@ulisesgascon/openjs-cna-tools 0.0.0-stage → 1.0.0-alpha.1

package/components/llm-review-prompt.js

@@ -0,0 +1,84 @@
+// openjs-cna-experimental llm-review-prompt <record.json>
+//
+// Print a prompt for an LLM-driven editorial review of the record's
+// natural-language fields (title + description). The tool does not call
+// an LLM itself. Paste the output into the LLM of your choice. Pure
+// read; no network.
+
+import { parseComponentArgs, buildCli, readFileOrStdin } from '../lib/component-utils.js'
+import { buildAuditPrompt } from '../lib/prompt.js'
+
+export const command = 'llm-review-prompt'
+export const describe = 'Print a prompt for an LLM editorial review of the record\'s title + description.'
+
+export async function handler (argv) {
+  const parsed = parseComponentArgs(argv, {}, { allowPositionals: true })
+  if (parsed.values.help) return printHelp()
+
+  // Keep buildCli for help/diagnostic plumbing even though we don't
+  // print status. Keeps the component shape consistent with peers.
+  buildCli(parsed)
+
+  const file = parsed.positionals[0]
+  const raw = await readFileOrStdin(file)
+  let record
+  try {
+    record = JSON.parse(raw)
+  } catch (e) {
+    process.stderr.write(`✖ Record is not valid JSON: ${e.message}\n`)
+    process.exit(64)
+  }
+
+  // Banner goes to stderr so a pipe like `| pbcopy` or `| llm` only
+  // captures the prompt itself, not the human-facing how-to.
+  process.stderr.write(buildBanner())
+  process.stdout.write(buildAuditPrompt(record))
+}
+
+function buildBanner () {
+  const lines = [
+    'How to use this prompt',
+    '',
+    '1. Paste everything that follows into an LLM (Claude, ChatGPT,',
+    '   Gemini, etc.).',
+    '2. Also attach the full CVE Record JSON so the LLM can cross-check',
+    '   the natural-language fields against the rest of the record.',
+    '3. The LLM returns a Markdown review you can act on.'
+  ]
+  const width = Math.max(...lines.map(l => l.length))
+  const top = '┌' + '─'.repeat(width + 2) + '┐'
+  const bottom = '└' + '─'.repeat(width + 2) + '┘'
+  const body = lines.map(l => '│ ' + l.padEnd(width) + ' │').join('\n')
+  return top + '\n' + body + '\n' + bottom + '\n'
+}
+
+function printHelp () {
+  process.stderr.write(
+`openjs-cna-experimental llm-review-prompt <record.json>
+
+Build a prompt that asks an LLM for an editorial review of the record's
+title and description. The prompt includes the OpenJS naming and tone
+guidelines, the texts to audit, and a short facts block (affected,
+CVSS, CWE) so the LLM can ground its suggestions.
+
+The tool does not call any LLM. Paste the output into the LLM of your
+choice and read the reply. Attach the full CVE Record JSON in the same
+turn so the LLM can cross-check the prose against the structured data.
+
+Reads the record from a file (positional) or from stdin if the
+positional is '-' or absent.
+
+A how-to banner is written to stderr so a pipe like \`| pbcopy\` only
+captures the prompt itself.
+
+Pipeline use (audit a freshly converted draft before publish):
+
+  openjs-cna-experimental convert https://github.com/<owner>/<repo>/security/advisories/<GHSA> \\
+    | tee draft.json \\
+    | openjs-cna-experimental llm-review-prompt - | pbcopy
+
+Open the LLM, paste, attach \`draft.json\`, then iterate before
+\`openjs-cna-experimental publish\`.
+`
+  )
+}

