBAAyB,CAC5B,CAAC;IACF,WAAW,CAAC,IAAI,CACd,wBAAwB,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B;QACtF,wFAAwF,CAC3F,CAAC;IACF,WAAW,CAAC,IAAI,CACd,+CAA+C,QAAQ,CAAC,GAAG,CAAC,SAAS;SAClE,WAAW,EAAE;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,+DAA+D,CAC/E,CAAC;IACF,WAAW,CAAC,IAAI,CACd,0FAA0F;QACxF,kDAAkD,CACrD,CAAC;IACF,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,WAAW,CAAC,IAAI,CACd,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,WAAW,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,QAAQ;YAClG,yFAAyF,CAC5F,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,IAAI,CACd,uFAAuF,CACxF,CAAC;IAEF,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,cAAc,GAAyC,MAAM,CAAC,MAAM,CAAC;IACzE,GAAG,EAAE,yBAAyB;IAC9B,GAAG,EAAE,iCAAiC;IACtC,IAAI,EAAE,mBAAmB;IACzB,MAAM,EAAE,iCAAiC;IACzC,MAAM,EAAE,eAAe;CACxB,CAAC,CAAC;AAEH,kFAAkF;AAClF,SAAS,aAAa,CAAC,QAAkB;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;IACrC,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,IAAI,KAAK,MAAM,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,KAAK,QAAQ,CAAC;IAEnC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CACR,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CACR,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAClF,IAAI,cAAc,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,cAAc,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CACR,wFAAwF;YACtF,8BAA8B,CACjC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAkB,EAAE,OAAsB;IACzE,MAAM,WAAW,GAA6B;QAC5C,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,QAAQ,EAAE,CAAC;KACZ,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;IACxD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YACxB,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAEvC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACxE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU;gBAAE,QAAQ,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAEjF,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC1D,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ;YACR,wEAAwE;YACxE,yCAAyC;YACzC,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;SAC5F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,gBAAgB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAExC,sEAAsE;IACtE,2EAA2E;IAC3E,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,IAAI,SAAS,CACjB,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QACpD,QAAQ;QACR,WAAW,EAAE,OAAO,CAAC,GAAG;QACxB,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,KAAK;QACL,WAAW,EAAE,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC;QACjD,QAAQ;QACR,QAAQ;QACR,WAAW;QACX,gBAAgB;QAChB,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,aAAa;QACzC,QAAQ;QACR,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/report/model.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAgbhD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAA4C,MAAM,CAAC,MAAM,CAAC;IACnF,KAAK,EAAE,OAAO;IACd,aAAa,EAAE,eAAe;IAC9B,QAAQ,EAAE,UAAU;IACpB,YAAY,EAAE,cAAc;IAC5B,GAAG,EAAE,WAAW;CACjB,CAAC,CAAC;AAuCH,yEAAyE;AACzE,SAAS,cAAc,CAAC,QAAkB;IACxC,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAC9B,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE7C,MAAM,OAAO,GAAkB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7D,KAAK;QACL,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC;KAC3B,CAAC,CAAC,CAAC;IACJ,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,qDAAqD;IACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,MAAM,UAAU,GACd,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACvD,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC1D,OAAO,UAAU,KAAK,CAAC;YACrB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE;YACrE,CAAC,CAAC,UAAU,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAkC;QAC5C,KAAK,EAAE,CAAC;QACR,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,CAAC;QACX,YAAY,EAAE,CAAC;QACf,GAAG,EAAE,CAAC;KACP,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,OAAO;QAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IAErD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;IACxE,OAAO;QACL,QAAQ;QACR,OAAO;QACP,MAAM;QACN,OAAO,EAAE,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,SAAS;KAC3D,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,KAAoB;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,UAAU,CAAC;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;AACtE,CAAC;AAED,qFAAqF;AACrF,SAAS,mBAAmB,CAC1B,QAAkB,EAClB,KAAmB,EACnB,OAAkC;IAElC,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,WAAW,CAAC,IAAI,CACd,oFAAoF;YAClF,+CAA+C,CAClD,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,IAAI,CACd,uFAAuF;QACrF,yBAAyB,CAC5B,CAAC;IACF,WAAW,CAAC,IAAI,CACd,wBAAwB,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B;QACtF,wFAAwF,CAC3F,CAAC;IACF,WAAW,CAAC,IAAI,CACd,+CAA+C,QAAQ,CAAC,GAAG,CAAC,SAAS;SAClE,WAAW,EAAE;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