@secureport/cli 0.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Andrew Jordan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,61 @@
+# @secureport/cli
+
+Turn a scanner's output into a client-ready security report.
+
+**MIT licensed. Runs entirely offline.** There is no account, nothing is
+uploaded, and nothing leaves the machine.
+
+```bash
+npx @secureport/cli report pen scan.jsonl --url https://app.example.com > report.md
+```
+
+Reads Nuclei, ZAP, Burp, Nessus and a generic JSON format, and works out which
+one it is looking at. Renders five reports — Penetration Test, Vulnerability
+Assessment, Executive Summary, Attestation Letter and Retest — as Markdown,
+HTML or JSON.
+
+## Two runs, and it remembers
+
+The tracked thing is the **issue**, not the finding, so a second run can say
+what got fixed and what came back.
+
+```bash
+npx @secureport/cli import run1.jsonl --url https://app.example.com --out run1.json
+npx @secureport/cli report retest run2.jsonl --previous run1.json
+```
+
+```
+Of the 4 issues carried into this retest, 1 is confirmed fixed, 3 are still
+present, 0 returned, and 0 could not be retested.
+```
+
+The second command needs no `--url`: the baseline carries the target, and a
+baseline for a different target is refused rather than compared.
+
+**"Could not be retested" is not "fixed".** A run that did not cover where an
+issue was found proves nothing about it, so it gets its own verdict and is left
+out of the percentage rather than counted either way. Pass `--scope` to say what
+a run actually covered.
+
+## Commands
+
+|                                   |                                                             |
+| --------------------------------- | ----------------------------------------------------------- |
+| `secureport report <kind> <file>` | Render a report. `pen`, `vap`, `exec`, `attest` or `retest` |
+| `secureport import <file>`        | Reconcile findings into a snapshot for a later `--previous` |
+| `secureport validate <file>`      | Say what is in a file, and whether it parses                |
+
+`secureport --help` lists every option. Exit codes are `0` for success, `1` for
+a bad command line and `2` for a bad input file.
+
+## What it does not claim
+
+Reports state how their findings were produced and what that does not
+establish. Automated results are described as automated, a partial scope names
+itself, and nothing here certifies compliance with any standard. That is
+derived from the run rather than written into a template, so it cannot drift
+out of date.
+
+The domain model, the fingerprint and the reconciliation are
+[`@secureport/core`](https://www.npmjs.com/package/@secureport/core), which this
+wraps. Both are MIT.

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+import { readFileSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { run } from './run.js';
+/**
+ * The executable.
+ *
+ * **The only file in this package that touches the outside world**, and the
+ * only one permitted to import `node:fs`. Everything the CLI actually does is
+ * in `run.ts`, behind an {@link Io} it is handed — so the whole command
+ * surface is testable in-process without a temporary directory or a spawned
+ * process.
+ */
+const io = {
+    readFile: (path) => readFileSync(path, 'utf8'),
+    writeFile: (path, content) => {
+        writeFileSync(path, content, 'utf8');
+    },
+    out: (text) => {
+        process.stdout.write(text);
+    },
+    err: (text) => {
+        process.stderr.write(text);
+    },
+    now: () => new Date(),
+};
+const { version } = createRequire(import.meta.url)('../package.json');
+process.exitCode = run(process.argv.slice(2), io, version);
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,GAAG,EAAW,MAAM,UAAU,CAAC;AAExC;;;;;;;;GAQG;AACH,MAAM,EAAE,GAAO;IACb,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;QAC3B,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;CACtB,CAAC;AAEF,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAwB,CAAC;AAE7F,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC"}

package/dist/detect.d.ts

@@ -0,0 +1,21 @@
+/** The scanner formats the CLI can read. */
+export type Engine = 'nuclei' | 'zap' | 'burp' | 'nessus' | 'generic';
+/** Every engine name, for error messages and `--engine` validation. */
+export declare const ENGINES: readonly Engine[];
+/**
+ * Works out which scanner produced a file, from its content.
+ *
+ * **Detection exists so the five-minute path has one fewer thing to know.**
+ * Somebody with a Nuclei file should not have to discover a `--engine` flag
+ * before they can render anything; `--engine` is there to override this when
+ * it guesses wrong, not to be mandatory.
+ *
+ * Every branch keys on something structural — a root element name, a
+ * required top-level field — rather than on a filename or an extension, both
+ * of which the user controls and neither of which the scanner guarantees.
