@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/cli/arguments.mjs

@@ -1,68 +1,22 @@
 import { parseInspectArchiveArguments, parseSignArtifactArguments, parseVerifySignatureArguments, } from "./evidence-command-arguments.mjs";
-import { CliUsageError } from "./errors.mjs";
-import { INVESTIGATION_PLAN_RECIPES, } from "./investigation-plan.mjs";
+import { CliUsageError, hasUnsafeCliText } from "./errors.mjs";
+import { INVESTIGATION_PLAN_RECIPES, RUNNABLE_INVESTIGATION_PLAN_RECIPES, } from "./investigation-plan.mjs";
 import { parseCliFailPolicies } from "./fail-policy.mjs";
+import { isDirectLookupTarget } from "../lib/classify.mjs";
+import { CLI_COMMANDS, cliMetaActionForInvocation, isCliCommand, } from "./command-reference.mjs";
 const MAX_CLI_ARGUMENTS = 32;
 const MAX_CLI_ARGUMENT_LENGTH = 1024;
-const CLI_COMMANDS = [
-    'completion',
-    'doctor',
-    'commands',
-    'manual',
-    'manifest',
-    'map-observations',
-    'oam-export',
-    'lookup',
-    'bulk',
-    'ct-search',
-    'ct-intake',
-    'discover',
-    'discover-scan',
-    'posture',
-    'http',
-    'tls',
-    'registry-support',
-    'registry-doctor',
-    'registry-cohort',
-    'registry-scaffold',
-    'risk-calibrate',
-    'lookalike-calibrate',
-    'verify-artifact',
-    'inspect-archive',
-    'sign-artifact',
-    'verify-signature',
-    'source-report',
-    'compare',
-    'page-compare',
-    'mail-review',
-    'review-evidence',
-    'brief',
-    'case-pack',
-    'domain-control',
-    'monitor-once',
-    'assurance',
-    'change-packet',
-    'sharing-review',
-    'workflow-plan',
-    'workflow-run',
-    'diff',
-    'reconcile',
-    'timeline',
-    'export',
-];
 function boundedArgument(value) {
-    if (typeof value !== 'string' || value.length > MAX_CLI_ARGUMENT_LENGTH || /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(value)) {
+    if (typeof value !== 'string' || value.length > MAX_CLI_ARGUMENT_LENGTH || hasUnsafeCliText(value)) {
         throw new CliUsageError('Arguments must be bounded text without control characters.');
     }
     return value;
 }
-function isCliCommand(value) {
-    return CLI_COMMANDS.includes(value);
-}
 function extractFileOutputArguments(argv) {
     const retained = [];
     let destination = null;
     let force = false;
+    let palette = null;
     for (let index = 0; index < argv.length; index++) {
         const argument = argv[index];
         if (argument === undefined)
@@ -80,19 +34,32 @@ function extractFileOutputArguments(argv) {
                 throw new CliUsageError('--force may be supplied only once.');
             force = true;
         }
+        else if (index > 0 && argument === '--palette') {
+            if (palette !== null)
+                throw new CliUsageError('--palette may be supplied only once.');
+            const value = argv[++index];
+            if (value !== 'auto' && value !== 'light' && value !== 'dark') {
+                throw new CliUsageError('--palette requires auto, light, or dark.');
+            }
+            palette = value;
+        }
         else {
             retained.push(argument);
         }
     }
     if (force && destination === null)
         throw new CliUsageError('--force requires --output.');
-    return { argv: retained, destination, force };
+    return { argv: retained, destination, force, palette };
 }
 function parseCliArguments(rawArgv) {
     if (!Array.isArray(rawArgv) || rawArgv.length > MAX_CLI_ARGUMENTS) {
         throw new CliUsageError(`At most ${MAX_CLI_ARGUMENTS} command arguments are supported.`);
     }
-    const extracted = extractFileOutputArguments(rawArgv.map(boundedArgument));
+    const boundedArguments = rawArgv.map(boundedArgument);
+    const metaAction = cliMetaActionForInvocation(boundedArguments);
+    if (metaAction)
+        return parseCliArgumentsCore(boundedArguments);
+    const extracted = extractFileOutputArguments(boundedArguments);
     const parsed = parseCliArgumentsCore(extracted.argv);
     if ('quiet' in parsed && parsed.quiet && extracted.destination !== null) {
         throw new CliUsageError('--quiet cannot be combined with --output.');
@@ -100,118 +67,53 @@ function parseCliArguments(rawArgv) {
     if ('events' in parsed && parsed.events && extracted.destination !== null) {
         throw new CliUsageError('--events cannot be combined with --output because completion must describe the final output delivery.');
     }
-    return extracted.destination === null
-        ? parsed
-        : { ...parsed, destination: extracted.destination, ...(extracted.force ? { force: true } : {}) };
+    if ('browse' in parsed && parsed.browse === true && extracted.destination !== null) {
+        throw new CliUsageError('--browse cannot be combined with --output because it requires an interactive terminal.');
+    }
+    return {
+        ...parsed,
+        ...(extracted.destination !== null ? { destination: extracted.destination } : {}),
+        ...(extracted.force ? { force: true } : {}),
