@ulisesgascon/openjs-cna-tools 0.0.0-stage → 1.0.0-alpha.3

package/components/update.js

@@ -0,0 +1,104 @@
+// openjs-cna-experimental update <cve-id> [-f container.json] [--skip-review] [--no-strict]
+//
+// Same shape as `publish`, but issues the update-cve operation. Same
+// cveMetadata.cveId cross-check, same strict-by-default reviewer, same
+// correlation_id + run_id surfacing on success.
+
+import {
+  parseComponentArgs,
+  buildClient,
+  buildCli,
+  readFileOrStdin
+} from '../lib/component-utils.js'
+import { reviewRecord } from '../lib/review/index.js'
+import { CnaReviewBlockedError } from '../lib/errors.js'
+
+export const command = 'update'
+export const describe = 'Update an already-published CVE record.'
+
+export async function handler (argv) {
+  const parsed = parseComponentArgs(argv, {
+    file: { type: 'string', short: 'f' },
+    'skip-review': { type: 'boolean' },
+    'no-strict': { type: 'boolean' }
+  }, { allowPositionals: true })
+  if (parsed.values.help) return printHelp()
+
+  const cveId = parsed.positionals[0]
+  if (!cveId) {
+    process.stderr.write('✖ Missing CVE id. Usage: openjs-cna-experimental update <CVE-...> -f container.json\n')
+    process.exit(64)
+  }
+
+  const cli = buildCli(parsed)
+  const client = buildClient(parsed)
+
+  const raw = await readFileOrStdin(parsed.values.file)
+  let record
+  try {
+    record = JSON.parse(raw)
+  } catch (e) {
+    process.stderr.write(`✖ File is not valid JSON: ${e.message}\n`)
+    process.exit(64)
+  }
+
+  // CVE id consistency check (same logic as publish).
+  const recordCveId = record?.cveMetadata?.cveId
+  if (recordCveId && recordCveId !== cveId) {
+    process.stderr.write(
+      `✖ CVE id mismatch: CLI argument is ${cveId}, record.cveMetadata.cveId is ${recordCveId}.\n` +
+      '  Aborting before update to prevent overwriting the wrong record.\n'
+    )
+    process.exit(64)
+  }
+
+  // Workflow expects just the inner cna container.
+  const container = record.containers.cna
+
+  if (!parsed.values['skip-review']) {
+    const strict = !parsed.values['no-strict']
+    const report = reviewRecord(record, { strict })
+    if (report.summary.blockers > 0) {
+      cli.error(`Review blocked update: ${report.summary.blockers} blocker(s)`)
+      for (const issue of report.issues) {
+        const tag = issue.severity === 'blocker' ? '✖' : '⚠'
+        cli.log(`  ${tag} [${issue.rule}] ${issue.message}`)
+      }
+      throw new CnaReviewBlockedError(`Review blocked update for ${cveId}`, { report })
+    }
+    cli.ok('Review clean.')
+  }
+
+  const confirmed = await cli.prompt(
+    `Update ${cveId}? This will replace the public MITRE record.`,
+    { defaultAnswer: !parsed.values['skip-review'] }
+  )
+  if (!confirmed) {
+    cli.info('Aborted.')
+    return
+  }
+
+  cli.info(`Updating ${cveId}…`)
+  const { correlationId, runId } = await client.updateCve(cveId, container, {
+    onPoll: (run) => { if (run.status !== 'completed') cli.info(`run status: ${run.status}`) }
+  })
+  cli.ok(`Updated ${cveId}`)
+  if (correlationId || runId) {
+    cli.info(`Forward to coordinator if needed: correlation_id=${correlationId ?? '?'}, run_id=${runId ?? '?'}`)
+  }
+}
+
+function printHelp () {
+  process.stderr.write(
+`openjs-cna-experimental update <cve-id> [-f container.json]
+
+Update a published CVE record. Same review semantics as publish (strict
+by default — warnings block too).
+
+Options:
+  -f, --file <path>     read the container from a file (default: stdin)
+  --skip-review         do not run the reviewer
+  --no-strict           let warnings pass through (only true blockers abort)
+`
+  )
+}

