@secureport/cli 0.0.0

package/dist/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,aAAa,EACb,UAAU,EACV,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,aAAa,EACb,UAAU,EACV,UAAU,EACV,cAAc,GAMf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,OAAO,EAAe,MAAM,aAAa,CAAC;AA2BjE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;AAEjE,MAAM,YAAY,GAA0B,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACvF,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAChD,MAAM,SAAS,GAAuB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAEnE,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCZ,CAAC;AAEF,0DAA0D;AAC1D,MAAM,QAAS,SAAQ,KAAK;IAGf;IAFX,YACE,OAAe,EACN,IAAY;QAErB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,SAAI,GAAJ,IAAI,CAAQ;QAGrB,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,CAAC,IAAuB,EAAE,EAAM,EAAE,OAAe;IAClE,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,EAAE,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;YACzC,OAAO,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC;QACD,wEAAwE;QACxE,yEAAyE;QACzE,EAAE,CAAC,GAAG,CAAC,eAAe,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAuB,EAAE,EAAM,EAAE,OAAe;IAChE,IAAI,MAA+D,CAAC;IACpE,IAAI,WAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC;YACvB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;YACf,gBAAgB,EAAE,IAAI;YACtB,OAAO,EAAE;gBACP,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC5B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACvB,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAClC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACvB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACzC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACjC,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAClC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACvB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;gBACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;aACzC;SACF,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACvB,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAChB,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EACvF,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/B,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACb,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClD,KAAK,QAAQ;YACX,OAAO,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzD,KAAK,UAAU;YACb,OAAO,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD;YACE,MAAM,IAAI,QAAQ,CAChB,qBAAqB,OAAO,0CAA0C,EACtE,IAAI,CAAC,KAAK,CACX,CAAC;IACN,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,GAAG,CAAC,MAA+B,EAAE,IAAY;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,4DAA4D;AAC5D,SAAS,KAAK,CACZ,MAA+B,EAC/B,IAAY,EACZ,OAAqB;IAErB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAE,OAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,QAAQ,CAChB,KAAK,IAAI,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,EACnE,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IACD,OAAO,KAAU,CAAC;AACpB,CAAC;AAED,sEAAsE;AACtE,SAAS,cAAc,CAAC,IAAuB,EAAE,IAAY;IAC3D,MAAM,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS;QACrB,MAAM,IAAI,QAAQ,CAAC,cAAc,IAAI,8BAA8B,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,yBAAyB,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,SAAS,IAAI,CAAC,EAAM,EAAE,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,iBAAiB,IAAI,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,MAAM,CAAC,MAAc,EAAE,QAAgB;IAC9C,OAAO,GAAG,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC;AASD,+DAA+D;AAC/D,SAAS,IAAI,CAAC,MAA+B,EAAE,IAAY,EAAE,EAAM;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAE5B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAChB,wCAAwC,IAAI,sBAAsB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EACxF,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAEzF,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;IACvD,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAC9D,MAAM,IAAI,QAAQ,CAChB,+BAA+B,QAAQ,CAAC,MAAM,CAAC,GAAG,oBAAoB,GAAG,IAAI;YAC3E,kFAAkF;YAClF,iFAAiF;YACjF,iCAAiC,EACnC,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,OAAO,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjD,EAAE,CAAC,GAAG,CACJ,uFAAuF;YACrF,8FAA8F,CACjG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAkB;QAC7B,KAAK,EAAE,WAAW;QAClB,KAAK;QACL,QAAQ;QACR,GAAG;QACH,KAAK,EAAE,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;KAC7B,CAAC;IACF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAE5D,MAAM,QAAQ,GAAG,aAAa,CAAC;QAC7B,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,WAAW;YAClB,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,QAAQ,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,QAAQ;YAC/E,GAAG,EAAE,GAAG,IAAI,SAAS;SACtB;QACD,GAAG,EAAE;YACH,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,WAAW;YAClB,QAAQ;YACR,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,IAAI,QAAQ;YACtD,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE;YACzE,SAAS,EAAE,GAAG;SACf;QACD,QAAQ;QACR,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG;QACH,KAAK,EAAE,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;KAC7B,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED,2EAA2E;AAC3E,SAAS,OAAO,CAAC,MAAc;IAC7B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,GAAG,EAAE,CAAC,GAAG,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CACpB,MAAc,EACd,IAAY,EACZ,OAAsB,EACtB,IAAY;IAEZ,IAAI,CAAC;QACH,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,QAAQ;gBACX,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACrC,KAAK,KAAK;gBACR,OAAO,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAClC,KAAK,MAAM;gBACT,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACnC,KAAK,QAAQ;gBACX,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACrC,KAAK,SAAS;gBACZ,OAAO,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAChB,KAAK,IAAI,mBAAmB,MAAM,YAAY,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACtG,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,EAAM,EAAE,IAAY;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAChB,KAAK,IAAI,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC1F,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,MAA+B,EAAE,EAAM;IACvD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAAC,0BAA0B,GAAG,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,SAAS,MAAM,CAAC,GAAuB;IACrC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,sCAAsC;AACtC,SAAS,IAAI,CAAC,MAA+B,EAAE,EAAM,EAAE,OAAe;IACpE,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,SAAS;QAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;;QAC5E,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,MAAM,CAAC,MAA+B,EAAE,IAAuB,EAAE,EAAM;IAC9E,MAAM,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC;IACjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,2BAA2B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,CAAE,YAAkC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,QAAQ,CAChB,yBAAyB,OAAO,gBAAgB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAC1E,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,OAAqB,CAAC;IACnC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IAExD,2EAA2E;IAC3E,4EAA4E;IAC5E,2DAA2D;IAC3D,IAAI,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;QAC/D,MAAM,IAAI,QAAQ,CAChB,kFAAkF;YAChF,oFAAoF,EACtF,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC;IACxD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAE5C,MAAM,OAAO,GAAG;QACd,IAAI;QACJ,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAW,EAAE,CAAC;QACxF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAW,EAAE,CAAC;QACzD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAW,EAAE,CAAC;KAC5D,CAAC;IAEF,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ;YACN,MAAM,KAAK,IAAI;gBACb,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC;gBACnC,CAAC,CAAC,MAAM,KAAK,MAAM;oBACjB,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC;oBAC/B,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,IAAI,QAAQ,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAChD,IAAI,WAAW,KAAK,SAAS;QAC3B,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAEtE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,MAA+B,EAAE,IAAuB,EAAE,EAAM;IACrF,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACpD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,MAA+B,EAAE,IAAuB,EAAE,EAAM;IAChF,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAE9D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE/F,EAAE,CAAC,GAAG,CACJ;QACE,GAAG,IAAI,WAAW,MAAM,SAAS;QACjC,KAAK,QAAQ,CAAC,MAAM,WAAW,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,UAAU,EAAE,EAAE;QAC/G,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,uBAAuB;QAClG,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC"}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@secureport/cli",
+  "version": "0.0.0",
+  "description": "Turn any scanner's output into a client-ready security report. Works entirely offline, with no account.",
+  "keywords": [
+    "security",
+    "pentest",
+    "penetration-testing",
+    "vulnerability",
+    "vulnerability-management",
+    "appsec",
+    "devsecops",
+    "dast",
+    "nuclei",
+    "zap",
+    "burp",
+    "nessus",
+    "security-reporting",
+    "cli"
+  ],
+  "homepage": "https://github.com/agbjordan/secureport/tree/main/packages/cli#readme",
+  "bugs": {
+    "url": "https://github.com/agbjordan/secureport/issues"
+  },
+  "type": "module",
+  "bin": {
+    "secureport": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "src",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "@secureport/core": "^0.3.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.1",
+    "typescript": "^5.7.2"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/agbjordan/secureport.git",
+    "directory": "packages/cli"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.json",
+    "typecheck": "tsc --noEmit"
+  }
+}

package/src/cli.ts

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+import { readFileSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { run, type Io } from './run.js';
+
+/**
+ * The executable.
+ *
+ * **The only file in this package that touches the outside world**, and the
+ * only one permitted to import `node:fs`. Everything the CLI actually does is
+ * in `run.ts`, behind an {@link Io} it is handed — so the whole command
+ * surface is testable in-process without a temporary directory or a spawned
+ * process.
