cve.now 0.0.1 → 0.1.0

package/cli.js

@@ -0,0 +1,1574 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { parseArgs } from "node:util";
+// package.json
+var package_default = {
+  name: "@sazabi/cve-now-cli",
+  version: "0.1.0",
+  private: true,
+  type: "module",
+  description: "The cve.now CLI (npm `cve.now`): look up vulnerabilities, read feeds and the cve.now Index, search, and check lockfiles against cve.now's public REST API",
+  main: "src/cli.ts",
+  scripts: {
+    dev: "bun src/cli.ts",
+    build: "bun build.ts",
+    clean: "rm -rf dist",
+    typecheck: "tsrs --noEmit",
+    "typecheck:local": "tsrs --noEmit",
+    lint: "oxlint . && oxfmt --check '**/*.{ts,tsx,js,jsx,json}'",
+    "lint:fix": "oxlint --fix . && oxfmt '**/*.{ts,tsx,js,jsx,json}'"
+  },
+  devDependencies: {
+    "@sazabi/advisory-catalog": "workspace:*",
+    "@types/bun": "^1.3.11",
+    "@types/node": "^25.5.2",
+    typescript: "7.1.0-beta"
+  }
+};
+
+// src/api.ts
+var VERSION = package_default.version;
+var DEFAULT_API_URL = "https://cve.now";
+var MAX_RETRIES = 2;
+var MAX_RETRY_WAIT_S = 60;
+
+class ApiError extends Error {
+  status;
+  body;
+  constructor(status, message, body) {
+    super(message);
+    this.status = status;
+    this.body = body;
+  }
+}
+
+class NetworkError extends Error {
+}
+function apiBase(env) {
+  return (env.CVE_NOW_API_URL || DEFAULT_API_URL).replace(/\/+$/, "");
+}
+var errorText = (body, status) => body && typeof body === "object" && ("error" in body) ? String(body.error) : `cve.now answered ${status}`;
+async function request({
+  path,
+  method = "GET",
+  body,
+  options
+}) {
+  const url = `${options.baseUrl ?? DEFAULT_API_URL}${path}`;
+  const headers = {
+    Accept: "application/json",
+    "User-Agent": `cve.now-cli/${VERSION}`
+  };
+  if (body !== undefined)
+    headers["Content-Type"] = "application/json";
+  if (options.apiKey)
+    headers.Authorization = `Bearer ${options.apiKey}`;
+  if (process.env.CI)
+    headers["X-CVE-Now-CI"] = "1";
+  for (let attempt = 0;; attempt++) {
+    let res;
+    try {
+      res = await fetch(url, {
+        method,
+        headers,
+        body: body === undefined ? undefined : JSON.stringify(body),
+        redirect: "follow"
+      });
+    } catch (e) {
+      throw new NetworkError(`Could not reach ${new URL(url).origin}: ${e.message}`);
+    }
+    if (res.status === 429 && attempt < MAX_RETRIES) {
+      const wait = Math.min(MAX_RETRY_WAIT_S, Math.max(1, Number(res.headers.get("retry-after")) || 5));
+      options.onRetry?.(wait);
+      await new Promise((resolve) => setTimeout(resolve, wait * 1000));
+      continue;
+    }
+    let text;
+    try {
+      text = await res.text();
+    } catch (e) {
+      throw new NetworkError(`cve.now's answer was cut off: ${e.message}`);
+    }
+    let json;
+    try {
+      json = text ? JSON.parse(text) : null;
+    } catch {
+      if (res.ok)
+        throw new NetworkError(`cve.now answered ${res.status} without JSON`);
+      json = null;
+    }
+    if (!res.ok) {
+      const message = res.status === 429 ? `${errorText(json, res.status)}. Set CVE_NOW_API_KEY to a cve.now API key for a per-key limit instead of the shared per-IP one.` : errorText(json, res.status);
+      throw new ApiError(res.status, message, json);
+    }
+    return json;
+  }
+}
+function query(params) {
+  const search = new URLSearchParams;
+  for (const [key, value] of Object.entries(params)) {
+    if (value === undefined)
+      continue;
+    for (const v of Array.isArray(value) ? value : [value])
+      search.append(key, String(v));
+  }
+  const s = search.toString();
+  return s ? `?${s}` : "";
+}
+
+// src/commands.ts
+var CLI_COMMANDS = [
+  {
+    name: "get",
+    tool: "get_vulnerability",
+    usage: "get <id...>",
+    summary: "Show entries by CVE, GHSA or OSV id (ids from stdin when none are given). `cve.now <id>` works too."
+  },
+  {
+    name: "feed",
+    tool: "list_feed",
+    usage: "feed [name] [--filter critical,kev] [--tech <slug>] [--ecosystem <eco>] [--limit <n>]",
+    summary: "The newest items of a stored feed (default critical), or of a filter/tech/ecosystem selection."
+  },
+  {
+    name: "check",
+    tool: "check_stack",
+    usage: "check [path...] [--packages eco:name@version,...] [--stack <id>] [--fail-on kev|critical|high|any] [--ignore <id>]",
+    summary: "Find lockfiles under each path (default .), parse them locally and check their packages. Only (ecosystem, name, version) is sent."
+  },
+  {
+    name: "top",
+    tool: "get_leaderboard",
+    usage: "top [--window week|month|year|all] [--week YYYY-Www] [--tech <slug>] [--ecosystem <eco>] [--filter critical,kev] [--limit <n>]",
+    summary: "The cve.now Index: the worst vulnerabilities this week or window."
+  },
+  {
+    name: "search",
+    tool: "search",
+    usage: 'search "<query>" [--severity <list>] [--tech <slug>] [--ecosystem <eco>] [--vendor <v>] [--package <p>] [--kev true|false] [--exploited true|false] [--published <bound>] [--type cve|early_warning|all] [--limit <n>] [--cursor <c>]',
+    summary: "Search every entry and early warning; each result says why it matched."