package/lib/auth.js

@@ -0,0 +1,20 @@
+// Resolve token + base URL from the precedence chain (flags > env > project >
+// global) and feed them to a CnaClient.
+//
+// The CLI passes any explicit --token / --base-url flags as `overrides`.
+// Everything else comes from the merged config (see ./config.js).
+//
+// Validation here is permissive: we surface what we have, the CnaClient
+// throws lazy CnaAuthError on the first operation that actually needs a
+// credential. That keeps `openjs-cna-experimental --help` and `openjs-cna-experimental config list`
+// usable without any auth at all.
+
+import { getMergedConfig } from './config.js'
+
+export function resolveCredentials ({ overrides = {}, cwd } = {}) {
+  const config = getMergedConfig({ cwd })
+  return {
+    token: overrides.token ?? config.openjs_cna_token,
+    baseUrl: overrides.baseUrl ?? config.openjs_cna_base_url
+  }
+}

package/lib/batch.js

@@ -0,0 +1,141 @@
+// Review and publish several CVE Records in one go.
+//
+// This is the "all or none" flow a release pipeline wants: every record is
+// reviewed first and nothing is sent unless all of them pass. Publication
+// itself is best effort per record, since MITRE has no batch operation and
+// the records are independent; a failed id is reported and the rest still
+// go out. `--skip-published` style reruns are supported by asking the CNA
+// whether an id already has a published container before sending it.
+//
+// Both functions take `entries`: an array of `{ record, file? }` where
+// `record` is a full v5.2 CVE Record (`containers.cna` plus `cveMetadata`)
+// and `file` is only used to label output. The CLI `review` and `publish`
+// commands are thin wrappers over them.
+
+import { reviewRecord } from './review/index.js'
+import { CnaOperationError } from './errors.js'
+
+function labelOf (entry) {
+  return entry.record?.cveMetadata?.cveId ?? entry.file ?? '<record>'
+}
+
+/**
+ * Review every entry. Never stops early, so the caller sees all problems at
+ * once. A record without `cveMetadata.cveId` gets an extra blocker: in a
+ * batch there is no CLI argument to fall back on for the id.
+ *
+ * Returns `[{ file, cveId, ready, summary, issues }]` in input order.
+ */
+export function reviewRecords (entries, { strict = true } = {}) {
+  return entries.map((entry) => {
+    const report = reviewRecord(entry.record, { strict })
+    const cveId = entry.record?.cveMetadata?.cveId
+    const issues = [...report.issues]
+    const summary = { ...report.summary }
+    if (!cveId) {
+      issues.unshift({
+        rule: 'cve-id-present',
+        tier: 'mitre-common',
+        severity: 'blocker',
+        path: 'cveMetadata.cveId',
+        message: 'Record carries no cveMetadata.cveId; batch publish needs one per record'
+      })
+      summary.blockers += 1
+      summary.rating = 'blocked'
+    }
+    return {
+      file: entry.file,
+      cveId,
+      ready: summary.blockers === 0,
+      summary,
+      issues
+    }
+  })
+}
+
+// `getCve` resolves with the container when MITRE has a published record.
+// For a RESERVED id there is nothing to fetch and the CNA either fails the
+// run or completes it with an empty result; neither is pinned down, so
+// only positive evidence counts: an operational failure, or a result that
+// does not look like a record, means "not published" and the id is sent.
+// Erring towards publishing is the safe side, since the CNA rejects a
+// second publish loudly while a wrong skip would exit 0 having sent
+// nothing. Auth and timeout errors propagate so a broken setup does not
+// look like a clean slate.
+async function isPublished (client, cveId) {
+  let result
+  try {
+    result = await client.getCve(cveId)
+  } catch (error) {
+    if (error instanceof CnaOperationError) return false
+    throw error
+  }
+  const cna = result?.containers?.cna ?? result
+  return result?.cveMetadata?.state === 'PUBLISHED' ||
+    Array.isArray(cna?.descriptions) ||
+    Array.isArray(cna?.affected)
+}
+
+/**
+ * Review every entry, then publish each one through `client.publishCve`.
+ *
+ * Options:
+ *   client        — a CnaClient (required unless every record is skipped)
+ *   strict        — reviewer strictness (default true, warnings block)
+ *   skipReview    — publish without reviewing (discouraged)
+ *   skipPublished — ask the CNA first and skip ids already published
+ *   onProgress    — called with `{ phase, cveId, file, status, ... }` as
+ *                   each step completes, for CLI progress lines
+ *
+ * Returns `{ blocked, review, results }`. When `blocked` is true the review
+ * found blockers, `results` is empty and nothing was sent. Otherwise
+ * `results` has one `{ file, cveId, status, ... }` per entry, with status
+ * `published`, `skipped` or `failed`, plus `correlationId` / `runId` when
+ * the CNA returned them and `error` for failures.
+ */
+export async function publishRecords (entries, {
+  client,
+  strict = true,
+  skipReview = false,
+  skipPublished = false,
+  onProgress = () => {}
+} = {}) {
+  const review = skipReview ? [] : reviewRecords(entries, { strict })
+  if (review.some((item) => !item.ready)) {
+    return { blocked: true, review, results: [] }
+  }
+  if (skipReview && entries.some((entry) => !entry.record?.cveMetadata?.cveId)) {
+    throw new Error('Every record needs cveMetadata.cveId to be published in a batch')
+  }
+
+  const results = []
+  for (const entry of entries) {
+    const cveId = labelOf(entry)
+    const base = { file: entry.file, cveId }
+    let result
+    if (skipPublished && await isPublished(client, cveId)) {
+      result = { ...base, status: 'skipped', reason: 'already published' }
+    } else {
+      try {
+        const response = await client.publishCve(cveId, entry.record.containers.cna)
+        result = {
+          ...base,
+          status: 'published',
+          correlationId: response.correlationId,
+          runId: response.runId
+        }
+      } catch (error) {
+        result = {
+          ...base,
+          status: 'failed',
+          error: error.message,
+          correlationId: error.correlationId,
+          runId: error.runId
+        }
+      }
+    }
+    results.push(result)
+    onProgress({ phase: 'publish', ...result })
+  }
+  return { blocked: false, review, results }
+}