+        ...(extracted.palette ? { palette: extracted.palette } : {}),
+    };
 }
 function parseCliArgumentsCore(argv) {
     if (!argv.length)
         return { action: 'help' };
     const firstArgument = argv[0] ?? '';
-    const helpRequested = argv.includes('--help') || argv.includes('-h');
-    if (helpRequested) {
+    const metaAction = cliMetaActionForInvocation(argv);
+    if (metaAction?.id === 'help') {
         if (argv.length === 1)
             return { action: 'help' };
-        if (argv.length === 2 && isCliCommand(firstArgument))
-            return { action: 'help', command: firstArgument };
+        if (argv.length === 2 && (isCliCommand(firstArgument) || isDirectLookupTarget(firstArgument))) {
+            return { action: 'help', command: isCliCommand(firstArgument) ? firstArgument : 'lookup' };
+        }
         throw new CliUsageError('Help accepts only an optional command name.');
     }
-    if (firstArgument === '--version' || firstArgument === '-V') {
+    if (metaAction?.id === 'version') {
         if (argv.length !== 1)
             throw new CliUsageError('--version does not accept other arguments.');
         return { action: 'version' };
     }
-    const command = firstArgument;
-    if (!isCliCommand(command)) {
-        const displayedCommand = command.length > 80 ? `${command.slice(0, 79)}…` : command;
+    let command;
+    let directLookup = false;
+    if (isCliCommand(firstArgument))
+        command = firstArgument;
+    else if (isDirectLookupTarget(firstArgument)) {
+        command = 'lookup';
+        directLookup = true;
+    }
+    else {
+        const displayedCommand = firstArgument.length > 80 ? `${firstArgument.slice(0, 79)}…` : firstArgument;
         throw new CliUsageError(`Unknown command "${displayedCommand}". Run "whoisleuth commands" to list supported commands.`);
     }
-    if (command === 'bulk')
-        return parseBulkArguments(argv.slice(1));
-    if (command === 'completion')
-        return parseCompletionArguments(argv.slice(1));
-    if (command === 'doctor')
-        return parseDoctorArguments(argv.slice(1));
-    if (command === 'commands')
-        return parseCommandsArguments(argv.slice(1));
-    if (command === 'manual')
-        return parseManualArguments(argv.slice(1));
-    if (command === 'manifest')
-        return parseManifestArguments(argv.slice(1));
-    if (command === 'map-observations')
-        return parseOfflineImportArguments('map-observations', argv.slice(1));
-    if (command === 'oam-export')
-        return parseOfflineImportArguments('oam-export', argv.slice(1));
-    if (command === 'ct-search')
-        return parseCtSearchArguments(argv.slice(1));
-    if (command === 'ct-intake')
-        return parseCtIntakeArguments(argv.slice(1));
-    if (command === 'discover')
-        return parseDiscoverArguments(argv.slice(1));
-    if (command === 'discover-scan')
-        return parseDiscoverScanArguments(argv.slice(1));
-    if (command === 'posture')
-        return parsePostureArguments(argv.slice(1));
-    if (command === 'http')
-        return parseHttpArguments(argv.slice(1));
-    if (command === 'tls')
-        return parseTlsArguments(argv.slice(1));
-    if (command === 'registry-support')
-        return parseRegistrySupportArguments(argv.slice(1));
-    if (command === 'registry-doctor')
-        return parseRegistryDoctorArguments(argv.slice(1));
-    if (command === 'registry-cohort')
-        return parseRegistryCohortArguments(argv.slice(1));
-    if (command === 'registry-scaffold')
-        return parseRegistryScaffoldArguments(argv.slice(1));
-    if (command === 'risk-calibrate')
-        return parseRiskCalibrateArguments(argv.slice(1));
-    if (command === 'lookalike-calibrate')
-        return parseLookalikeCalibrateArguments(argv.slice(1));
-    if (command === 'verify-artifact')
-        return parseVerifyArtifactArguments(argv.slice(1));
-    if (command === 'inspect-archive')
-        return parseInspectArchiveArguments(argv.slice(1));
-    if (command === 'sign-artifact')
-        return parseSignArtifactArguments(argv.slice(1));
-    if (command === 'verify-signature')
-        return parseVerifySignatureArguments(argv.slice(1));
-    if (command === 'source-report')
-        return parseSourceReportArguments(argv.slice(1));
-    if (command === 'compare')
-        return parseCompareArguments(argv.slice(1));
-    if (command === 'page-compare')
-        return parsePageCompareArguments(argv.slice(1));
-    if (command === 'mail-review')
-        return parseMailReviewArguments(argv.slice(1));
-    if (command === 'review-evidence')
-        return parseReviewEvidenceArguments(argv.slice(1));
-    if (command === 'brief')
-        return parseBriefArguments(argv.slice(1));
-    if (command === 'case-pack')
-        return parseCasePackArguments(argv.slice(1));
-    if (command === 'domain-control')
-        return parseDomainControlArguments(argv.slice(1));
-    if (command === 'monitor-once')
-        return parseMonitorOnceArguments(argv.slice(1));
-    if (command === 'assurance')