package/components/preview.js

@@ -0,0 +1,42 @@
+// openjs-cna-experimental preview <container.json>
+// Compact terminal view of a v5.2 CNA Container. Pure read; no network.
+
+import { parseComponentArgs, buildCli, readFileOrStdin } from '../lib/component-utils.js'
+import { renderPreview } from '../lib/preview.js'
+
+export const command = 'preview'
+export const describe = 'Print a compact preview of a CNA Container.'
+
+export async function handler (argv) {
+  const parsed = parseComponentArgs(argv, {}, { allowPositionals: true })
+  if (parsed.values.help) return printHelp()
+
+  const cli = buildCli(parsed)
+  const file = parsed.positionals[0]
+  const raw = await readFileOrStdin(file)
+  let container
+  try {
+    container = JSON.parse(raw)
+  } catch (e) {
+    process.stderr.write(`✖ Container is not valid JSON: ${e.message}\n`)
+    process.exit(64)
+  }
+
+  renderPreview(container, cli)
+}
+
+function printHelp () {
+  process.stderr.write(
+`openjs-cna-experimental preview <container.json>
+
+Print a compact summary of the container — title, description, affected
+products, CVSS, CWE, credits, references, and the x_generator engine.
+
+Useful as a quick sanity check before publish, or as a step in a pipeline
+('openjs-cna-experimental get CVE-... | openjs-cna-experimental preview -').
+
+Reads the container from a file (positional) or from stdin if the
+positional is '-' or absent.
+`
+  )
+}

package/components/publish.js

@@ -0,0 +1,133 @@
+// openjs-cna-experimental publish <cve-id> [-f container.json] [--skip-review] [--no-strict]
+//
+// Cross-checks the CLI <cve-id> against `container.cveMetadata.cveId` if
+// present (hard-error on mismatch); fills cveMetadata in when absent.
+// Then runs the reviewer (strict by default — warnings block too). On a
+// clean review (or `--skip-review`), prompts for confirmation and
+// publishes. Surfaces `correlation_id` + `run_id` after publish so the
+// operator can forward to a CNA coordinator if needed.
+
+import {
+  parseComponentArgs,
+  buildClient,
+  buildCli,
+  readFileOrStdin
+} from '../lib/component-utils.js'
+import { reviewRecord } from '../lib/review/index.js'
+import { CnaReviewBlockedError } from '../lib/errors.js'
+
+export const command = 'publish'
+export const describe = 'Publish a v5.2 CNA Container for a reserved CVE.'
+
+export async function handler (argv) {
+  const parsed = parseComponentArgs(argv, {
+    file: { type: 'string', short: 'f' },
+    'skip-review': { type: 'boolean' },
+    'no-strict': { type: 'boolean' }
+  }, { allowPositionals: true })
+  if (parsed.values.help) return printHelp()
+
+  const cveId = parsed.positionals[0]
+  if (!cveId) {
+    process.stderr.write('✖ Missing CVE id. Usage: openjs-cna-experimental publish <CVE-...> -f container.json\n')
+    process.exit(64)
+  }
+
+  const cli = buildCli(parsed)
+  const client = buildClient(parsed)
+
+  const raw = await readFileOrStdin(parsed.values.file)
+  let record
+  try {
+    record = JSON.parse(raw)
+  } catch (e) {
+    process.stderr.write(`✖ File is not valid JSON: ${e.message}\n`)
+    process.exit(64)
+  }
+
+  // CVE id consistency check. The Record's cveMetadata.cveId must match
+  // the CLI arg; mismatch is a hard error (operator was probably about to
+  // publish the wrong record). If cveMetadata is missing, the CLI arg is
+  // the sole source of truth.
+  const recordCveId = record?.cveMetadata?.cveId
+  if (recordCveId && recordCveId !== cveId) {
+    process.stderr.write(
+      `✖ CVE id mismatch: CLI argument is ${cveId}, record.cveMetadata.cveId is ${recordCveId}.\n` +
+      '  Aborting before publish to prevent updating the wrong record.\n'
+    )
+    process.exit(64)
+  }
+
+  // Extract the inner cna container — the workflow expects just that,
+  // not the full Record (it builds the Record server-side with the
+  // assignerOrgId and dateUpdated MITRE injects).
+  const container = record.containers.cna
+
+  if (!parsed.values['skip-review']) {
+    const strict = !parsed.values['no-strict']
+    const report = reviewRecord(record, { strict })
+    // Strict mode promotes warnings to blockers inside reviewRecord, so
+    // the `summary.blockers` count already reflects strictness. We just
+    // need to check that single number.
+    if (report.summary.blockers > 0) {
+      cli.error(
+        `Review blocked publish: ${report.summary.blockers} blocker(s)`
+      )
+      for (const issue of report.issues) {
+        const tag = issue.severity === 'blocker' ? '✖' : issue.severity === 'warning' ? '⚠' : '·'
+        cli.log(`  ${tag} [${issue.rule}] ${issue.message}`)
+      }
+      cli.log('')
+      cli.log('  Re-run with --skip-review to bypass.')
+      throw new CnaReviewBlockedError(
+        `Review blocked publish for ${cveId}`,
+        { report }
+      )
+    }
+    if (report.summary.warnings) {
+      cli.warn(`Review surfaced ${report.summary.warnings} warning(s); proceeding.`)
+    } else {
+      cli.ok(`Review clean (${report.summary.suggestions} suggestion(s)).`)
+    }
+  }
+
+  // Confirmation prompt. Defaults to "yes" only when the review was clean
+  // (and we got here without --skip-review). Honors --yes / OPENJS_CNA_YES.
+  const confirmed = await cli.prompt(
+    `Publish ${cveId}? This is irreversible.`,
+    { defaultAnswer: !parsed.values['skip-review'] }
+  )
+  if (!confirmed) {
+    cli.info('Aborted.')
+    return
+  }
+
+  cli.info(`Publishing ${cveId}…`)
+  const { correlationId, runId, result } = await client.publishCve(cveId, container, {
+    onPoll: (run) => {
+      if (run.status && run.status !== 'completed') cli.info(`run status: ${run.status}`)
+    }
+  })
+  cli.ok(`Published ${cveId}`)
+  if (correlationId || runId) {
+    cli.info(`Forward to coordinator if needed: correlation_id=${correlationId ?? '?'}, run_id=${runId ?? '?'}`)
+  }
+  if (result) process.stdout.write(JSON.stringify(result, null, 2) + '\n')
+}
+
+function printHelp () {
+  process.stderr.write(
+`openjs-cna-experimental publish <cve-id> [-f container.json]
+
+Publish a v5.2 CNA Container against an already-reserved CVE id. Default
+behavior runs the reviewer first (strict — warnings block too) and aborts
+on any issue.
+
+Options:
+  -f, --file <path>     read the container from a file (default: stdin)
+  --skip-review         do not run the reviewer
+  --no-strict           let warnings pass through (only true blockers abort)
+  [global flags]
+`
+  )
+}