+ *
+ * @param text - The file's content.
+ * @returns The engine, or `undefined` when nothing matches confidently.
+ */
+export declare function detectEngine(text: string): Engine | undefined;
+//# sourceMappingURL=detect.d.ts.map

package/dist/detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,MAAM,MAAM,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEtE,uEAAuE;AACvE,eAAO,MAAM,OAAO,EAAE,SAAS,MAAM,EAAmD,CAAC;AAEzF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAiC7D"}

package/dist/detect.js

@@ -0,0 +1,65 @@
+/** Every engine name, for error messages and `--engine` validation. */
+export const ENGINES = ['nuclei', 'zap', 'burp', 'nessus', 'generic'];
+/**
+ * Works out which scanner produced a file, from its content.
+ *
+ * **Detection exists so the five-minute path has one fewer thing to know.**
+ * Somebody with a Nuclei file should not have to discover a `--engine` flag
+ * before they can render anything; `--engine` is there to override this when
+ * it guesses wrong, not to be mandatory.
+ *
+ * Every branch keys on something structural — a root element name, a
+ * required top-level field — rather than on a filename or an extension, both
+ * of which the user controls and neither of which the scanner guarantees.
+ *
+ * @param text - The file's content.
+ * @returns The engine, or `undefined` when nothing matches confidently.
+ */
+export function detectEngine(text) {
+    const trimmed = text.trimStart();
+    if (trimmed === '')
+        return undefined;
+    if (trimmed.startsWith('<')) {
+        // Nessus names itself in its root element. Burp's root is `<issues>`, and
+        // the `burpVersion` attribute is what separates it from anything else
+        // that happens to call its root that.
+        if (/<NessusClientData_v2[\s>]/u.test(trimmed))
+            return 'nessus';
+        if (/<issues[\s>]/u.test(trimmed))
+            return 'burp';
+        return undefined;
+    }
+    // A generic document declares its own version, which is the whole reason
+    // that field exists — so check it before anything that guesses.
+    const whole = parse(trimmed);
+    if (whole !== undefined && typeof whole === 'object' && !Array.isArray(whole)) {
+        const record = whole;
+        if ('version' in record && Array.isArray(record['findings']))
+            return 'generic';
+        // ZAP writes one object with a `site` array; the alerts hang off it.
+        if (Array.isArray(record['site']))
+            return 'zap';
+        return undefined;
+    }
+    // Nuclei is JSONL: the whole file is not one document, but each line is.
+    const first = trimmed.split('\n').find((line) => line.trim() !== '');
+    if (first === undefined)
+        return undefined;
+    const line = parse(first);
+    if (line !== undefined && typeof line === 'object' && !Array.isArray(line)) {
+        const record = line;
+        if ('template-id' in record || 'matched-at' in record)
+            return 'nuclei';
+    }
+    return undefined;
+}
+/** `JSON.parse` that answers "no" instead of throwing. */
+function parse(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=detect.js.map

package/dist/detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.js","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAGA,uEAAuE;AACvE,MAAM,CAAC,MAAM,OAAO,GAAsB,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAEzF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IACjC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAErC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,0EAA0E;QAC1E,sEAAsE;QACtE,sCAAsC;QACtC,IAAI,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,QAAQ,CAAC;QAChE,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,MAAM,CAAC;QACjD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,yEAAyE;IACzE,gEAAgE;IAChE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,IAAI,SAAS,IAAI,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/E,qEAAqE;QACrE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,yEAAyE;IACzE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3E,MAAM,MAAM,GAAG,IAA+B,CAAC;QAC/C,IAAI,aAAa,IAAI,MAAM,IAAI,YAAY,IAAI,MAAM;YAAE,OAAO,QAAQ,CAAC;IACzE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0DAA0D;AAC1D,SAAS,KAAK,CAAC,IAAY;IACzB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/run.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Everything the CLI touches outside itself.
+ *
+ * Injected rather than reached for, so the whole command surface can be
+ * exercised in-process by a test that hands it strings and reads strings
+ * back. `cli.ts` is the only file that builds a real one, and it is the only
+ * file in this package permitted to import `node:fs`.
