@ulisesgascon/openjs-cna-tools 0.0.0-stage → 1.0.0-alpha.3

package/components/health.js

@@ -0,0 +1,30 @@
+// openjs-cna-experimental health
+// Unauthenticated liveness check against the configured CNA API.
+
+import { parseComponentArgs, buildClient, buildCli } from '../lib/component-utils.js'
+
+export const command = 'health'
+export const describe = 'Check that the CNA API is reachable.'
+
+export async function handler (argv) {
+  const parsed = parseComponentArgs(argv)
+  if (parsed.values.help) return printHelp()
+  const cli = buildCli(parsed)
+  const client = buildClient(parsed)
+  const status = await client.health()
+  cli.ok(`API is reachable (${status?.status ?? 'ok'})`)
+  process.stdout.write(JSON.stringify(status, null, 2) + '\n')
+}
+
+function printHelp () {
+  process.stderr.write(
+`openjs-cna-experimental health
+
+Probe the configured CNA API's /health endpoint. Useful to catch base-url
+misconfiguration before burning a workflow dispatch.
+
+Usage:
+  openjs-cna-experimental health [global flags]
+`
+  )
+}

package/components/list.js

@@ -0,0 +1,36 @@
+// openjs-cna-experimental list
+// Lists all CVE ids in the bucket. One id per line by default; --json for array.
+
+import { parseComponentArgs, buildClient, buildCli } from '../lib/component-utils.js'
+
+export const command = 'list'
+export const describe = 'List all CVEs in the bucket.'
+
+export async function handler (argv) {
+  const parsed = parseComponentArgs(argv)
+  if (parsed.values.help) return printHelp()
+  const cli = buildCli(parsed)
+  const client = buildClient(parsed)
+  cli.info('Listing CVEs…')
+  const ids = await client.listCves({
+    onPoll: (run) => { if (run.status !== 'completed') cli.info(`run status: ${run.status}`) }
+  })
+  cli.ok(`Found ${ids.length} CVE id(s)`)
+  if (parsed.values.json) {
+    process.stdout.write(JSON.stringify(ids, null, 2) + '\n')
+  } else {
+    for (const id of ids) process.stdout.write(`${id}\n`)
+  }
+}
+
+function printHelp () {
+  process.stderr.write(
+`openjs-cna-experimental list
+
+List every CVE id in the bucket. Default output: one id per line.
+
+Options:
+  --json    emit a JSON array instead
+`
+  )
+}

package/components/llm-review-prompt.js

@@ -0,0 +1,84 @@
+// openjs-cna-experimental llm-review-prompt <record.json>
+//
+// Print a prompt for an LLM-driven editorial review of the record's
+// natural-language fields (title + description). The tool does not call
+// an LLM itself. Paste the output into the LLM of your choice. Pure
+// read; no network.
+
+import { parseComponentArgs, buildCli, readFileOrStdin } from '../lib/component-utils.js'
+import { buildAuditPrompt } from '../lib/prompt.js'
+
+export const command = 'llm-review-prompt'
+export const describe = 'Print a prompt for an LLM editorial review of the record\'s title + description.'
+
+export async function handler (argv) {
+  const parsed = parseComponentArgs(argv, {}, { allowPositionals: true })
+  if (parsed.values.help) return printHelp()
+
+  // Keep buildCli for help/diagnostic plumbing even though we don't
+  // print status. Keeps the component shape consistent with peers.
+  buildCli(parsed)
+
+  const file = parsed.positionals[0]
+  const raw = await readFileOrStdin(file)
+  let record
+  try {
+    record = JSON.parse(raw)
+  } catch (e) {
+    process.stderr.write(`✖ Record is not valid JSON: ${e.message}\n`)
+    process.exit(64)
+  }
+
+  // Banner goes to stderr so a pipe like `| pbcopy` or `| llm` only
+  // captures the prompt itself, not the human-facing how-to.
+  process.stderr.write(buildBanner())
+  process.stdout.write(buildAuditPrompt(record))
+}
+
+function buildBanner () {
+  const lines = [
+    'How to use this prompt',
+    '',
+    '1. Paste everything that follows into an LLM (Claude, ChatGPT,',
+    '   Gemini, etc.).',
+    '2. Also attach the full CVE Record JSON so the LLM can cross-check',
+    '   the natural-language fields against the rest of the record.',
+    '3. The LLM returns a Markdown review you can act on.'
+  ]
+  const width = Math.max(...lines.map(l => l.length))
+  const top = '┌' + '─'.repeat(width + 2) + '┐'
+  const bottom = '└' + '─'.repeat(width + 2) + '┘'
+  const body = lines.map(l => '│ ' + l.padEnd(width) + ' │').join('\n')
+  return top + '\n' + body + '\n' + bottom + '\n'
+}
+
+function printHelp () {
+  process.stderr.write(
+`openjs-cna-experimental llm-review-prompt <record.json>
+
+Build a prompt that asks an LLM for an editorial review of the record's
+title and description. The prompt includes the OpenJS naming and tone
+guidelines, the texts to audit, and a short facts block (affected,
+CVSS, CWE) so the LLM can ground its suggestions.
+
+The tool does not call any LLM. Paste the output into the LLM of your
+choice and read the reply. Attach the full CVE Record JSON in the same
+turn so the LLM can cross-check the prose against the structured data.
+
+Reads the record from a file (positional) or from stdin if the
+positional is '-' or absent.
+
+A how-to banner is written to stderr so a pipe like \`| pbcopy\` only
+captures the prompt itself.
+
+Pipeline use (audit a freshly converted draft before publish):
+
+  openjs-cna-experimental convert https://github.com/<owner>/<repo>/security/advisories/<GHSA> \\
+    | tee draft.json \\
+    | openjs-cna-experimental llm-review-prompt - | pbcopy
+
+Open the LLM, paste, attach \`draft.json\`, then iterate before
+\`openjs-cna-experimental publish\`.
+`
+  )
+}

