@slicedearth/whoisleuth-cli 1.39.1 → 1.43.0

package/cli/arguments.mjs

@@ -1,6 +1,7 @@
 import { parseInspectArchiveArguments, parseSignArtifactArguments, parseVerifySignatureArguments, } from "./evidence-command-arguments.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { INVESTIGATION_PLAN_RECIPES, } from "./investigation-plan.mjs";
+import { parseCliFailPolicies } from "./fail-policy.mjs";
 const MAX_CLI_ARGUMENTS = 32;
 const MAX_CLI_ARGUMENT_LENGTH = 1024;
 const CLI_COMMANDS = [
@@ -8,9 +9,13 @@ const CLI_COMMANDS = [
     'doctor',
     'commands',
     'manual',
+    'manifest',
+    'map-observations',
+    'oam-export',
     'lookup',
     'bulk',
     'ct-search',
+    'ct-intake',
     'discover',
     'discover-scan',
     'posture',
@@ -18,6 +23,8 @@ const CLI_COMMANDS = [
     'tls',
     'registry-support',
     'registry-doctor',
+    'registry-cohort',
+    'registry-scaffold',
     'risk-calibrate',
     'lookalike-calibrate',
     'verify-artifact',
@@ -29,10 +36,15 @@ const CLI_COMMANDS = [
     'page-compare',
     'mail-review',
     'review-evidence',
+    'brief',
+    'case-pack',
     'domain-control',
+    'monitor-once',
     'assurance',
+    'change-packet',
     'sharing-review',
     'workflow-plan',
+    'workflow-run',
     'diff',
     'reconcile',
     'timeline',
@@ -111,7 +123,8 @@ function parseCliArgumentsCore(argv) {
     }
     const command = firstArgument;
     if (!isCliCommand(command)) {
-        throw new CliUsageError(`Unknown command "${command}". This release supports: ${CLI_COMMANDS.join(', ')}.`);
+        const displayedCommand = command.length > 80 ? `${command.slice(0, 79)}…` : command;
+        throw new CliUsageError(`Unknown command "${displayedCommand}". Run "whoisleuth commands" to list supported commands.`);
     }
     if (command === 'bulk')
         return parseBulkArguments(argv.slice(1));
@@ -123,8 +136,16 @@ function parseCliArgumentsCore(argv) {
         return parseCommandsArguments(argv.slice(1));
     if (command === 'manual')
         return parseManualArguments(argv.slice(1));
+    if (command === 'manifest')
+        return parseManifestArguments(argv.slice(1));
+    if (command === 'map-observations')
+        return parseOfflineImportArguments('map-observations', argv.slice(1));
+    if (command === 'oam-export')
+        return parseOfflineImportArguments('oam-export', argv.slice(1));
     if (command === 'ct-search')
         return parseCtSearchArguments(argv.slice(1));
+    if (command === 'ct-intake')
+        return parseCtIntakeArguments(argv.slice(1));
     if (command === 'discover')
         return parseDiscoverArguments(argv.slice(1));
     if (command === 'discover-scan')
@@ -139,6 +160,10 @@ function parseCliArgumentsCore(argv) {
         return parseRegistrySupportArguments(argv.slice(1));
     if (command === 'registry-doctor')
         return parseRegistryDoctorArguments(argv.slice(1));
+    if (command === 'registry-cohort')
+        return parseRegistryCohortArguments(argv.slice(1));
+    if (command === 'registry-scaffold')
+        return parseRegistryScaffoldArguments(argv.slice(1));
     if (command === 'risk-calibrate')
         return parseRiskCalibrateArguments(argv.slice(1));
     if (command === 'lookalike-calibrate')
@@ -161,14 +186,24 @@ function parseCliArgumentsCore(argv) {
         return parseMailReviewArguments(argv.slice(1));
     if (command === 'review-evidence')
         return parseReviewEvidenceArguments(argv.slice(1));
+    if (command === 'brief')
+        return parseBriefArguments(argv.slice(1));
+    if (command === 'case-pack')
+        return parseCasePackArguments(argv.slice(1));
     if (command === 'domain-control')
         return parseDomainControlArguments(argv.slice(1));
+    if (command === 'monitor-once')
+        return parseMonitorOnceArguments(argv.slice(1));
     if (command === 'assurance')
         return parseAssuranceArguments(argv.slice(1));
+    if (command === 'change-packet')
+        return parseChangePacketArguments(argv.slice(1));
     if (command === 'sharing-review')
         return parseSharingReviewArguments(argv.slice(1));
     if (command === 'workflow-plan')
         return parseWorkflowPlanArguments(argv.slice(1));
+    if (command === 'workflow-run')
+        return parseWorkflowRunArguments(argv.slice(1));
     if (command === 'diff')
         return parseDiffArguments(argv.slice(1));
     if (command === 'reconcile')
@@ -188,6 +223,7 @@ function parseCliArgumentsCore(argv) {
     let strictExit = false;
     let events = false;
     let plan = false;
+    let failOn = null;
     let observerLabel = null;
     let vantageLabel = null;
     const lookupArguments = argv.slice(1);
@@ -200,6 +236,11 @@ function parseCliArgumentsCore(argv) {
                 throw new CliUsageError('Choose only one output format.');
             output = 'json';
         }
+        else if (argument === '--junit') {
+            if (output !== 'terminal')
+                throw new CliUsageError('Choose only one output format.');
+            output = 'junit';
+        }