+ */
+export interface Io {
+    /** Reads a file as UTF-8. Throws if it cannot. */
+    readFile(path: string): string;
+    /** Writes a file as UTF-8. */
+    writeFile(path: string, content: string): void;
+    /** Writes to standard output. The report goes here. */
+    out(text: string): void;
+    /** Writes to standard error. Diagnostics go here, never the report. */
+    err(text: string): void;
+    /** The wall clock. An argument so output can be made reproducible. */
+    now(): Date;
+}
+/**
+ * Exit codes, which are a contract for anything scripting this.
+ *
+ * - `0` — it worked.
+ * - `1` — the command line was wrong: unknown flag, missing argument, a
+ *   `--format` that does not exist. Nothing was read.
+ * - `2` — the input was wrong: a file that does not parse, an engine that
+ *   could not be detected, a baseline against a different target.
+ */
+export declare const EXIT: Readonly<{
+    ok: 0;
+    usage: 1;
+    input: 2;
+}>;
+/**
+ * Runs one command.
+ *
+ * @param argv - Arguments after the executable and script, as `process.argv.slice(2)`.
+ * @param io - Where to read, write and read the clock.
+ * @param version - The package version, for `--version`.
+ * @returns The process exit code.
+ */
+export declare function run(argv: readonly string[], io: Io, version: string): number;
+//# sourceMappingURL=run.d.ts.map

package/dist/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAqBA;;;;;;;GAOG;AACH,MAAM,WAAW,EAAE;IACjB,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAE/B,8BAA8B;IAC9B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAE/C,uDAAuD;IACvD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAExB,uEAAuE;IACvE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAExB,sEAAsE;IACtE,GAAG,IAAI,IAAI,CAAC;CACb;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,IAAI;;;;EAA+C,CAAC;AA2DjE;;;;;;;GAOG;AACH,wBAAgB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAa5E"}

package/dist/run.js

@@ -0,0 +1,390 @@
+import { createHash } from 'node:crypto';
+import { parseArgs } from 'node:util';
+import { buildSnapshot, importBurp, importGeneric, importNessus, importNuclei, importZap, parseSnapshot, renderHtml, renderJson, renderMarkdown, } from '@secureport/core';
+import { detectEngine, ENGINES } from './detect.js';
+/**
+ * Exit codes, which are a contract for anything scripting this.
+ *
+ * - `0` — it worked.
+ * - `1` — the command line was wrong: unknown flag, missing argument, a
+ *   `--format` that does not exist. Nothing was read.
+ * - `2` — the input was wrong: a file that does not parse, an engine that
+ *   could not be detected, a baseline against a different target.
+ */
+export const EXIT = Object.freeze({ ok: 0, usage: 1, input: 2 });
+const REPORT_KINDS = ['pen', 'vap', 'exec', 'attest', 'retest'];
+const FORMATS = ['md', 'html', 'json'];
+const RUN_KINDS = ['scan', 'upload', 'manual'];
+const HELP = `secureport — turn a scanner's output into a client-ready report.
+
+Everything here runs offline against local files. There is no account, nothing
+is uploaded, and nothing leaves the machine.
+
+Usage
+  secureport report <kind> <file>   Render a report to stdout
+  secureport import <file>          Reconcile findings into a snapshot
+  secureport validate <file>        Check a file parses, and say what is in it
+
+Report kinds
+  pen       Penetration Test — every issue in full, with its evidence
+  vap       Vulnerability Assessment — the same issues, tabulated
+  exec      Executive Summary — where things stand, no technical detail
+  attest    Attestation Letter — a formal statement, with its limits stated
+  retest    Retest — what a second run fixed, and what came back
+
+Options
+  --engine <name>       nuclei, zap, burp, nessus or generic. Detected by default
+  --previous <file>     A snapshot from an earlier run, to compare against
+  --format <fmt>        md, html or json. Default: md
+  --out <file>          Write here instead of stdout
+  --snapshot-out <file> Also write the snapshot, for the next run's --previous
+  --url <url>           What was tested. Part of every fingerprint
+  --target <name>       Its name on the report cover
+  --scope <glob>        What the run covered. Repeatable. Default: everything
+  --run-kind <kind>     scan, upload or manual. Default: upload
+  --title <text>        Override the report title
+  --prepared-by <text>  Who prepared it
+  --prepared-for <text> Who it is for
+  --now <iso8601>       Freeze the clock, for byte-identical output
+  -h, --help            This
+  -v, --version         Print the version
+
+Two runs, no account
+  secureport import run1.jsonl --url https://app.example.com --out run1.json
+  secureport report retest run2.jsonl --previous run1.json
+
+The second command needs no --url: the baseline carries the target, and a
+baseline for a different target is refused rather than compared.