package/components/preview.js

@@ -0,0 +1,42 @@
+// openjs-cna-experimental preview <container.json>
+// Compact terminal view of a v5.2 CNA Container. Pure read; no network.
+
+import { parseComponentArgs, buildCli, readFileOrStdin } from '../lib/component-utils.js'
+import { renderPreview } from '../lib/preview.js'
+
+export const command = 'preview'
+export const describe = 'Print a compact preview of a CNA Container.'
+
+export async function handler (argv) {
+  const parsed = parseComponentArgs(argv, {}, { allowPositionals: true })
+  if (parsed.values.help) return printHelp()
+
+  const cli = buildCli(parsed)
+  const file = parsed.positionals[0]
+  const raw = await readFileOrStdin(file)
+  let container
+  try {
+    container = JSON.parse(raw)
+  } catch (e) {
+    process.stderr.write(`✖ Container is not valid JSON: ${e.message}\n`)
+    process.exit(64)
+  }
+
+  renderPreview(container, cli)
+}
+
+function printHelp () {
+  process.stderr.write(
+`openjs-cna-experimental preview <container.json>
+
+Print a compact summary of the container — title, description, affected
+products, CVSS, CWE, credits, references, and the x_generator engine.
+
+Useful as a quick sanity check before publish, or as a step in a pipeline
+('openjs-cna-experimental get CVE-... | openjs-cna-experimental preview -').
+
+Reads the container from a file (positional) or from stdin if the
+positional is '-' or absent.
+`
+  )
+}