         else if (argument === '--markdown' || argument === '--html') {
             if (output !== 'terminal')
                 throw new CliUsageError('Choose only one output format.');
@@ -238,6 +279,11 @@ function parseCliArgumentsCore(argv) {
                 throw new CliUsageError('--plan may be supplied only once.');
             plan = true;
         }
+        else if (argument === '--fail-on') {
+            if (failOn !== null)
+                throw new CliUsageError('--fail-on may be supplied only once.');
+            failOn = parseCliFailPolicies(lookupArguments[++index]);
+        }
         else if (argument === '--observer' || argument === '--vantage') {
             const isObserver = argument === '--observer';
             if (isObserver ? observerLabel !== null : vantageLabel !== null) {
@@ -269,12 +315,12 @@ function parseCliArgumentsCore(argv) {
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
     if (detailSet && output !== 'terminal')
         throw new CliUsageError('--summary and --verbose apply only to terminal output.');
-    if (plan && (output === 'markdown' || output === 'html'))
+    if (plan && !['terminal', 'json'].includes(output))
         throw new CliUsageError('--plan supports terminal or JSON output only.');
-    if (plan && (detailSet || strictExit || events || quiet)) {
+    if (plan && (detailSet || strictExit || events || quiet || failOn !== null)) {
         throw new CliUsageError('--plan cannot be combined with detail, strict-exit, event, or quiet options.');
     }
-    return { action: 'lookup', query, output, deep, detail, strictExit, events, plan, observerLabel, vantageLabel, quiet, color };
+    return { action: 'lookup', query, output, deep, detail, strictExit, events, plan, observerLabel, vantageLabel, quiet, color, ...(failOn ? { failOn } : {}) };
 }
 function parseCompletionArguments(argv) {
     if (argv.length !== 1 || !['bash', 'zsh', 'fish', 'powershell'].includes(argv[0] || '')) {
@@ -287,6 +333,84 @@ function parseManualArguments(argv) {
         throw new CliUsageError('manual does not accept command arguments.');
     return { action: 'manual' };
 }
+function parseManifestArguments(argv) {
+    const sources = [];
+    let workflow = null;
+    let configurationDigestSha256 = null;
+    let output = 'terminal';
+    let quiet = false;
+    let color = true;
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (argument === '--json') {
+            if (output !== 'terminal')
+                throw new CliUsageError('--json may be supplied only once.');
+            output = 'json';
+        }
+        else if (argument === '--workflow') {
+            if (workflow !== null)
+                throw new CliUsageError('--workflow may be supplied only once.');
+            workflow = argv[++index] ?? null;
+            if (!workflow)
+                throw new CliUsageError('--workflow requires a bounded label.');
+        }
+        else if (argument === '--configuration-digest') {
+            if (configurationDigestSha256 !== null)
+                throw new CliUsageError('--configuration-digest may be supplied only once.');
+            configurationDigestSha256 = argv[++index] ?? null;
+            if (!configurationDigestSha256 || !/^sha256:[a-f0-9]{64}$/u.test(configurationDigestSha256)) {
+                throw new CliUsageError('--configuration-digest requires a sha256: hexadecimal digest.');
+            }
+        }
+        else if (argument === '--quiet')
+            quiet = true;
+        else if (argument === '--no-color')
+            color = false;
+        else if (argument?.startsWith('-'))
+            throw new CliUsageError(`Unknown option "${argument}".`);
+        else if (argument)
+            sources.push(argument);
+    }
+    if (!workflow)
+        throw new CliUsageError('manifest requires --workflow <label>.');
+    if (sources.length < 1 || sources.length > 16)
+        throw new CliUsageError('manifest requires from 1 to 16 JSON artefact files.');
+    if (new Set(sources).size !== sources.length)
+        throw new CliUsageError('manifest artefact files must be different.');
+    if (quiet && output !== 'terminal')
+        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
+    return { action: 'manifest', sources, workflow, configurationDigestSha256, output, quiet, color };
+}
+function parseSingleJsonInput(argv, overflowMessage) {
+    let source = null;
+    let output = 'terminal';
+    let quiet = false;
+    let color = true;
+    for (const argument of argv) {
+        if (argument === '--json') {
+            if (output !== 'terminal')
+                throw new CliUsageError('--json may be supplied only once.');
+            output = 'json';
+        }
+        else if (argument === '--quiet')
+            quiet = true;
+        else if (argument === '--no-color')
+            color = false;
+        else if (argument.startsWith('-'))
+            throw new CliUsageError(`Unknown option "${argument}".`);
+        else if (source === null)
+            source = argument;
+        else