,+DAA+D,CAC/E,CAAC;IACF,WAAW,CAAC,IAAI,CACd,0FAA0F;QACxF,kDAAkD,CACrD,CAAC;IACF,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,WAAW,CAAC,IAAI,CACd,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,WAAW,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,QAAQ;YAClG,yFAAyF,CAC5F,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,4EAA4E;IAC5E,sEAAsE;IACtE,yEAAyE;IACzE,IAAI,OAAO,KAAK,SAAS;QAAE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/D,WAAW,CAAC,IAAI,CACd,uFAAuF,CACxF,CAAC;IAEF,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,GAAG,8CAA8C,CAAC;AAElE,MAAM,cAAc,GAAyC,MAAM,CAAC,MAAM,CAAC;IACzE,GAAG,EAAE,yBAAyB;IAC9B,GAAG,EAAE,iCAAiC;IACtC,IAAI,EAAE,mBAAmB;IACzB,MAAM,EAAE,iCAAiC;IACzC,MAAM,EAAE,eAAe;CACxB,CAAC,CAAC;AAEH,kFAAkF;AAClF,SAAS,aAAa,CAAC,QAAkB;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;IACrC,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,IAAI,KAAK,MAAM,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,KAAK,QAAQ,CAAC;IAEnC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CACR,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CACR,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAClF,IAAI,cAAc,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,cAAc,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CACR,wFAAwF;YACtF,8BAA8B,CACjC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAkB,EAAE,OAAsB;IACzE,MAAM,WAAW,GAA6B;QAC5C,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,QAAQ,EAAE,CAAC;KACZ,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;IACxD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAE1B,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,OAAO,GACX,OAAO,CAAC,aAAa,KAAK,SAAS;QACjC,CAAC,CAAC,cAAc,CAAC,MAAM;QACvB,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAEpD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAE/C,yEAAyE;QACzE,6CAA6C;QAC7C,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACxE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU;gBAAE,QAAQ,EAAE,CAAC;QACjD,CAAC;QAED,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,EAAE,CAAC;YAC/C,iBAAiB,EAAE,CAAC;YACpB,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YACxB,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAEjF,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC1D,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ;YACR,wEAAwE;YACxE,yCAAyC;YACzC,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;SAC5F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC;IACpC,MAAM,OAAO,GACX,iBAAiB,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS;QAC5C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC;YACE,KAAK,EAAE,iBAAiB;YACxB,KAAK;YACL,SAAS,EACP,GAAG,iBAAiB,SAAS,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,KAAK,YAAY;gBAC1F,GAAG,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,6CAA6C;gBACtF,GAAG,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,YAAY;gBACrE,GAAG,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,iCAAiC;SAC7E,CAAC;IAER,MAAM,gBAAgB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAExC,sEAAsE;IACtE,2EAA2E;IAC3E,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,IAAI,SAAS,CACjB,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,MAAM,GAAG,QAAQ,EAAE,aAAa,CAAC;IACvC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,SAAS,CACjB,oEAAoE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI;YAC5F,4FAA4F,CAC/F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,CAAC;IAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CACjB,iCAAiC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI;YACpE,2EAA2E;YAC3E,qEAAqE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,IAAI,QAAQ,EAAE,WAAW,CAAC;IAC7D,6EAA6E;IAC7E,0EAA0E;IAC1E,qEAAqE;IACrE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,EAAE,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzF,MAAM,IAAI,SAAS,CACjB,sEAAsE;YACpE,wCAAwC,CAC3C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QACpD,QAAQ;QACR,WAAW,EAAE,OAAO,CAAC,GAAG;QACxB,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,QAAQ,EAAE,QAAQ,IAAI,YAAY;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS,KAAK,IAAI;QACrC,eAAe,EAAE,OAAO,CAAC,eAAe,KAAK,IAAI;QACjD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,KAAK;QACL,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,SAAS;QACzD,WAAW,EAAE,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC;QAC1D,QAAQ;QACR,QAAQ,EAAE,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ;QAC3D,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,WAAW;QACX,gBAAgB;QAChB,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,aAAa;QACzC,QAAQ;QACR,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secureport/core",
-  "version": "1.0.0",
+  "version": "2.2.0",
   "description": "Shared domain model for Secureport. Imported by the hosted API the same way a third party would.",
   "keywords": [
     "security",

