dio-lookup 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 disclose.io
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,59 @@
+# dio-lookup
+
+Pipe internet assets to [lookup.disclose.io](https://lookup.disclose.io) and get the right **security-disclosure contact** for each — as JSONL, built for recon pipelines.
+
+Give it a domain, IP, ASN, URL, email, package, repo, container, cloud resource, mobile app, hardware, browser extension, or org name; get back the owner and where to report a vulnerability (security.txt, bug bounty program, VDP, PSIRT, national CERT).
+
+```bash
+subfinder -d example.com | httpx -silent | dio-lookup > contacts.jsonl
+cat hosts.txt | dio-lookup -c 8
+dio-lookup cloudflare.com npm:express gh:facebook/react
+```
+
+## Install
+
+**With [Bun](https://bun.sh) (run from source):**
+
+```bash
+bun install -g dio-lookup        # or: git clone + bun link
+```
+
+**Prebuilt binary** (no runtime needed) — grab the right asset from [Releases](https://github.com/disclose/dio-lookup/releases), then:
+
+```bash
+chmod +x dio-lookup && sudo mv dio-lookup /usr/local/bin/
+```
+
+## Usage
+
+```
+dio-lookup [options] [asset ...]
+cat hosts.txt | dio-lookup [options]
+
+  -c, --concurrency N   parallel requests (default 5)
+  -k, --key KEY         API key (raises rate limits); or set DIO_API_KEY
+      --api URL         API endpoint (default https://lookup.disclose.io/api/lookup)
+      --full            emit the full LookupResult instead of the compact summary
+  -V, --version         print version
+  -h, --help            help
+```
+
+One JSON object per asset on stdout. Compact form:
+
+```json
+{"input":"cloudflare.com","assetType":"domain","status":"complete","organization":"Cloudflare","jurisdiction":"US","contacts":[{"type":"security_txt","value":"https://www.cloudflare.com/.well-known/security.txt","confidence":"high"}]}
+```
+
+Pull just the reporting channels with `jq`:
+
+```bash
+cat hosts.txt | dio-lookup | jq -r 'select(.status=="complete") | "\(.input)\t\(.contacts[0].value)"'
+```
+
+## Notes
+
+- **Free and anonymous.** A free API key only raises rate limits — request one by emailing [hello@disclose.io](mailto:hello@disclose.io). Pass it with `-k` or `DIO_API_KEY`.
+- Honors the API's `Retry-After` on 429 and retries transient failures.
+- `--full` emits the complete `LookupResult` (attribution, contacts, resolution chain, data sources) — see the [OpenAPI spec](https://lookup.disclose.io/openapi.yaml).
+
+A [disclose.io](https://disclose.io) project. MIT licensed.