+            throw new CliUsageError(overflowMessage);
+    }
+    if (quiet && output !== 'terminal')
+        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
+    return { source, output, quiet, color };
+}
+function parseOfflineImportArguments(action, argv) {
+    const parsed = parseSingleJsonInput(argv, `${action} accepts one optional versioned JSON input file.`);
+    return { action, ...parsed };
+}
 function parseCommandsArguments(argv) {
     let output = 'terminal';
     let quiet = false;
@@ -346,12 +470,14 @@ function parseBulkArguments(argv) {
     let checkpoint = null;
     let resume = false;
     let events = false;
+    let plan = false;
+    let failOn = null;
     let filter = 'all';
     for (let index = 0; index < argv.length; index++) {
         const argument = argv[index];
         if (argument === undefined)
             break;
-        if (argument === '--json' || argument === '--jsonl' || argument === '--csv' || argument === '--domains' || argument === '--queries') {
+        if (argument === '--json' || argument === '--jsonl' || argument === '--csv' || argument === '--domains' || argument === '--queries' || argument === '--junit') {
             if (output !== 'terminal')
                 throw new CliUsageError('Choose only one output format.');
             output = argument === '--json'
@@ -362,7 +488,9 @@ function parseBulkArguments(argv) {
                         ? 'csv'
                         : argument === '--domains'
                             ? 'domains'
-                            : 'queries';
+                            : argument === '--queries'
+                                ? 'queries'
+                                : 'junit';
         }
         else if (argument === '--deep' || argument === '--fast') {
             if (scanMode)
@@ -398,6 +526,16 @@ function parseBulkArguments(argv) {
                 throw new CliUsageError('--events may be supplied only once.');
             events = true;
         }
+        else if (argument === '--plan') {
+            if (plan)
+                throw new CliUsageError('--plan may be supplied only once.');
+            plan = true;
+        }
+        else if (argument === '--fail-on') {
+            if (failOn !== null)
+                throw new CliUsageError('--fail-on may be supplied only once.');
+            failOn = parseCliFailPolicies(argv[++index]);
+        }
         else if (argument === '--registered-only' || argument === '--inconclusive-only' || argument === '--errors-only') {
             if (filter !== 'all')
                 throw new CliUsageError('Bulk output filters are mutually exclusive and may be supplied only once.');
@@ -422,37 +560,22 @@ function parseBulkArguments(argv) {
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
     if (resume && checkpoint === null)
         throw new CliUsageError('--resume requires --checkpoint.');
+    if (plan && (events || resume || checkpoint !== null || quiet || failOn !== null || !['terminal', 'json'].includes(output))) {
+        throw new CliUsageError('--plan supports terminal or JSON output and cannot be combined with events, checkpoint, resume, or quiet options.');
+    }
     const maximum = deep ? 3 : 8;
     if (concurrency !== null && concurrency > maximum) {
         throw new CliUsageError(`--concurrency is capped at ${maximum} in ${deep ? 'deep' : 'fast'} bulk mode.`);
     }
-    return { action: 'bulk', source, output, deep, quiet, color, concurrency: concurrency ?? (deep ? 2 : 4), checkpoint, resume, events, filter };
+    return { action: 'bulk', source, output, deep, quiet, color, concurrency: concurrency ?? (deep ? 2 : 4), checkpoint, resume, events, plan, filter, ...(failOn ? { failOn } : {}) };
 }
 function parseCtSearchArguments(argv) {
-    let keyword = null;
-    let output = 'terminal';
-    let quiet = false;
-    let color = true;
-    for (const argument of argv) {
-        if (argument === '--json') {
-            if (output !== 'terminal')
-                throw new CliUsageError('--json may be supplied only once.');
-            output = 'json';
-        }
-        else if (argument === '--quiet')
-            quiet = true;
-        else if (argument === '--no-color')
-            color = false;
-        else if (argument.startsWith('-'))
-            throw new CliUsageError(`Unknown option "${argument}".`);
-        else if (keyword === null)
-            keyword = argument;
-        else
-            throw new CliUsageError('ct-search accepts one keyword. Quote multi-word keywords as one argument.');
-    }
-    if (quiet && output !== 'terminal')
-        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'ct-search', keyword, output, quiet, color };
+    const { source: keyword, ...options } = parseSingleJsonInput(argv, 'ct-search accepts one keyword. Quote multi-word keywords as one argument.');
+    return { action: 'ct-search', keyword, ...options };
+}
+function parseCtIntakeArguments(argv) {
+    const parsed = parseSingleJsonInput(argv, 'ct-intake accepts one optional versioned JSON event file.');
+    return { action: 'ct-intake', ...parsed };