package/src/finding.ts

@@ -94,15 +94,16 @@ export interface Finding {
    *
    * **Recorded, not addressed.** The port is already inside
    * {@link Finding.location} for host-oriented engines (Nessus assembles
-   * `host:port`) and is already a fingerprint component, so this field changes
-   * neither. It exists because a port was otherwise unrecoverable from a
-   * finding except by parsing its location, which is not something a consumer
-   * should have to do.
+   * `host:port`), and that location is what the fingerprint reads. It exists
+   * because a port was otherwise unrecoverable from a finding except by
+   * parsing its location, which is not something a consumer should have to do.
    *
-   * Deliberately **not** added to the fingerprint inputs: doing so would move
-   * every existing Nessus fingerprint and force a re-fingerprint migration,
-   * which is a far worse outcome than a field being merely inconvenient to
-   * read.
+   * **No longer a fingerprint component at all, as of `fp_v2`.** It used to
+   * fill the last slot when no parameter was named, which counted a Nessus
+   * port twice and stopped a network scan ever matching a web scan of the same
+   * endpoint. The location carries the port now, canonicalised — so a default
+   * port drops and any other is kept, which is the distinction that actually
+   * matters.
    */
   readonly port?: number;
 

package/src/fingerprint.ts

@@ -13,7 +13,7 @@ import { createHash } from 'node:crypto';
  * If you are tempted to "just tweak" the normaliser, that is this constant's
  * job to prevent.
  */
-export const FINGERPRINT_VERSION = 'fp_v1';
+export const FINGERPRINT_VERSION = 'fp_v2';
 
 /** A path segment that is entirely digits, e.g. the `123` in `/orders/123`. */
 const NUMERIC_SEGMENT = /^\d+$/u;
@@ -80,10 +80,17 @@ function collapseSegment(segment: string): string {
  *   one issue into two.
  * - **Drops the fragment**, which the server never sees.
  *
- * Anything that is not a parseable absolute URL — a bare host, a file path, a
- * `host:port` pair from a network scan — is normalised as a path alone. That is
- * deliberate: refusing to fingerprint a non-HTTP finding would exclude whole
- * classes of scanner from the model.
+ * - **Reads `host:443` and `host:80` as the URL the port implies**, so a
+ *   network scanner's `app.example.com:443` and a web scanner's
+ *   `https://app.example.com/` are one endpoint (B102, `fp_v2`). Only those two
+ *   ports: any other is left alone rather than guessed at, because
+ *   `host:8443` could be TLS or plaintext and inventing a scheme to force a
+ *   match would assert something nobody measured.
+ *
+ * Anything else that is not a parseable absolute URL — a bare host, a file
+ * path — is normalised as a path alone. That is deliberate: refusing to
+ * fingerprint a non-HTTP finding would exclude whole classes of scanner from
+ * the model.
  *
  * @param location - Where the weakness was found.
  * @returns The normalised location.
@@ -107,7 +114,9 @@ export function normaliseLocation(location: string): string {
   // Not an absolute URL: normalise it as a bare path and stop. `new URL` would
   // otherwise turn `example.com/x` into the `example.com:` protocol.
   if (!url || url.protocol === '' || !url.host) {
-    return normalisePathOnly(trimmed);
+    const implied = impliedSchemeUrl(trimmed);
+    if (implied === undefined) return normalisePathOnly(trimmed);
+    url = implied;
   }
 