package/components/publish.js

@@ -0,0 +1,238 @@
+// openjs-cna-experimental publish <cve-id> [-f record.json] [--skip-review] [--no-strict]
+// openjs-cna-experimental publish -f a.json -f b.json … [--skip-published] [--json]
+//
+// Single record: cross-checks the CLI <cve-id> against `record.cveMetadata.cveId`
+// if present (hard-error on mismatch); the CLI arg is the sole source of
+// truth when the record has none. Runs the reviewer (strict by default —
+// warnings block too). On a clean review (or `--skip-review`), prompts for
+// confirmation and publishes. Surfaces `correlation_id` + `run_id` after
+// publish so the operator can forward them to a CNA coordinator if needed.
+//
+// Batch (no <cve-id>, one or more -f): every record must carry
+// cveMetadata.cveId. All records are reviewed first and nothing is sent
+// unless all of them pass; then each one is published in order, a failure
+// is recorded and the rest still go out. One confirmation covers the whole
+// batch. --skip-published asks the CNA first and skips ids that already
+// have a published record, so reruns after a partial failure stay green.
+// --json prints one result per record on stdout. Exit code is 1 when the
+// review blocked or any record failed.
+
+import {
+  parseComponentArgs,
+  buildClient,
+  buildCli,
+  readFileOrStdin
+} from '../lib/component-utils.js'
+import { reviewRecord } from '../lib/review/index.js'
+import { publishRecords } from '../lib/batch.js'
+import { CnaReviewBlockedError } from '../lib/errors.js'
+
+export const command = 'publish'
+export const describe = 'Publish one or more v5.2 CVE Records for reserved CVE ids.'
+
+export async function handler (argv) {
+  const parsed = parseComponentArgs(argv, {
+    file: { type: 'string', short: 'f', multiple: true },
+    'skip-review': { type: 'boolean' },
+    'no-strict': { type: 'boolean' },
+    'skip-published': { type: 'boolean' }
+  }, { allowPositionals: true })
+  if (parsed.values.help) return printHelp()
+
+  const cveId = parsed.positionals[0]
+  const files = parsed.values.file ?? []
+  const strict = !parsed.values['no-strict']
+  const skipReview = parsed.values['skip-review']
+
+  if (!cveId) {
+    if (files.length === 0) {
+      process.stderr.write('✖ Missing CVE id. Usage: openjs-cna-experimental publish <CVE-...> -f record.json\n' +
+        '  or, for a batch: openjs-cna-experimental publish -f a.json -f b.json\n')
+      process.exit(64)
+    }
+    return publishMany(files, {
+      parsed, strict, skipReview, skipPublished: parsed.values['skip-published']
+    })
+  }
+  if (files.length > 1) {
+    process.stderr.write('✖ Several -f files need batch mode: drop the <cve-id> argument.\n')
+    process.exit(64)
+  }
+
+  const cli = buildCli(parsed)
+  const client = buildClient(parsed)
+  const record = await readRecord(files[0])
+
+  // CVE id consistency check. The Record's cveMetadata.cveId must match
+  // the CLI arg; mismatch is a hard error (operator was probably about to
+  // publish the wrong record). If cveMetadata is missing, the CLI arg is
+  // the sole source of truth.
+  const recordCveId = record?.cveMetadata?.cveId
+  if (recordCveId && recordCveId !== cveId) {
+    process.stderr.write(
+      `✖ CVE id mismatch: CLI argument is ${cveId}, record.cveMetadata.cveId is ${recordCveId}.\n` +
+      '  Aborting before publish to prevent updating the wrong record.\n'
+    )
+    process.exit(64)
+  }
+
+  // Extract the inner cna container — the workflow expects just that,
+  // not the full Record (it builds the Record server-side with the
+  // assignerOrgId and dateUpdated MITRE injects).
+  const container = record.containers.cna
+
+  if (!skipReview) {
+    const report = reviewRecord(record, { strict })
+    // Strict mode promotes warnings to blockers inside reviewRecord, so
+    // the `summary.blockers` count already reflects strictness. We just
+    // need to check that single number.
+    if (report.summary.blockers > 0) {
+      cli.error(
+        `Review blocked publish: ${report.summary.blockers} blocker(s)`
+      )
+      printIssues(cli, report.issues)
+      cli.log('')
+      cli.log('  Re-run with --skip-review to bypass.')
+      throw new CnaReviewBlockedError(
+        `Review blocked publish for ${cveId}`,
+        { report }
+      )
+    }
+    if (report.summary.warnings) {
+      cli.warn(`Review surfaced ${report.summary.warnings} warning(s); proceeding.`)
+    } else {
+      cli.ok(`Review clean (${report.summary.suggestions} suggestion(s)).`)
+    }
+  }
+
+  // Confirmation prompt. Defaults to "yes" only when the review was clean
+  // (and we got here without --skip-review). Honors --yes / OPENJS_CNA_YES.
+  const confirmed = await cli.prompt(
+    `Publish ${cveId}? This is irreversible.`,
+    { defaultAnswer: !skipReview }
+  )
