vskill 1.2.4 → 1.2.7

package/dist/webmcp/merge.js

@@ -0,0 +1,167 @@
+// ---------------------------------------------------------------------------
+// vskill audit-webmcp -- merge the three enumeration sources by tool name.
+//
+//   capture   our init script wraps document.modelContext.registerTool and
+//             records the raw descriptor plus the calling script URL
+//   cdp       WebMCP.toolsAdded / toolsRemoved events (annotations arrive as
+//             readOnly / untrustedContent)
+//   getTools  document.modelContext.getTools() after the page settles
+//             (inputSchema arrives as a JSON string)
+//
+// Chrome 153 drops consequentialHint from both getTools() and CDP, so the
+// captured descriptor is the only place it survives. Pure module: no browser.
+// ---------------------------------------------------------------------------
+import { classifyRegistrar } from "./attribution.js";
+import { originOf, parseSchema } from "./score.js";
+function bool(v) {
+    return typeof v === "boolean" ? v : undefined;
+}
+/** Map readOnly/readOnlyHint, consequential/consequentialHint, untrustedContent/untrustedContentHint. */
+export function normalizeAnnotations(raw) {
+    if (typeof raw !== "object" || raw === null)
+        return {};
+    const r = raw;
+    const out = {};
+    const readOnly = bool(r.readOnlyHint) ?? bool(r.readOnly);
+    const consequential = bool(r.consequentialHint) ?? bool(r.consequential);
+    const untrusted = bool(r.untrustedContentHint) ?? bool(r.untrustedContent);
+    if (readOnly !== undefined)
+        out.readOnlyHint = readOnly;
+    if (consequential !== undefined)
+        out.consequentialHint = consequential;
+    if (untrusted !== undefined)
+        out.untrustedContentHint = untrusted;
+    return out;
+}
+function nonEmpty(s) {
+    return typeof s === "string" && s.length > 0 ? s : undefined;
+}
+function stringList(v) {
+    if (typeof v === "string" && v)
+        return [v];
+    if (Array.isArray(v)) {
+        const xs = v.filter((x) => typeof x === "string" && x.length > 0);
+        return xs.length ? xs : undefined;
+    }
+    return undefined;
+}
+/** First http(s) frame in a CDP stack trace. */
+export function cdpRegistrar(t) {
+    for (const f of t.stackTrace?.callFrames ?? []) {
+        if (f.url && originOf(f.url))
+            return f.url;
+    }
+    return undefined;
+}
+/** First http(s) URL in a V8 Error().stack that is not our probe script. */
+export function scriptUrlFromStack(stack, probeName = "vskill-webmcp-probe") {
+    if (!stack)
+        return null;
+    for (const line of stack.split("\n")) {
+        if (line.includes(probeName))
+            continue;
+        const m = /(https?:\/\/[^\s)]+?):\d+(?::\d+)?\)?\s*$/.exec(line.trim());
+        if (m)
+            return m[1];
+    }
+    return null;
+}
+function normalizeSchema(raw) {
+    if (raw === undefined || raw === null || raw === "")
+        return undefined;
+    const p = parseSchema(raw);
+    return p.ok ? p.value : raw;
+}
+export function mergeTools(input) {
+    // Latest event per name wins (a tool can be removed and re-registered).
+    const cdpLive = new Map();
+    for (const t of input.cdp) {
+        if (t.removed)
+            cdpLive.delete(t.name);
+        else
+            cdpLive.set(t.name, t);
+    }
+    const captured = new Map();
+    for (const t of input.captured) {
+        if (t.unregistered)
+            captured.delete(t.name);
+        else
+            captured.set(t.name, t);
+    }
+    // Keep the registering script even if the descriptor was later replaced.