+  }
+];
+
+// src/commands/check.ts
+import { existsSync as existsSync2 } from "node:fs";
+import { resolve as resolve2 } from "node:path";
+// ../advisory-catalog/src/flake-lock.ts
+var GIT_ECOSYSTEM = "GIT";
+var MAX_COMMITS = 1000;
+var NIXPKGS_STALE_MS = 183 * 24 * 60 * 60 * 1000;
+var COMMIT = /^[0-9a-f]{40}$/;
+var text = (value) => typeof value === "string" && value ? value : undefined;
+function cleanUrl(raw) {
+  const href = raw.replace(/^git\+/, "");
+  if (!URL.canParse(href))
+    return null;
+  const url = new URL(href);
+  const path = url.pathname.replace(/\/+$/, "").replace(/\.git$/, "");
+  return `${url.protocol}//${url.host}${path}`.slice(0, 200);
+}
+function sourceUrl(locked) {
+  const forges = {
+    github: "github.com",
+    gitlab: "gitlab.com",
+    sourcehut: "git.sr.ht"
+  };
+  const type = text(locked.type) ?? "";
+  const owner = text(locked.owner);
+  const repo = text(locked.repo);
+  const forge = forges[type];
+  if (forge)
+    return owner && repo ? cleanUrl(`https://${text(locked.host) ?? forge}/${owner}/${repo}`) : null;
+  const url = text(locked.url);
+  return (type === "git" || type === "tarball") && url ? cleanUrl(url) : null;
+}
+function nixpkgsLastModified(lock) {
+  const input = lock.nodes[lock.root ?? "root"]?.inputs?.nixpkgs;
+  const modified = typeof input === "string" ? lock.nodes[input]?.locked?.lastModified : undefined;
+  return typeof modified === "number" && modified > 0 ? new Date(modified * 1000).toISOString() : undefined;
+}
+function scanFlakeLock(content) {
+  const lock = JSON.parse(content);
+  const packages = [];
+  let unchecked = 0;
+  for (const [key, node] of Object.entries(lock.nodes)) {
+    const locked = node?.locked;
+    if (key === lock.root || !locked || typeof locked !== "object")
+      continue;
+    const rev = text(locked.rev);
+    const name = rev && COMMIT.test(rev) ? sourceUrl(locked) : null;
+    if (name && rev && packages.length < MAX_COMMITS)
+      packages.push({ ecosystem: GIT_ECOSYSTEM, name, version: rev });
+    else
+      unchecked++;
+  }
+  return {
+    packages,
+    coverage: { unchecked, nixpkgsLastModified: nixpkgsLastModified(lock) }
+  };
+}
+
+// ../advisory-catalog/src/mix-lock.ts
+function fields(source) {
+  const result = [];
+  const closing = [];
+  let quote = "";
+  let field = "";
+  for (let i = 0;i < source.length; i++) {
+    const char = source[i];
+    if (quote) {
+      field += char;
+      if (char === "\\") {
+        if (++i >= source.length)
+          throw new Error("Invalid mix.lock string");
+        field += source[i];
+      } else if (char === quote)
+        quote = "";
+    } else if (char === "#") {
+      while (i + 1 < source.length && source[i + 1] !== `
+`)
+        i++;
+      field += " ";
+    } else if (char === '"' || char === "'") {
+      quote = char;
+      field += char;
+    } else if (char === "{" || char === "[" || char === "(") {
+      closing.push(char === "{" ? "}" : char === "[" ? "]" : ")");
+      field += char;
+    } else if (char === "}" || char === "]" || char === ")") {
+      if (closing.pop() !== char)
+        throw new Error("Invalid mix.lock delimiters");
+      field += char;
+    } else if (char === "," && closing.length === 0) {
+      if (!field.trim())
+        throw new Error("Invalid mix.lock field");
+      result.push(field.trim());
+      field = "";
+    } else
+      field += char;
+  }
+  if (quote || closing.length)
+    throw new Error("Incomplete mix.lock");
+  if (field.trim())
+    result.push(field.trim());
+  return result;
+}
+function parseMixLock(content) {
+  const roots = fields(content);
+  const map = roots.length === 1 ? roots[0]?.match(/^%\{([\s\S]*)\}$/) : null;
+  if (!map)
+    throw new Error("Expected a mix.lock map");
+  const packages = [];
+  for (const entry of fields(map[1])) {
+    const value = entry.match(/^(?:"(?:\\.|[^"\\])*"|:"(?:\\.|[^"\\])*"|:?[A-Za-z_][\w@]*)\s*(?:=>|:)\s*(\{[\s\S]*\}|nil)$/)?.[1];
+    if (!value)
+      throw new Error("Invalid mix.lock entry");
+    if (value === "nil")
+      continue;
+    const tuple = fields(value.slice(1, -1));
+    if (tuple[0] !== ":hex")
+      continue;
+    if (tuple[6] && tuple[6] !== "nil" && tuple[6] !== '"hexpm"')
+      continue;
+    const name = tuple[1]?.match(/^(?::"([A-Za-z0-9_.-]+)"|:([A-Za-z0-9_]+)|"([A-Za-z0-9_.-]+)")$/);
+    const version = tuple[2]?.match(/^"(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)"$/)?.[1];
+    if (!name || !version)
+      throw new Error("Invalid Hex package or version");
+    packages.push({
+      ecosystem: "Hex",
+      name: name[1] ?? name[2] ?? name[3],
+      version
+    });
+  }
+  return packages;
+}
+
+// ../advisory-catalog/src/stack.ts
+var DIRECT_UPLOAD_THRESHOLD = 4 * 1024 * 1024;
+var ECOSYSTEMS = {
+  npm: "npm",
+  pypi: "PyPI",
+  pip: "PyPI",
+  go: "Go",
+  golang: "Go",
+  "crates.io": "crates.io",
+  crates: "crates.io",
+  cargo: "crates.io",
+  rubygems: "RubyGems",
+  gem: "RubyGems",
+  hex: "Hex",
+  elixir: "Hex",
+  packagist: "Packagist",
+  composer: "Packagist",
+  nuget: "NuGet",
+  maven: "Maven"
+};
+function normalizeEcosystem(name) {
+  return ECOSYSTEMS[name.trim().toLowerCase()] ?? null;
+}
+function dedupe(list) {
+  const seen = new Map;
+  for (const p of list) {
+    const key = `${p.ecosystem}\x00${p.name}\x00${p.version}`;
+    const kept = seen.get(key);
+    if (kept)
+      kept.dev = kept.dev && p.dev;
+    else
+      seen.set(key, { ...p });
+  }
+  return [...seen.values()];
+}
+var isVersion = (v) => /^v?\d/.test(v);
+function parsePackageLock(content) {
+  const json = JSON.parse(content);
+  const out = [];
+  if (json.packages) {
+    for (const [key, p] of Object.entries(json.packages)) {
+      if (!key || p.link || !p.version)
+        continue;
+      const idx = key.lastIndexOf("node_modules/");
+      const name = p.name ?? (idx === -1 ? null : key.slice(idx + "node_modules/".length));
+      if (name)
+        out.push({
+          ecosystem: "npm",
+          name,
+          version: p.version,
+          dev: p.dev === true
+        });
+    }
+  } else if (json.dependencies) {
+    const walk = (deps) => {
+      for (const [name, d] of Object.entries(deps)) {
+        if (d.version && isVersion(d.version))
+          out.push({
+            ecosystem: "npm",
+            name,
+            version: d.version,
+            dev: d.dev === true
+          });
+        if (d.dependencies)
+          walk(d.dependencies);
+      }
+    };
+    walk(json.dependencies);
+  }
+  return out;
+}
+function parseBunLock(content) {
+  const cleaned = content.replace(/,(\s*[}\]])/g, "$1");
+  const json = JSON.parse(cleaned);
+  const out = [];