 }
 function parseDiscoverArguments(argv) {
     let seed = null;
@@ -576,6 +699,8 @@ function parseDiscoverScanArguments(argv) {
     let filter = 'all';
     let filterSet = false;
     let events = false;
+    let plan = false;
+    let failOn = null;
     for (let index = 0; index < argv.length; index++) {
         const argument = argv[index];
         if (argument === undefined)
@@ -706,6 +831,16 @@ function parseDiscoverScanArguments(argv) {
                 throw new CliUsageError('--events may be supplied only once.');
             events = true;
         }
+        else if (argument === '--plan') {
+            if (plan)
+                throw new CliUsageError('--plan may be supplied only once.');
+            plan = true;
+        }
+        else if (argument === '--fail-on') {
+            if (failOn !== null)
+                throw new CliUsageError('--fail-on may be supplied only once.');
+            failOn = parseCliFailPolicies(argv[++index]);
+        }
         else if (argument === '--quiet')
             quiet = true;
         else if (argument === '--no-color')
@@ -726,6 +861,9 @@ function parseDiscoverScanArguments(argv) {
     }
     if (resume && checkpoint === null)
         throw new CliUsageError('--resume requires --checkpoint.');
+    if (plan && (events || resume || checkpoint !== null || observationSnapshot !== null || quiet || failOn !== null || !['terminal', 'json'].includes(output))) {
+        throw new CliUsageError('--plan supports terminal or JSON output and cannot be combined with events, checkpoint, resume, observation snapshots, or quiet options.');
+    }
     if (quiet && output !== 'terminal')
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
     if (dictionarySource && preset === 'common')
@@ -734,7 +872,7 @@ function parseDiscoverScanArguments(argv) {
         action: 'discover-scan', seed, output, quiet, color, preset, keyboardLayout, tldText,
         dictionarySource, familyText, deep, scanLimit: scanLimit ?? Math.min(100, maximum),
         chunkSize: chunkSize ?? 25, concurrency: concurrency ?? (deep ? 2 : 4), checkpoint,
-        resume, resolverText, observationSnapshot, allowlistSource, filter, events,
+        resume, resolverText, observationSnapshot, allowlistSource, filter, events, plan, ...(failOn ? { failOn } : {}),
     };
 }
 function positiveIntegerOption(value, option, maximum) {
@@ -754,6 +892,7 @@ function parsePostureArguments(argv) {
     let retiredSelectorText = null;
     let mailProfile = 'standard';
     let mailProfileSeen = false;
+    let ownedDomain = false;
     for (let index = 0; index < argv.length; index++) {
         const argument = argv[index];
         if (argument === undefined)
@@ -763,6 +902,16 @@ function parsePostureArguments(argv) {
                 throw new CliUsageError('--json may be supplied only once.');
             output = 'json';
         }
+        else if (argument === '--sarif') {
+            if (output !== 'terminal')
+                throw new CliUsageError('Choose only one output format.');
+            output = 'sarif';
+        }
+        else if (argument === '--owned-domain') {
+            if (ownedDomain)
+                throw new CliUsageError('--owned-domain may be supplied only once.');
+            ownedDomain = true;
+        }
         else if (argument === '--selectors') {
             if (selectorText !== null)
                 throw new CliUsageError('--selectors may be supplied only once.');
@@ -802,85 +951,21 @@ function parsePostureArguments(argv) {
     }
     if (quiet && output !== 'terminal')
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'posture', domain, output, quiet, color, selectorText, retiredSelectorText, mailProfile };
+    if (output === 'sarif' && !ownedDomain)
+        throw new CliUsageError('--sarif requires --owned-domain to confirm the passive posture target is controlled by the operator.');
+    return { action: 'posture', domain, output, quiet, color, selectorText, retiredSelectorText, mailProfile, ownedDomain };
 }
 function parseHttpArguments(argv) {
-    let domain = null;
-    let output = 'terminal';
-    let quiet = false;
-    let color = true;
-    for (const argument of argv) {
-        if (argument === '--json') {
-            if (output !== 'terminal')
-                throw new CliUsageError('--json may be supplied only once.');
-            output = 'json';
-        }
-        else if (argument === '--quiet')
-            quiet = true;
-        else if (argument === '--no-color')
-            color = false;
-        else if (argument.startsWith('-'))
-            throw new CliUsageError(`Unknown option "${argument}".`);
-        else if (domain === null)
-            domain = argument;
-        else
-            throw new CliUsageError('http accepts one domain.');
-    }
-    if (quiet && output !== 'terminal')
-        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'http', domain, output, quiet, color };
+    const { source: domain, ...options } = parseSingleJsonInput(argv, 'http accepts one domain.');