   // Not `decodeOnce` here: normalisePathOnly decodes, and decoding on the way
@@ -123,6 +132,32 @@ export function normaliseLocation(location: string): string {
   return `${url.protocol}//${url.host}${path}${query}`;
 }
 
+/**
+ * A bare `host:port` read as the URL its port implies, or `undefined`.
+ *
+ * **Only `:443` and `:80`, and that restraint is the point.** A network scanner
+ * reports `app.example.com:443` for the weakness a web scanner reports at
+ * `https://app.example.com/`, and those are one endpoint: 443 means TLS and an
+ * empty path means the root. Both are convention rather than guarantee, but
+ * they are conventions every scanner in this model already relies on, and
+ * leaving the two unmatched means a network scan and a web scan of one host
+ * can never agree about anything — which is the duplication P6 exists to
+ * remove (B102).
+ *
+ * Any other port is left alone rather than guessed at. `app.example.com:8443`
+ * could be TLS or plaintext, and inventing a scheme to make a match happen
+ * would be asserting something nobody measured.
+ */
+function impliedSchemeUrl(location: string): URL | undefined {
+  const match = /^([a-z0-9.\-_]+|\[[0-9a-f:]+\]):(443|80)$/iu.exec(location);
+  if (!match) return undefined;
+  try {
+    return new URL(`${match[2] === '443' ? 'https' : 'http'}://${location}`);
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Normalises a path with no scheme or host.
  */
@@ -197,6 +232,15 @@ export const VULN_KEY_MAP: Readonly<Record<string, string>> = Object.freeze({
   // the other stops the two agreeing, so these travel together.
   'nuclei:xss-reflected': 'xss-reflected',
   'nuclei:missing-hsts': 'hsts-missing',
+
+  // Burp and Nessus, added in `fp_v2`. Neither had a single entry, so both fell
+  // through to the CWE for every finding — which is worse than no table at all:
+  // ZAP and Nuclei keyed `hsts-missing` while Burp and Nessus keyed `CWE-319`
+  // for the same weakness, so half a table was actively splitting issues that a
+  // plain CWE fallback would have kept together.
+  'burp:5244160': 'xss-reflected',
+  'burp:6234880': 'hsts-missing',
+  'nessus:42822': 'hsts-missing',
 });
 
 /**
@@ -306,10 +350,32 @@ export interface FingerprintInput {
  * ```
  */
 export function fingerprint(input: FingerprintInput): string {
-  const tail = input.parameter ?? (input.port !== undefined ? String(input.port) : '');
-  const material = [input.targetId, input.vulnKey, normaliseLocation(input.location), tail].join(
-    '|',
-  );
+  // The port is no longer part of the tail. `normaliseLocation` now canonicalises
+  // a `host:port` location, so a non-default port is already in the location and
+  // a default one is deliberately absent from it — counting the port again here
+  // made a Nessus finding on 443 unable to match a web scanner's finding on the
+  // same endpoint. `import/nessus.ts` recorded this double-count as something
+  // that had to stay because removing it would force a re-fingerprint migration;
+  // `fp_v2` is that migration.
+  const tail = input.parameter ?? '';
+
+  // A named parameter makes the query string redundant: both describe the same
+  // input, and keeping the query too means a scanner that reports the parameter
+  // separately (Burp: `/search`, parameter `q`) can never match one that leaves
+  // it in the URL (ZAP: `/search?q=test`, parameter `q`). When no parameter is
+  // named the query names stay, because then they are the only thing
+  // distinguishing one page from another — and Nuclei never names a parameter,
+  // so dropping them unconditionally would merge `/view?id` with `/view?page`.
+  const location = normaliseLocation(input.location);
+  const addressed = input.parameter === undefined ? location : stripQuery(location);
+
+  const material = [input.targetId, input.vulnKey, addressed, tail].join('|');
 
   return createHash('sha256').update(material, 'utf8').digest('hex');
 }
+
+/** Everything before the `?` of an already-normalised location. */
+function stripQuery(location: string): string {
+  const at = location.indexOf('?');
+  return at === -1 ? location : location.slice(0, at);
+}