+  for (const entry of Object.values(json.packages ?? {})) {
+    const spec = entry[0];
+    if (typeof spec !== "string")
+      continue;
+    const at = spec.lastIndexOf("@");
+    if (at <= 0)
+      continue;
+    const version = spec.slice(at + 1);
+    if (!isVersion(version))
+      continue;
+    out.push({ ecosystem: "npm", name: spec.slice(0, at), version });
+  }
+  return out;
+}
+function parsePnpmLock(content) {
+  const out = [];
+  const patterns = [
+    /^ {2}'?\/?((?:@[^/@\s']+\/)?[^/@\s']+)@([^:(\s']+)/gm,
+    /^ {2}\/((?:@[^/\s]+\/)?[^/@\s]+)\/([^_:(\s/]+)/gm
+  ];
+  for (const re of patterns)
+    for (const m of content.matchAll(re)) {
+      const name = m[1];
+      const version = m[2];
+      if (name && version && isVersion(version))
+        out.push({ ecosystem: "npm", name, version });
+    }
+  return out;
+}
+function parseYarnLock(content) {
+  const out = [];
+  let name = null;
+  for (const line of content.split(`
+`)) {
+    if (!line || line.startsWith("#"))
+      continue;
+    if (!line.startsWith(" ")) {
+      name = null;
+      if (!line.trimEnd().endsWith(":") || line.startsWith("__metadata"))
+        continue;
+      const first = line.trimEnd().slice(0, -1).split(",")[0]?.trim().replace(/^"|"$/g, "") ?? "";
+      const at = first.lastIndexOf("@", first.indexOf(":") === -1 ? undefined : first.indexOf(":"));
+      const cut = first.indexOf("@", 1);
+      const idx = cut === -1 ? at : cut;
+      if (idx > 0)
+        name = first.slice(0, idx);
+      continue;
+    }
+    const m = line.match(/^ {2}version:? "?([^"\s]+)"?/);
+    if (m && name && m[1] && isVersion(m[1])) {
+      out.push({ ecosystem: "npm", name, version: m[1] });
+      name = null;
+    }
+  }
+  return out;
+}
+function parseRequirements(content) {
+  const out = [];
+  for (const line of content.split(`
+`)) {
+    const m = line.match(/^\s*([A-Za-z0-9][A-Za-z0-9_.-]*)(?:\[[^\]]*\])?\s*===?\s*([^\s;#\\]+)/);
+    if (m?.[1] && m[2])
+      out.push({ ecosystem: "PyPI", name: m[1], version: m[2] });
+  }
+  return out;
+}
+function parseTomlPackages({
+  content,
+  ecosystem,
+  requireSource,
+  skip
+}) {
+  const out = [];
+  for (const block of content.split("[[package]]").slice(1)) {
+    const name = block.match(/^name\s*=\s*"([^"]+)"/m)?.[1];
+    const version = block.match(/^version\s*=\s*"([^"]+)"/m)?.[1];
+    if (!name || !version)
+      continue;
+    if (requireSource && !/^source\s*=/m.test(block))
+      continue;
+    if (skip?.test(block))
+      continue;
+    const category = block.match(/^category\s*=\s*"([^"]+)"/m)?.[1];
+    out.push(category ? { ecosystem, name, version, dev: category === "dev" } : { ecosystem, name, version });
+  }
+  return out;
+}
+function parseUvLock(content) {
+  return parseTomlPackages({
+    content,
+    ecosystem: "PyPI",
+    requireSource: false,
+    skip: /^source\s*=\s*\{\s*(editable|virtual)\s*=/m
+  });
+}
+function parseGoSum(content) {
+  const out = [];
+  for (const line of content.split(`
+`)) {
+    const [mod, ver] = line.trim().split(/\s+/);
+    if (!mod || !ver || ver.endsWith("/go.mod"))
+      continue;
+    out.push({ ecosystem: "Go", name: mod, version: ver });
+  }
+  return out;
+}
+var GEM_PLATFORM = /-(?:x86|x64|i[3-6]86|arm|aarch64|universal|java|jruby|mswin|mingw|darwin|linux|freebsd|openbsd|netbsd|solaris|wasm|ruby)[\w.-]*$/;
+function parseGemfileLock(content) {
+  const out = [];
+  for (const m of content.matchAll(/^ {4}([A-Za-z0-9_.-]+) \(([^)\s,]+)\)/gm)) {
+    if (m[1] && m[2])
+      out.push({
+        ecosystem: "RubyGems",
+        name: m[1],
+        version: m[2].replace(GEM_PLATFORM, "")
+      });
+  }
+  return out;
+}
+function parseComposerLock(content) {
+  const json = JSON.parse(content);
+  const out = [];
+  for (const [list, dev] of [
+    [json.packages, false],
+    [json["packages-dev"], true]
+  ])
+    for (const p of list ?? []) {
+      const version = p.version?.replace(/^v(?=\d)/, "");
+      if (p.name && version && /^\d/.test(version) && !/-dev$/.test(version))
+        out.push({ ecosystem: "Packagist", name: p.name, version, dev });
+    }
+  return out;
+}
+function parsePipfileLock(content) {
+  const json = JSON.parse(content);
+  const out = [];
+  for (const [section, dev] of [
+    ["default", false],
+    ["develop", true]
+  ])
+    for (const [name, p] of Object.entries(json[section] ?? {})) {
+      const version = p.version?.match(/^===?\s*(\S+)$/)?.[1];
+      if (version)
+        out.push({ ecosystem: "PyPI", name, version, dev });
+    }
+  return out;
+}
+function parseNugetLock(content) {
+  const json = JSON.parse(content);
+  const out = [];
+  for (const framework of Object.values(json.dependencies ?? {}))
+    for (const [name, p] of Object.entries(framework)) {
+      if (p.type !== "Project" && p.resolved && isVersion(p.resolved))
+        out.push({ ecosystem: "NuGet", name, version: p.resolved });
+    }
+  return out;
+}
+function parseGradleLockfile(content) {
+  const out = [];
+  for (const m of content.matchAll(/^([\w.-]+):([\w.-]+):([^:=\s]+)=(\S*)$/gm)) {
+    const [, group, artifact, version, configurations = ""] = m;
+    if (!group || !artifact || !version || !isVersion(version))
+      continue;
+    const used = configurations.split(",").filter(Boolean);
+    out.push({
+      ecosystem: "Maven",
+      name: `${group}:${artifact}`,
+      version,
+      dev: used.length > 0 && used.every((c) => /^test/i.test(c))
+    });
+  }
+  return out;
+}
+
+class LockfileError extends Error {
+}
+var SUPPORTED_LOCKFILES = "package-lock.json, npm-shrinkwrap.json, bun.lock, pnpm-lock.yaml, yarn.lock, poetry.lock, uv.lock, requirements.txt, Cargo.lock, go.sum, Gemfile.lock, mix.lock, flake.lock, composer.lock, Pipfile.lock, packages.lock.json (NuGet), gradle.lockfile";
+var PARSERS = {
+  "package-lock.json": parsePackageLock,
+  "bun.lock": parseBunLock,
+  "pnpm-lock.yaml": parsePnpmLock,
+  "yarn.lock": parseYarnLock,
+  "poetry.lock": (content) => parseTomlPackages({ content, ecosystem: "PyPI", requireSource: false }),
+  "uv.lock": parseUvLock,
+  "Cargo.lock": (content) => parseTomlPackages({
+    content,
+    ecosystem: "crates.io",
+    requireSource: true
+  }),
+  "go.sum": parseGoSum,
+  "Gemfile.lock": parseGemfileLock,
+  "mix.lock": parseMixLock,
+  "flake.lock": (content) => scanFlakeLock(content).packages,
+  "requirements.txt": parseRequirements,
+  "composer.lock": parseComposerLock,
+  "Pipfile.lock": parsePipfileLock,
+  "packages.lock.json": parseNugetLock,
+  "gradle.lockfile": parseGradleLockfile
+};
+var MANIFESTS = [
+  {
+    file: "pyproject.toml",
+    lockfiles: "poetry.lock, uv.lock or requirements.txt",
+    test: /^\[(project|tool\.poetry|build-system)\]/m