package/lib/cli.js

@@ -0,0 +1,81 @@
+// Minimal CLI: a stream wrapper, four log levels, a non-animated spinner,
+// and a confirm/input prompt. Zero deps — ANSI escapes inline, gated by
+// stream.isTTY so piped output stays clean.
+//
+// Output discipline: this class always writes to its `stream` (defaulting
+// to stderr). The CLI verbs are responsible for writing data (CVE ids,
+// JSON records) to stdout directly. That keeps `CVE=$(openjs-cna-experimental reserve)`
+// pipeline-safe by construction.
+
+const ANSI = {
+  reset: '\x1b[0m',
+  bold: '\x1b[1m',
+  red: '\x1b[31m',
+  yellow: '\x1b[33m',
+  green: '\x1b[32m',
+  blue: '\x1b[34m',
+  gray: '\x1b[90m'
+}
+
+export class CLI {
+  constructor (stream = process.stderr, { color, assumeYes } = {}) {
+    this.stream = stream
+    // Default to color when stderr is a TTY and the user didn't opt out.
+    this.color = color ?? (stream.isTTY === true && !process.env.NO_COLOR)
+    this.assumeYes = assumeYes ?? false
+    this._exitCode = 0
+  }
+
+  setAssumeYes (value = true) { this.assumeYes = value }
+  setExitCode (code) { this._exitCode = code }
+  exitCode () { return this._exitCode }
+
+  _paint (code, text) { return this.color ? `${code}${text}${ANSI.reset}` : text }
+  _write (line) { this.stream.write(line + '\n') }
+
+  // Severity-leveled log lines. Match NCU's vocabulary (ok / info / warn /
+  // error) so a developer moving between the two codebases doesn't have to
+  // re-learn the lexicon.
+  ok (msg) { this._write(this._paint(ANSI.green, '✔ ') + msg) }
+  info (msg) { this._write(this._paint(ANSI.blue, 'ℹ ') + msg) }
+  warn (msg) { this._write(this._paint(ANSI.yellow, '⚠ ') + msg) }
+  error (msg) { this._write(this._paint(ANSI.red, '✖ ') + msg) }
+  log (msg) { this._write(msg) }
+  separator () { this._write('') }
+
+  // Non-animated spinner replacement. Prints a "starting…" line on start
+  // and a "done" line on stop. Honest about progress without leaning on
+  // ora's TTY animation. Future: rewrite-in-place when stream.isTTY, fall
+  // back to discrete lines when piped.
+  startSpinner (text) {
+    this._write(this._paint(ANSI.gray, '… ') + text)
+    return { stop: () => {} }
+  }
+
+  stopSpinner (text) {
+    if (text) this._write(this._paint(ANSI.green, '✔ ') + text)
+  }
+
+  // Confirm or input prompt. Honors --yes (or assumeYes flag) by returning
+  // the defaultAnswer without rendering. Non-TTY stdin also defaults to
+  // the default so the CLI is safe to drive from CI without explicit --yes.
+  async prompt (question, { defaultAnswer = false, questionType = 'confirm' } = {}) {
+    if (this.assumeYes) return defaultAnswer
+    if (!process.stdin.isTTY) return defaultAnswer
+    const { createInterface } = await import('node:readline/promises')
+    const rl = createInterface({ input: process.stdin, output: this.stream })
+    try {
+      const hint = questionType === 'confirm'
+        ? (defaultAnswer ? '[Y/n]' : '[y/N]')
+        : ''
+      const raw = (await rl.question(`${question} ${hint} `.trimEnd() + ' ')).trim()
+      if (questionType === 'confirm') {
+        if (!raw) return defaultAnswer
+        return /^y(es)?$/i.test(raw)
+      }
+      return raw || defaultAnswer
+    } finally {
+      rl.close()
+    }
+  }
+}