-        return parseAssuranceArguments(argv.slice(1));
-    if (command === 'change-packet')
-        return parseChangePacketArguments(argv.slice(1));
-    if (command === 'sharing-review')
-        return parseSharingReviewArguments(argv.slice(1));
-    if (command === 'workflow-plan')
-        return parseWorkflowPlanArguments(argv.slice(1));
-    if (command === 'workflow-run')
-        return parseWorkflowRunArguments(argv.slice(1));
-    if (command === 'diff')
-        return parseDiffArguments(argv.slice(1));
-    if (command === 'reconcile')
-        return parseReconcileArguments(argv.slice(1));
-    if (command === 'timeline')
-        return parseTimelineArguments(argv.slice(1));
-    if (command === 'export')
-        return parseExportArguments(argv.slice(1));
+    const parsed = CLI_PARSERS[command](directLookup ? argv : argv.slice(1));
+    if (parsed.action !== command) {
+        throw new Error(`CLI parser contract mismatch for ${command}.`);
+    }
+    return parsed;
+}
+function parseLookupArguments(lookupArguments) {
     let query = null;
     let output = 'terminal';
     let deep = false;
@@ -223,10 +125,12 @@ function parseCliArgumentsCore(argv) {
     let strictExit = false;
     let events = false;
     let plan = false;
+    let browse = false;
+    let includeAttribution = true;
     let failOn = null;
     let observerLabel = null;
     let vantageLabel = null;
-    const lookupArguments = argv.slice(1);
+    let saveLookup = null;
     for (let index = 0; index < lookupArguments.length; index++) {
         const argument = lookupArguments[index];
         if (argument === undefined)
@@ -279,6 +183,24 @@ function parseCliArgumentsCore(argv) {
                 throw new CliUsageError('--plan may be supplied only once.');
             plan = true;
         }
+        else if (argument === '--browse') {
+            if (browse)
+                throw new CliUsageError('--browse may be supplied only once.');
+            browse = true;
+        }
+        else if (argument === '--save-lookup') {
+            if (saveLookup !== null)
+                throw new CliUsageError('--save-lookup may be supplied only once.');
+            const value = lookupArguments[++index];
+            if (!value || value.startsWith('-'))
+                throw new CliUsageError('--save-lookup requires one bounded file path.');
+            saveLookup = value;
+        }
+        else if (argument === '--no-attribution') {
+            if (!includeAttribution)
+                throw new CliUsageError('--no-attribution may be supplied only once.');
+            includeAttribution = false;
+        }
         else if (argument === '--fail-on') {
             if (failOn !== null)
                 throw new CliUsageError('--fail-on may be supplied only once.');
@@ -315,12 +237,26 @@ function parseCliArgumentsCore(argv) {
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
     if (detailSet && output !== 'terminal')
         throw new CliUsageError('--summary and --verbose apply only to terminal output.');
+    if (browse && output !== 'terminal')
+        throw new CliUsageError('--browse applies only to terminal output.');
+    if (browse && (detailSet || events || plan || quiet)) {
+        throw new CliUsageError('--browse cannot be combined with detail, event, plan, or quiet options.');
+    }
+    if (browse && query === null) {
+        throw new CliUsageError('--browse requires a positional target because interactive stdin is reserved for navigation.');
+    }
+    if (saveLookup !== null && !browse) {
+        throw new CliUsageError('--save-lookup requires --browse so the exact completed Lookup document is saved after the browser closes.');
+    }
+    if (!includeAttribution && output !== 'markdown' && output !== 'html') {
+        throw new CliUsageError('--no-attribution applies only to Markdown or HTML reports.');
+    }
     if (plan && !['terminal', 'json'].includes(output))
         throw new CliUsageError('--plan supports terminal or JSON output only.');
     if (plan && (detailSet || strictExit || events || quiet || failOn !== null)) {
         throw new CliUsageError('--plan cannot be combined with detail, strict-exit, event, or quiet options.');
     }
-    return { action: 'lookup', query, output, deep, detail, strictExit, events, plan, observerLabel, vantageLabel, quiet, color, ...(failOn ? { failOn } : {}) };
+    return { action: 'lookup', query, output, deep, detail, strictExit, events, plan, includeAttribution, observerLabel, vantageLabel, quiet, color, ...(browse ? { browse: true } : {}), ...(saveLookup ? { saveLookup } : {}), ...(failOn ? { failOn } : {}) };
 }
 function parseCompletionArguments(argv) {
     if (argv.length !== 1 || !['bash', 'zsh', 'fish', 'powershell'].includes(argv[0] || '')) {
@@ -413,14 +349,41 @@ function parseOfflineImportArguments(action, argv) {
 }
 function parseCommandsArguments(argv) {
     let output = 'terminal';
+    let common = false;
+    let group = null;
+    let mode = null;
     let quiet = false;