+  },
+  {
+    file: "Cargo.toml",
+    lockfiles: "Cargo.lock",
+    test: /^\[(package|workspace|dependencies)\]/m
+  },
+  {
+    file: "go.mod",
+    lockfiles: "go.sum",
+    test: /^module \S+/m
+  },
+  {
+    file: "Gemfile",
+    lockfiles: "Gemfile.lock",
+    test: /^(source ['"]|gem ['"])/m
+  },
+  {
+    file: "Pipfile",
+    lockfiles: "Pipfile.lock",
+    test: /^\[(packages|dev-packages|requires)\]/m
+  },
+  {
+    file: "mix.exs",
+    lockfiles: "mix.lock",
+    test: /use Mix\.Project/
+  }
+];
+var isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function detectJson({
+  content,
+  base
+}) {
+  let json = null;
+  try {
+    json = JSON.parse(content);
+  } catch {
+    if (/"lockfileVersion"/.test(content) && /"workspaces"/.test(content))
+      return "bun.lock";
+    if (base === "package-lock.json" || base === "npm-shrinkwrap.json")
+      return "package-lock.json";
+    return null;
+  }
+  if (!json || typeof json !== "object")
+    return null;
+  if (Array.isArray(json.packages) && (("content-hash" in json) || ("packages-dev" in json)))
+    return "composer.lock";
+  if (isObject(json._meta) && (("default" in json) || ("develop" in json)))
+    return "Pipfile.lock";
+  if (typeof json.version === "number" && isObject(json.dependencies) && Object.values(json.dependencies).some((framework) => isObject(framework) && Object.values(framework).some((p) => isObject(p) && (("resolved" in p) || ("contentHash" in p)))))
+    return "packages.lock.json";
+  if ("require" in json || "require-dev" in json)
+    return { manifest: "composer.json", lockfiles: "composer.lock" };
+  if ("lockfileVersion" in json) {
+    if ("workspaces" in json)
+      return "bun.lock";
+    if ("packages" in json || "dependencies" in json)
+      return "package-lock.json";
+    return null;
+  }
+  if (json.packages && Object.keys(json.packages).some((k) => k.startsWith("node_modules/")))
+    return "package-lock.json";
+  if ("dependencies" in json || "devDependencies" in json || "name" in json)
+    return "package.json";
+  if (typeof json.nodes === "object" && json.nodes !== null && typeof json.root === "string" && typeof json.version === "number")
+    return "flake.lock";
+  return null;
+}
+function detectLockfile({
+  filename,
+  content
+}) {
+  const base = filename.split(/[\\/]/).pop()?.toLowerCase() ?? "";
+  const text = content.replace(/^\uFEFF/, "");
+  const trimmed = text.trimStart();
+  if (trimmed.startsWith("{"))
+    return detectJson({ content: text, base });
+  if (/^lockfileVersion:/m.test(text))
+    return "pnpm-lock.yaml";
+  if (/^# yarn lockfile v1/m.test(text) || /^__metadata:/m.test(text))
+    return "yarn.lock";
+  if (/^\[\[package\]\]/m.test(text)) {
+    if (/^source\s*=\s*\{/m.test(text) || base === "uv.lock")
+      return "uv.lock";
+    if (/^python-versions\s*=|^\[package\.dependencies\]|^content-hash\s*=|^files\s*=\s*\[/m.test(text))
+      return "poetry.lock";
+    if (/^checksum\s*=|^source\s*=\s*"registry\+/m.test(text))
+      return "Cargo.lock";
+    return base === "poetry.lock" ? "poetry.lock" : "Cargo.lock";
+  }
+  if (/^\S+ v\S+ h1:/m.test(text))
+    return "go.sum";
+  if (/^# This is a Gradle generated file/m.test(text) || /^[\w.-]+:[\w.-]+:[^:=\s]+=\S*$/m.test(text))
+    return "gradle.lockfile";
+  if (/^(GEM|GIT|PATH)$/m.test(text) && /^ {2}specs:/m.test(text))
+    return "Gemfile.lock";
+  if (/^(?:#[^\n]*\n\s*)*%\{/.test(trimmed) && /:hex/.test(text))
+    return "mix.lock";
+  const manifest = MANIFESTS.find((m) => m.test.test(text));
+  if (manifest)
+    return { manifest: manifest.file, lockfiles: manifest.lockfiles };
+  if (/^\s*[A-Za-z0-9][A-Za-z0-9_.-]*(\[[^\]]*\])?\s*===?\s*\S/m.test(text))
+    return "requirements.txt";
+  return null;
+}
+function parseLockfile({
+  filename,
+  content
+}) {
+  const kind = detectLockfile({ filename, content });
+  if (kind === "package.json")
+    throw new LockfileError("This is package.json, not a lockfile. Run `npm install --package-lock-only` and upload package-lock.json (or bun.lock, pnpm-lock.yaml, yarn.lock).");
+  if (kind && typeof kind === "object")
+    throw new LockfileError(`This looks like ${kind.manifest}, a dependency manifest, not a lockfile. Upload the lockfile your package manager writes (${kind.lockfiles}).`);
+  if (!kind)
+    throw new LockfileError(`Could not recognize that file as a lockfile. Supported: ${SUPPORTED_LOCKFILES}.`);
+  try {
+    return dedupe(PARSERS[kind](content.replace(/^\uFEFF/, "")));
+  } catch {
+    throw new LockfileError(`Could not parse that ${kind}. Check its format and try again.`);
+  }
+}
+function parseStackParam(param) {
+  const out = [];
+  for (const raw of param.split(",")) {
+    const item = raw.trim();
+    if (!item)
+      continue;
+    const colon = item.indexOf(":");
+    if (colon <= 0)
+      throw new Error(`Invalid stack item: ${item}`);
+    const ecosystem = normalizeEcosystem(item.slice(0, colon));
+    if (!ecosystem)
+      throw new Error(`Unknown ecosystem in: ${item}`);
+    const rest = item.slice(colon + 1);
+    const at = rest.lastIndexOf("@");
+    if (at <= 0 || at === rest.length - 1)
+      throw new Error(`Invalid stack item: ${item}`);
+    out.push({
+      ecosystem,
+      name: rest.slice(0, at),
+      version: rest.slice(at + 1)
+    });
+  }
+  return dedupe(out);
+}
+// ../advisory-catalog/src/sources/osv.ts
+var LISTING_CHUNK_BYTES = 64 * 1024;
+var LISTING_MAX_BYTES = 8 * 1024 * 1024;
+// ../advisory-catalog/src/sources/public-exploits.ts
+var URLS = {
+  metasploit: "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/db/modules_metadata_base.json",
+  nuclei: "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/cves.json",
+  "poc-in-github": "https://raw.githubusercontent.com/nomi-sec/PoC-in-GitHub/master/README.md"
+};
+var PUBLIC_EXPLOIT_SOURCES = Object.keys(URLS);
+// ../advisory-catalog/src/sources/nvd.ts
+var MAX_WINDOW_MS = 120 * 86400000;
+// ../advisory-catalog/src/signals/text.ts
+var ACCESS = /\b(breach(?:ed|es)?|hacked|compromised|compromise|stole|stolen|steal(?:ing)?|theft|exfiltrat\w*|leaked|exposed|accessed|gained access|unauthori[sz]ed access|intrusion|ransomware|infiltrat\w*|encrypted|obtained|downloaded|copied|took)\b/gi;
+var ACTION_LIST_TAIL = new RegExp(`(?:[\\s,]+|\\b(?:or|and)\\b|${ACCESS.source})+$`, "i");
+var STATES_ACCESS = new Set(["press", "vendor", "official"]);
+var STOP_WORDS = new Set("a an and any are as at be before by for from had has have if in into is it its of on or that the their them then there these this those to up was were what when whether which while who will with you your yours".split(" "));
+
+// ../advisory-catalog/src/signals/types.ts
+var PUBLIC_SIGNAL_STATUSES = new Set([
