@slicedearth/whoisleuth-cli 1.43.0 → 1.47.4

package/DISCLOSURE

@@ -8,9 +8,13 @@ can have both legitimate and potentially harmful uses.
 WHOISleuth is intended for authorised defensive investigation, abuse response,
 threat research, domain acquisition due diligence, asset review, and education.
 Network collection is initiated explicitly by the operator, uses bounded
-requests, and keeps source provenance and incomplete results visible. The tool
-does not exploit targets, bypass access controls, submit credentials, execute
-remote page scripts, or automate enforcement actions.
+requests, and keeps source provenance and incomplete results visible. Hosted
+and distributable collection does not exploit targets, bypass access controls,
+submit credentials, execute remote page scripts, or automate enforcement
+actions. The separate repo-local rendered-capture package is an explicit
+authorised exception: it executes page JavaScript in a disposable,
+network-bounded browser and writes only a local screenshot plus sanitised
+digest and manifest artefacts for operator-controlled review and deletion.
 
 Operators are responsible for using WHOISleuth only on systems and data they
 are authorised to examine and in accordance with applicable laws, provider

package/NOTICE

@@ -32,10 +32,11 @@ warning-lists are available under CC0 1.0 Universal or the BSD 2-Clause
 "Simplified" License. Source:
 https://github.com/MISP/misp-warninglists
 
-The exact locked production-dependency inventory and the licence documents
-distributed by those packages are retained in
-frontend/static/third-party-notices.txt. The same file is served by the static
-website at /third-party-notices.txt and is checked for lockfile drift in CI.
+The exact locked production-dependency inventories and licence documents are
+distributed as third-party-notices.txt. The website inventory is served at
+/third-party-notices.txt; the installed CLI contains its own notice file for
+only the CLI runtime dependency closure. Both are generated from the reviewed
+lockfile, and the website inventory is checked for lockfile drift in CI.
 
 The generated Unicode confusable projection is derived from Unicode UTS #39
 data file confusables.txt, Unicode version 17.0.0.

package/README.md

@@ -59,6 +59,8 @@ node bin/whoisleuth.mts discover example.test --dictionary private-terms.txt --s
 node bin/whoisleuth.mts discover-scan example.test --scan-limit 50 --checkpoint candidate-scan.json --json
 node bin/whoisleuth.mts page-compare official.json candidate.json --json
 node bin/whoisleuth.mts mail-review bulk.json --json
+node bin/whoisleuth.mts dnssec-validate example.test --resolver "$PUBLIC_RESOLVER_IP" --trust-anchor anchor.json --owned-or-authorized --json
+node bin/whoisleuth.mts mail-transport selected-mx.json --resolver "$PUBLIC_RESOLVER_IP" --trust-anchor anchor.json --owned-or-authorized --active-probe --json
 node bin/whoisleuth.mts domain-control domain-control-input.json --json
 node bin/whoisleuth.mts assurance domain-assurance-input.json --json
 node bin/whoisleuth.mts sharing-review response-packet.json --marking amber --recipient-scope organization --purpose 'Reviewed handoff' --human-reviewed --personal-data-reviewed --redactions-confirmed --json
@@ -88,10 +90,25 @@ explicit and are never interpreted as evidence of safety or absence.
 `lookup --plan` classifies a target and explains the selected source families
 and disclosures without making a network request. `commands --json` exposes the
 installed command contracts for local wrappers without running collection.
+The isolated `dnssec-validate` and `mail-transport` actions are not part of
+Lookup, Bulk, monitoring, or recipes. Each run requires explicit
+owned-or-authorised acknowledgement; mail transport also requires a separate
+active-probe acknowledgement and never sends a message, authenticates, tests
+relay, or enumerates recipients or mailboxes. Its output distinguishes selected,
+public-revalidated, and connected addresses and explicitly reports that A, AAAA,
+and CNAME authentication was not evaluated after a candidate is retained, or
+that address authentication is unavailable when no candidate exists; only
+confirmed connections can form address relationship leads. If a DANE-TA TLSA
+usage 2 association is published, active collection retains only the observed
+leaf certificate and leaves that comparison partial without certificate-path
+construction and trust-anchor path validation. SMTP relay PKIX-TA usage 0 and
+PKIX-EE usage 1 records are retained as unsupported and cannot complete SMTP
+DANE assurance; a separate usage 3 match remains eligible. Saved
+Lookup JSON is byte-, nesting-, entry-, and per-container-bounded before parsing and portable export.
 Focused command help and the generated manual label every operation as offline
 or networked and state its target, input, and concurrency boundaries. The
-packaged [dual-use disclosure](DISCLOSURE) defines the supported defensive use
-of those capabilities.
+packaged [dual-use disclosure](https://github.com/slicedearth/whoisleuth/blob/main/DISCLOSURE)
+defines the supported defensive use of those capabilities.
 
