Add cve-validate CLI

[jgamblin]

Summary

Adds a cve-validate command so CVE Records and CNA Containers can be validated from the shell or a CI pipeline, without writing a script against the library API. This is one of the more commonly requested additions. It wraps the existing Validate API — no validation logic changes.

Usage

cve-validate record.json                       # validate a file
cve-validate record1.json record2.json         # validate several
cat record.json | cve-validate                 # read from stdin (or "-")
cve-validate --type published-cna container.json
cve-validate --type rejected-cna  container.json
cve-validate --json record.json                # machine-readable output

• --type record|published-cna|rejected-cna (default record)
• --json, -q/--quiet, -h/--help, -v/--version, and -- end-of-options
• Exit codes: 0 all valid, 1 any invalid or unreadable, 2 usage error
• Registry warnings are printed under each result and reflected in the summary count
• Human output uses ✓/✗/⚠ on UTF-8 terminals and falls back to PASS/FAIL/WARN otherwise
• Errors and usage go to stderr; results go to stdout, so --json … | jq is clean

Changes

• src/cli.ts — the CLI (arg parsing, file/stdin input, dispatch to the three Validate methods, human/JSON output).
• package.json — bin: cve-validate → dist/cli.js, build src/cli.ts alongside src/index.ts, add a test:cli script.
• scripts/test-cli.mjs — spawn-based tests covering valid/invalid/mixed inputs, --json, stdin (- and piped), --quiet, all three --type values and the --type= form, --help/--version (asserting the real package version), short flags, --, unknown option, bad --type, missing file, malformed JSON, a packaging guard (asserts src//dist/ stay in files and the bin path), and a slow-pipe truncation regression test.
• README.md — CLI section.

Notes

• Exit handling: the entrypoint sets process.exitCode rather than calling process.exit(), so buffered stdout drains before exit — otherwise large --json output is truncated at the OS pipe buffer when piped to another process. The regression test reproduces this with a backpressured slow reader.
• Packaging: the published bin resolves its schema/registry JSON assets from src/ at runtime, so src/ must remain in the package files allowlist (it is today; a test guards this).
• Independent of Add CI workflow and node --test suite #12 and Harden WarningRegistry against a malformed registry file #13 — new files plus additive package.json/README edits in distinct regions, so all three merge in any order.
• Follow-up (out of scope): a top-level null record input currently surfaces a raw TypeError string rather than a clean FAILED_JSON_SCHEMA_VALIDATION; the root cause is the input guard in src/core/validate.ts, best fixed there separately.

🤖 Generated with Claude Code