+  "corroborated",
+  "confirmed"
+]);
+var LEAK_RELAY_ACCOUNTS = new Set([
+  "mastodon:@RedPacketSecurity@mastodon.social",
+  "mastodon:@Ransomlook@social.circl.lu",
+  "mastodon:@darkwebsonar@infosec.exchange",
+  "mastodon:@DevaOnBreaches@infosec.exchange"
+]);
+// ../advisory-catalog/src/breaches/types.ts
+var SENSITIVE_DATA_TYPES = new Set([
+  "password_plain",
+  "password_hash",
+  "ssn",
+  "gov_id",
+  "health",
+  "payment_card",
+  "bank"
+]);
+var PUBLIC_BREACH_STATUSES = new Set([
+  "corroborated",
+  "confirmed",
+  "disputed"
+]);
+var DUPLICATE_WINDOW_MS = 7 * 86400000;
+// src/context.ts
+var EXIT = { ok: 0, findings: 1, usage: 2, api: 3 };
+
+class UsageError extends Error {
+}
+var list = (v) => Array.isArray(v) && v.length ? v : undefined;
+var str = (v) => typeof v === "string" ? v : undefined;
+function intOption(v, flag) {
+  if (v === undefined)
+    return;
+  const n = Number(v);
+  if (typeof v !== "string" || !Number.isInteger(n) || n < 1)
+    throw new UsageError(`${flag} takes a whole number of 1 or more`);
+  return n;
+}
+var printJson = (ctx, value) => ctx.out(JSON.stringify(value, null, 2));
+
+// src/ignore.ts
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+var IGNORE_FILE = ".cve-now-ignore";
+function parseIgnoreFile(content) {
+  return content.split(`
+`).map((line) => line.replace(/#.*/, "").trim()).filter(Boolean).flatMap((line) => line.split(/[\s,]+/)).map((id) => id.toUpperCase());
+}
+var cache = new Map;
+function dirIgnores(dir) {
+  let ids = cache.get(dir);
+  if (!ids) {
+    const file = join(dir, IGNORE_FILE);
+    ids = existsSync(file) ? parseIgnoreFile(readFileSync(file, "utf8")) : [];
+    cache.set(dir, ids);
+  }
+  return ids;
+}
+function sharedIgnores({
+  cwd,
+  flags
+}) {
+  const ids = new Set(dirIgnores(resolve(cwd)));
+  for (const id of flags.flatMap((f) => f.split(",")))
+    if (id.trim())
+      ids.add(id.trim().toUpperCase());
+  return ids;
+}
+function ignoresFor({
+  shared,
+  file,
+  root
+}) {
+  const ids = new Set(shared);
+  let dir = dirname(resolve(file));
+  const stop = resolve(root);
+  for (;; ) {
+    for (const id of dirIgnores(dir))
+      ids.add(id);
+    const rel = relative(stop, dir);
+    if (!rel || rel.startsWith("..") || dir === dirname(dir))
+      break;
+    dir = dirname(dir);
+  }
+  return ids;
+}
+
+// src/lockfiles.ts
+import { readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
+import { basename, join as join2, relative as relative2 } from "node:path";
+var LOCKFILE_NAMES = new Set([
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "bun.lock",
+  "pnpm-lock.yaml",
+  "yarn.lock",
+  "poetry.lock",
+  "uv.lock",
+  "Pipfile.lock",
+  "requirements.txt",
+  "Cargo.lock",
+  "go.sum",
+  "Gemfile.lock",
+  "mix.lock",
+  "flake.lock",
+  "composer.lock",
+  "packages.lock.json",
+  "gradle.lockfile"
+]);
+var SKIP_DIRS = new Set([
+  "node_modules",
+  ".git",
+  "vendor",
+  "target",
+  ".venv",
+  "venv",
+  "__pycache__",
+  "dist",
+  ".next",
+  ".turbo"
+]);
+var MAX_DEPTH = 12;
+function findLockfiles(path) {
+  const stat = statSync(path);
+  if (stat.isFile())
+    return [path];
+  const found = [];
+  const walk = (dir, depth) => {
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRS.has(entry.name) && depth < MAX_DEPTH)
+          walk(join2(dir, entry.name), depth + 1);
+      } else if (entry.isFile() && LOCKFILE_NAMES.has(entry.name))
+        found.push(join2(dir, entry.name));
+    }
+  };
+  walk(path, 0);
+  return found.sort();
+}
+function parseLockfileAt({
+  file,
+  cwd
+}) {
+  const shown = relative2(cwd, file) || basename(file);
+  let content;
+  try {
+    content = readFileSync2(file, "utf8");
+  } catch (e) {
+    return { file: shown, error: e.message };
+  }
+  const filename = basename(file);
+  let packages;
+  try {
+    packages = parseLockfile({ filename, content });
+  } catch (e) {
+    return { file: shown, error: e.message };
+  }
+  if (detectLockfile({ filename, content }) === "flake.lock")
+    return {
+      file: shown,
+      body: { lockfile_name: filename, lockfile_content: content },
+      packageCount: packages.length
+    };
+  return {
+    file: shown,
+    body: {
+      packages: packages.map(({ ecosystem, name, version }) => ({
+        ecosystem,
+        name,
+        version
+      }))
+    },
+    packageCount: packages.length
+  };
+}
+
+// src/style.ts
+var wrap = ({ on, open, close }) => (s) => on ? `\x1B[${open}m${s}\x1B[${close}m` : s;
+function makeStyle(on) {
+  return {
+    bold: wrap({ on, open: 1, close: 22 }),
+    dim: wrap({ on, open: 2, close: 22 }),
+    red: wrap({ on, open: 31, close: 39 }),
+    yellow: wrap({ on, open: 33, close: 39 }),
+    green: wrap({ on, open: 32, close: 39 }),
+    cyan: wrap({ on, open: 36, close: 39 })
+  };
+}
+function ratingText(style, rating) {
+  const word = rating ?? "unrated";
+  if (word === "critical")
+    return style.red(style.bold(word));
+  if (word === "high")
+    return style.red(word);
+  if (word === "medium")
+    return style.yellow(word);
+  return style.dim(word);
+}
+var ratingFor = (cvss) => cvss === null || cvss === undefined ? null : cvss >= 9 ? "critical" : cvss >= 7 ? "high" : cvss >= 4 ? "medium" : cvss > 0 ? "low" : "none";
+
+// src/commands/check.ts
+var MAX_PACKAGES = 1e4;
+var FAIL_ON = ["kev", "critical", "high", "any"];
+var cvssOf = (f) => f.severity?.cvss ?? -1;
+var ratingOf = (f) => f.rating ?? ratingFor(f.severity?.cvss);
+function meets(f, failOn) {
+  if (failOn === "any" || f.kev)
+    return true;
+  if (failOn === "kev")
+    return false;
+  const rating = ratingOf(f);
+  const cvss = cvssOf(f);
+  if (failOn === "critical")
+    return cvss >= 9 || rating === "critical";
+  return cvss >= 7 || rating === "critical" || rating === "high";
+}
+function rank(a, b) {
+  const exploited = (f) => f.kev || f.activelyExploited ? 1 : 0;
+  return exploited(b) - exploited(a) || Number(!!b.publicExploit) - Number(!!a.publicExploit) || cvssOf(b) - cvssOf(a) || Number(!!b.epssReached) - Number(!!a.epssReached) || a.id.localeCompare(b.id);
+}
+async function checkBody(ctx, body) {
+  if (!("packages" in body) || body.packages.length <= MAX_PACKAGES)
+    return request({
+      path: "/api/v1/check",
+      method: "POST",
+      body,
+      options: ctx.api
+    });
+  const merged = {
+    coverage: "",
+    checked: 0,
+    notes: [],
+    affected: []
+  };
+  const seen = new Set;
+  for (let i = 0;i < body.packages.length; i += MAX_PACKAGES) {
+    const part = await request({
+      path: "/api/v1/check",
+      method: "POST",
+      body: { packages: body.packages.slice(i, i + MAX_PACKAGES) },
+      options: ctx.api
+    });