 Interactive output uses restrained semantic colour, width-aware wrapping, and
 stderr-only progress for slower collection. Redirected and machine-readable
@@ -101,9 +118,13 @@ offline unless `--network` is explicitly supplied, and completion scripts are
 printed without modifying shell configuration. Commands can use atomic private
 `--output` files, Lookup can emit strict automation exits and target-free
 versioned progress events, and Bulk can resume an exact validated compact
-checkpoint. A checkpoint write failure preserves completed output and returns
+checkpoint. Checkpoint schema 2 preserves each current row's observation time;
+legacy schema-1 rows remain readable with unknown observation time rather than
+being restamped on resume. Bulk machine output schema 3 distinguishes current
+and resumed rows. A checkpoint write failure preserves completed output and returns
 the partial-result exit code. Ctrl-C suppresses partial final output and
-returns exit code 130; a second interrupt performs best-effort temporary-file
+returns exit code 130. SIGTERM uses the same graceful cleanup path and returns
+143; a second interrupt performs best-effort temporary-file
 cleanup before exiting immediately.
 Strict local profiles can supply only safe presentation, Fast-mode,
 concurrency, and observer defaults; command-line options override them.
@@ -123,12 +144,48 @@ non-comparable evidence separate; the labels are context, not proof of
 independence. `registry-doctor`, `assurance`, `sharing-review`, and
 `lookalike-calibrate` add offline compatibility, change/recovery, sharing, and
 review-yield workflows without contacting the hosted application.
-`registry-cohort` aggregates target-free publication-quality counts from saved
-Lookups, while `registry-scaffold` produces a sanitised synthetic contributor
-fixture. `brief` and `case-pack` create bounded local handoffs, `monitor-once`
-runs one explicit control review rather than a daemon, and `workflow-run`
-executes only installed fixed-recipe steps with per-run network approval and
-analyst-selection pauses.
+`registry-cohort` emits target-free publication-quality timelines from either
+saved Lookups or one unmixed family of retained version-1/version-2 cohort
+reports; it never sums overlapping retained samples into independent
+consistency. `registry-scaffold` produces a sanitised synthetic contributor
+fixture. `diff` preserves saved-Lookup output and also emits a bounded
+comparison ledger for explicitly paired Bulk sessions or domain portfolios.
+`verify-artifact --manifest ... --manifest-entry ...` separates exact retained
+byte identity from canonical-only or mismatched identity. `brief` and
+`case-pack` create bounded local handoffs, `monitor-once` runs one explicit
+control review rather than a daemon, and `workflow-run` executes only installed
+fixed-recipe steps with per-run network approval and analyst-selection pauses.
+The current schema-26 JSON produced by `export` is accepted directly by
+`verify-artifact` and reported as `structure_valid`. It has no embedded checksum
+or signature, so exact retained bytes require a verified investigation manifest
+entry. The export can contain a bounded privacy-projected registry RDAP
+publication, normalised WHOIS values, and bounded contacts and should be
+reviewed before sharing. Request and response headers, cookies, session and
+credential fields, and credential-bearing or query-bearing URLs are excluded.
+Schema 25 remains readable through its historical wrapper contract: retained
+diagnostics are authoritative, unavailable wrapper data is suppressed during
+replay, and other contradictions fail closed. Verification and browser replay share a 5 MiB,
+20,000-entry, 24-level portable boundary.
+
+Lookup can also export a version-1 `whoisleuth.lookup-claim-passport` for one
+selected readiness statement. `verify-artifact` checks its strict bounded
+structure and sorted-json-v2 digest; `interchange-report` describes the exact
+source-state fields it preserves and the raw payload, contact, page-value,
+request-path, credential, browser-store, and signer-authentication fields it
+excludes.
+
+Current `case-pack` output keeps its version-1 envelope. Trusted and internal
+audiences preserve exact analyst-selected Case-to-Brand Profile identifiers;
+public output clears them from cases and embedded reports and discloses the
+bounded `brandProfileReferencesOmitted` count. Verification also enforces the
+actual audience projection after digest validation, rejects re-signed
+sensitive-field leaks at expected or unexpected nested paths, and binds each
+report to its canonical top-level Case and exact manifest counts. Current
+schema-12 input must survive bounded normalisation exactly, provide safe unique
+Case identities and a valid unique at-most-eight identifier list, and use
+report v8. Schema 11 uses report v7; valid collections through schema 10 remain
+compatible with supported reports through v6 and without later branch,
+reference, or omission-count fields.
 