+    const firstScript = new Map();
+    for (const t of input.captured) {
+        if (t.scriptUrl && !firstScript.has(t.name))
+            firstScript.set(t.name, t.scriptUrl);
+    }
+    const listed = new Map();
+    for (const t of input.listed ?? [])
+        listed.set(t.name, t);
+    const names = [];
+    const add = (n) => {
+        if (n && !names.includes(n))
+            names.push(n);
+    };
+    if (input.listed !== null) {
+        for (const n of listed.keys())
+            add(n);
+    }
+    else {
+        for (const n of captured.keys())
+            add(n);
+    }
+    for (const n of cdpLive.keys())
+        add(n);
+    return names.map((name) => {
+        const c = captured.get(name);
+        const d = cdpLive.get(name);
+        const l = listed.get(name);
+        const sources = [];
+        if (c)
+            sources.push("registerTool");
+        if (d)
+            sources.push("cdp");
+        if (l)
+            sources.push("getTools");
+        const ac = normalizeAnnotations(c?.annotations);
+        const al = normalizeAnnotations(l?.annotations);
+        const ad = normalizeAnnotations(d?.annotations);
+        const annotations = {};
+        for (const k of ["readOnlyHint", "consequentialHint", "untrustedContentHint"]) {
+            const v = ac[k] ?? al[k] ?? ad[k];
+            if (v !== undefined)
+                annotations[k] = v;
+        }
+        const registeredBy = firstScript.get(name) ?? c?.scriptUrl ?? (d ? cdpRegistrar(d) : undefined) ?? undefined;
+        const attribution = classifyRegistrar(registeredBy, input.pageUrl, input.platforms);
+        const tool = {
+            name,
+            annotations,
+            thirdParty: attribution?.kind === "third-party",
+            sources,
+        };
+        const title = nonEmpty(l?.title) ?? nonEmpty(c?.title) ?? nonEmpty(d?.title);
+        if (title)
+            tool.title = title;
+        const description = nonEmpty(l?.description) ?? nonEmpty(c?.description) ?? nonEmpty(d?.description);
+        if (description)
+            tool.description = description;
+        const schema = normalizeSchema(l?.inputSchema) ?? normalizeSchema(c?.inputSchema) ?? normalizeSchema(d?.inputSchema);
+        if (schema !== undefined)
+            tool.inputSchema = schema;
+        if (registeredBy)
+            tool.registeredBy = registeredBy;
+        if (attribution) {
+            tool.registeredByKind = attribution.kind;
+            if (attribution.platform)
+                tool.registeredByPlatform = attribution.platform;
+            if (attribution.package)
+                tool.registeredByPackage = attribution.package;
+        }
+        const exposedTo = stringList(c?.exposedTo) ?? stringList(l?.exposedTo);
+        if (exposedTo)
+            tool.exposedTo = exposedTo;
+        return tool;
+    });
+}
+//# sourceMappingURL=merge.js.map

package/dist/webmcp/merge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge.js","sourceRoot":"","sources":["../../src/webmcp/merge.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,2EAA2E;AAC3E,EAAE;AACF,2EAA2E;AAC3E,qEAAqE;AACrE,6EAA6E;AAC7E,2CAA2C;AAC3C,sEAAsE;AACtE,qDAAqD;AACrD,EAAE;AACF,0EAA0E;AAC1E,8EAA8E;AAC9E,8EAA8E;AAE9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA4CnD,SAAS,IAAI,CAAC,CAAU;IACtB,OAAO,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAC3E,IAAI,QAAQ,KAAK,SAAS;QAAE,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC;IACxD,IAAI,aAAa,KAAK,SAAS;QAAE,GAAG,CAAC,iBAAiB,GAAG,aAAa,CAAC;IACvE,IAAI,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAClE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,SAAS,UAAU,CAAC,CAAU;IAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACpC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,IAAI,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,CAAC,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,GAAG,CAAC;IAC7C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,KAAyB,EAAE,SAAS,GAAG,qBAAqB;IAC7F,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,SAAS;QACvC,MAAM,CAAC,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,wEAAwE;IACxE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;;YACjC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,YAAY;YAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;;YACvC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,yEAAyE;IACzE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAE1D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE;QACxB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAEvC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEhC,MAAM,EAAE,GAAG,oBAAoB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAChD,MAAM,EAAE,GAAG,oBAAoB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAChD,MAAM,EAAE,GAAG,oBAAoB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAChD,MAAM,WAAW,GAAoB,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