     let color = true;
-    for (const argument of argv) {
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
         if (argument === '--json') {
             if (output !== 'terminal')
                 throw new CliUsageError('--json may be supplied only once.');
             output = 'json';
         }
+        else if (argument === '--common') {
+            if (common)
+                throw new CliUsageError('--common may be supplied only once.');
+            common = true;
+        }
+        else if (argument === '--group') {
+            if (group !== null)
+                throw new CliUsageError('--group may be supplied only once.');
+            const value = argv[++index];
+            if (!['investigate', 'respond', 'assure', 'utilities'].includes(value ?? '')) {
+                throw new CliUsageError('--group requires investigate, respond, assure, or utilities.');
+            }
+            group = value;
+        }
+        else if (argument === '--mode') {
+            if (mode !== null)
+                throw new CliUsageError('--mode may be supplied only once.');
+            const value = argv[++index];
+            if (value !== 'offline' && value !== 'network') {
+                throw new CliUsageError('--mode requires offline or network.');
+            }
+            mode = value;
+        }
         else if (argument === '--quiet')
             quiet = true;
         else if (argument === '--no-color')
@@ -430,7 +393,7 @@ function parseCommandsArguments(argv) {
     }
     if (quiet && output !== 'terminal')
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'commands', output, quiet, color };
+    return { action: 'commands', output, common, group, mode, quiet, color };
 }
 function parseDoctorArguments(argv) {
     let network = false;
@@ -963,6 +926,122 @@ function parseTlsArguments(argv) {
     const { source: hostname, ...options } = parseSingleJsonInput(argv, 'tls accepts one hostname.');
     return { action: 'tls', hostname, ...options };
 }
+function parseDnssecValidateArguments(argv) {
+    let target = null;
+    let resolver = null;
+    let trustAnchorSource = null;
+    let ownedOrAuthorized = false;
+    let output = 'terminal';
+    let quiet = false;
+    let color = true;
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (argument === '--resolver' || argument === '--trust-anchor') {
+            const selected = argument === '--resolver' ? resolver : trustAnchorSource;
+            if (selected !== null)
+                throw new CliUsageError(`${argument} may be supplied only once.`);
+            const value = argv[++index];
+            if (!value || value.startsWith('-'))
+                throw new CliUsageError(`${argument} requires one bounded value.`);
+            if (argument === '--resolver')
+                resolver = value;
+            else
+                trustAnchorSource = value;
+        }
+        else if (argument === '--owned-or-authorized') {
+            if (ownedOrAuthorized)
+                throw new CliUsageError('--owned-or-authorized may be supplied only once.');
+            ownedOrAuthorized = true;
+        }
+        else if (argument === '--json') {
+            if (output !== 'terminal')
+                throw new CliUsageError('--json may be supplied only once.');
+            output = 'json';
+        }
+        else if (argument === '--quiet')
+            quiet = true;
+        else if (argument === '--no-color')
+            color = false;
+        else if (argument?.startsWith('-'))
+            throw new CliUsageError(`Unknown option "${argument}".`);
+        else if (argument && target === null)
+            target = argument;
+        else
+            throw new CliUsageError('dnssec-validate accepts one domain target.');
+    }
+    if (!target)
+        throw new CliUsageError('dnssec-validate requires one domain target.');
+    if (!resolver)
+        throw new CliUsageError('dnssec-validate requires --resolver <public-IP>.');
+    if (!trustAnchorSource)
+        throw new CliUsageError('dnssec-validate requires --trust-anchor <anchor.json>.');
+    if (!ownedOrAuthorized)
+        throw new CliUsageError('dnssec-validate requires --owned-or-authorized for every run.');
+    if (quiet && output !== 'terminal')
+        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
+    return { action: 'dnssec-validate', target, resolver, trustAnchorSource, ownedOrAuthorized: true, output, quiet, color };
+}
+function parseMailTransportArguments(argv) {
+    let source = null;
+    let resolver = null;
+    let trustAnchorSource = null;
+    let ownedOrAuthorized = false;
+    let activeProbeAcknowledged = false;
+    let output = 'terminal';
+    let quiet = false;
+    let color = true;
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (argument === '--resolver' || argument === '--trust-anchor') {
+            const selected = argument === '--resolver' ? resolver : trustAnchorSource;
+            if (selected !== null)
+                throw new CliUsageError(`${argument} may be supplied only once.`);