 Bulk also supports fixed-column CSV, domain-only or exact-query output,
 registered, inconclusive, and hard-failure output filters, and bounded A, AAAA,

package/bin/whoisleuth.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import EXIT_CODES from "../cli/exit-codes.mjs";
 for (const stream of [process.stdout, process.stderr]) {
     stream.on('error', (error) => {
         if (error.code === 'EPIPE')
@@ -27,37 +28,49 @@ else {
         import("../cli/runner.mjs"),
     ]);
     let resolvedArgv;
+    let profileResolutionFailed = false;
     try {
         resolvedArgv = await configModule.resolveCliProfileArguments(argv);
     }
     catch (error) {
         process.stderr.write(`Usage error: ${errorsModule.boundedCliErrorMessage(error, 'Invalid CLI profile')}\n`);
-        process.exitCode = 64;
+        process.exitCode = EXIT_CODES.USAGE;
+        profileResolutionFailed = true;
         resolvedArgv = [];
     }
     const cancellation = new AbortController();
     let interruptionCount = 0;
-    const interrupt = () => {
+    let requestedExitCode = 130;
+    const interrupt = (signal) => {
         interruptionCount += 1;
-        if (interruptionCount === 1)
+        if (interruptionCount === 1) {
+            requestedExitCode = signal === 'SIGTERM' ? 143 : 130;
             cancellation.abort(new DOMException('Aborted', 'AbortError'));
+        }
         else {
             outputModule.cleanupPendingOutputFilesSync();
-            process.exit(130);
+            process.exit(requestedExitCode);
         }
     };
-    process.on('SIGINT', interrupt);
-    const execution = resolvedArgv.length ? runnerModule.runCli(resolvedArgv, { signal: cancellation.signal }) : Promise.resolve(process.exitCode || 64);
+    const onSigint = () => interrupt('SIGINT');
+    const onSigterm = () => interrupt('SIGTERM');
+    process.on('SIGINT', onSigint);
+    process.on('SIGTERM', onSigterm);
+    const execution = profileResolutionFailed
+        ? Promise.resolve(process.exitCode || EXIT_CODES.USAGE)
+        : runnerModule.runCli(resolvedArgv, { signal: cancellation.signal });
     execution.then((code) => {
         if (code === 130) {
-            process.removeListener('SIGINT', interrupt);
-            process.exit(130);
+            process.removeListener('SIGINT', onSigint);
+            process.removeListener('SIGTERM', onSigterm);
+            process.exit(requestedExitCode);
         }
         process.exitCode = code;
     }).catch((error) => {
         process.stderr.write(`Internal CLI error: ${errorsModule.boundedCliErrorMessage(error)}\n`);
         process.exitCode = 70;
     }).finally(() => {
-        process.removeListener('SIGINT', interrupt);
+        process.removeListener('SIGINT', onSigint);
+        process.removeListener('SIGTERM', onSigterm);
     });
 }