+ */
+const io: Io = {
+  readFile: (path) => readFileSync(path, 'utf8'),
+  writeFile: (path, content) => {
+    writeFileSync(path, content, 'utf8');
+  },
+  out: (text) => {
+    process.stdout.write(text);
+  },
+  err: (text) => {
+    process.stderr.write(text);
+  },
+  now: () => new Date(),
+};
+
+const { version } = createRequire(import.meta.url)('../package.json') as { version: string };
+
+process.exitCode = run(process.argv.slice(2), io, version);

package/src/detect.ts

@@ -0,0 +1,64 @@
+/** The scanner formats the CLI can read. */
+export type Engine = 'nuclei' | 'zap' | 'burp' | 'nessus' | 'generic';
+
+/** Every engine name, for error messages and `--engine` validation. */
+export const ENGINES: readonly Engine[] = ['nuclei', 'zap', 'burp', 'nessus', 'generic'];
+
+/**
+ * Works out which scanner produced a file, from its content.
+ *
+ * **Detection exists so the five-minute path has one fewer thing to know.**
+ * Somebody with a Nuclei file should not have to discover a `--engine` flag
+ * before they can render anything; `--engine` is there to override this when
+ * it guesses wrong, not to be mandatory.
+ *
+ * Every branch keys on something structural — a root element name, a
+ * required top-level field — rather than on a filename or an extension, both
+ * of which the user controls and neither of which the scanner guarantees.
+ *
+ * @param text - The file's content.
+ * @returns The engine, or `undefined` when nothing matches confidently.
+ */
+export function detectEngine(text: string): Engine | undefined {
+  const trimmed = text.trimStart();
+  if (trimmed === '') return undefined;
+
+  if (trimmed.startsWith('<')) {
+    // Nessus names itself in its root element. Burp's root is `<issues>`, and
+    // the `burpVersion` attribute is what separates it from anything else
+    // that happens to call its root that.
+    if (/<NessusClientData_v2[\s>]/u.test(trimmed)) return 'nessus';
+    if (/<issues[\s>]/u.test(trimmed)) return 'burp';
+    return undefined;
+  }
+
+  // A generic document declares its own version, which is the whole reason
+  // that field exists — so check it before anything that guesses.
+  const whole = parse(trimmed);
+  if (whole !== undefined && typeof whole === 'object' && !Array.isArray(whole)) {
+    const record = whole as Record<string, unknown>;
+    if ('version' in record && Array.isArray(record['findings'])) return 'generic';
+    // ZAP writes one object with a `site` array; the alerts hang off it.
+    if (Array.isArray(record['site'])) return 'zap';
+    return undefined;
+  }
+
+  // Nuclei is JSONL: the whole file is not one document, but each line is.
+  const first = trimmed.split('\n').find((line) => line.trim() !== '');
+  if (first === undefined) return undefined;
+  const line = parse(first);
+  if (line !== undefined && typeof line === 'object' && !Array.isArray(line)) {
+    const record = line as Record<string, unknown>;
+    if ('template-id' in record || 'matched-at' in record) return 'nuclei';
+  }
+  return undefined;
+}
+
+/** `JSON.parse` that answers "no" instead of throwing. */
+function parse(text: string): unknown {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return undefined;
+  }
+}

package/src/run.ts

@@ -0,0 +1,503 @@
+import { createHash } from 'node:crypto';
+import { parseArgs } from 'node:util';
+import {
+  buildSnapshot,
+  importBurp,
+  importGeneric,
+  importNessus,
+  importNuclei,
+  importZap,
+  parseSnapshot,
+  renderHtml,
+  renderJson,
+  renderMarkdown,
+  type Finding,
+  type ImportOptions,
+  type ReportKind,
+  type RunKind,
+  type Snapshot,
+} from '@secureport/core';
+import { detectEngine, ENGINES, type Engine } from './detect.js';
+
+/**
+ * Everything the CLI touches outside itself.
+ *
+ * Injected rather than reached for, so the whole command surface can be
+ * exercised in-process by a test that hands it strings and reads strings
+ * back. `cli.ts` is the only file that builds a real one, and it is the only
+ * file in this package permitted to import `node:fs`.