+`;
+/** A command that failed in a way the user can act on. */
+class CliError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'CliError';
+    }
+}
+/**
+ * Runs one command.
+ *
+ * @param argv - Arguments after the executable and script, as `process.argv.slice(2)`.
+ * @param io - Where to read, write and read the clock.
+ * @param version - The package version, for `--version`.
+ * @returns The process exit code.
+ */
+export function run(argv, io, version) {
+    try {
+        return dispatch(argv, io, version);
+    }
+    catch (error) {
+        if (error instanceof CliError) {
+            io.err(`secureport: ${error.message}\n`);
+            return error.code;
+        }
+        // An unexpected failure is still the user's problem to see, and a stack
+        // trace is not a message. The message is, and importers write good ones.
+        io.err(`secureport: ${error instanceof Error ? error.message : String(error)}\n`);
+        return EXIT.input;
+    }
+}
+function dispatch(argv, io, version) {
+    let values;
+    let positionals;
+    try {
+        const parsed = parseArgs({
+            args: [...argv],
+            allowPositionals: true,
+            options: {
+                engine: { type: 'string' },
+                previous: { type: 'string' },
+                format: { type: 'string' },
+                out: { type: 'string' },
+                'snapshot-out': { type: 'string' },
+                url: { type: 'string' },
+                target: { type: 'string' },
+                scope: { type: 'string', multiple: true },
+                'run-kind': { type: 'string' },
+                title: { type: 'string' },
+                'prepared-by': { type: 'string' },
+                'prepared-for': { type: 'string' },
+                now: { type: 'string' },
+                help: { type: 'boolean', short: 'h' },
+                version: { type: 'boolean', short: 'v' },
+            },
+        });
+        values = parsed.values;
+        positionals = parsed.positionals;
+    }
+    catch (error) {
+        throw new CliError(`${error instanceof Error ? error.message : String(error)}\nRun \`secureport --help\`.`, EXIT.usage);
+    }
+    if (values['version'] === true) {
+        io.out(`${version}\n`);
+        return EXIT.ok;
+    }
+    if (values['help'] === true || positionals.length === 0) {
+        io.out(HELP);
+        return EXIT.ok;
+    }
+    const command = positionals[0];
+    switch (command) {
+        case 'report':
+            return report(values, positionals.slice(1), io);
+        case 'import':
+            return importCommand(values, positionals.slice(1), io);
+        case 'validate':
+            return validate(values, positionals.slice(1), io);
+        default:
+            throw new CliError(`unknown command \`${command}\`. Expected report, import or validate.`, EXIT.usage);
+    }
+}
+/** A string option, or undefined. `parseArgs` gives us `string | boolean`. */
+function str(values, name) {
+    const value = values[name];
+    return typeof value === 'string' ? value : undefined;
+}
+/** One `--option value` that must be one of a known set. */
+function oneOf(values, name, allowed) {
+    const value = str(values, name);
+    if (value === undefined)
+        return undefined;
+    if (!allowed.includes(value)) {
+        throw new CliError(`--${name} must be one of ${allowed.join(', ')} (got \`${value}\`)`, EXIT.usage);
+    }
+    return value;
+}
+/** The one positional a command needs, or a usage error naming it. */
+function onlyPositional(rest, what) {
+    const [first, ...extra] = rest;
+    if (first === undefined)
+        throw new CliError(`expected a ${what}. Run \`secureport --help\`.`, EXIT.usage);
+    if (extra.length > 0)
+        throw new CliError(`unexpected argument \`${extra[0]}\``, EXIT.usage);
+    return first;
+}
+/** Reads a file, turning a missing one into a message rather than a stack. */
+function read(io, path) {
+    try {
+        return io.readFile(path);
+    }
+    catch {
+        throw new CliError(`cannot read \`${path}\``, EXIT.input);
+    }
+}
+/**
+ * A stable id derived from content.
+ *
+ * **Ids have to be deterministic here, and they have to not collide across
+ * runs.** Deterministic, because a report re-rendered from the same input must
+ * come out byte-identical or it cannot be compared with the copy somebody was
+ * sent. Non-colliding, because a second run's new issues are appended to a
+ * baseline's existing ones, and a counter restarting at 1 would reuse ids the
+ * baseline already holds.