package/lib/client.js

@@ -0,0 +1,244 @@
+// CnaClient — the transport layer for the OpenJS Foundation CNA API.
+//
+// The CNA API is a thin edge in front of a `workflow_dispatch`-backed GitHub
+// Actions workflow. POST /dispatch returns a Worker-minted correlation_id;
+// GET /runs/{id} polls the backing run and, once it completes, returns the
+// operation's structured result extracted from the job log.
+//
+// Two layers:
+//
+//   * High-level methods (`reserveCve`, `publishCve`, `getCve`, `listCves`,
+//     `updateCve`, `health`) dispatch, wait for completion, throw on failure,
+//     and return the operation result.
+//
+//   * Low-level methods (`dispatch`, `poll`, `waitForCompletion`) expose the
+//     three primitives for callers that want to bridge polling externally
+//     (UIs, queues, retries, custom progress reporting).
+//
+// The constructor is non-allocating — no network, no fs, no subprocess. Token
+// and base-url validation is deferred until the first operation (the
+// self-replacing-getter pattern from node-core-utils).
+
+import { createRequire } from 'node:module'
+import {
+  CnaAuthError,
+  CnaTimeoutError,
+  CnaOperationError
+} from './errors.js'
+
+const require = createRequire(import.meta.url)
+const pkg = require('../package.json')
+
+// Single identity string used as the User-Agent on every outbound HTTP
+// request AND as `cna.x_generator.engine` on every container we publish.
+// Pinning both to the same string means a downstream reader of a CVE
+// record can find the exact `openjs-cna-tools <version>` that produced
+// the call.
+export const USER_AGENT = `${pkg.name} ${pkg.version}`
+
+const DEFAULT_TIMEOUT_MS = 600_000 // 10 minutes; matches NCU's choice
+const DEFAULT_POLL_INTERVAL_MS = 5_000
+
+export class CnaClient {
+  constructor ({ token, baseUrl, timeoutMs, pollIntervalMs, fetch: fetchImpl } = {}) {
+    this._token = token
+    this._baseUrl = baseUrl
+    this._timeoutMs = timeoutMs ?? DEFAULT_TIMEOUT_MS
+    this._pollIntervalMs = pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS
+    // Injectable for tests; defaults to the runtime's global fetch.
+    this._fetch = fetchImpl ?? globalThis.fetch
+  }
+
+  // Lazy validation. Reading `client.token` once is the only time we check
+  // the configuration. Re-reads pay no cost; missing-token failures throw at
+  // the exact moment the caller is about to make a network call, which is
+  // also the moment the operator can act on the error.
+  get token () {
+    if (!this._token) {
+      throw new CnaAuthError(
+        'OPENJS_CNA_TOKEN is not configured. Run:\n' +
+        '  openjs-cna-experimental config set -x openjs_cna_token "<bucket>:<hex-secret>"\n' +
+        'or pass --token / set OPENJS_CNA_TOKEN in the environment.'
+      )
+    }
+    return this._token
+  }
+
+  get baseUrl () {
+    if (!this._baseUrl) {
+      throw new CnaAuthError(
+        'OPENJS_CNA_BASE_URL is not configured. Run:\n' +
+        '  openjs-cna-experimental config set openjs_cna_base_url "https://cna.openjsf.org"\n' +
+        'or pass --base-url / set OPENJS_CNA_BASE_URL in the environment.'
+      )
+    }
+    return this._baseUrl.replace(/\/$/, '')
+  }
+
+  _authHeaders () {
+    return {
+      Authorization: `Bearer ${this.token}`,
+      Accept: 'application/json',
+      'User-Agent': USER_AGENT
+    }
+  }
+
+  // Unauthenticated liveness probe. Useful for `openjs-cna-experimental health` and for
+  // catching base-url misconfiguration without burning a workflow dispatch.
+  async health () {
+    const res = await this._fetch(`${this.baseUrl}/health`, {
+      headers: { 'User-Agent': USER_AGENT }
+    })
+    if (!res.ok) {
+      throw new CnaOperationError(`Health check failed: ${res.status} ${res.statusText}`)
+    }
+    return res.json()
+  }
+
+  // Low-level: POST /dispatch. Returns { correlation_id, status } from the
+  // Worker. Throws CnaAuthError on 401 so the CLI can map to exit 2.
+  async dispatch (operation, inputs = {}) {
+    const res = await this._fetch(`${this.baseUrl}/dispatch`, {
+      method: 'POST',
+      headers: { ...this._authHeaders(), 'Content-Type': 'application/json' },
+      body: JSON.stringify({ operation, inputs })
+    })
+    if (res.status === 401) {
+      throw new CnaAuthError(
+        'The CNA API rejected the bearer token (401). Check that ' +
+        '`openjs_cna_token` matches the bucket your CNA coordinator provisioned.',
+        { status: 401 }
+      )
+    }
+    let body
+    try {
+      body = await res.json()
+    } catch (e) {
+      throw new CnaOperationError(