+    merged.coverage = part.coverage;
+    merged.checked += part.checked;
+    for (const note of part.notes ?? [])
+      if (!merged.notes.includes(note))
+        merged.notes.push(note);
+    for (const f of part.affected)
+      if (!seen.has(f.id)) {
+        seen.add(f.id);
+        merged.affected.push(f);
+      }
+  }
+  if (!merged.notes.length)
+    delete merged.notes;
+  return merged;
+}
+function gatherSources(ctx, positionals, values) {
+  const sources = [];
+  const packages = list(values.packages);
+  if (packages) {
+    let parsed;
+    try {
+      parsed = parseStackParam(packages.join(","));
+    } catch (e) {
+      throw new UsageError(`--packages: ${e.message}. Use ecosystem:name@version, e.g. npm:lodash@4.17.20`);
+    }
+    sources.push({
+      source: "--packages",
+      body: {
+        packages: parsed.map(({ ecosystem, name, version }) => ({
+          ecosystem,
+          name,
+          version
+        }))
+      }
+    });
+  }
+  const stack = str(values.stack);
+  if (stack)
+    sources.push({ source: `--stack ${stack}`, body: { stack_id: stack } });
+  const paths = positionals.length || sources.length ? positionals : ["."];
+  for (const path of paths) {
+    const full = resolve2(ctx.cwd, path);
+    if (!existsSync2(full))
+      throw new UsageError(`No such file or directory: ${path}`);
+    const files = findLockfiles(full);
+    if (!files.length) {
+      ctx.err(`No supported lockfile found under ${path}`);
+      continue;
+    }
+    for (const file of files) {
+      const parsed = parseLockfileAt({ file, cwd: ctx.cwd });
+      const lockfile = { file, root: full };
+      sources.push("error" in parsed ? { source: parsed.file, error: parsed.error, lockfile } : { source: parsed.file, body: parsed.body, lockfile });
+    }
+  }
+  return sources;
+}
+async function checkCommand(ctx, positionals, values) {
+  const failOnValue = str(values["fail-on"]);
+  if (failOnValue && !FAIL_ON.includes(failOnValue))
+    throw new UsageError(`--fail-on takes ${FAIL_ON.join(", ")}`);
+  const failOn = failOnValue;
+  const sources = gatherSources(ctx, positionals, values);
+  if (!sources.length)
+    throw new UsageError("Nothing to check: pass a path with a lockfile, --packages or --stack");
+  const shared = sharedIgnores({
+    cwd: ctx.cwd,
+    flags: list(values.ignore) ?? []
+  });
+  const { style, out, err } = ctx;
+  let parseErrors = 0;
+  let apiErrors = 0;
+  let failing = 0;
+  const ignored = new Set;
+  const results = [];
+  for (const [index, src] of sources.entries()) {
+    if (src.error || !src.body) {
+      parseErrors++;
+      err(`${src.source}: ${src.error}`);
+      results.push({ source: src.source, error: src.error });
+      continue;
+    }
+    let response;
+    try {
+      response = await checkBody(ctx, src.body);
+    } catch (e) {
+      if (!(e instanceof ApiError || e instanceof NetworkError))
+        throw e;
+      if (e instanceof ApiError && [400, 404, 413, 422].includes(e.status))
+        parseErrors++;
+      else
+        apiErrors++;
+      err(`${src.source}: ${e.message}`);
+      results.push({ source: src.source, error: e.message });
+      if (e instanceof NetworkError)
+        break;
+      continue;
+    }
+    const ignores = src.lockfile ? ignoresFor({ shared, ...src.lockfile }) : shared;
+    const findings = response.affected.filter((f) => {
+      if (!ignores.has(f.id.toUpperCase()))
+        return true;
+      ignored.add(f.id);
+      return false;
+    }).sort(rank);
+    if (failOn)
+      failing += findings.filter((f) => meets(f, failOn)).length;
+    results.push({ source: src.source, response });
+    if (ctx.json)
+      continue;
+    if (index)
+      out();
+    const count = `${response.checked.toLocaleString("en-US")} ${response.checked === 1 ? "package" : "packages"}`;
+    out(`${style.bold(src.source)} ${style.dim(`(${count})`)}: ${findings.length ? style.red(`${findings.length} found`) : style.green("none found")}`);
+    for (const f of findings) {
+      const cvss = f.severity?.cvss;
+      const flags = [
+        f.kev ? "KEV" : f.activelyExploited ? "actively exploited" : "",
+        f.publicExploit ? "public exploit" : "",
+        f.epssReached ? "EPSS reached 0.1" : ""
+      ].filter(Boolean);
+      out(`  ${[
+        ratingText(style, ratingOf(f)) + (cvss !== undefined ? ` ${cvss.toFixed(1)}` : ""),
+        style.bold(f.id),
+        `${f.package.name} ${f.package.version}${f.fixed?.length ? ` → ${f.fixed.join(", ")}` : ""}`,
+        flags.length ? style.red(flags.join(" · ")) : ""
+      ].filter(Boolean).join("  ")}`);
+      out(`    ${f.title}`);
+      if (f.exposure)
+        out(style.dim(`    Exposure: ${f.exposure}`));
+      out(style.cyan(`    ${f.url}`));
+    }
+    for (const note of response.notes ?? [])
+      out(style.yellow(`  ${note}`));
+  }
+  if (ctx.json)
+    printJson(ctx, {
+      schemaVersion: 1,
+      results,
+      ignored: [...ignored].sort(),
+      ...failOn ? { failOn, failing } : {}
+    });
+  else {
+    out();
+    if (ignored.size)
+      out(style.dim(`Ignored: ${[...ignored].sort().join(", ")}`));
+    out(style.dim("No match means cve.now's index has no known vulnerability for that version, not a guarantee that none exists."));
+  }
+  if (apiErrors)
+    return EXIT.api;
+  if (parseErrors)
+    return EXIT.usage;
+  if (failOn && failing) {
+    if (!ctx.json)
+      err(`${failing} ${failing === 1 ? "finding meets" : "findings meet"} --fail-on ${failOn}`);
+    return EXIT.findings;
+  }
+  return EXIT.ok;
+}
+
+// src/commands/feed.ts
+var DEFAULT_LIMIT = 20;
+async function feedCommand(ctx, positionals, values) {
+  if (positionals.length > 1)
+    throw new UsageError("feed takes at most one feed name");
+  const feed = await request({
+    path: `/api/v1/entries${query({
+      name: positionals[0],
+      filter: list(values.filter),
+      tech: list(values.tech),
+      ecosystem: list(values.ecosystem),
+      limit: intOption(values.limit, "--limit") ?? DEFAULT_LIMIT
+    })}`,
+    options: ctx.api
+  });
+  if (ctx.json) {
+    printJson(ctx, feed);
+    return EXIT.ok;
+  }
+  const { style, out } = ctx;
+  out(`${style.bold(feed.title)} ${style.dim(`(updated ${feed.updatedAt})`)}`);
+  if (!feed.items.length)
+    out(style.dim("No items."));
+  for (const item of feed.items) {
+    out();
+    out(`${style.bold(item.id)}  ${item.title}`);
+    if (item.updateNote)
+      out(style.yellow(item.updateNote));
+    out(style.dim(`${item.updatedAt.slice(0, 10)}  https://cve.now/${encodeURIComponent(item.id)}`));
+  }
+  return EXIT.ok;
+}
+
+// src/commands/get.ts
+var MAX_AFFECTED = 8;
+var rangeText = (r) => {
+  const from = r.introduced && r.introduced !== "0" ? r.introduced : null;