+    return { action: 'http', domain, ...options };
 }
 function parseTlsArguments(argv) {
-    let hostname = null;
-    let output = 'terminal';
-    let quiet = false;
-    let color = true;
-    for (const argument of argv) {
-        if (argument === '--json') {
-            if (output !== 'terminal')
-                throw new CliUsageError('--json may be supplied only once.');
-            output = 'json';
-        }
-        else if (argument === '--quiet')
-            quiet = true;
-        else if (argument === '--no-color')
-            color = false;
-        else if (argument.startsWith('-'))
-            throw new CliUsageError(`Unknown option "${argument}".`);
-        else if (hostname === null)
-            hostname = argument;
-        else
-            throw new CliUsageError('tls accepts one hostname.');
-    }
-    if (quiet && output !== 'terminal')
-        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'tls', hostname, output, quiet, color };
+    const { source: hostname, ...options } = parseSingleJsonInput(argv, 'tls accepts one hostname.');
+    return { action: 'tls', hostname, ...options };
 }
 function parseCompareArguments(argv) {
-    let source = null;
-    let output = 'terminal';
-    let quiet = false;
-    let color = true;
-    for (const argument of argv) {
-        if (argument === '--json') {
-            if (output !== 'terminal')
-                throw new CliUsageError('--json may be supplied only once.');
-            output = 'json';
-        }
-        else if (argument === '--quiet')
-            quiet = true;
-        else if (argument === '--no-color')
-            color = false;
-        else if (argument.startsWith('-'))
-            throw new CliUsageError(`Unknown option "${argument}".`);
-        else if (source === null)
-            source = argument;
-        else
-            throw new CliUsageError('compare accepts one optional lookup JSON file. Otherwise pipe one lookup document on stdin.');
-    }
-    if (quiet && output !== 'terminal')
-        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'compare', source, output, quiet, color };
+    const parsed = parseSingleJsonInput(argv, 'compare accepts one optional lookup JSON file. Otherwise pipe one lookup document on stdin.');
+    return { action: 'compare', ...parsed };
 }
 function parsePageCompareArguments(argv) {
     const parsed = parseTwoFileComparisonArguments(argv, 'page-compare');
@@ -915,35 +1000,14 @@ function parseTwoFileComparisonArguments(argv, command) {
     return { leftSource: sources[0], rightSource: sources[1], output, quiet, color };
 }
 function parseMailReviewArguments(argv) {
-    let source = null;
-    let output = 'terminal';
-    let quiet = false;
-    let color = true;
-    for (const argument of argv) {
-        if (argument === '--json') {
-            if (output !== 'terminal')
-                throw new CliUsageError('--json may be supplied only once.');
-            output = 'json';
-        }
-        else if (argument === '--quiet')
-            quiet = true;
-        else if (argument === '--no-color')
-            color = false;
-        else if (argument.startsWith('-'))
-            throw new CliUsageError(`Unknown option "${argument}".`);
-        else if (source === null)
-            source = argument;
-        else
-            throw new CliUsageError('mail-review accepts one optional Bulk JSON or JSONL input file.');
-    }
-    if (quiet && output !== 'terminal')
-        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'mail-review', source, output, quiet, color };
+    const parsed = parseSingleJsonInput(argv, 'mail-review accepts one optional Bulk JSON or JSONL input file.');
+    return { action: 'mail-review', ...parsed };
 }
 function parseReviewEvidenceArguments(argv) {
     let source = null;
     let mmdbSource = null;
     let output = 'terminal';
+    let strictExit = false;
     let quiet = false;
     let color = true;
     for (let index = 0; index < argv.length; index += 1) {
@@ -961,6 +1025,11 @@ function parseReviewEvidenceArguments(argv) {
                 throw new CliUsageError('--mmdb requires one database file and may be supplied only once.');
             mmdbSource = value;
         }
+        else if (argument === '--strict-exit') {
+            if (strictExit)
+                throw new CliUsageError('--strict-exit may be supplied only once.');
+            strictExit = true;
+        }
         else if (argument === '--quiet')
             quiet = true;
         else if (argument === '--no-color')
@@ -974,19 +1043,41 @@ function parseReviewEvidenceArguments(argv) {
     }
     if (quiet && output !== 'terminal')
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'review-evidence', source, mmdbSource, output, quiet, color };
+    return { action: 'review-evidence', source, mmdbSource, output, strictExit, quiet, color };
 }
-function parseDomainControlArguments(argv) {
+function parseBriefArguments(argv) {
+    const parsed = parseSingleJsonInput(argv, 'brief accepts one optional saved Lookup file.');
+    return { action: 'brief', ...parsed };