+        `Dispatch returned non-JSON response (${res.status}): ${e.message}`
+      )
+    }
+    if (body?.error) {
+      throw new CnaOperationError(`Dispatch failed (${operation}): ${body.error}`)
+    }
+    return body
+  }
+
+  // Low-level: GET /runs/{id}. Returns the run object, possibly with a
+  // `result` field when the workflow has completed successfully.
+  async poll (correlationId) {
+    const res = await this._fetch(`${this.baseUrl}/runs/${correlationId}`, {
+      headers: this._authHeaders()
+    })
+    if (res.status === 401) {
+      throw new CnaAuthError('CNA API rejected the bearer token (401)', { status: 401 })
+    }
+    // 502 run_result_unavailable: completed+success but the Worker could not
+    // extract the marker block. Surface as an operation error with the run
+    // metadata still attached so the CLI can suggest `openjs-cna-experimental runs <id>`.
+    if (res.status === 502) {
+      const body = await res.json().catch(() => ({}))
+      throw new CnaOperationError(
+        body?.message ?? `CNA API returned 502 for run ${correlationId}`,
+        {
+          correlationId,
+          runId: body?.run_id
+        }
+      )
+    }
+    return res.json()
+  }
+
+  // Poll until the run completes. Throws on timeout, on a non-success
+  // conclusion, or on AbortSignal cancellation. `onPoll` lets callers update
+  // a progress UI without owning the polling loop.
+  async waitForCompletion (correlationId, opts = {}) {
+    const {
+      timeoutMs = this._timeoutMs,
+      intervalMs = this._pollIntervalMs,
+      signal,
+      onPoll
+    } = opts
+    const deadline = Date.now() + timeoutMs
+    while (Date.now() < deadline) {
+      if (signal?.aborted) throw new DOMException('aborted', 'AbortError')
+      const run = await this.poll(correlationId)
+      if (typeof onPoll === 'function') onPoll(run)
+      if (run.status === 'completed') {
+        if (run.conclusion !== 'success') {
+          throw new CnaOperationError(
+            `Run ${correlationId} concluded with '${run.conclusion}'. ` +
+            'Forward correlation_id and run_id to your CNA coordinator for inspection.',
+            {
+              correlationId,
+              runId: run.run_id,
+              conclusion: run.conclusion,
+              result: run.result
+            }
+          )
+        }
+        return run
+      }
+      await new Promise(resolve => setTimeout(resolve, intervalMs))
+    }
+    throw new CnaTimeoutError(
+      `Run ${correlationId} did not complete within ${timeoutMs}ms`,
+      { correlationId, timeoutMs }
+    )
+  }
+
+  // Internal: dispatch + wait. Every high-level method funnels through here.
+  async _runAndWait (operation, inputs, opts) {
+    const dispatched = await this.dispatch(operation, inputs)
+    const run = await this.waitForCompletion(dispatched.correlation_id, opts)
+    return { ...run, correlationId: dispatched.correlation_id }
+  }
+
+  // ----- High-level operations -----
+
+  async reserveCve (opts = {}) {
+    const run = await this._runAndWait('reserve-cve', {}, opts)
+    const cveId = run.result?.cve_id
+    if (!cveId) {
+      throw new CnaOperationError(
+        'reserve-cve completed but no cve_id in the result. ' +
+        'Forward correlation_id and run_id to your CNA coordinator.',
+        {
+          correlationId: run.correlationId,
+          runId: run.run_id,
+          result: run.result
+        }
+      )
+    }
+    return { cveId, correlationId: run.correlationId, runId: run.run_id, run }
+  }
+
+  async publishCve (cveId, container, opts = {}) {
+    const run = await this._runAndWait('publish-cve', {
+      cve_id: cveId,
+      cnaContainer: container
+    }, opts)
+    return { correlationId: run.correlationId, runId: run.run_id, run, result: run.result }
+  }
+
+  async updateCve (cveId, container, opts = {}) {
+    const run = await this._runAndWait('update-cve', {
+      cve_id: cveId,
+      cnaContainer: container
+    }, opts)
+    return { correlationId: run.correlationId, runId: run.run_id, run, result: run.result }
+  }
+
+  async getCve (cveId, opts = {}) {
+    const run = await this._runAndWait('get-cve', { cve_id: cveId }, opts)
+    return run.result
+  }
+
+  async listCves (opts = {}) {
+    const run = await this._runAndWait('list-cve', {}, opts)
+    // Two acceptable result shapes:
+    //   * { cve_ids: [...] }  — what the workflow currently emits
+    //   * [ ... ]              — direct array, in case the API evolves
+    return run.result?.cve_ids ?? (Array.isArray(run.result) ? run.result : [])
+  }
+}