package/dio-lookup.ts

@@ -0,0 +1,148 @@
+#!/usr/bin/env bun
+/**
+ * dio-lookup — pipe internet assets to lookup.disclose.io, get security
+ * disclosure contacts back as JSONL.
+ *
+ * Built for recon pipelines:
+ *   subfinder -d example.com | httpx -silent | dio-lookup
+ *   cat hosts.txt | dio-lookup --concurrency 8 > contacts.jsonl
+ *   dio-lookup cloudflare.com npm:express gh:facebook/react
+ *
+ * Each input asset (domain, IP, ASN, URL, email, package, repo, container,
+ * cloud resource, mobile app, hardware, extension, org name) becomes one JSON
+ * object on stdout. Anonymous + free; an optional API key raises rate limits.
+ */
+
+const VERSION = '0.1.0';
+const DEFAULT_API = 'https://lookup.disclose.io/api/lookup';
+
+interface Options {
+  concurrency: number;
+  api: string;
+  apiKey?: string;
+  full: boolean;
+  inputs: string[];
+}
+
+export function parseArgs(argv: string[]): Options | { help: true } | { version: true } {
+  const o: Options = { concurrency: 5, api: DEFAULT_API, full: false, inputs: [] };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '-h' || a === '--help') return { help: true };
+    if (a === '-V' || a === '--version') return { version: true };
+    else if (a === '-c' || a === '--concurrency') o.concurrency = Math.max(1, parseInt(argv[++i] ?? '5', 10) || 5);
+    else if (a === '--api') o.api = argv[++i] ?? DEFAULT_API;
+    else if (a === '-k' || a === '--key') o.apiKey = argv[++i];
+    else if (a === '--full') o.full = true;
+    else if (a.startsWith('-')) { process.stderr.write(`unknown flag: ${a}\n`); return { help: true }; }
+    else o.inputs.push(a);
+  }
+  return o;
+}
+
+const HELP = `dio-lookup ${VERSION} — security-disclosure contacts for any internet asset
+
+USAGE
+  dio-lookup [options] [asset ...]
+  cat hosts.txt | dio-lookup [options]
+
+OPTIONS
+  -c, --concurrency N   parallel requests (default 5)
+  -k, --key KEY         API key (raises rate limits); or set DIO_API_KEY
+      --api URL         API endpoint (default ${DEFAULT_API})
+      --full            emit the full LookupResult instead of the compact summary
+  -V, --version         print version
+  -h, --help            this help
+
+OUTPUT
+  One JSON object per asset on stdout (JSONL). Compact form:
+  {"input","assetType","status","organization","jurisdiction","contacts":[{type,value,confidence}]}
+
+EXAMPLES
+  dio-lookup cloudflare.com
+  subfinder -d example.com | httpx -silent | dio-lookup -c 8 > contacts.jsonl
+  echo npm:express | dio-lookup --full | jq .
+
+A disclose.io project — https://lookup.disclose.io`;
+
+async function readStdinLines(): Promise<string[]> {
+  if (process.stdin.isTTY) return [];
+  const text = await new Response(Bun.stdin.stream()).text();
+  return text.split('\n').map(l => l.trim()).filter(Boolean);
+}
+
+interface Contact { type: string; value: string; confidence: string }
+interface LookupResult {
+  input: string; assetType?: string; status?: string;
+  attribution?: { organization?: string; jurisdiction?: string };
+  contacts?: Contact[];
+}
+
+export async function lookupOne(input: string, o: Options): Promise<Record<string, unknown>> {
+  const headers: Record<string, string> = { 'Content-Type': 'application/json', 'User-Agent': `dio-lookup/${VERSION}` };
+  const key = o.apiKey ?? process.env.DIO_API_KEY;
+  if (key) headers['Authorization'] = `Bearer ${key}`;
+
+  // Up to 3 attempts, honoring Retry-After on 429.
+  for (let attempt = 0; attempt < 3; attempt++) {
+    try {
+      const res = await fetch(o.api, { method: 'POST', headers, body: JSON.stringify({ input }) });
+      if (res.status === 429) {
+        const wait = Math.min(30, parseInt(res.headers.get('retry-after') ?? '2', 10) || 2);
+        await Bun.sleep(wait * 1000);
+        continue;
+      }
+      const body = await res.json() as LookupResult;
+      if (o.full) return body as unknown as Record<string, unknown>;
+      return {
+        input,
+        assetType: body.assetType ?? null,
+        status: body.status ?? null,
+        organization: body.attribution?.organization ?? null,
+        jurisdiction: body.attribution?.jurisdiction ?? null,
+        contacts: (body.contacts ?? []).map(c => ({ type: c.type, value: c.value, confidence: c.confidence })),
+      };
+    } catch (err) {
+      if (attempt === 2) return { input, error: String(err).slice(0, 200) };
+      await Bun.sleep(1000);
+    }
+  }
+  return { input, error: 'exhausted retries' };
+}
+
+// Bounded-concurrency worker pool over the input list, preserving nothing about
+// order (recon pipelines don't need it) — emit as each completes.
+export async function run(inputs: string[], o: Options): Promise<number> {
+  let idx = 0;
+  let failures = 0;
+  const out = (obj: Record<string, unknown>) => {
+    if (obj.error) failures++;
+    process.stdout.write(JSON.stringify(obj) + '\n');
+  };
+  const worker = async () => {
+    while (idx < inputs.length) {
+      const i = idx++;
+      out(await lookupOne(inputs[i], o));
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(o.concurrency, inputs.length) }, worker));
+  return failures;
+}
+
+export { VERSION, HELP };
+export type { Options, LookupResult, Contact };
+
+// Only run the CLI when executed directly (`bun dio-lookup.ts`), not when imported
+// by the test suite. This keeps parseArgs/lookupOne/run unit-testable in isolation.
+if (import.meta.main) {
+  const parsed = parseArgs(process.argv.slice(2));
+  if ('help' in parsed) { console.log(HELP); process.exit(0); }
+  if ('version' in parsed) { console.log(VERSION); process.exit(0); }
+
+  const stdinInputs = await readStdinLines();
+  const inputs = [...parsed.inputs, ...stdinInputs];
+  if (inputs.length === 0) { console.error('no input assets (pass as args or pipe via stdin); --help for usage'); process.exit(2); }
+
+  const failures = await run(inputs, parsed);
+  process.exit(failures > 0 && failures === inputs.length ? 1 : 0);
+}

package/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "dio-lookup",
+  "version": "0.1.0",
+  "description": "Pipe internet assets to lookup.disclose.io and get security-disclosure contacts as JSONL.",
+  "type": "module",
+  "bin": {
+    "dio-lookup": "./dio-lookup.ts"
+  },
+  "files": [
+    "dio-lookup.ts"
+  ],
+  "scripts": {
+    "start": "bun dio-lookup.ts",
+    "build": "bun build ./dio-lookup.ts --compile --outfile dist/dio-lookup"
+  },
+  "engines": {
+    "bun": ">=1.0.0"
+  },
+  "license": "MIT",
+  "homepage": "https://lookup.disclose.io",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/disclose/dio-lookup.git"
+  },
+  "keywords": ["security", "vulnerability-disclosure", "security.txt", "recon", "bug-bounty", "disclose.io", "osint"]
+}