+}
+function parseCasePackArguments(argv) {
     let source = null;
     let output = 'terminal';
+    let audience = null;
+    let reviewed = false;
     let quiet = false;
     let color = true;
-    for (const argument of argv) {
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (argument === undefined)
+            break;
         if (argument === '--json') {
             if (output !== 'terminal')
                 throw new CliUsageError('--json may be supplied only once.');
             output = 'json';
         }
+        else if (argument === '--audience') {
+            if (audience !== null)
+                throw new CliUsageError('--audience may be supplied only once.');
+            const value = argv[++index];
+            if (!['internal', 'trusted', 'public'].includes(value || ''))
+                throw new CliUsageError('--audience requires internal, trusted, or public.');
+            audience = value;
+        }
+        else if (argument === '--reviewed') {
+            if (reviewed)
+                throw new CliUsageError('--reviewed may be supplied only once.');
+            reviewed = true;
+        }
         else if (argument === '--quiet')
             quiet = true;
         else if (argument === '--no-color')
@@ -996,23 +1087,60 @@ function parseDomainControlArguments(argv) {
         else if (source === null)
             source = argument;
         else
-            throw new CliUsageError('domain-control accepts one optional versioned JSON input file.');
+            throw new CliUsageError('case-pack accepts one optional case-export file.');
     }
+    if (audience === null)
+        throw new CliUsageError('case-pack requires --audience internal, trusted, or public.');
     if (quiet && output !== 'terminal')
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'domain-control', source, output, quiet, color };
+    return { action: 'case-pack', source, output, audience, reviewed, quiet, color };
 }
-function parseAssuranceArguments(argv) {
+function parseMonitorOnceArguments(argv) {
     let source = null;
+    let previousSource = null;
     let output = 'terminal';
+    let limit = 20;
+    let concurrency = 2;
+    let failOn = null;
     let quiet = false;
     let color = true;
-    for (const argument of argv) {
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (argument === undefined)
+            break;
         if (argument === '--json') {
             if (output !== 'terminal')
                 throw new CliUsageError('--json may be supplied only once.');
             output = 'json';
         }
+        else if (argument === '--junit') {
+            if (output !== 'terminal')
+                throw new CliUsageError('Choose only one output format.');
+            output = 'junit';
+        }
+        else if (argument === '--previous') {
+            if (previousSource !== null)
+                throw new CliUsageError('--previous may be supplied only once.');
+            const value = argv[++index];
+            if (!value || value.startsWith('-'))
+                throw new CliUsageError('--previous requires one prior monitor snapshot file.');
+            previousSource = value;
+        }
+        else if (argument === '--limit' || argument === '--concurrency') {
+            const value = Number(argv[++index]);
+            const maximum = argument === '--limit' ? 20 : 3;
+            if (!Number.isSafeInteger(value) || value < 1 || value > maximum)
+                throw new CliUsageError(`${argument} requires an integer from 1 to ${maximum}.`);
+            if (argument === '--limit')
+                limit = value;
+            else
+                concurrency = value;
+        }
+        else if (argument === '--fail-on') {
+            if (failOn !== null)
+                throw new CliUsageError('--fail-on may be supplied only once.');
+            failOn = parseCliFailPolicies(argv[++index]);
+        }
         else if (argument === '--quiet')
             quiet = true;
         else if (argument === '--no-color')
@@ -1022,11 +1150,23 @@ function parseAssuranceArguments(argv) {
         else if (source === null)
             source = argument;
         else
-            throw new CliUsageError('assurance accepts one optional versioned JSON input file.');
+            throw new CliUsageError('monitor-once accepts one optional domain-control manifest file.');
     }
     if (quiet && output !== 'terminal')
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'assurance', source, output, quiet, color };
+    return { action: 'monitor-once', source, previousSource, output, limit, concurrency, quiet, color, ...(failOn ? { failOn } : {}) };
+}
+function parseDomainControlArguments(argv) {
+    const parsed = parseSingleJsonInput(argv, 'domain-control accepts one optional versioned JSON input file.');
+    return { action: 'domain-control', ...parsed };
+}
+function parseAssuranceArguments(argv) {
+    const parsed = parseSingleJsonInput(argv, 'assurance accepts one optional versioned JSON input file.');
+    return { action: 'assurance', ...parsed };