package/lib/component-utils.js

@@ -0,0 +1,74 @@
+// Shared bootstrap for CLI components.
+//
+// Every component runs the same opening sequence: parse argv (mixing global
+// flags with its own), resolve credentials, build a CLI + CnaClient. This
+// module factors that out so each component file in components/ can stay
+// at ~30 lines.
+
+import { parseArgs } from 'node:util'
+import { CLI } from './cli.js'
+import { CnaClient } from './client.js'
+import { resolveCredentials } from './auth.js'
+
+const GLOBAL_OPTIONS = {
+  token: { type: 'string' },
+  'base-url': { type: 'string' },
+  timeout: { type: 'string' },
+  'poll-interval': { type: 'string' },
+  json: { type: 'boolean' },
+  quiet: { type: 'boolean' },
+  yes: { type: 'boolean', short: 'y' },
+  'no-color': { type: 'boolean' },
+  help: { type: 'boolean', short: 'h' }
+}
+
+export function parseComponentArgs (argv, componentOptions = {}, { allowPositionals = false } = {}) {
+  const options = { ...GLOBAL_OPTIONS, ...componentOptions }
+  let parsed
+  try {
+    parsed = parseArgs({ args: argv, options, allowPositionals })
+  } catch (e) {
+    process.stderr.write(`✖ ${e.message}\n`)
+    process.exit(64) // EX_USAGE
+  }
+  return parsed
+}
+
+export function buildCli ({ values } = { values: {} }) {
+  return new CLI(process.stderr, {
+    color: values['no-color'] ? false : undefined,
+    assumeYes: values.yes || process.env.OPENJS_CNA_YES === '1'
+  })
+}
+
+export function buildClient ({ values } = { values: {} }) {
+  const creds = resolveCredentials({
+    overrides: {
+      token: values.token,
+      baseUrl: values['base-url']
+    }
+  })
+  return new CnaClient({
+    token: creds.token,
+    baseUrl: creds.baseUrl,
+    timeoutMs: values.timeout ? Number(values.timeout) * 1000 : undefined,
+    pollIntervalMs: values['poll-interval'] ? Number(values['poll-interval']) * 1000 : undefined
+  })
+}
+
+// Convenience: read a file or stdin to text. Used by publish/update/review/
+// convert when -f is omitted.
+export async function readFileOrStdin (filePath) {
+  const fs = await import('node:fs/promises')
+  if (filePath && filePath !== '-') {
+    return fs.readFile(filePath, 'utf8')
+  }
+  // Read all of stdin.
+  return new Promise((resolve, reject) => {
+    let data = ''
+    process.stdin.setEncoding('utf8')
+    process.stdin.on('data', (chunk) => { data += chunk })
+    process.stdin.on('end', () => resolve(data))
+    process.stdin.on('error', reject)
+  })
+}