+ */
+export interface Io {
+  /** Reads a file as UTF-8. Throws if it cannot. */
+  readFile(path: string): string;
+
+  /** Writes a file as UTF-8. */
+  writeFile(path: string, content: string): void;
+
+  /** Writes to standard output. The report goes here. */
+  out(text: string): void;
+
+  /** Writes to standard error. Diagnostics go here, never the report. */
+  err(text: string): void;
+
+  /** The wall clock. An argument so output can be made reproducible. */
+  now(): Date;
+}
+
+/**
+ * Exit codes, which are a contract for anything scripting this.
+ *
+ * - `0` — it worked.
+ * - `1` — the command line was wrong: unknown flag, missing argument, a
+ *   `--format` that does not exist. Nothing was read.
+ * - `2` — the input was wrong: a file that does not parse, an engine that
+ *   could not be detected, a baseline against a different target.
+ */
+export const EXIT = Object.freeze({ ok: 0, usage: 1, input: 2 });
+
+const REPORT_KINDS: readonly ReportKind[] = ['pen', 'vap', 'exec', 'attest', 'retest'];
+const FORMATS = ['md', 'html', 'json'] as const;
+const RUN_KINDS: readonly RunKind[] = ['scan', 'upload', 'manual'];
+
+const HELP = `secureport — turn a scanner's output into a client-ready report.
+
+Everything here runs offline against local files. There is no account, nothing
+is uploaded, and nothing leaves the machine.
+
+Usage
+  secureport report <kind> <file>   Render a report to stdout
+  secureport import <file>          Reconcile findings into a snapshot
+  secureport validate <file>        Check a file parses, and say what is in it
+
+Report kinds
+  pen       Penetration Test — every issue in full, with its evidence
+  vap       Vulnerability Assessment — the same issues, tabulated
+  exec      Executive Summary — where things stand, no technical detail
+  attest    Attestation Letter — a formal statement, with its limits stated
+  retest    Retest — what a second run fixed, and what came back
+
+Options
+  --engine <name>       nuclei, zap, burp, nessus or generic. Detected by default
+  --previous <file>     A snapshot from an earlier run, to compare against
+  --format <fmt>        md, html or json. Default: md
+  --out <file>          Write here instead of stdout
+  --snapshot-out <file> Also write the snapshot, for the next run's --previous
+  --url <url>           What was tested. Part of every fingerprint
+  --target <name>       Its name on the report cover
+  --scope <glob>        What the run covered. Repeatable. Default: everything
+  --run-kind <kind>     scan, upload or manual. Default: upload
+  --title <text>        Override the report title
+  --prepared-by <text>  Who prepared it
+  --prepared-for <text> Who it is for
+  --now <iso8601>       Freeze the clock, for byte-identical output
+  -h, --help            This
+  -v, --version         Print the version
+
+Two runs, no account
+  secureport import run1.jsonl --url https://app.example.com --out run1.json
+  secureport report retest run2.jsonl --previous run1.json
+
+The second command needs no --url: the baseline carries the target, and a
+baseline for a different target is refused rather than compared.
+`;
+
+/** A command that failed in a way the user can act on. */
+class CliError extends Error {
+  constructor(
+    message: string,
+    readonly code: number,
+  ) {
+    super(message);
+    this.name = 'CliError';
+  }
+}
+
+/**
+ * Runs one command.
+ *
+ * @param argv - Arguments after the executable and script, as `process.argv.slice(2)`.
+ * @param io - Where to read, write and read the clock.
+ * @param version - The package version, for `--version`.
+ * @returns The process exit code.
+ */
+export function run(argv: readonly string[], io: Io, version: string): number {
+  try {
+    return dispatch(argv, io, version);
+  } catch (error) {
+    if (error instanceof CliError) {
+      io.err(`secureport: ${error.message}\n`);
+      return error.code;
+    }
+    // An unexpected failure is still the user's problem to see, and a stack
+    // trace is not a message. The message is, and importers write good ones.
