@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/cli/runner.mjs

@@ -1,15 +1,16 @@
 import { Buffer } from 'node:buffer';
-import { createReadStream } from 'node:fs';
 import { createRequire } from 'node:module';
 import { abortable } from "../lib/abort.mjs";
+import { scanBoundedJson } from "../lib/bounded-json.mjs";
 import { REGISTRY_CAPABILITIES_VERSION, registryCapabilityFor } from "../lib/registry-capabilities.mjs";
 import { explainRiskScore, explainRiskScoreV6, RISK_MODEL_VERSION, RISK_REVIEW_THRESHOLD } from "../lib/risk-scoring.mjs";
-import { CLI_COMMANDS, parseCliArguments } from "./arguments.mjs";
-import { buildCliCommandCatalogue, formatCliCommandCatalogue } from "./command-catalogue.mjs";
-import { COMMAND_COLLECTION, COMMAND_DETAILS, COMMAND_USAGE, HELP, commandHelp, } from "./command-reference.mjs";
+import { buildRiskCalibrationSummaryReport } from "../lib/risk-calibration-summary.mjs";
+import { parseCliArguments } from "./arguments.mjs";
+import { buildCliCommandCatalogue, formatCliCommandCatalogue, selectCliCommands } from "./command-catalogue.mjs";
+import { COMMAND_COLLECTION, COMMAND_DETAILS, COMMAND_USAGE, HELP, CLI_COMMANDS, CLI_COMMAND_REGISTRY, commandDefinition, commandHelp, } from "./command-reference.mjs";
 import { buildShellCompletion } from "./completion.mjs";
 import { buildDoctorReport, formatDoctorReport } from "./doctor.mjs";
-import { MAX_COMPARE_INPUT_BYTES, compareLookupDocument, parseCliLookupDocument, readCompareInputBounded, } from "./compare.mjs";
+import { MAX_COMPARE_INPUT_BYTES, compareLookupDocument, parseCliLookupDocument, } from "./compare.mjs";
 import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 import { evidenceCommandFailureLabel, isEvidenceCommand, runEvidenceCommand, } from "./evidence-command-runner.mjs";
 import { buildCliEvidenceExport, formatCliEvidenceExport } from "./export-evidence.mjs";
@@ -18,7 +19,7 @@ import { formatLookupEvidenceHtml } from "./formatters/html.mjs";
 import { buildCliCompareDocument, formatJsonDocument, } from "./formatters/json.mjs";
 import { formatLookupEvidenceMarkdown } from "./formatters/markdown.mjs";
 import { formatTerminalCompare, formatTerminalRegistrySupport, formatTerminalRiskCalibration, } from "./formatters/terminal.mjs";
-import { buildCliLookupDiff, formatCliLookupDiff } from "./lookup-diff.mjs";
+import { MAX_RETAINED_ARTIFACT_DIFF_BYTES, buildCliRetainedArtifactDiff, formatCliRetainedArtifactDiff, } from "./retained-artifact-diff.mjs";
 import { MAX_LOOKUP_RECONCILIATION_INPUT_BYTES, buildCliLookupReconciliation, formatCliLookupReconciliation, } from "./lookup-reconcile.mjs";
 import { MAX_SHARING_REVIEW_BYTES, buildSharingReview, formatSharingReview, } from "./sharing-review.mjs";
 import { MAX_LOOKUP_TIMELINE_INPUT_BYTES, buildCliLookupTimeline, formatCliLookupTimeline, } from "./lookup-timeline.mjs";
@@ -26,61 +27,48 @@ import { buildCliPageComparison, formatCliPageComparison } from "./page-compare.