+ *
+ * Hashing the thing being identified gives both at once.
+ */
+function idFrom(prefix, material) {
+    return `${prefix}_${createHash('sha256').update(material).digest('hex').slice(0, 12)}`;
+}
+/** Parses a scanner file and reconciles it into a snapshot. */
+function load(values, file, io) {
+    const text = read(io, file);
+    const engine = oneOf(values, 'engine', ENGINES) ?? detectEngine(text);
+    if (engine === undefined) {
+        throw new CliError(`cannot tell which scanner produced \`${file}\`. Pass --engine (${ENGINES.join(', ')}).`, EXIT.input);
+    }
+    const previousPath = str(values, 'previous');
+    const previous = previousPath === undefined ? undefined : loadSnapshot(io, previousPath);
+    // The baseline carries the target, so a retest needs no --url. An explicit
+    // one that disagrees is refused rather than honoured: the target id is in
+    // every fingerprint, so comparing across two of them would report every
+    // issue as resolved and every issue as new, which is worse than an error.
+    const url = str(values, 'url') ?? previous?.target.url;
+    const targetId = url === undefined ? 'tgt_local' : idFrom('tgt', url);
+    if (previous !== undefined && targetId !== previous.target.id) {
+        throw new CliError(`--previous is a snapshot of ${previous.target.url}, and --url says ${url}. ` +
+            'A target id is part of every fingerprint, so comparing across two of them would ' +
+            'report everything as both resolved and new. Drop --url to use the baseline, or ' +
+            'drop --previous to start fresh.', EXIT.input);
+    }
+    const now = parseNow(values, io);
+    const runId = idFrom('run', text);
+    const paths = Array.isArray(values['scope']) ? values['scope'] : [];
+    if (paths.length === 0 && previous !== undefined) {
+        io.err('secureport: no --scope given, so this run is assumed to have covered everything, and ' +
+            'anything the baseline had that this file does not will resolve. Pass --scope to narrow it.\n');
+    }
+    const options = {
+        orgId: 'org_local',
+        runId,
+        targetId,
+        now,
+        newId: counter(`${runId}_f`),
+    };
+    const findings = parseFindings(engine, text, options, file);
+    const snapshot = buildSnapshot({
+        target: {
+            id: targetId,
+            orgId: 'org_local',
+            name: str(values, 'target') ?? previous?.target.name ?? hostOf(url) ?? 'Target',
+            url: url ?? 'unknown',
+        },
+        run: {
+            id: runId,
+            orgId: 'org_local',
+            targetId,
+            kind: oneOf(values, 'run-kind', RUN_KINDS) ?? 'upload',
+            trigger: 'cli',
+            coverage: { paths: paths.length > 0 ? paths : ['**'], engines: [engine] },
+            startedAt: now,
+        },
+        findings,
+        ...(previous === undefined ? {} : { previous }),
+        now,
+        newId: counter(`${runId}_i`),
+    });
+    return { snapshot, engine, findings };
+}
+/** Ids within one run, numbered in order. The run id keeps them unique. */
+function counter(prefix) {
+    let n = 0;
+    return () => `${prefix}${++n}`;
+}
+function parseFindings(engine, text, options, file) {
+    try {
+        switch (engine) {
+            case 'nuclei':
+                return importNuclei(text, options);
+            case 'zap':
+                return importZap(text, options);
+            case 'burp':
+                return importBurp(text, options);
+            case 'nessus':
+                return importNessus(text, options);
+            case 'generic':
+                return importGeneric(text, options);
+        }
+    }
+    catch (error) {
+        throw new CliError(`\`${file}\` is not valid ${engine} output: ${error instanceof Error ? error.message : String(error)}`, EXIT.input);
+    }
+}
+function loadSnapshot(io, path) {
+    const text = read(io, path);
+    try {
+        return parseSnapshot(text);
+    }
+    catch (error) {
+        throw new CliError(`\`${path}\` is not a snapshot: ${error instanceof Error ? error.message : String(error)}`, EXIT.input);
+    }
+}
+function parseNow(values, io) {
+    const raw = str(values, 'now');
+    if (raw === undefined)
+        return io.now();
+    const now = new Date(raw);