+  if (r.lastAffected && from === r.lastAffected)
+    return `=${from}`;
+  const upper = r.fixed ? `<${r.fixed}` : r.lastAffected ? `<=${r.lastAffected}` : r.limit ? `<${r.limit}` : "(no fix listed)";
+  return from ? `>=${from} ${upper}` : upper === "(no fix listed)" ? "all versions (no fix listed)" : upper;
+};
+function signalsOf(e) {
+  const x = e.exploitation ?? {};
+  const out = [];
+  if (x.kev)
+    out.push(`CISA KEV since ${x.kev.dateAdded}`);
+  else if (e.ssvc?.exploitation === "active")
+    out.push("actively exploited");
+  if (x.metasploit?.modules.length)
+    out.push("Metasploit module");
+  if (x.exploitDb?.ids.length || x.githubPoc?.exploits?.length)
+    out.push("public exploit");
+  if (x.nuclei?.templates.length)
+    out.push("Nuclei template");
+  if (x.epssReached)
+    out.push("EPSS reached 0.1");
+  return out;
+}
+function printEntry(ctx, e) {
+  const { style, out } = ctx;
+  const cvss = e.severity?.cvss;
+  const rating = ratingFor(cvss) ?? e.statedSeverity?.value ?? null;
+  const signals = signalsOf(e);
+  out([
+    style.bold(e.id),
+    ratingText(style, rating) + (cvss !== undefined ? ` ${cvss.toFixed(1)}` : ""),
+    signals.length ? style.red(signals.join(" · ")) : ""
+  ].filter(Boolean).join("  "));
+  out(e.title);
+  if (e.exposure)
+    out(`${style.dim("Exposure:")} ${e.exposure}`);
+  const about = e.context?.sentence ?? e.summary?.text ?? e.originalDescription;
+  if (about && about !== e.title)
+    out(about);
+  const conditions = e.context?.conditions ?? [];
+  if (conditions.length) {
+    out(style.dim("Conditions:"));
+    for (const c of conditions)
+      out(`  - ${c.text}`);
+  }
+  if (e.context?.impact)
+    out(`${style.dim("Impact:")} ${e.context.impact.text}`);
+  const fix = e.context?.fix;
+  if (fix?.versions?.length || fix?.workaround)
+    out(`${style.dim("Fix:")} ${[
+      fix.versions?.length ? fix.versions.join(", ") : "",
+      fix.workaround ? `workaround: ${fix.workaround}` : "",
+      fix.partial ? "(partial)" : ""
+    ].filter(Boolean).join(" ")}`);
+  const affected = e.affected ?? [];
+  if (affected.length) {
+    out(style.dim("Affected:"));
+    for (const a of affected.slice(0, MAX_AFFECTED)) {
+      const name = [a.ecosystem ?? a.vendor, a.package ?? a.product].filter(Boolean).join(" ");
+      const ranges = (a.ranges ?? []).map(rangeText);
+      out(`  ${name}: ${ranges.length ? ranges.join("; ") : (a.versions ?? []).join(", ") || "versions not listed"}`);
+    }
+    if (affected.length > MAX_AFFECTED)
+      out(style.dim(`  and ${affected.length - MAX_AFFECTED} more`));
+  }
+  const ssvc = e.ssvc;
+  if (ssvc && (ssvc.exploitation || ssvc.automatable || ssvc.technicalImpact))
+    out(`${style.dim("CISA SSVC:")} exploitation ${ssvc.exploitation ?? "unknown"} · automatable ${ssvc.automatable ?? "unknown"} · technical impact ${ssvc.technicalImpact ?? "unknown"}`);
+  if (e.aliases?.length)
+    out(`${style.dim("Also:")} ${e.aliases.join(", ")}`);
+  out(style.cyan(`https://cve.now/${encodeURIComponent(e.id)}`));
+}
+async function getCommand(ctx, ids) {
+  let missing = 0;
+  const found = [];
+  for (const id of ids) {
+    try {
+      const entry = await request({
+        path: `/api/v1/entries/${encodeURIComponent(id)}`,
+        options: ctx.api
+      });
+      if (ctx.json)
+        found.push(entry);
+      else {
+        if (found.length || missing)
+          ctx.out();
+        found.push(entry);
+        printEntry(ctx, entry);
+      }
+    } catch (e) {
+      if (e instanceof ApiError && e.status === 404) {
+        missing++;
+        ctx.err(`No cve.now entry for ${id}`);
+        continue;
+      }
+      throw e;
+    }
+  }
+  if (ctx.json)
+    printJson(ctx, ids.length === 1 ? found[0] ?? null : found);
+  return missing ? EXIT.findings : EXIT.ok;
+}
+
+// src/commands/search.ts
+async function searchCommand(ctx, positionals, values) {
+  const results = await request({
+    path: `/api/v1/search${query({
+      q: positionals.length ? positionals.join(" ") : undefined,
+      severity: list(values.severity),
+      tech: list(values.tech),
+      ecosystem: list(values.ecosystem),
+      vendor: list(values.vendor),
+      package: list(values.package),
+      kev: str(values.kev),
+      exploited: str(values.exploited),
+      published: list(values.published),
+      type: str(values.type),
+      limit: intOption(values.limit, "--limit"),
+      cursor: str(values.cursor)
+    })}`,
+    options: ctx.api
+  });
+  if (ctx.json) {
+    printJson(ctx, results);
+    return EXIT.ok;
+  }
+  const { style, out, err } = ctx;
+  if (!results.entries.length) {
+    out("No matches.");
+    if (results.note)
+      out(style.dim(results.note));
+    const suggestions = (results.suggestions ?? []).map((s) => typeof s === "string" ? s : `${s.q}${s.total ? ` (${s.total})` : ""}`);
+    if (suggestions.length) {
+      out("Broader queries that match:");
+      for (const s of suggestions)
+        out(`  ${s}`);
+    }
+    return EXIT.ok;
+  }
+  for (const [i, e] of results.entries.entries()) {
+    if (i)
+      out();
+    const flags = [e.kev ? "KEV" : "", e.exploit ? "public exploit" : ""].filter(Boolean).join(" · ");
+    out([
+      style.bold(e.id),
+      ratingText(style, e.severity) + (e.cvss !== null && e.cvss !== undefined ? ` ${e.cvss.toFixed(1)}` : ""),
+      flags ? style.red(flags) : ""
+    ].filter(Boolean).join("  "));
+    out(e.title);
+    out(style.dim(`${e.published?.slice(0, 10) ?? ""}  ${e.url}`.trim()));
+  }
+  if (results.next_cursor)
+    err(style.dim(`${results.total !== undefined ? `${results.total.toLocaleString("en-US")} matches. ` : ""}Next page: --cursor ${results.next_cursor}`));
+  return EXIT.ok;
+}
+
+// src/commands/top.ts
+async function topCommand(ctx, values) {
+  const board = await request({
+    path: `/api/v1/leaderboard${query({
+      window: str(values.window),
+      week: str(values.week),
+      tech: list(values.tech),
+      ecosystem: list(values.ecosystem),
+      filter: list(values.filter),
+      limit: intOption(values.limit, "--limit")
+    })}`,
+    options: ctx.api
+  });
+  if (ctx.json) {
+    printJson(ctx, board);
+    return EXIT.ok;
+  }
+  const { style, out } = ctx;
+  out(style.bold(`cve.now Index · ${board.week ? `week ${board.week}` : `this ${board.window ?? "week"}`}`));
+  if (!board.rows.length)
+    out(style.dim("No entries."));
+  for (const row of board.rows) {
+    const move = row.movement === "new" ? style.yellow("new") : typeof row.movement === "number" && row.movement !== 0 ? row.movement > 0 ? style.red(`▲${row.movement}`) : style.green(`▼${-row.movement}`) : "";
+    out();