+  if (!confirmed) {
+    cli.info('Aborted.')
+    return
+  }
+
+  cli.info(`Publishing ${cveId}…`)
+  const { correlationId, runId, result } = await client.publishCve(cveId, container, {
+    onPoll: (run) => {
+      if (run.status && run.status !== 'completed') cli.info(`run status: ${run.status}`)
+    }
+  })
+  cli.ok(`Published ${cveId}`)
+  if (correlationId || runId) {
+    cli.info(`Forward to coordinator if needed: correlation_id=${correlationId ?? '?'}, run_id=${runId ?? '?'}`)
+  }
+  if (result) process.stdout.write(JSON.stringify(result, null, 2) + '\n')
+}
+
+async function publishMany (files, { parsed, strict, skipReview, skipPublished }) {
+  const cli = buildCli(parsed)
+  const entries = []
+  for (const file of files) {
+    entries.push({ file, record: await readRecord(file) })
+  }
+
+  // The reviewer runs inside publishRecords too; this early pass exists so
+  // the operator sees the ids before confirming, and so a missing id is
+  // caught before credentials are even resolved.
+  const ids = entries.map((entry) => entry.record?.cveMetadata?.cveId ?? `${entry.file} (no cveMetadata.cveId)`)
+  cli.info(`Publishing ${entries.length} record(s): ${ids.join(', ')}`)
+  const confirmed = await cli.prompt(
+    `Publish ${entries.length} record(s)? This is irreversible.`,
+    { defaultAnswer: !skipReview }
+  )
+  if (!confirmed) {
+    cli.info('Aborted.')
+    return
+  }
+
+  const client = buildClient(parsed)
+  const outcome = await publishRecords(entries, {
+    client,
+    strict,
+    skipReview,
+    skipPublished,
+    onProgress: (event) => {
+      const trace = traceOf(event)
+      if (event.status === 'published') cli.ok(`Published ${event.cveId}${trace}`)
+      else if (event.status === 'skipped') cli.info(`Skipped ${event.cveId}: ${event.reason}`)
+      else cli.error(`Failed ${event.cveId}: ${event.error}${trace}`)
+    }
+  })
+
+  if (outcome.blocked) {
+    const blocked = outcome.review.filter((item) => !item.ready)
+    cli.error(`Review blocked publish: ${blocked.length} of ${outcome.review.length} record(s) have blockers. Nothing was sent.`)
+    for (const item of blocked) {
+      cli.log(`  ${item.file}${item.cveId ? ` (${item.cveId})` : ''}`)
+      printIssues(cli, item.issues.filter((issue) => issue.severity === 'blocker'), '    ')
+    }
+    if (parsed.values.json) process.stdout.write(JSON.stringify(outcome.review, null, 2) + '\n')
+    process.exit(1)
+  }
+
+  if (parsed.values.json) process.stdout.write(JSON.stringify(outcome.results, null, 2) + '\n')
+  const failed = outcome.results.filter((item) => item.status === 'failed')
+  const published = outcome.results.filter((item) => item.status === 'published').length
+  const skipped = outcome.results.filter((item) => item.status === 'skipped').length
+  cli.log('')
+  cli.info(`${published} published · ${skipped} skipped · ${failed.length} failed`)
+  if (failed.length) {
+    cli.info('Forward the correlation_id / run_id pairs above to your CNA coordinator.')
+    process.exit(1)
+  }
+}
+
+function traceOf (event) {
+  const parts = []
+  if (event.correlationId) parts.push(`correlation_id=${event.correlationId}`)
+  if (event.runId) parts.push(`run_id=${event.runId}`)
+  return parts.length ? ` (${parts.join(', ')})` : ''
+}
+
+function printIssues (cli, issues, indent = '  ') {
+  for (const issue of issues) {
+    const tag = issue.severity === 'blocker' ? '✖' : issue.severity === 'warning' ? '⚠' : '·'
+    cli.log(`${indent}${tag} [${issue.rule}] ${issue.message}`)
+  }
+}
+
+async function readRecord (file) {
+  const raw = await readFileOrStdin(file)
+  try {
+    return JSON.parse(raw)
+  } catch (e) {
+    process.stderr.write(`✖ ${file ?? 'stdin'} is not valid JSON: ${e.message}\n`)
+    process.exit(64)
+  }
+}
+
+function printHelp () {
+  process.stderr.write(
+`openjs-cna-experimental publish <cve-id> [-f record.json]
+openjs-cna-experimental publish -f a.json -f b.json … [--skip-published]
+
+Publish v5.2 CVE Records against already-reserved CVE ids. Default
+behavior runs the reviewer first (strict — warnings block too) and aborts
+on any issue.
+
+Without <cve-id> every -f record is published as a batch: each record must
+carry cveMetadata.cveId, all records are reviewed before anything is sent,
+then each is published in order (a failure does not stop the others). One
+confirmation covers the batch. Exit code is 1 if the review blocked or any
+record failed.
+
+Options:
+  -f, --file <path>     read a record from a file (default: stdin); repeatable
+  --skip-review         do not run the reviewer
+  --no-strict           let warnings pass through (only true blockers abort)
+  --skip-published      batch only: skip ids the CNA already has published
+  --json                batch only: print one result per record on stdout
+  [global flags]
+`
+  )
+}