+    if (Number.isNaN(now.getTime())) {
+        throw new CliError(`--now is not a date: \`${raw}\``, EXIT.usage);
+    }
+    return now;
+}
+/** The host of a URL, for a report cover, when nothing better was given. */
+function hostOf(url) {
+    if (url === undefined)
+        return undefined;
+    try {
+        return new URL(url).host;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Writes to `--out` or to stdout. */
+function emit(values, io, content) {
+    const out = str(values, 'out');
+    if (out === undefined)
+        io.out(content.endsWith('\n') ? content : `${content}\n`);
+    else
+        io.writeFile(out, content);
+}
+function report(values, rest, io) {
+    const [kindArg, ...files] = rest;
+    if (kindArg === undefined) {
+        throw new CliError(`expected a report kind: ${REPORT_KINDS.join(', ')}.`, EXIT.usage);
+    }
+    if (!REPORT_KINDS.includes(kindArg)) {
+        throw new CliError(`unknown report kind \`${kindArg}\`. Expected ${REPORT_KINDS.join(', ')}.`, EXIT.usage);
+    }
+    const kind = kindArg;
+    const file = onlyPositional(files, 'file to report on');
+    // Checked here rather than left to the model, which refuses the same thing
+    // a few steps later in the vocabulary of a library caller. Failing before a
+    // file is read also means the message arrives immediately.
+    if (kind === 'retest' && str(values, 'previous') === undefined) {
+        throw new CliError('a retest compares two runs, so it needs --previous <snapshot.json> — a snapshot ' +
+            'written by an earlier `secureport import`. There is nothing to compare one run to.', EXIT.usage);
+    }
+    const format = oneOf(values, 'format', FORMATS) ?? 'md';
+    const { snapshot } = load(values, file, io);
+    const options = {
+        kind,
+        now: parseNow(values, io),
+        ...(str(values, 'title') === undefined ? {} : { title: str(values, 'title') }),
+        ...(str(values, 'prepared-by') === undefined
+            ? {}
+            : { preparedBy: str(values, 'prepared-by') }),
+        ...(str(values, 'prepared-for') === undefined
+            ? {}
+            : { preparedFor: str(values, 'prepared-for') }),
+    };
+    let rendered;
+    try {
+        rendered =
+            format === 'md'
+                ? renderMarkdown(snapshot, options)
+                : format === 'html'
+                    ? renderHtml(snapshot, options)
+                    : renderJson(snapshot, options);
+    }
+    catch (error) {
+        // The one case that lands here is a retest with no baseline, which the
+        // model refuses rather than rendering a comparison against nothing.
+        throw new CliError(error instanceof Error ? error.message : String(error), EXIT.input);
+    }
+    const snapshotOut = str(values, 'snapshot-out');
+    if (snapshotOut !== undefined)
+        io.writeFile(snapshotOut, `${JSON.stringify(snapshot, null, 2)}\n`);
+    emit(values, io, rendered);
+    return EXIT.ok;
+}
+function importCommand(values, rest, io) {
+    const file = onlyPositional(rest, 'file to import');
+    const { snapshot } = load(values, file, io);
+    emit(values, io, `${JSON.stringify(snapshot, null, 2)}\n`);
+    return EXIT.ok;
+}
+/**
+ * Says what is in a file without producing anything from it.
+ *
+ * The command somebody runs when an import failed and they want to know
+ * whether the file or the flag was wrong, so it reports what it detected and
+ * what it read rather than only whether it parsed.
+ */
+function validate(values, rest, io) {
+    const file = onlyPositional(rest, 'file to validate');
+    const { engine, findings, snapshot } = load(values, file, io);
+    const counts = new Map();
+    for (const finding of findings) {
+        counts.set(finding.detectedSeverity, (counts.get(finding.detectedSeverity) ?? 0) + 1);
+    }
+    const bySeverity = [...counts.entries()].map(([severity, n]) => `${n} ${severity}`).join(', ');
+    io.out([
+        `${file}: valid ${engine} output`,
+        `  ${findings.length} finding${findings.length === 1 ? '' : 's'}${bySeverity === '' ? '' : ` — ${bySeverity}`}`,
+        `  ${snapshot.issues.length} issue${snapshot.issues.length === 1 ? '' : 's'} after reconciliation`,
+        '',
+    ].join('\n'));
+    return EXIT.ok;
+}
+//# sourceMappingURL=run.js.map