package/cli/arguments.mjs

@@ -21,6 +21,8 @@ const CLI_COMMANDS = [
     'posture',
     'http',
     'tls',
+    'dnssec-validate',
+    'mail-transport',
     'registry-support',
     'registry-doctor',
     'registry-cohort',
@@ -28,6 +30,7 @@ const CLI_COMMANDS = [
     'risk-calibrate',
     'lookalike-calibrate',
     'verify-artifact',
+    'interchange-report',
     'inspect-archive',
     'sign-artifact',
     'verify-signature',
@@ -156,6 +159,10 @@ function parseCliArgumentsCore(argv) {
         return parseHttpArguments(argv.slice(1));
     if (command === 'tls')
         return parseTlsArguments(argv.slice(1));
+    if (command === 'dnssec-validate')
+        return parseDnssecValidateArguments(argv.slice(1));
+    if (command === 'mail-transport')
+        return parseMailTransportArguments(argv.slice(1));
     if (command === 'registry-support')
         return parseRegistrySupportArguments(argv.slice(1));
     if (command === 'registry-doctor')
@@ -170,6 +177,8 @@ function parseCliArgumentsCore(argv) {
         return parseLookalikeCalibrateArguments(argv.slice(1));
     if (command === 'verify-artifact')
         return parseVerifyArtifactArguments(argv.slice(1));
+    if (command === 'interchange-report')
+        return parseInterchangeReportArguments(argv.slice(1));
     if (command === 'inspect-archive')
         return parseInspectArchiveArguments(argv.slice(1));
     if (command === 'sign-artifact')
@@ -223,6 +232,7 @@ function parseCliArgumentsCore(argv) {
     let strictExit = false;
     let events = false;
     let plan = false;
+    let includeAttribution = true;
     let failOn = null;
     let observerLabel = null;
     let vantageLabel = null;
@@ -279,6 +289,11 @@ function parseCliArgumentsCore(argv) {
                 throw new CliUsageError('--plan may be supplied only once.');
             plan = true;
         }
+        else if (argument === '--no-attribution') {
+            if (!includeAttribution)
+                throw new CliUsageError('--no-attribution may be supplied only once.');
+            includeAttribution = false;
+        }
         else if (argument === '--fail-on') {
             if (failOn !== null)
                 throw new CliUsageError('--fail-on may be supplied only once.');
@@ -315,12 +330,15 @@ function parseCliArgumentsCore(argv) {
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
     if (detailSet && output !== 'terminal')
         throw new CliUsageError('--summary and --verbose apply only to terminal output.');
+    if (!includeAttribution && output !== 'markdown' && output !== 'html') {
+        throw new CliUsageError('--no-attribution applies only to Markdown or HTML reports.');
+    }
     if (plan && !['terminal', 'json'].includes(output))
         throw new CliUsageError('--plan supports terminal or JSON output only.');
     if (plan && (detailSet || strictExit || events || quiet || failOn !== null)) {
         throw new CliUsageError('--plan cannot be combined with detail, strict-exit, event, or quiet options.');
     }
-    return { action: 'lookup', query, output, deep, detail, strictExit, events, plan, observerLabel, vantageLabel, quiet, color, ...(failOn ? { failOn } : {}) };
+    return { action: 'lookup', query, output, deep, detail, strictExit, events, plan, includeAttribution, observerLabel, vantageLabel, quiet, color, ...(failOn ? { failOn } : {}) };
 }
 function parseCompletionArguments(argv) {
     if (argv.length !== 1 || !['bash', 'zsh', 'fish', 'powershell'].includes(argv[0] || '')) {
@@ -963,6 +981,122 @@ function parseTlsArguments(argv) {
     const { source: hostname, ...options } = parseSingleJsonInput(argv, 'tls accepts one hostname.');
     return { action: 'tls', hostname, ...options };
 }
+function parseDnssecValidateArguments(argv) {
+    let target = null;
+    let resolver = null;
+    let trustAnchorSource = null;
+    let ownedOrAuthorized = false;
+    let output = 'terminal';
+    let quiet = false;
+    let color = true;
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (argument === '--resolver' || argument === '--trust-anchor') {
+            const selected = argument === '--resolver' ? resolver : trustAnchorSource;
+            if (selected !== null)
+                throw new CliUsageError(`${argument} may be supplied only once.`);
+            const value = argv[++index];
+            if (!value || value.startsWith('-'))
+                throw new CliUsageError(`${argument} requires one bounded value.`);
+            if (argument === '--resolver')
+                resolver = value;
+            else
+                trustAnchorSource = value;
+        }
+        else if (argument === '--owned-or-authorized') {
+            if (ownedOrAuthorized)
+                throw new CliUsageError('--owned-or-authorized may be supplied only once.');