+    io.err(`secureport: ${error instanceof Error ? error.message : String(error)}\n`);
+    return EXIT.input;
+  }
+}
+
+function dispatch(argv: readonly string[], io: Io, version: string): number {
+  let values: Record<string, string | boolean | string[] | undefined>;
+  let positionals: string[];
+  try {
+    const parsed = parseArgs({
+      args: [...argv],
+      allowPositionals: true,
+      options: {
+        engine: { type: 'string' },
+        previous: { type: 'string' },
+        format: { type: 'string' },
+        out: { type: 'string' },
+        'snapshot-out': { type: 'string' },
+        url: { type: 'string' },
+        target: { type: 'string' },
+        scope: { type: 'string', multiple: true },
+        'run-kind': { type: 'string' },
+        title: { type: 'string' },
+        'prepared-by': { type: 'string' },
+        'prepared-for': { type: 'string' },
+        now: { type: 'string' },
+        help: { type: 'boolean', short: 'h' },
+        version: { type: 'boolean', short: 'v' },
+      },
+    });
+    values = parsed.values;
+    positionals = parsed.positionals;
+  } catch (error) {
+    throw new CliError(
+      `${error instanceof Error ? error.message : String(error)}\nRun \`secureport --help\`.`,
+      EXIT.usage,
+    );
+  }
+
+  if (values['version'] === true) {
+    io.out(`${version}\n`);
+    return EXIT.ok;
+  }
+  if (values['help'] === true || positionals.length === 0) {
+    io.out(HELP);
+    return EXIT.ok;
+  }
+
+  const command = positionals[0];
+  switch (command) {
+    case 'report':
+      return report(values, positionals.slice(1), io);
+    case 'import':
+      return importCommand(values, positionals.slice(1), io);
+    case 'validate':
+      return validate(values, positionals.slice(1), io);
+    default:
+      throw new CliError(
+        `unknown command \`${command}\`. Expected report, import or validate.`,
+        EXIT.usage,
+      );
+  }
+}
+
+/** A string option, or undefined. `parseArgs` gives us `string | boolean`. */
+function str(values: Record<string, unknown>, name: string): string | undefined {
+  const value = values[name];
+  return typeof value === 'string' ? value : undefined;
+}
+
+/** One `--option value` that must be one of a known set. */
+function oneOf<T extends string>(
+  values: Record<string, unknown>,
+  name: string,
+  allowed: readonly T[],
+): T | undefined {
+  const value = str(values, name);
+  if (value === undefined) return undefined;
+  if (!(allowed as readonly string[]).includes(value)) {
+    throw new CliError(
+      `--${name} must be one of ${allowed.join(', ')} (got \`${value}\`)`,
+      EXIT.usage,
+    );
+  }
+  return value as T;
+}
+
+/** The one positional a command needs, or a usage error naming it. */
+function onlyPositional(rest: readonly string[], what: string): string {
+  const [first, ...extra] = rest;
+  if (first === undefined)
+    throw new CliError(`expected a ${what}. Run \`secureport --help\`.`, EXIT.usage);
+  if (extra.length > 0) throw new CliError(`unexpected argument \`${extra[0]}\``, EXIT.usage);
+  return first;
+}
+
+/** Reads a file, turning a missing one into a message rather than a stack. */
+function read(io: Io, path: string): string {
+  try {
+    return io.readFile(path);
+  } catch {
+    throw new CliError(`cannot read \`${path}\``, EXIT.input);
+  }
+}
+
+/**
+ * A stable id derived from content.
+ *
+ * **Ids have to be deterministic here, and they have to not collide across
+ * runs.** Deterministic, because a report re-rendered from the same input must
+ * come out byte-identical or it cannot be compared with the copy somebody was
+ * sent. Non-colliding, because a second run's new issues are appended to a
+ * baseline's existing ones, and a counter restarting at 1 would reuse ids the
+ * baseline already holds.
+ *
+ * Hashing the thing being identified gives both at once.
+ */
+function idFrom(prefix: string, material: string): string {
+  return `${prefix}_${createHash('sha256').update(material).digest('hex').slice(0, 12)}`;
+}
+
+/** Everything the three commands work out the same way. */
+interface Loaded {
+  readonly snapshot: Snapshot;
+  readonly engine: Engine;
+  readonly findings: readonly Finding[];
+}
+
+/** Parses a scanner file and reconciles it into a snapshot. */
+function load(values: Record<string, unknown>, file: string, io: Io): Loaded {
+  const text = read(io, file);
+
+  const engine = oneOf(values, 'engine', ENGINES) ?? detectEngine(text);
+  if (engine === undefined) {
+    throw new CliError(
+      `cannot tell which scanner produced \`${file}\`. Pass --engine (${ENGINES.join(', ')}).`,
+      EXIT.input,
+    );
+  }
+
+  const previousPath = str(values, 'previous');
+  const previous = previousPath === undefined ? undefined : loadSnapshot(io, previousPath);
+
+  // The baseline carries the target, so a retest needs no --url. An explicit
+  // one that disagrees is refused rather than honoured: the target id is in
+  // every fingerprint, so comparing across two of them would report every
+  // issue as resolved and every issue as new, which is worse than an error.