+    out(`${style.bold(`#${row.rank}`)}  ${style.bold(String(row.score))}  ${row.id}  ${move}`.trimEnd());
+    out(row.product ? `${row.product}: ${row.title}` : row.title);
+    const facts = [
+      row.cvss !== null && row.cvss !== undefined ? `CVSS ${row.cvss}` : "",
+      row.signals?.length ? row.signals.join(", ") : "",
+      row.fix?.length ? `fix: ${row.fix.join(", ")}` : ""
+    ].filter(Boolean);
+    if (facts.length)
+      out(style.dim(facts.join(" · ")));
+  }
+  out();
+  out(style.cyan(board.url));
+  return EXIT.ok;
+}
+
+// src/cli.ts
+var OPTIONS = {
+  json: { type: "boolean" },
+  "no-color": { type: "boolean" },
+  "api-key": { type: "string" },
+  help: { type: "boolean", short: "h" },
+  version: { type: "boolean", short: "v" },
+  filter: { type: "string", multiple: true },
+  tech: { type: "string", multiple: true },
+  ecosystem: { type: "string", multiple: true },
+  limit: { type: "string" },
+  window: { type: "string" },
+  week: { type: "string" },
+  packages: { type: "string", multiple: true },
+  stack: { type: "string" },
+  "fail-on": { type: "string" },
+  ignore: { type: "string", multiple: true },
+  severity: { type: "string", multiple: true },
+  vendor: { type: "string", multiple: true },
+  package: { type: "string", multiple: true },
+  kev: { type: "string" },
+  exploited: { type: "string" },
+  published: { type: "string", multiple: true },
+  type: { type: "string" },
+  cursor: { type: "string" }
+};
+var COMMAND_OPTIONS = {
+  get: [],
+  feed: ["filter", "tech", "ecosystem", "limit"],
+  check: ["packages", "stack", "fail-on", "ignore"],
+  top: ["window", "week", "tech", "ecosystem", "filter", "limit"],
+  search: [
+    "severity",
+    "tech",
+    "ecosystem",
+    "vendor",
+    "package",
+    "kev",
+    "exploited",
+    "published",
+    "type",
+    "limit",
+    "cursor"
+  ]
+};
+var GLOBAL_OPTIONS = new Set([
+  "json",
+  "no-color",
+  "api-key",
+  "help",
+  "version"
+]);
+var looksLikeId = (s) => /^(CVE-\d{4}-\d+|GHSA(-[0-9a-z]{4}){3}|[A-Z][A-Z0-9]*-[\w.:-]+)$/i.test(s);
+function help() {
+  const width = Math.max(...CLI_COMMANDS.map((c) => c.name.length));
+  return `cve.now ${VERSION}: vulnerabilities from cve.now in your terminal and CI
+
+Usage: cve.now <command> [options]
+       cve.now <id>              same as cve.now get <id>
+
+Commands:
+${CLI_COMMANDS.map((c) => `  ${c.name.padEnd(width)}  ${c.summary}`).join(`
+`)}
+
+${CLI_COMMANDS.map((c) => `  cve.now ${c.usage}`).join(`
+`)}
+
+Options:
+  --json             Print the API's JSON (check wraps each lockfile's answer in { schemaVersion: 1, results })
+  --no-color         No ANSI colors (also NO_COLOR)
+  --api-key <key>    A cve.now API key (cvn_...); also CVE_NOW_API_KEY. Not needed: anonymous use is free
+  -v, --version      Print the version
+  -h, --help         Print this help
+
+Exit codes: 0 ok, 1 findings at or above --fail-on (or an id not found), 2 usage or parse error,
+3 network or API error. CVE_NOW_API_URL points the CLI at another cve.now deployment.
+Docs: https://cve.now/llms.txt`;
+}
+async function readStdinIds() {
+  if (process.stdin.isTTY)
+    return [];
+  const chunks = [];
+  for await (const chunk of process.stdin)
+    chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8").split(/[\s,]+/).filter(Boolean);
+}
+async function main(argv, env = process.env) {
+  const err = (line = "") => process.stderr.write(`${line}
+`);
+  let parsed;
+  try {
+    parsed = parseArgs({
+      args: argv,
+      options: OPTIONS,
+      allowPositionals: true,
+      strict: true
+    });
+  } catch (e) {
+    err(`${e.message}
+Run cve.now --help for usage.`);
+    return EXIT.usage;
+  }
+  const values = parsed.values;
+  let [command, ...rest] = parsed.positionals;
+  if (values.version) {
+    process.stdout.write(`${VERSION}
+`);
+    return EXIT.ok;
+  }
+  if (values.help || !command) {
+    process.stdout.write(`${help()}
+`);
+    return command || values.help ? EXIT.ok : EXIT.usage;
+  }
+  if (!Object.hasOwn(COMMAND_OPTIONS, command)) {
+    if (!looksLikeId(command)) {
+      err(`Unknown command: ${command}
+Run cve.now --help for usage.`);
+      return EXIT.usage;
+    }
+    rest = [command, ...rest];
+    command = "get";
+  }
+  const allowed = new Set([...GLOBAL_OPTIONS, ...COMMAND_OPTIONS[command]]);
+  const stray = Object.keys(values).filter((key) => !allowed.has(key));
+  if (stray.length) {
+    err(`${command} doesn't take ${stray.map((key) => `--${key}`).join(", ")}
+Run cve.now --help for usage.`);
+    return EXIT.usage;
+  }
+  const json = values.json === true;
+  const color = !json && values["no-color"] !== true && !env.NO_COLOR && process.stdout.isTTY === true;
+  const style = makeStyle(color);
+  const baseUrl = apiBase(env);
+  if (!isHttpUrl(baseUrl)) {
+    err(`CVE_NOW_API_URL must be an http(s) URL, got "${baseUrl}"`);
+    return EXIT.usage;
+  }
+  const ctx = {
+    json,
+    style,
+    cwd: process.cwd(),
+    out: (line = "") => process.stdout.write(`${line}
+`),
+    err,
+    api: {
+      apiKey: str(values["api-key"]) ?? env.CVE_NOW_API_KEY,
+      baseUrl,
+      onRetry: (seconds) => err(style.dim(`cve.now asked to slow down; retrying in ${seconds}s`))
+    }
+  };
+  try {
+    switch (command) {
+      case "get": {
+        const ids = rest.length ? rest : await readStdinIds();
+        if (!ids.length)
+          throw new UsageError("get takes one or more ids");
+        return await getCommand(ctx, ids);
+      }
+      case "feed":
+        return await feedCommand(ctx, rest, values);
+      case "check":
+        return await checkCommand(ctx, rest, values);
+      case "top":
+        if (rest.length)
+          throw new UsageError("top takes no arguments");
+        return await topCommand(ctx, values);
+      default:
+        return await searchCommand(ctx, rest, values);
+    }
+  } catch (e) {
+    if (e instanceof UsageError) {
+      err(`${e.message}
+Run cve.now --help for usage.`);
+      return EXIT.usage;
+    }
+    if (e instanceof ApiError && e.status === 404 && (command === "top" || command === "search")) {
+      err(`cve.now ${command} is not available on cve.now yet.`);
+      return EXIT.usage;
+    }
+    if (e instanceof ApiError) {
+      err(e.message);
+      return e.status >= 400 && e.status < 500 && e.status !== 429 ? EXIT.usage : EXIT.api;
+    }
+    if (e instanceof NetworkError) {
+      err(e.message);
+      return EXIT.api;
+    }
+    throw e;
+  }
+}
+function isHttpUrl(value) {
+  try {
+    const { protocol } = new URL(value);
+    return protocol === "https:" || protocol === "http:";
+  } catch {
+    return false;
+  }
+}
+process.exitCode = await main(process.argv.slice(2));
+export {
+  main
+};