package/components/reserve.js

@@ -0,0 +1,48 @@
+// openjs-cna-experimental reserve
+// Reserves a CVE id via the CNA API and prints it on stdout.
+
+import { parseComponentArgs, buildClient, buildCli } from '../lib/component-utils.js'
+
+export const command = 'reserve'
+export const describe = 'Reserve a CVE id via the OpenJS Foundation CNA.'
+
+export async function handler (argv) {
+  const parsed = parseComponentArgs(argv)
+  if (parsed.values.help) return printHelp()
+  const cli = buildCli(parsed)
+  const client = buildClient(parsed)
+
+  cli.info('Reserving CVE…')
+  const { cveId, correlationId, runId } = await client.reserveCve({
+    onPoll: (run) => {
+      if (run.status && run.status !== 'completed') {
+        // Honest progress — one line per poll cycle, no animation.
+        cli.info(`run status: ${run.status}`)
+      }
+    }
+  })
+  cli.ok(`Reserved ${cveId}`)
+  if (correlationId || runId) {
+    cli.info(`Forward to coordinator if needed: correlation_id=${correlationId ?? '?'}, run_id=${runId ?? '?'}`)
+  }
+
+  // Data on stdout, no decoration — `CVE=$(openjs-cna-experimental reserve)` Just Works.
+  process.stdout.write(`${cveId}\n`)
+}
+
+function printHelp () {
+  process.stderr.write(
+`openjs-cna-experimental reserve
+
+Reserve a CVE id from the configured bucket. Prints the CVE id on stdout
+once the workflow completes.
+
+Usage:
+  openjs-cna-experimental reserve [global flags]
+
+Example:
+  CVE=$(openjs-cna-experimental reserve)
+  openjs-cna-experimental publish "$CVE" -f container.json
+`
+  )
+}