+  const url = str(values, 'url') ?? previous?.target.url;
+  const targetId = url === undefined ? 'tgt_local' : idFrom('tgt', url);
+  if (previous !== undefined && targetId !== previous.target.id) {
+    throw new CliError(
+      `--previous is a snapshot of ${previous.target.url}, and --url says ${url}. ` +
+        'A target id is part of every fingerprint, so comparing across two of them would ' +
+        'report everything as both resolved and new. Drop --url to use the baseline, or ' +
+        'drop --previous to start fresh.',
+      EXIT.input,
+    );
+  }
+
+  const now = parseNow(values, io);
+  const runId = idFrom('run', text);
+  const paths = Array.isArray(values['scope']) ? (values['scope'] as string[]) : [];
+  if (paths.length === 0 && previous !== undefined) {
+    io.err(
+      'secureport: no --scope given, so this run is assumed to have covered everything, and ' +
+        'anything the baseline had that this file does not will resolve. Pass --scope to narrow it.\n',
+    );
+  }
+
+  const options: ImportOptions = {
+    orgId: 'org_local',
+    runId,
+    targetId,
+    now,
+    newId: counter(`${runId}_f`),
+  };
+  const findings = parseFindings(engine, text, options, file);
+
+  const snapshot = buildSnapshot({
+    target: {
+      id: targetId,
+      orgId: 'org_local',
+      name: str(values, 'target') ?? previous?.target.name ?? hostOf(url) ?? 'Target',
+      url: url ?? 'unknown',
+    },
+    run: {
+      id: runId,
+      orgId: 'org_local',
+      targetId,
+      kind: oneOf(values, 'run-kind', RUN_KINDS) ?? 'upload',
+      trigger: 'cli',
+      coverage: { paths: paths.length > 0 ? paths : ['**'], engines: [engine] },
+      startedAt: now,
+    },
+    findings,
+    ...(previous === undefined ? {} : { previous }),
+    now,
+    newId: counter(`${runId}_i`),
+  });
+
+  return { snapshot, engine, findings };
+}
+
+/** Ids within one run, numbered in order. The run id keeps them unique. */
+function counter(prefix: string): () => string {
+  let n = 0;
+  return () => `${prefix}${++n}`;
+}
+
+function parseFindings(
+  engine: Engine,
+  text: string,
+  options: ImportOptions,
+  file: string,
+): readonly Finding[] {
+  try {
+    switch (engine) {
+      case 'nuclei':
+        return importNuclei(text, options);
+      case 'zap':
+        return importZap(text, options);
+      case 'burp':
+        return importBurp(text, options);
+      case 'nessus':
+        return importNessus(text, options);
+      case 'generic':
+        return importGeneric(text, options);
+    }
+  } catch (error) {
+    throw new CliError(
+      `\`${file}\` is not valid ${engine} output: ${error instanceof Error ? error.message : String(error)}`,
+      EXIT.input,
+    );
+  }
+}
+
+function loadSnapshot(io: Io, path: string): Snapshot {
+  const text = read(io, path);
+  try {
+    return parseSnapshot(text);
+  } catch (error) {
+    throw new CliError(
+      `\`${path}\` is not a snapshot: ${error instanceof Error ? error.message : String(error)}`,
+      EXIT.input,
+    );
+  }
+}
+
+function parseNow(values: Record<string, unknown>, io: Io): Date {
+  const raw = str(values, 'now');
+  if (raw === undefined) return io.now();
+  const now = new Date(raw);
+  if (Number.isNaN(now.getTime())) {
+    throw new CliError(`--now is not a date: \`${raw}\``, EXIT.usage);
+  }
+  return now;
+}
+
+/** The host of a URL, for a report cover, when nothing better was given. */
+function hostOf(url: string | undefined): string | undefined {
+  if (url === undefined) return undefined;
+  try {
+    return new URL(url).host;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Writes to `--out` or to stdout. */
+function emit(values: Record<string, unknown>, io: Io, content: string): void {
+  const out = str(values, 'out');
+  if (out === undefined) io.out(content.endsWith('\n') ? content : `${content}\n`);
+  else io.writeFile(out, content);
+}
+
+function report(values: Record<string, unknown>, rest: readonly string[], io: Io): number {
+  const [kindArg, ...files] = rest;
+  if (kindArg === undefined) {
+    throw new CliError(`expected a report kind: ${REPORT_KINDS.join(', ')}.`, EXIT.usage);
+  }
+  if (!(REPORT_KINDS as readonly string[]).includes(kindArg)) {
+    throw new CliError(
+      `unknown report kind \`${kindArg}\`. Expected ${REPORT_KINDS.join(', ')}.`,
+      EXIT.usage,
+    );
+  }
+  const kind = kindArg as ReportKind;
+  const file = onlyPositional(files, 'file to report on');
+
+  // Checked here rather than left to the model, which refuses the same thing
+  // a few steps later in the vocabulary of a library caller. Failing before a
+  // file is read also means the message arrives immediately.