+            const value = argv[++index];
+            if (!value || value.startsWith('-'))
+                throw new CliUsageError(`${argument} requires one bounded value.`);
+            if (argument === '--resolver')
+                resolver = value;
+            else
+                trustAnchorSource = value;
+        }
+        else if (argument === '--owned-or-authorized') {
+            if (ownedOrAuthorized)
+                throw new CliUsageError('--owned-or-authorized may be supplied only once.');
+            ownedOrAuthorized = true;
+        }
+        else if (argument === '--active-probe') {
+            if (activeProbeAcknowledged)
+                throw new CliUsageError('--active-probe may be supplied only once.');
+            activeProbeAcknowledged = true;
+        }
+        else if (argument === '--json') {
+            if (output !== 'terminal')
+                throw new CliUsageError('--json may be supplied only once.');
+            output = 'json';
+        }
+        else if (argument === '--quiet')
+            quiet = true;
+        else if (argument === '--no-color')
+            color = false;
+        else if (argument?.startsWith('-'))
+            throw new CliUsageError(`Unknown option "${argument}".`);
+        else if (argument && source === null)
+            source = argument;
+        else
+            throw new CliUsageError('mail-transport accepts one optional versioned JSON input file.');
+    }
+    if (!resolver)
+        throw new CliUsageError('mail-transport requires --resolver <public-IP>.');
+    if (!trustAnchorSource)
+        throw new CliUsageError('mail-transport requires --trust-anchor <anchor.json>.');
+    if (!ownedOrAuthorized)
+        throw new CliUsageError('mail-transport requires --owned-or-authorized for every run.');
+    if (!activeProbeAcknowledged)
+        throw new CliUsageError('mail-transport requires --active-probe for every run.');
+    if (quiet && output !== 'terminal')
+        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
+    return { action: 'mail-transport', source, resolver, trustAnchorSource, ownedOrAuthorized: true, activeProbeAcknowledged: true, output, quiet, color };
+}
 function parseCompareArguments(argv) {
     const parsed = parseSingleJsonInput(argv, 'compare accepts one optional lookup JSON file. Otherwise pipe one lookup document on stdin.');
     return { action: 'compare', ...parsed };
@@ -1091,9 +1170,11 @@ function parseCasePackArguments(argv) {
     }
     if (audience === null)
         throw new CliUsageError('case-pack requires --audience internal, trusted, or public.');
+    if (!reviewed)
+        throw new CliUsageError('case-pack requires --reviewed to confirm deliberate analyst review.');
     if (quiet && output !== 'terminal')
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'case-pack', source, output, audience, reviewed, quiet, color };
+    return { action: 'case-pack', source, output, audience, reviewed: true, quiet, color };
 }
 function parseMonitorOnceArguments(argv) {
     let source = null;
@@ -1101,6 +1182,8 @@ function parseMonitorOnceArguments(argv) {
     let output = 'terminal';
     let limit = 20;
     let concurrency = 2;
+    let limitSupplied = false;
+    let concurrencySupplied = false;
     let failOn = null;
     let quiet = false;
     let color = true;
@@ -1127,14 +1210,21 @@ function parseMonitorOnceArguments(argv) {
             previousSource = value;
         }
         else if (argument === '--limit' || argument === '--concurrency') {
+            if (argument === '--limit' ? limitSupplied : concurrencySupplied) {
+                throw new CliUsageError(`${argument} may be supplied only once.`);
+            }
             const value = Number(argv[++index]);
             const maximum = argument === '--limit' ? 20 : 3;
             if (!Number.isSafeInteger(value) || value < 1 || value > maximum)
                 throw new CliUsageError(`${argument} requires an integer from 1 to ${maximum}.`);
-            if (argument === '--limit')
+            if (argument === '--limit') {
                 limit = value;
-            else
+                limitSupplied = true;
+            }
+            else {
                 concurrency = value;
+                concurrencySupplied = true;
+            }
         }
         else if (argument === '--fail-on') {
             if (failOn !== null)
@@ -1246,15 +1336,33 @@ function parseSharingReviewArguments(argv) {
 }
 function parseWorkflowPlanArguments(argv) {
     const positional = [];
+    let discovery = null;
+    let explainedRecipe = null;
     let output = 'terminal';
     let quiet = false;
     let color = true;
-    for (const argument of argv) {
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
         if (argument === '--json') {
             if (output !== 'terminal')
                 throw new CliUsageError('--json may be supplied only once.');
             output = 'json';
         }
+        else if (argument === '--list') {