package/components/reserve.js

@@ -0,0 +1,48 @@
+// openjs-cna-experimental reserve
+// Reserves a CVE id via the CNA API and prints it on stdout.
+
+import { parseComponentArgs, buildClient, buildCli } from '../lib/component-utils.js'
+
+export const command = 'reserve'
+export const describe = 'Reserve a CVE id via the OpenJS Foundation CNA.'
+
+export async function handler (argv) {
+  const parsed = parseComponentArgs(argv)
+  if (parsed.values.help) return printHelp()
+  const cli = buildCli(parsed)
+  const client = buildClient(parsed)
+
+  cli.info('Reserving CVE…')
+  const { cveId, correlationId, runId } = await client.reserveCve({
+    onPoll: (run) => {
+      if (run.status && run.status !== 'completed') {
+        // Honest progress — one line per poll cycle, no animation.
+        cli.info(`run status: ${run.status}`)
+      }
+    }
+  })
+  cli.ok(`Reserved ${cveId}`)
+  if (correlationId || runId) {
+    cli.info(`Forward to coordinator if needed: correlation_id=${correlationId ?? '?'}, run_id=${runId ?? '?'}`)
+  }
+
+  // Data on stdout, no decoration — `CVE=$(openjs-cna-experimental reserve)` Just Works.
+  process.stdout.write(`${cveId}\n`)
+}
+
+function printHelp () {
+  process.stderr.write(
+`openjs-cna-experimental reserve
+
+Reserve a CVE id from the configured bucket. Prints the CVE id on stdout
+once the workflow completes.
+
+Usage:
+  openjs-cna-experimental reserve [global flags]
+
+Example:
+  CVE=$(openjs-cna-experimental reserve)
+  openjs-cna-experimental publish "$CVE" -f container.json
+`
+  )
+}