,mBAAmB,EAAE,sBAAsB,CAAU,EAAE,CAAC;YACvF,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,SAAS;gBAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;QAC7G,MAAM,WAAW,GAAG,iBAAiB,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAEpF,MAAM,IAAI,GAAe;YACvB,IAAI;YACJ,WAAW;YACX,UAAU,EAAE,WAAW,EAAE,IAAI,KAAK,aAAa;YAC/C,OAAO;SACR,CAAC;QACF,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7E,IAAI,KAAK;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAC9B,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACrG,IAAI,WAAW;YAAE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAChD,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,eAAe,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,eAAe,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACrH,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC;QACpD,IAAI,YAAY;YAAE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACnD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,gBAAgB,GAAG,WAAW,CAAC,IAAI,CAAC;YACzC,IAAI,WAAW,CAAC,QAAQ;gBAAE,IAAI,CAAC,oBAAoB,GAAG,WAAW,CAAC,QAAQ,CAAC;YAC3E,IAAI,WAAW,CAAC,OAAO;gBAAE,IAAI,CAAC,mBAAmB,GAAG,WAAW,CAAC,OAAO,CAAC;QAC1E,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACvE,IAAI,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/webmcp/score.d.ts

@@ -0,0 +1,70 @@
+import { type ScanVerdict } from "../scanner/patterns.js";
+import { type EnumerationResult, type Severity, type SiteReport, type SiteSummary, type WebmcpFinding, type WebmcpTool } from "./types.js";
+export declare const MAX_DESCRIPTION_CHARS = 500;
+export declare const MAX_TOOLS_PER_PAGE = 40;
+/** Split a tool name into lowercase words: "proceedToCheckout" -> [proceed, to, checkout]. */
+export declare function tokenizeName(name: string): string[];
+export declare function severityRank(s: Severity): number;
+/** True when `s` is at or above `threshold` (critical is highest). */
+export declare function atOrAbove(s: Severity, threshold: Severity): boolean;
+export declare function originOf(url: string | undefined | null): string | null;
+/**
+ * Approximate registrable domain ("site") of a URL: www.shop.example and
+ * cdn.shop.example share one. A heuristic without the full Public Suffix
+ * List: two-letter ccTLD second levels and common shared hosts are handled.
+ */
+export declare function siteOf(url: string | undefined | null): string | null;
+/** Parse a schema that may arrive as a JSON string (Chrome's getTools does this). */
+export declare function parseSchema(raw: unknown): {
+    ok: boolean;
+    value: unknown;
+};
+interface SchemaParam {
+    path: string;
+    key: string;
+    description?: string;
+}
+/** Walk object properties (nested objects and array items) of a JSON Schema. */
+export declare function schemaParams(schema: unknown, prefix?: string, depth?: number): SchemaParam[];
+export type WriteTier = "high" | "medium" | "low";
+export interface WriteShape {
+    tier: WriteTier;
+    reason: string;
+}
+/** Does the tool look like it changes state (buys, deletes, sends, books ...)? */
+export declare function classifyWriteShape(tool: Pick<WebmcpTool, "name" | "description">): WriteShape | null;
+interface PoisonPattern {
+    id: string;
+    name: string;
+    severity: Severity;
+    re: RegExp;
+}
+/** WebMCP-specific tool-poisoning shapes not covered by scanContent. */
+export declare const POISON_PATTERNS: PoisonPattern[];
+/**
+ * Remove invisible characters that real text needs before WP-05 runs:
+ * emoji ZWJ sequences, subdivision flags (tag characters), ZWJ/ZWNJ in
+ * scripts that use them for shaping, LRM/RLM in right-to-left text, and a
+ * leading BOM.
+ */
+export declare function stripBenignInvisibles(text: string): string;
+export declare function scoreTool(tool: WebmcpTool): WebmcpFinding[];
+export declare function scorePage(input: Pick<EnumerationResult, "tools" | "permissionsPolicy">): WebmcpFinding[];
+/**
+ * Score starts at 100. Each rule deducts per finding, capped at twice the
+ * weight of its worst finding, so a site with 30 similar tools is not
+ * punished 30 times for one design choice. Thresholds match Tier 1
+ * (>= 80 PASS, 50-79 CONCERNS, < 50 FAIL), with two floors: any critical
+ * finding is FAIL, and any high finding is at least CONCERNS.
+ */
+export declare function computeVerdict(findings: WebmcpFinding[]): {
+    score: number;
+    verdict: ScanVerdict;
+};
+/** `failed` (the page never loaded and no tool was found) gives score null and verdict ERROR. */
+export declare function summarize(tools: WebmcpTool[], findings: WebmcpFinding[], failed?: boolean): SiteSummary;
+/** Turn an enumeration into the schemaVersion 1 report. */
+export declare function buildReport(e: EnumerationResult, scannedAt?: Date): SiteReport;
+/** Highest severity in a report, or null when there are no findings. */
+export declare function worstSeverity(findings: WebmcpFinding[]): Severity | null;
+export {};