+            ownedOrAuthorized = true;
+        }
+        else if (argument === '--json') {
+            if (output !== 'terminal')
+                throw new CliUsageError('--json may be supplied only once.');
+            output = 'json';
+        }
+        else if (argument === '--quiet')
+            quiet = true;
+        else if (argument === '--no-color')
+            color = false;
+        else if (argument?.startsWith('-'))
+            throw new CliUsageError(`Unknown option "${argument}".`);
+        else if (argument && target === null)
+            target = argument;
+        else
+            throw new CliUsageError('dnssec-validate accepts one domain target.');
+    }
+    if (!target)
+        throw new CliUsageError('dnssec-validate requires one domain target.');
+    if (!resolver)
+        throw new CliUsageError('dnssec-validate requires --resolver <public-IP>.');
+    if (!trustAnchorSource)
+        throw new CliUsageError('dnssec-validate requires --trust-anchor <anchor.json>.');
+    if (!ownedOrAuthorized)
+        throw new CliUsageError('dnssec-validate requires --owned-or-authorized for every run.');
+    if (quiet && output !== 'terminal')
+        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
+    return { action: 'dnssec-validate', target, resolver, trustAnchorSource, ownedOrAuthorized: true, output, quiet, color };
+}
+function parseMailTransportArguments(argv) {
+    let source = null;
+    let resolver = null;
+    let trustAnchorSource = null;
+    let ownedOrAuthorized = false;
+    let activeProbeAcknowledged = false;
+    let output = 'terminal';
+    let quiet = false;
+    let color = true;
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (argument === '--resolver' || argument === '--trust-anchor') {
+            const selected = argument === '--resolver' ? resolver : trustAnchorSource;
+            if (selected !== null)
+                throw new CliUsageError(`${argument} may be supplied only once.`);
+            const value = argv[++index];
+            if (!value || value.startsWith('-'))
+                throw new CliUsageError(`${argument} requires one bounded value.`);
+            if (argument === '--resolver')
+                resolver = value;
+            else
+                trustAnchorSource = value;
+        }
+        else if (argument === '--owned-or-authorized') {
+            if (ownedOrAuthorized)
+                throw new CliUsageError('--owned-or-authorized may be supplied only once.');
+            ownedOrAuthorized = true;
+        }
+        else if (argument === '--active-probe') {
+            if (activeProbeAcknowledged)
+                throw new CliUsageError('--active-probe may be supplied only once.');
+            activeProbeAcknowledged = true;
+        }
+        else if (argument === '--json') {
+            if (output !== 'terminal')
+                throw new CliUsageError('--json may be supplied only once.');
+            output = 'json';
+        }
+        else if (argument === '--quiet')
+            quiet = true;
+        else if (argument === '--no-color')
+            color = false;
+        else if (argument?.startsWith('-'))
+            throw new CliUsageError(`Unknown option "${argument}".`);
+        else if (argument && source === null)
+            source = argument;
+        else
+            throw new CliUsageError('mail-transport accepts one optional versioned JSON input file.');
+    }
+    if (!resolver)
+        throw new CliUsageError('mail-transport requires --resolver <public-IP>.');
+    if (!trustAnchorSource)
+        throw new CliUsageError('mail-transport requires --trust-anchor <anchor.json>.');
+    if (!ownedOrAuthorized)
+        throw new CliUsageError('mail-transport requires --owned-or-authorized for every run.');
+    if (!activeProbeAcknowledged)
+        throw new CliUsageError('mail-transport requires --active-probe for every run.');
+    if (quiet && output !== 'terminal')
+        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
+    return { action: 'mail-transport', source, resolver, trustAnchorSource, ownedOrAuthorized: true, activeProbeAcknowledged: true, output, quiet, color };
+}
 function parseCompareArguments(argv) {
     const parsed = parseSingleJsonInput(argv, 'compare accepts one optional lookup JSON file. Otherwise pipe one lookup document on stdin.');
     return { action: 'compare', ...parsed };
@@ -1325,15 +1459,32 @@ function parseWorkflowRunArguments(argv) {
 function parseDiffArguments(argv) {
     let leftSource = null;
     let rightSource = null;
+    let leftSessionId = null;
+    let rightSessionId = null;
     let output = 'terminal';
     let quiet = false;
     let color = true;
-    for (const argument of argv) {