+  if (kind === 'retest' && str(values, 'previous') === undefined) {
+    throw new CliError(
+      'a retest compares two runs, so it needs --previous <snapshot.json> — a snapshot ' +
+        'written by an earlier `secureport import`. There is nothing to compare one run to.',
+      EXIT.usage,
+    );
+  }
+
+  const format = oneOf(values, 'format', FORMATS) ?? 'md';
+  const { snapshot } = load(values, file, io);
+
+  const options = {
+    kind,
+    now: parseNow(values, io),
+    ...(str(values, 'title') === undefined ? {} : { title: str(values, 'title') as string }),
+    ...(str(values, 'prepared-by') === undefined
+      ? {}
+      : { preparedBy: str(values, 'prepared-by') as string }),
+    ...(str(values, 'prepared-for') === undefined
+      ? {}
+      : { preparedFor: str(values, 'prepared-for') as string }),
+  };
+
+  let rendered: string;
+  try {
+    rendered =
+      format === 'md'
+        ? renderMarkdown(snapshot, options)
+        : format === 'html'
+          ? renderHtml(snapshot, options)
+          : renderJson(snapshot, options);
+  } catch (error) {
+    // The one case that lands here is a retest with no baseline, which the
+    // model refuses rather than rendering a comparison against nothing.
+    throw new CliError(error instanceof Error ? error.message : String(error), EXIT.input);
+  }
+
+  const snapshotOut = str(values, 'snapshot-out');
+  if (snapshotOut !== undefined)
+    io.writeFile(snapshotOut, `${JSON.stringify(snapshot, null, 2)}\n`);
+
+  emit(values, io, rendered);
+  return EXIT.ok;
+}
+
+function importCommand(values: Record<string, unknown>, rest: readonly string[], io: Io): number {
+  const file = onlyPositional(rest, 'file to import');
+  const { snapshot } = load(values, file, io);
+  emit(values, io, `${JSON.stringify(snapshot, null, 2)}\n`);
+  return EXIT.ok;
+}
+
+/**
+ * Says what is in a file without producing anything from it.
+ *
+ * The command somebody runs when an import failed and they want to know
+ * whether the file or the flag was wrong, so it reports what it detected and
+ * what it read rather than only whether it parsed.
+ */
+function validate(values: Record<string, unknown>, rest: readonly string[], io: Io): number {
+  const file = onlyPositional(rest, 'file to validate');
+  const { engine, findings, snapshot } = load(values, file, io);
+
+  const counts = new Map<string, number>();
+  for (const finding of findings) {
+    counts.set(finding.detectedSeverity, (counts.get(finding.detectedSeverity) ?? 0) + 1);
+  }
+  const bySeverity = [...counts.entries()].map(([severity, n]) => `${n} ${severity}`).join(', ');
+
+  io.out(
+    [
+      `${file}: valid ${engine} output`,
+      `  ${findings.length} finding${findings.length === 1 ? '' : 's'}${bySeverity === '' ? '' : ` — ${bySeverity}`}`,
+      `  ${snapshot.issues.length} issue${snapshot.issues.length === 1 ? '' : 's'} after reconciliation`,
+      '',
+    ].join('\n'),
+  );
+  return EXIT.ok;
+}