+            if (discovery !== null)
+                throw new CliUsageError('--list and --explain are mutually exclusive and may be supplied only once.');
+            discovery = 'list';
+        }
+        else if (argument === '--explain') {
+            if (discovery !== null)
+                throw new CliUsageError('--list and --explain are mutually exclusive and may be supplied only once.');
+            const value = argv[++index];
+            if (!INVESTIGATION_PLAN_RECIPES.includes(value)) {
+                throw new CliUsageError(`--explain recipe must be one of: ${INVESTIGATION_PLAN_RECIPES.join(', ')}.`);
+            }
+            discovery = 'explain';
+            explainedRecipe = value;
+        }
         else if (argument === '--quiet')
             quiet = true;
         else if (argument === '--no-color')
@@ -1264,14 +1372,21 @@ function parseWorkflowPlanArguments(argv) {
         else
             positional.push(argument);
     }
+    if (quiet && output !== 'terminal')
+        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
+    if (discovery !== null) {
+        if (positional.length !== 0)
+            throw new CliUsageError('workflow-plan discovery options do not accept a subject.');
+        if (discovery === 'list')
+            return { action: 'workflow-plan', discovery, output, quiet, color };
+        return { action: 'workflow-plan', discovery, recipe: explainedRecipe, output, quiet, color };
+    }
     if (positional.length !== 2)
-        throw new CliUsageError('workflow-plan requires one fixed recipe and one subject.');
+        throw new CliUsageError('workflow-plan requires one fixed recipe and one subject, --list, or --explain <recipe>.');
     const recipe = positional[0];
     if (!INVESTIGATION_PLAN_RECIPES.includes(recipe)) {
         throw new CliUsageError(`workflow-plan recipe must be one of: ${INVESTIGATION_PLAN_RECIPES.join(', ')}.`);
     }
-    if (quiet && output !== 'terminal')
-        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
     return { action: 'workflow-plan', recipe: recipe, subject: positional[1], output, quiet, color };
 }
 function parseWorkflowRunArguments(argv) {
@@ -1315,8 +1430,8 @@ function parseWorkflowRunArguments(argv) {
     if (positional.length !== 2)
         throw new CliUsageError('workflow-run requires one fixed recipe and one subject.');
     const recipe = positional[0];
-    if (!INVESTIGATION_PLAN_RECIPES.includes(recipe)) {
-        throw new CliUsageError(`workflow-run recipe must be one of: ${INVESTIGATION_PLAN_RECIPES.join(', ')}.`);
+    if (!RUNNABLE_INVESTIGATION_PLAN_RECIPES.includes(recipe)) {
+        throw new CliUsageError(`workflow-run recipe must be one of: ${RUNNABLE_INVESTIGATION_PLAN_RECIPES.join(', ')}.`);
     }
     if (quiet && output !== 'terminal')
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
@@ -1325,15 +1440,32 @@ function parseWorkflowRunArguments(argv) {
 function parseDiffArguments(argv) {
     let leftSource = null;
     let rightSource = null;
+    let leftSessionId = null;
+    let rightSessionId = null;
     let output = 'terminal';
     let quiet = false;
     let color = true;
-    for (const argument of argv) {
+    for (let index = 0; index < argv.length; index++) {
+        const argument = argv[index];
+        if (argument === undefined)
+            break;
         if (argument === '--json') {
             if (output !== 'terminal')
                 throw new CliUsageError('--json may be supplied only once.');
             output = 'json';
         }
+        else if (argument === '--left-session' || argument === '--right-session') {
+            const current = argument === '--left-session' ? leftSessionId : rightSessionId;
+            if (current !== null)
+                throw new CliUsageError(`${argument} may be supplied only once.`);
+            const value = argv[++index];
+            if (!value || !/^[A-Za-z0-9_-]{1,128}$/u.test(value))
+                throw new CliUsageError(`${argument} requires one bounded saved-session ID.`);
+            if (argument === '--left-session')
+                leftSessionId = value;
+            else
+                rightSessionId = value;
+        }
         else if (argument === '--quiet')
             quiet = true;
         else if (argument === '--no-color')
@@ -1345,15 +1477,15 @@ function parseDiffArguments(argv) {
         else if (rightSource === null)
             rightSource = argument;
         else
-            throw new CliUsageError('diff accepts exactly two saved lookup JSON files.');
+            throw new CliUsageError('diff accepts exactly two compatible retained JSON files.');
     }
     if (!leftSource || !rightSource)
-        throw new CliUsageError('diff requires exactly two saved lookup JSON files.');
+        throw new CliUsageError('diff requires exactly two compatible retained JSON files.');
     if (leftSource === rightSource)
         throw new CliUsageError('diff requires two different input files.');
     if (quiet && output !== 'terminal')