+}
+function parseChangePacketArguments(argv) {
+    const parsed = parseSingleJsonInput(argv, 'change-packet accepts one optional versioned JSON input file.');
+    return { action: 'change-packet', ...parsed };
 }
 function parseSharingReviewArguments(argv) {
     let source = null;
@@ -1134,6 +1274,54 @@ function parseWorkflowPlanArguments(argv) {
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
     return { action: 'workflow-plan', recipe: recipe, subject: positional[1], output, quiet, color };
 }
+function parseWorkflowRunArguments(argv) {
+    const positional = [];
+    let resumeSource = null;
+    let approveNetwork = false;
+    let output = 'terminal';
+    let quiet = false;
+    let color = true;
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (argument === undefined)
+            break;
+        if (argument === '--json') {
+            if (output !== 'terminal')
+                throw new CliUsageError('--json may be supplied only once.');
+            output = 'json';
+        }
+        else if (argument === '--resume') {
+            if (resumeSource !== null)
+                throw new CliUsageError('--resume may be supplied only once.');
+            const value = argv[++index];
+            if (!value || value.startsWith('-'))
+                throw new CliUsageError('--resume requires one prior workflow-run state file.');
+            resumeSource = value;
+        }
+        else if (argument === '--approve-network') {
+            if (approveNetwork)
+                throw new CliUsageError('--approve-network may be supplied only once.');
+            approveNetwork = true;
+        }
+        else if (argument === '--quiet')
+            quiet = true;
+        else if (argument === '--no-color')
+            color = false;
+        else if (argument.startsWith('-'))
+            throw new CliUsageError(`Unknown option "${argument}".`);
+        else
+            positional.push(argument);
+    }
+    if (positional.length !== 2)
+        throw new CliUsageError('workflow-run requires one fixed recipe and one subject.');
+    const recipe = positional[0];
+    if (!INVESTIGATION_PLAN_RECIPES.includes(recipe)) {
+        throw new CliUsageError(`workflow-run recipe must be one of: ${INVESTIGATION_PLAN_RECIPES.join(', ')}.`);
+    }
+    if (quiet && output !== 'terminal')
+        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
+    return { action: 'workflow-run', recipe: recipe, subject: positional[1], resumeSource, approveNetwork, output, quiet, color };
+}
 function parseDiffArguments(argv) {
     let leftSource = null;
     let rightSource = null;
@@ -1228,108 +1416,47 @@ function parseTimelineArguments(argv) {
     return { action: 'timeline', sources, output, quiet, color };
 }
 function parseRegistrySupportArguments(argv) {
-    let target = null;
-    let output = 'terminal';
-    let quiet = false;
-    let color = true;
-    for (const argument of argv) {
-        if (argument === '--json') {
-            if (output !== 'terminal')
-                throw new CliUsageError('--json may be supplied only once.');
-            output = 'json';
-        }
-        else if (argument === '--quiet')
-            quiet = true;
-        else if (argument === '--no-color')
-            color = false;
-        else if (argument.startsWith('-'))
-            throw new CliUsageError(`Unknown option "${argument}".`);
-        else if (target === null)
-            target = argument;
-        else
-            throw new CliUsageError('registry-support accepts one domain or suffix.');
-    }
-    if (quiet && output !== 'terminal')
-        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'registry-support', target, output, quiet, color };
+    const { source: target, ...options } = parseSingleJsonInput(argv, 'registry-support accepts one domain or suffix.');
+    return { action: 'registry-support', target, ...options };
 }
 function parseRegistryDoctorArguments(argv) {
-    let source = null;
-    let output = 'terminal';
-    let quiet = false;
-    let color = true;
-    for (const argument of argv) {
-        if (argument === '--json') {
-            if (output !== 'terminal')
-                throw new CliUsageError('--json may be supplied only once.');
-            output = 'json';
-        }
-        else if (argument === '--quiet')
-            quiet = true;
-        else if (argument === '--no-color')
-            color = false;
-        else if (argument.startsWith('-'))
-            throw new CliUsageError(`Unknown option "${argument}".`);
-        else if (source === null)
-            source = argument;
+    const parsed = parseSingleJsonInput(argv, 'registry-doctor accepts one optional saved Lookup JSON file.');
+    return { action: 'registry-doctor', ...parsed };
+}
+function parseRegistryCohortArguments(argv) {
+    const parsed = parseSingleJsonInput(argv, 'registry-cohort accepts one optional JSON or JSONL input file.');
+    return { action: 'registry-cohort', ...parsed };
+}
+function parseRegistryScaffoldArguments(argv) {
+    let profile = '';