+    for (let index = 0; index < argv.length; index++) {
+        const argument = argv[index];
+        if (argument === undefined)
+            break;
         if (argument === '--json') {
             if (output !== 'terminal')
                 throw new CliUsageError('--json may be supplied only once.');
             output = 'json';
         }
+        else if (argument === '--left-session' || argument === '--right-session') {
+            const current = argument === '--left-session' ? leftSessionId : rightSessionId;
+            if (current !== null)
+                throw new CliUsageError(`${argument} may be supplied only once.`);
+            const value = argv[++index];
+            if (!value || !/^[A-Za-z0-9_-]{1,128}$/u.test(value))
+                throw new CliUsageError(`${argument} requires one bounded saved-session ID.`);
+            if (argument === '--left-session')
+                leftSessionId = value;
+            else
+                rightSessionId = value;
+        }
         else if (argument === '--quiet')
             quiet = true;
         else if (argument === '--no-color')
@@ -1345,15 +1496,15 @@ function parseDiffArguments(argv) {
         else if (rightSource === null)
             rightSource = argument;
         else
-            throw new CliUsageError('diff accepts exactly two saved lookup JSON files.');
+            throw new CliUsageError('diff accepts exactly two compatible retained JSON files.');
     }
     if (!leftSource || !rightSource)
-        throw new CliUsageError('diff requires exactly two saved lookup JSON files.');
+        throw new CliUsageError('diff requires exactly two compatible retained JSON files.');
     if (leftSource === rightSource)
         throw new CliUsageError('diff requires two different input files.');
     if (quiet && output !== 'terminal')
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'diff', leftSource, rightSource, output, quiet, color };
+    return { action: 'diff', leftSource, rightSource, leftSessionId, rightSessionId, output, quiet, color };
 }
 function parseReconcileArguments(argv) {
     const sources = [];
@@ -1451,8 +1602,30 @@ function parseRegistryScaffoldArguments(argv) {
     return { action: 'registry-scaffold', profile, suffix, scenario: scenario };
 }
 function parseRiskCalibrateArguments(argv) {
-    const parsed = parseSingleJsonInput(argv, 'risk-calibrate accepts one optional dataset file. Otherwise pipe one dataset on stdin.');
-    return { action: 'risk-calibrate', ...parsed };
+    let source = null;
+    let output = 'terminal';
+    let quiet = false;
+    let color = true;
+    for (const argument of argv) {
+        if (argument === '--json' || argument === '--summary-json') {
+            if (output !== 'terminal')
+                throw new CliUsageError('--json and --summary-json are mutually exclusive and may be supplied only once.');
+            output = argument === '--json' ? 'json' : 'summary_json';
+        }
+        else if (argument === '--quiet')
+            quiet = true;
+        else if (argument === '--no-color')
+            color = false;
+        else if (argument.startsWith('-'))
+            throw new CliUsageError(`Unknown option "${argument}".`);
+        else if (source === null)
+            source = argument;
+        else
+            throw new CliUsageError('risk-calibrate accepts one optional dataset file. Otherwise pipe one dataset on stdin.');
+    }
+    if (quiet && output !== 'terminal')
+        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
+    return { action: 'risk-calibrate', source, output, quiet, color };
 }
 function parseLookalikeCalibrateArguments(argv) {
     const parsed = parseSingleJsonInput(argv, 'lookalike-calibrate accepts one optional reviewed dataset JSON file.');
@@ -1461,7 +1634,10 @@ function parseLookalikeCalibrateArguments(argv) {
 function parseVerifyArtifactArguments(argv) {
     let source = null;
     let passphraseSource = null;
+    let manifestSource = null;
+    let manifestEntryId = null;
     let output = 'terminal';
+    let strictExit = false;
     let quiet = false;
     let color = true;
     for (let index = 0; index < argv.length; index++) {
@@ -1482,6 +1658,28 @@ function parseVerifyArtifactArguments(argv) {
             }
             passphraseSource = value;
         }
+        else if (argument === '--manifest') {
+            if (manifestSource !== null)
+                throw new CliUsageError('--manifest may be supplied only once.');
+            const value = argv[++index];
+            if (!value || value.startsWith('-'))
+                throw new CliUsageError('--manifest requires one bounded investigation manifest file.');
+            manifestSource = value;
+        }
+        else if (argument === '--manifest-entry') {