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'diff', leftSource, rightSource, output, quiet, color };
+    return { action: 'diff', leftSource, rightSource, leftSessionId, rightSessionId, output, quiet, color };
 }
 function parseReconcileArguments(argv) {
     const sources = [];
@@ -1451,8 +1583,30 @@ function parseRegistryScaffoldArguments(argv) {
     return { action: 'registry-scaffold', profile, suffix, scenario: scenario };
 }
 function parseRiskCalibrateArguments(argv) {
-    const parsed = parseSingleJsonInput(argv, 'risk-calibrate accepts one optional dataset file. Otherwise pipe one dataset on stdin.');
-    return { action: 'risk-calibrate', ...parsed };
+    let source = null;
+    let output = 'terminal';
+    let quiet = false;
+    let color = true;
+    for (const argument of argv) {
+        if (argument === '--json' || argument === '--summary-json') {
+            if (output !== 'terminal')
+                throw new CliUsageError('--json and --summary-json are mutually exclusive and may be supplied only once.');
+            output = argument === '--json' ? 'json' : 'summary_json';
+        }
+        else if (argument === '--quiet')
+            quiet = true;
+        else if (argument === '--no-color')
+            color = false;
+        else if (argument.startsWith('-'))
+            throw new CliUsageError(`Unknown option "${argument}".`);
+        else if (source === null)
+            source = argument;
+        else
+            throw new CliUsageError('risk-calibrate accepts one optional dataset file. Otherwise pipe one dataset on stdin.');
+    }
+    if (quiet && output !== 'terminal')
+        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
+    return { action: 'risk-calibrate', source, output, quiet, color };
 }
 function parseLookalikeCalibrateArguments(argv) {
     const parsed = parseSingleJsonInput(argv, 'lookalike-calibrate accepts one optional reviewed dataset JSON file.');
@@ -1461,7 +1615,10 @@ function parseLookalikeCalibrateArguments(argv) {
 function parseVerifyArtifactArguments(argv) {
     let source = null;
     let passphraseSource = null;
+    let manifestSource = null;
+    let manifestEntryId = null;
     let output = 'terminal';
+    let strictExit = false;
     let quiet = false;
     let color = true;
     for (let index = 0; index < argv.length; index++) {
@@ -1482,6 +1639,28 @@ function parseVerifyArtifactArguments(argv) {
             }
             passphraseSource = value;
         }
+        else if (argument === '--manifest') {
+            if (manifestSource !== null)
+                throw new CliUsageError('--manifest may be supplied only once.');
+            const value = argv[++index];
+            if (!value || value.startsWith('-'))
+                throw new CliUsageError('--manifest requires one bounded investigation manifest file.');
+            manifestSource = value;
+        }
+        else if (argument === '--manifest-entry') {
+            if (manifestEntryId !== null)
+                throw new CliUsageError('--manifest-entry may be supplied only once.');
+            const value = argv[++index];
+            if (!value || !/^artifact-(?:[1-9]|1[0-6])$/u.test(value)) {
+                throw new CliUsageError('--manifest-entry requires an ID from artifact-1 through artifact-16.');
+            }
+            manifestEntryId = value;
+        }
+        else if (argument === '--strict-exit') {
+            if (strictExit)
+                throw new CliUsageError('--strict-exit may be supplied only once.');
+            strictExit = true;
+        }
         else if (argument === '--quiet')
             quiet = true;
         else if (argument === '--no-color')
@@ -1493,9 +1672,50 @@ function parseVerifyArtifactArguments(argv) {
         else
             throw new CliUsageError('verify-artifact accepts one optional JSON file. Otherwise pipe one artefact on stdin.');
     }
+    if ((manifestSource === null) !== (manifestEntryId === null)) {
+        throw new CliUsageError('--manifest and --manifest-entry must be supplied together.');
+    }
     if (quiet && output !== 'terminal')
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return { action: 'verify-artifact', source, passphraseSource, output, quiet, color };
+    return { action: 'verify-artifact', source, passphraseSource, manifestSource, manifestEntryId, output, strictExit, quiet, color };
+}
+function parseInterchangeReportArguments(argv) {
+    let source = null;
+    let passphraseSource = null;
+    let output = 'terminal';
+    let quiet = false;
+    let color = true;
+    for (let index = 0; index < argv.length; index++) {
+        const argument = argv[index];
+        if (argument === undefined)
+            break;
+        if (argument === '--json') {
+            if (output !== 'terminal')
+                throw new CliUsageError('--json may be supplied only once.');
+            output = 'json';
+        }
+        else if (argument === '--passphrase-file') {
+            if (passphraseSource !== null)