package/components/review.js

@@ -0,0 +1,123 @@
+// openjs-cna-experimental review <container.json> [--no-strict] [--no-preview] [--tier <name>] [--json]
+//
+// Runs the offline reviewer against a CNA Container. Strict by default
+// (warnings block); --no-strict surfaces them as warnings. Renders the
+// preview before the issues list unless --no-preview. --tier filters the
+// printed issues to a single severity tier (mitre-common / openjs-extra)
+// without changing the exit code, which always reflects the full review.
+
+import { parseComponentArgs, buildCli, readFileOrStdin } from '../lib/component-utils.js'
+import { reviewRecord } from '../lib/review/index.js'
+import { renderPreview } from '../lib/preview.js'
+
+export const command = 'review'
+export const describe = 'Review a v5.2 CNA Container against best-practice rules.'
+
+const VALID_TIERS = new Set(['mitre-common', 'openjs-extra'])
+
+export async function handler (argv) {
+  const parsed = parseComponentArgs(argv, {
+    'no-strict': { type: 'boolean' },
+    'no-preview': { type: 'boolean' },
+    tier: { type: 'string' }
+  }, { allowPositionals: true })
+  if (parsed.values.help) return printHelp()
+
+  const cli = buildCli(parsed)
+  const file = parsed.positionals[0]
+
+  // Validate the --tier filter early so a typo doesn't silently match
+  // nothing and look like a clean review.
+  const tierFilter = parsed.values.tier
+  if (tierFilter && !VALID_TIERS.has(tierFilter)) {
+    process.stderr.write(
+      `✖ Unknown --tier '${tierFilter}'. Expected one of: ${[...VALID_TIERS].join(', ')}\n`
+    )
+    process.exit(64)
+  }
+
+  const raw = await readFileOrStdin(file)
+  let container
+  try {
+    container = JSON.parse(raw)
+  } catch (e) {
+    process.stderr.write(`✖ Container is not valid JSON: ${e.message}\n`)
+    process.exit(64)
+  }
+
+  const report = reviewRecord(container, { strict: !parsed.values['no-strict'] })
+
+  if (parsed.values.json) {
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n')
+  } else {
+    // Preview goes first so the operator sees what they're about to ship
+    // alongside what the reviewer caught. --no-preview drops it for
+    // CI / pipeline use.
+    if (!parsed.values['no-preview']) renderPreview(container, cli)
+    printHumanReport(cli, report, { tierFilter })
+  }
+
+  // Exit code: 0 if ready, 1 if blockers (or strict + warnings).
+  if (report.summary.blockers > 0) process.exit(1)
+}
+
+function printHumanReport (cli, report, { tierFilter } = {}) {
+  const { summary, issues } = report
+  const ratingLabel = {
+    ready: '✔ ready',
+    'needs-work': '⚠ needs work',
+    blocked: '✖ blocked'
+  }[summary.rating]
+  cli.log('')
+  cli.log(`Review: ${ratingLabel}`)
+  cli.log(`  ${summary.blockers} blocker(s) · ${summary.warnings} warning(s) · ${summary.suggestions} suggestion(s)`)
+  if (tierFilter) {
+    cli.log(`  (filtered to tier: ${tierFilter})`)
+  }
+  cli.log('')
+  // Filter at print time so the summary counts above still reflect the full
+  // review. This keeps `--tier mitre-common` from hiding the broader picture
+  // while still letting operators focus on the must-fix items.
+  const shown = tierFilter
+    ? issues.filter(i => i.tier === tierFilter)
+    : issues
+  if (shown.length === 0) {
+    if (tierFilter && issues.length > 0) {
+      cli.log(`  No ${tierFilter} issues found.`)
+    } else {
+      cli.log('  No issues found.')
+    }
+    return
+  }
+  for (const issue of shown) {
+    const tag = issue.severity === 'blocker'
+      ? '✖'
+      : issue.severity === 'warning'
+        ? '⚠'
+        : '·'
+    // Tier rides inline with the rule id so a glance at the report tells
+    // the operator whether MITRE would have caught the issue too.
+    const tierLabel = issue.tier ? `${issue.tier}: ` : ''
+    cli.log(`  ${tag} [${tierLabel}${issue.rule}] ${issue.path}`)
+    cli.log(`      ${issue.message}`)
+  }
+}
+
+function printHelp () {
+  process.stderr.write(
+`openjs-cna-experimental review <container.json>
+
+Run the offline reviewer against a CNA Container. Strict by default —
+warnings are treated as blockers because publishing to MITRE is
+irreversible. Pass --no-strict to surface warnings as warnings.
+
+Options:
+  --no-strict        surface warnings as warnings (default treats them as blockers)
+  --json             emit a structured JSON report instead of the human view
+  --no-preview       skip the container preview (for CI / pipelines)
+  --tier <tier>      filter the printed issue list to a single tier
+                     (mitre-common | openjs-extra). Summary counts still
+                     reflect the full review; exit code is unaffected.
+`
+  )
+}