+            if (manifestEntryId !== null)
+                throw new CliUsageError('--manifest-entry may be supplied only once.');
+            const value = argv[++index];
+            if (!value || !/^artifact-(?:[1-9]|1[0-6])$/u.test(value)) {
+                throw new CliUsageError('--manifest-entry requires an ID from artifact-1 through artifact-16.');
+            }
+            manifestEntryId = value;
+        }
+        else if (argument === '--strict-exit') {
+            if (strictExit)
+                throw new CliUsageError('--strict-exit may be supplied only once.');
+            strictExit = true;
+        }
         else if (argument === '--quiet')
             quiet = true;
         else if (argument === '--no-color')
@@ -1493,9 +1691,50 @@ function parseVerifyArtifactArguments(argv) {
         else
             throw new CliUsageError('verify-artifact accepts one optional JSON file. Otherwise pipe one artefact on stdin.');
     }
+    if ((manifestSource === null) !== (manifestEntryId === null)) {
+        throw new CliUsageError('--manifest and --manifest-entry must be supplied together.');
+    }
+    if (quiet && output !== 'terminal')
+        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
+    return { action: 'verify-artifact', source, passphraseSource, manifestSource, manifestEntryId, output, strictExit, quiet, color };
+}
+function parseInterchangeReportArguments(argv) {
+    let source = null;
+    let passphraseSource = null;
+    let output = 'terminal';
+    let quiet = false;
+    let color = true;
+    for (let index = 0; index < argv.length; index++) {
+        const argument = argv[index];
+        if (argument === undefined)
+            break;
+        if (argument === '--json') {
+            if (output !== 'terminal')
+                throw new CliUsageError('--json may be supplied only once.');
+            output = 'json';
+        }
+        else if (argument === '--passphrase-file') {
+            if (passphraseSource !== null)
+                throw new CliUsageError('--passphrase-file may be supplied only once.');
+            const value = argv[++index];
+            if (!value || value.startsWith('-'))
+                throw new CliUsageError('--passphrase-file requires one bounded UTF-8 file.');
+            passphraseSource = value;
+        }
+        else if (argument === '--quiet')
+            quiet = true;
+        else if (argument === '--no-color')
+            color = false;
+        else if (argument.startsWith('-'))
+            throw new CliUsageError(`Unknown option "${argument}".`);
+        else if (source === null)
+            source = argument;
+        else
+            throw new CliUsageError('interchange-report accepts one optional JSON file. Otherwise pipe one artefact on stdin.');
+    }
     if (quiet && output !== 'terminal')
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'verify-artifact', source, passphraseSource, output, quiet, color };
+    return { action: 'interchange-report', source, passphraseSource, output, quiet, color };
 }
 function parseSourceReportArguments(argv) {
     const parsed = parseSingleJsonInput(argv, 'source-report accepts one optional JSON file. Otherwise pipe lookup documents on stdin.');
@@ -1504,6 +1743,7 @@ function parseSourceReportArguments(argv) {
 function parseExportArguments(argv) {
     let source = null;
     let compact = false;
+    let includeAttribution = true;
     let format = 'json';
     for (const argument of argv) {
         if (argument === '--compact') {
@@ -1511,6 +1751,11 @@ function parseExportArguments(argv) {
                 throw new CliUsageError('--compact may be supplied only once.');
             compact = true;
         }
+        else if (argument === '--no-attribution') {
+            if (!includeAttribution)
+                throw new CliUsageError('--no-attribution may be supplied only once.');
+            includeAttribution = false;
+        }
         else if (argument === '--markdown' || argument === '--html') {
             if (format !== 'json')
                 throw new CliUsageError('Choose only one evidence export format.');
@@ -1525,6 +1770,8 @@ function parseExportArguments(argv) {
     }
     if (compact && format !== 'json')
         throw new CliUsageError('--compact applies to JSON export and cannot be combined with --markdown or --html.');
-    return { action: 'export', source, format, compact };
+    if (!includeAttribution && format === 'json')
+        throw new CliUsageError('--no-attribution applies only to Markdown or HTML reports.');
+    return { action: 'export', source, format, compact, includeAttribution };
 }
 export { CLI_COMMANDS, CliUsageError, MAX_CLI_ARGUMENTS, MAX_CLI_ARGUMENT_LENGTH, parseCliArguments };