+                throw new CliUsageError('--passphrase-file may be supplied only once.');
+            const value = argv[++index];
+            if (!value || value.startsWith('-'))
+                throw new CliUsageError('--passphrase-file requires one bounded UTF-8 file.');
+            passphraseSource = value;
+        }
+        else if (argument === '--quiet')
+            quiet = true;
+        else if (argument === '--no-color')
+            color = false;
+        else if (argument.startsWith('-'))
+            throw new CliUsageError(`Unknown option "${argument}".`);
+        else if (source === null)
+            source = argument;
+        else
+            throw new CliUsageError('interchange-report accepts one optional JSON file. Otherwise pipe one artefact on stdin.');
+    }
+    if (quiet && output !== 'terminal')
+        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
+    return { action: 'interchange-report', source, passphraseSource, output, quiet, color };
 }
 function parseSourceReportArguments(argv) {
     const parsed = parseSingleJsonInput(argv, 'source-report accepts one optional JSON file. Otherwise pipe lookup documents on stdin.');
@@ -1504,6 +1724,7 @@ function parseSourceReportArguments(argv) {
 function parseExportArguments(argv) {
     let source = null;
     let compact = false;
+    let includeAttribution = true;
     let format = 'json';
     for (const argument of argv) {
         if (argument === '--compact') {
@@ -1511,6 +1732,11 @@ function parseExportArguments(argv) {
                 throw new CliUsageError('--compact may be supplied only once.');
             compact = true;
         }
+        else if (argument === '--no-attribution') {
+            if (!includeAttribution)
+                throw new CliUsageError('--no-attribution may be supplied only once.');
+            includeAttribution = false;
+        }
         else if (argument === '--markdown' || argument === '--html') {
             if (format !== 'json')
                 throw new CliUsageError('Choose only one evidence export format.');
@@ -1525,6 +1751,57 @@ function parseExportArguments(argv) {
     }
     if (compact && format !== 'json')
         throw new CliUsageError('--compact applies to JSON export and cannot be combined with --markdown or --html.');
-    return { action: 'export', source, format, compact };
+    if (!includeAttribution && format === 'json')
+        throw new CliUsageError('--no-attribution applies only to Markdown or HTML reports.');
+    return { action: 'export', source, format, compact, includeAttribution };
 }
-export { CLI_COMMANDS, CliUsageError, MAX_CLI_ARGUMENTS, MAX_CLI_ARGUMENT_LENGTH, parseCliArguments };
+const CLI_PARSERS = Object.freeze({
+    completion: parseCompletionArguments,
+    doctor: parseDoctorArguments,
+    commands: parseCommandsArguments,
+    manual: parseManualArguments,
+    manifest: parseManifestArguments,
+    'map-observations': (argv) => parseOfflineImportArguments('map-observations', argv),
+    'oam-export': (argv) => parseOfflineImportArguments('oam-export', argv),
+    lookup: parseLookupArguments,
+    bulk: parseBulkArguments,
+    'ct-search': parseCtSearchArguments,
+    'ct-intake': parseCtIntakeArguments,
+    discover: parseDiscoverArguments,
+    'discover-scan': parseDiscoverScanArguments,
+    posture: parsePostureArguments,
+    http: parseHttpArguments,
+    tls: parseTlsArguments,
+    'dnssec-validate': parseDnssecValidateArguments,
+    'mail-transport': parseMailTransportArguments,
+    'registry-support': parseRegistrySupportArguments,
+    'registry-doctor': parseRegistryDoctorArguments,
+    'registry-cohort': parseRegistryCohortArguments,
+    'registry-scaffold': parseRegistryScaffoldArguments,
+    'risk-calibrate': parseRiskCalibrateArguments,
+    'lookalike-calibrate': parseLookalikeCalibrateArguments,
+    'verify-artifact': parseVerifyArtifactArguments,
+    'interchange-report': parseInterchangeReportArguments,
+    'inspect-archive': parseInspectArchiveArguments,
+    'sign-artifact': parseSignArtifactArguments,
+    'verify-signature': parseVerifySignatureArguments,
+    'source-report': parseSourceReportArguments,
+    compare: parseCompareArguments,
+    'page-compare': parsePageCompareArguments,
+    'mail-review': parseMailReviewArguments,
+    'review-evidence': parseReviewEvidenceArguments,
+    brief: parseBriefArguments,
+    'case-pack': parseCasePackArguments,
+    'domain-control': parseDomainControlArguments,
+    'monitor-once': parseMonitorOnceArguments,
+    assurance: parseAssuranceArguments,
+    'change-packet': parseChangePacketArguments,
+    'sharing-review': parseSharingReviewArguments,
+    'workflow-plan': parseWorkflowPlanArguments,
+    'workflow-run': parseWorkflowRunArguments,
+    diff: parseDiffArguments,
+    reconcile: parseReconcileArguments,
+    timeline: parseTimelineArguments,
+    export: parseExportArguments,
+});
+export { CLI_COMMANDS, CLI_PARSERS, CliUsageError, MAX_CLI_ARGUMENTS, MAX_CLI_ARGUMENT_LENGTH, parseCliArguments };