package/components/update.js

@@ -0,0 +1,104 @@
+// openjs-cna-experimental update <cve-id> [-f container.json] [--skip-review] [--no-strict]
+//
+// Same shape as `publish`, but issues the update-cve operation. Same
+// cveMetadata.cveId cross-check, same strict-by-default reviewer, same
+// correlation_id + run_id surfacing on success.
+
+import {
+  parseComponentArgs,
+  buildClient,
+  buildCli,
+  readFileOrStdin
+} from '../lib/component-utils.js'
+import { reviewRecord } from '../lib/review/index.js'
+import { CnaReviewBlockedError } from '../lib/errors.js'
+
+export const command = 'update'
+export const describe = 'Update an already-published CVE record.'
+
+export async function handler (argv) {
+  const parsed = parseComponentArgs(argv, {
+    file: { type: 'string', short: 'f' },
+    'skip-review': { type: 'boolean' },
+    'no-strict': { type: 'boolean' }
+  }, { allowPositionals: true })
+  if (parsed.values.help) return printHelp()
+
+  const cveId = parsed.positionals[0]
+  if (!cveId) {
+    process.stderr.write('✖ Missing CVE id. Usage: openjs-cna-experimental update <CVE-...> -f container.json\n')
+    process.exit(64)
+  }
+
+  const cli = buildCli(parsed)
+  const client = buildClient(parsed)
+
+  const raw = await readFileOrStdin(parsed.values.file)
+  let record
+  try {
+    record = JSON.parse(raw)
+  } catch (e) {
+    process.stderr.write(`✖ File is not valid JSON: ${e.message}\n`)
+    process.exit(64)
+  }
+
+  // CVE id consistency check (same logic as publish).
+  const recordCveId = record?.cveMetadata?.cveId
+  if (recordCveId && recordCveId !== cveId) {
+    process.stderr.write(
+      `✖ CVE id mismatch: CLI argument is ${cveId}, record.cveMetadata.cveId is ${recordCveId}.\n` +
+      '  Aborting before update to prevent overwriting the wrong record.\n'
+    )
+    process.exit(64)
+  }
+
+  // Workflow expects just the inner cna container.
+  const container = record.containers.cna
+
+  if (!parsed.values['skip-review']) {
+    const strict = !parsed.values['no-strict']
+    const report = reviewRecord(record, { strict })
+    if (report.summary.blockers > 0) {
+      cli.error(`Review blocked update: ${report.summary.blockers} blocker(s)`)
+      for (const issue of report.issues) {
+        const tag = issue.severity === 'blocker' ? '✖' : '⚠'
+        cli.log(`  ${tag} [${issue.rule}] ${issue.message}`)
+      }
+      throw new CnaReviewBlockedError(`Review blocked update for ${cveId}`, { report })
+    }
+    cli.ok('Review clean.')
+  }
+
+  const confirmed = await cli.prompt(
+    `Update ${cveId}? This will replace the public MITRE record.`,
+    { defaultAnswer: !parsed.values['skip-review'] }
+  )
+  if (!confirmed) {
+    cli.info('Aborted.')
+    return
+  }
+
+  cli.info(`Updating ${cveId}…`)
+  const { correlationId, runId } = await client.updateCve(cveId, container, {
+    onPoll: (run) => { if (run.status !== 'completed') cli.info(`run status: ${run.status}`) }
+  })
+  cli.ok(`Updated ${cveId}`)
+  if (correlationId || runId) {
+    cli.info(`Forward to coordinator if needed: correlation_id=${correlationId ?? '?'}, run_id=${runId ?? '?'}`)
+  }
+}
+
+function printHelp () {
+  process.stderr.write(
+`openjs-cna-experimental update <cve-id> [-f container.json]
+
+Update a published CVE record. Same review semantics as publish (strict
+by default — warnings block too).
+
+Options:
+  -f, --file <path>     read the container from a file (default: stdin)
+  --skip-review         do not run the reviewer
+  --no-strict           let warnings pass through (only true blockers abort)
+`
+  )
+}