package/components/review.js

@@ -0,0 +1,170 @@
+// openjs-cna-experimental review <record.json> [<record.json>…] [--no-strict] [--no-preview] [--tier <name>] [--json]
+//
+// Runs the offline reviewer against one or more CVE Records. Strict by
+// default (warnings block); --no-strict surfaces them as warnings. Renders
+// the preview before the issues list unless --no-preview. --tier filters
+// the printed issues to a single severity tier (mitre-common / openjs-extra)
+// without changing the exit code, which always reflects the full review.
+//
+// With several files every record is reviewed (no early stop), each block
+// is headed by the file and CVE id, --json emits an array, and the exit
+// code is 1 when any record has a blocker. A record without
+// cveMetadata.cveId is a blocker in batch mode, since batch publish needs
+// the id from the record.
+
+import { parseComponentArgs, buildCli, readFileOrStdin } from '../lib/component-utils.js'
+import { reviewRecord } from '../lib/review/index.js'
+import { reviewRecords } from '../lib/batch.js'
+import { renderPreview } from '../lib/preview.js'
+
+export const command = 'review'
+export const describe = 'Review one or more v5.2 CVE Records against best-practice rules.'
+
+const VALID_TIERS = new Set(['mitre-common', 'openjs-extra'])
+
+export async function handler (argv) {
+  const parsed = parseComponentArgs(argv, {
+    'no-strict': { type: 'boolean' },
+    'no-preview': { type: 'boolean' },
+    tier: { type: 'string' }
+  }, { allowPositionals: true })
+  if (parsed.values.help) return printHelp()
+
+  const cli = buildCli(parsed)
+  const files = parsed.positionals
+
+  // Validate the --tier filter early so a typo doesn't silently match
+  // nothing and look like a clean review.
+  const tierFilter = parsed.values.tier
+  if (tierFilter && !VALID_TIERS.has(tierFilter)) {
+    process.stderr.write(
+      `✖ Unknown --tier '${tierFilter}'. Expected one of: ${[...VALID_TIERS].join(', ')}\n`
+    )
+    process.exit(64)
+  }
+
+  const strict = !parsed.values['no-strict']
+  const showPreview = !parsed.values['no-preview']
+
+  if (files.length > 1) {
+    return reviewMany(files, { cli, strict, showPreview, tierFilter, json: parsed.values.json })
+  }
+
+  const container = await readRecord(files[0])
+  const report = reviewRecord(container, { strict })
+
+  if (parsed.values.json) {
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n')
+  } else {
+    // Preview goes first so the operator sees what they're about to ship
+    // alongside what the reviewer caught. --no-preview drops it for
+    // CI / pipeline use.
+    if (showPreview) renderPreview(container, cli)
+    printHumanReport(cli, report, { tierFilter })
+  }
+
+  // Exit code: 0 if ready, 1 if blockers (or strict + warnings).
+  if (report.summary.blockers > 0) process.exit(1)
+}
+
+async function reviewMany (files, { cli, strict, showPreview, tierFilter, json }) {
+  const entries = []
+  for (const file of files) {
+    entries.push({ file, record: await readRecord(file) })
+  }
+  const review = reviewRecords(entries, { strict })
+
+  if (json) {
+    process.stdout.write(JSON.stringify(review, null, 2) + '\n')
+  } else {
+    review.forEach((item, index) => {
+      cli.log('')
+      cli.log(`── ${item.file}${item.cveId ? ` (${item.cveId})` : ''}`)
+      if (showPreview) renderPreview(entries[index].record, cli)
+      printHumanReport(cli, item, { tierFilter })
+    })
+    const blocked = review.filter((item) => !item.ready).length
+    cli.log('')
+    if (blocked) {
+      cli.error(`${blocked} of ${review.length} record(s) blocked`)
+    } else {
+      cli.ok(`${review.length} record(s) ready`)
+    }
+  }
+
+  if (review.some((item) => !item.ready)) process.exit(1)
+}
+
+async function readRecord (file) {
+  const raw = await readFileOrStdin(file)
+  try {
+    return JSON.parse(raw)
+  } catch (e) {
+    process.stderr.write(`✖ ${file ?? 'stdin'} is not valid JSON: ${e.message}\n`)
+    process.exit(64)
+  }
+}
+
+function printHumanReport (cli, report, { tierFilter } = {}) {
+  const { summary, issues } = report
+  const ratingLabel = {
+    ready: '✔ ready',
+    'needs-work': '⚠ needs work',
+    blocked: '✖ blocked'
+  }[summary.rating]
+  cli.log('')
+  cli.log(`Review: ${ratingLabel}`)
+  cli.log(`  ${summary.blockers} blocker(s) · ${summary.warnings} warning(s) · ${summary.suggestions} suggestion(s)`)
+  if (tierFilter) {
+    cli.log(`  (filtered to tier: ${tierFilter})`)
+  }
+  cli.log('')
+  // Filter at print time so the summary counts above still reflect the full
+  // review. This keeps `--tier mitre-common` from hiding the broader picture
+  // while still letting operators focus on the must-fix items.
+  const shown = tierFilter
+    ? issues.filter(i => i.tier === tierFilter)
+    : issues
+  if (shown.length === 0) {
+    if (tierFilter && issues.length > 0) {
+      cli.log(`  No ${tierFilter} issues found.`)
+    } else {
+      cli.log('  No issues found.')
+    }
+    return
+  }
+  for (const issue of shown) {
+    const tag = issue.severity === 'blocker'
+      ? '✖'
+      : issue.severity === 'warning'
+        ? '⚠'
+        : '·'
+    // Tier rides inline with the rule id so a glance at the report tells
+    // the operator whether MITRE would have caught the issue too.
+    const tierLabel = issue.tier ? `${issue.tier}: ` : ''
+    cli.log(`  ${tag} [${tierLabel}${issue.rule}] ${issue.path}`)
+    cli.log(`      ${issue.message}`)
+  }
+}
+
+function printHelp () {
+  process.stderr.write(
+`openjs-cna-experimental review <record.json> [<record.json>…]
+
+Run the offline reviewer against one or more CVE Records. Strict by
+default — warnings are treated as blockers because publishing to MITRE is
+irreversible. Pass --no-strict to surface warnings as warnings.
+
+With several files every record is reviewed, --json emits an array with
+one entry per file, and the exit code is 1 when any record has a blocker.
+
+Options:
+  --no-strict        surface warnings as warnings (default treats them as blockers)
+  --json             emit a structured JSON report instead of the human view
+  --no-preview       skip the record preview (for CI / pipelines)
+  --tier <tier>      filter the printed issue list to a single tier
+                     (mitre-common | openjs-extra). Summary counts still
+                     reflect the full review; exit code is unaffected.
+`
+  )
+}