+    let suffix = '';
+    let scenario = '';
+    for (let index = 0; index < argv.length; index += 2) {
+        const option = argv[index];
+        const value = argv[index + 1];
+        if (!value)
+            throw new CliUsageError(`${option || 'Option'} requires a value.`);
+        if (option === '--profile' && !profile)
+            profile = value;
+        else if (option === '--suffix' && !suffix)
+            suffix = value;
+        else if (option === '--scenario' && !scenario)
+            scenario = value;
         else
-            throw new CliUsageError('registry-doctor accepts one optional saved Lookup JSON file.');
+            throw new CliUsageError(`Unknown or repeated option "${option || ''}".`);
     }
-    if (quiet && output !== 'terminal')
-        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'registry-doctor', source, output, quiet, color };
+    if (!profile || !suffix || !['registered', 'not_found', 'inconclusive'].includes(scenario)) {
+        throw new CliUsageError('registry-scaffold requires --profile, --suffix, and --scenario <registered|not_found|inconclusive>.');
+    }
+    return { action: 'registry-scaffold', profile, suffix, scenario: scenario };
 }
 function parseRiskCalibrateArguments(argv) {
-    let source = null;
-    let output = 'terminal';
-    let quiet = false;
-    let color = true;
-    for (const argument of argv) {
-        if (argument === '--json') {
-            if (output !== 'terminal')
-                throw new CliUsageError('--json may be supplied only once.');
-            output = 'json';
-        }
-        else if (argument === '--quiet')
-            quiet = true;
-        else if (argument === '--no-color')
-            color = false;
-        else if (argument.startsWith('-'))
-            throw new CliUsageError(`Unknown option "${argument}".`);
-        else if (source === null)
-            source = argument;
-        else
-            throw new CliUsageError('risk-calibrate accepts one optional dataset file. Otherwise pipe one dataset on stdin.');
-    }
-    if (quiet && output !== 'terminal')
-        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'risk-calibrate', source, output, quiet, color };
+    const parsed = parseSingleJsonInput(argv, 'risk-calibrate accepts one optional dataset file. Otherwise pipe one dataset on stdin.');
+    return { action: 'risk-calibrate', ...parsed };
 }
 function parseLookalikeCalibrateArguments(argv) {
-    let source = null;
-    let output = 'terminal';
-    let quiet = false;
-    let color = true;
-    for (const argument of argv) {
-        if (argument === '--json') {
-            if (output !== 'terminal')
-                throw new CliUsageError('--json may be supplied only once.');
-            output = 'json';
-        }
-        else if (argument === '--quiet')
-            quiet = true;
-        else if (argument === '--no-color')
-            color = false;
-        else if (argument.startsWith('-'))
-            throw new CliUsageError(`Unknown option "${argument}".`);
-        else if (source === null)
-            source = argument;
-        else
-            throw new CliUsageError('lookalike-calibrate accepts one optional reviewed dataset JSON file.');
-    }
-    if (quiet && output !== 'terminal')
-        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'lookalike-calibrate', source, output, quiet, color };
+    const parsed = parseSingleJsonInput(argv, 'lookalike-calibrate accepts one optional reviewed dataset JSON file.');
+    return { action: 'lookalike-calibrate', ...parsed };
 }
 function parseVerifyArtifactArguments(argv) {
     let source = null;
@@ -1371,30 +1498,8 @@ function parseVerifyArtifactArguments(argv) {
     return { action: 'verify-artifact', source, passphraseSource, output, quiet, color };
 }
 function parseSourceReportArguments(argv) {
-    let source = null;
-    let output = 'terminal';
-    let quiet = false;
-    let color = true;
-    for (const argument of argv) {
-        if (argument === '--json') {
-            if (output !== 'terminal')
-                throw new CliUsageError('--json may be supplied only once.');
-            output = 'json';
-        }
-        else if (argument === '--quiet')
-            quiet = true;
-        else if (argument === '--no-color')
-            color = false;
-        else if (argument.startsWith('-'))
-            throw new CliUsageError(`Unknown option "${argument}".`);
-        else if (source === null)
-            source = argument;
-        else
-            throw new CliUsageError('source-report accepts one optional JSON file. Otherwise pipe lookup documents on stdin.');
-    }
-    if (quiet && output !== 'terminal')
-        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'source-report', source, output, quiet, color };
+    const parsed = parseSingleJsonInput(argv, 'source-report accepts one optional JSON file. Otherwise pipe lookup documents on stdin.');
+    return { action: 'source-report', ...parsed };
 }
 function parseExportArguments(argv) {
     let source = null;