package/lib/auth.js

@@ -0,0 +1,20 @@
+// Resolve token + base URL from the precedence chain (flags > env > project >
+// global) and feed them to a CnaClient.
+//
+// The CLI passes any explicit --token / --base-url flags as `overrides`.
+// Everything else comes from the merged config (see ./config.js).
+//
+// Validation here is permissive: we surface what we have, the CnaClient
+// throws lazy CnaAuthError on the first operation that actually needs a
+// credential. That keeps `openjs-cna-experimental --help` and `openjs-cna-experimental config list`
+// usable without any auth at all.
+
+import { getMergedConfig } from './config.js'
+
+export function resolveCredentials ({ overrides = {}, cwd } = {}) {
+  const config = getMergedConfig({ cwd })
+  return {
+    token: overrides.token ?? config.openjs_cna_token,
+    baseUrl: overrides.baseUrl ?? config.openjs_cna_base_url
+  }
+}

package/lib/cli.js

@@ -0,0 +1,81 @@
+// Minimal CLI: a stream wrapper, four log levels, a non-animated spinner,
+// and a confirm/input prompt. Zero deps — ANSI escapes inline, gated by
+// stream.isTTY so piped output stays clean.
+//
+// Output discipline: this class always writes to its `stream` (defaulting
+// to stderr). The CLI verbs are responsible for writing data (CVE ids,
+// JSON records) to stdout directly. That keeps `CVE=$(openjs-cna-experimental reserve)`
+// pipeline-safe by construction.
+
+const ANSI = {
+  reset: '\x1b[0m',
+  bold: '\x1b[1m',
+  red: '\x1b[31m',
+  yellow: '\x1b[33m',
+  green: '\x1b[32m',
+  blue: '\x1b[34m',
+  gray: '\x1b[90m'
+}
+
+export class CLI {
+  constructor (stream = process.stderr, { color, assumeYes } = {}) {
+    this.stream = stream
+    // Default to color when stderr is a TTY and the user didn't opt out.
+    this.color = color ?? (stream.isTTY === true && !process.env.NO_COLOR)
+    this.assumeYes = assumeYes ?? false
+    this._exitCode = 0
+  }
+
+  setAssumeYes (value = true) { this.assumeYes = value }
+  setExitCode (code) { this._exitCode = code }
+  exitCode () { return this._exitCode }
+
+  _paint (code, text) { return this.color ? `${code}${text}${ANSI.reset}` : text }
+  _write (line) { this.stream.write(line + '\n') }
+
+  // Severity-leveled log lines. Match NCU's vocabulary (ok / info / warn /
+  // error) so a developer moving between the two codebases doesn't have to
+  // re-learn the lexicon.
+  ok (msg) { this._write(this._paint(ANSI.green, '✔ ') + msg) }
+  info (msg) { this._write(this._paint(ANSI.blue, 'ℹ ') + msg) }
+  warn (msg) { this._write(this._paint(ANSI.yellow, '⚠ ') + msg) }
+  error (msg) { this._write(this._paint(ANSI.red, '✖ ') + msg) }
+  log (msg) { this._write(msg) }
+  separator () { this._write('') }
+
+  // Non-animated spinner replacement. Prints a "starting…" line on start
+  // and a "done" line on stop. Honest about progress without leaning on
+  // ora's TTY animation. Future: rewrite-in-place when stream.isTTY, fall
+  // back to discrete lines when piped.
+  startSpinner (text) {
+    this._write(this._paint(ANSI.gray, '… ') + text)
+    return { stop: () => {} }
+  }
+
+  stopSpinner (text) {
+    if (text) this._write(this._paint(ANSI.green, '✔ ') + text)
+  }
+
+  // Confirm or input prompt. Honors --yes (or assumeYes flag) by returning
+  // the defaultAnswer without rendering. Non-TTY stdin also defaults to
+  // the default so the CLI is safe to drive from CI without explicit --yes.
+  async prompt (question, { defaultAnswer = false, questionType = 'confirm' } = {}) {
+    if (this.assumeYes) return defaultAnswer
+    if (!process.stdin.isTTY) return defaultAnswer
+    const { createInterface } = await import('node:readline/promises')
+    const rl = createInterface({ input: process.stdin, output: this.stream })
+    try {
+      const hint = questionType === 'confirm'
+        ? (defaultAnswer ? '[Y/n]' : '[y/N]')
+        : ''
+      const raw = (await rl.question(`${question} ${hint} `.trimEnd() + ' ')).trim()
+      if (questionType === 'confirm') {
+        if (!raw) return defaultAnswer
+        return /^y(es)?$/i.test(raw)
+      }
+      return raw || defaultAnswer
+    } finally {
+      rl.close()
+    }
+  }
+}