 import { MAX_MAIL_REVIEW_INPUT_BYTES, buildCliMailReview, formatCliMailReview, } from "./mail-review.mjs";
 import { MAX_OFFLINE_EVIDENCE_INPUT_BYTES, buildOfflineEvidenceReview, buildOfflineEvidenceReviewWithLocalResources, formatOfflineEvidenceReview, } from "./offline-evidence-review.mjs";
 import { DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA, DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, buildDomainControlManifest, formatDomainControlResult, reviewDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
-import { DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_SCHEMA, buildDomainControlFlightRecorder, formatDomainControlFlightRecorder, } from "../lib/domain-control-flight-recorder.mjs";
-import { CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, buildCliDomainControlReview, formatCliDomainControlReview, } from "./domain-control-observations.mjs";
+import { serializeDomainControlManifest } from "../packages/evidence/domain-control-runtime.mjs";
+import { MAX_DOMAIN_CONTROL_REVIEW_COMMAND_BYTES } from "../packages/contracts/domain-control-review.mjs";
+import { DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_SCHEMA, buildDomainControlFlightRecorder, formatDomainControlFlightRecorder, serializeDomainControlFlightRecorder, } from "../lib/domain-control-flight-recorder.mjs";
+import { CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, MAX_DOMAIN_CONTROL_REVIEW_JSON_DEPTH, MAX_DOMAIN_CONTROL_REVIEW_JSON_KEYS, MAX_DOMAIN_CONTROL_REVIEW_JSON_VALUES, buildCliDomainControlReview, formatCliDomainControlReview, } from "./domain-control-observations.mjs";
 import { buildCliLookupBrief, formatCliLookupBrief } from "./lookup-brief.mjs";
 import { buildCliCasePack, formatCliCasePack } from "./case-pack.mjs";
 import { formatDomainControlMonitor, runDomainControlMonitor } from "./domain-control-monitor.mjs";
 import { MAX_ASSURANCE_INPUT_BYTES, buildDomainAssurance, formatDomainAssurance, } from "../lib/domain-assurance.mjs";
 import { MAX_DOMAIN_CHANGE_PACKET_INPUT_BYTES, buildDomainChangePacket, formatDomainChangePacket, } from "../lib/domain-change-packet.mjs";
 import { buildCliManual } from "./manual.mjs";
-import { MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES, buildInvestigationManifest, formatInvestigationManifest, } from "./investigation-manifest.mjs";
+import { MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES, MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES, buildInvestigationManifest, formatInvestigationManifest, } from "./investigation-manifest.mjs";
 import { MAX_EXTERNAL_OBSERVATION_MAPPING_BYTES, mapExternalObservations, formatExternalObservationMapping, } from "./external-observation-mapping.mjs";
 import { buildOpenAssetModelBridge, formatOpenAssetModelBridge, } from "./open-asset-model-bridge.mjs";
 import { MAX_CT_EVENT_INPUT_BYTES, buildCtEventFindings, formatCtEventFindings, } from "./ct-event-intake.mjs";
-import { buildInvestigationPlan, formatInvestigationPlan } from "./investigation-plan.mjs";
-import { formatInvestigationRun, runInvestigationRecipe } from "./investigation-run.mjs";
+import { buildInvestigationPlan, buildWorkflowRecipeCatalogue, formatInvestigationPlan, formatWorkflowRecipeCatalogue, } from "./investigation-plan.mjs";
+import { MAX_INVESTIGATION_RUN_BYTES, formatInvestigationRun, runInvestigationRecipe } from "./investigation-run.mjs";
+import { readCliTextInput } from "./input.mjs";
 import { evaluateCliFailPolicies, formatFailPolicyNotice } from "./fail-policy.mjs";
 import { formatCliJunit } from "./ci-report.mjs";
-import { createBufferedOutput, writePrivateFile } from "./output-file.mjs";
+import { cleanupPendingOutputFiles, createBufferedOutput, writePrivateFile } from "./output-file.mjs";
+import { canLaunchInteractiveCli, launchInteractiveCli, } from "./interactive-launcher.mjs";
 import { createTerminalProgress } from "./progress.mjs";
 import { buildRegistrySupportDocument } from "./registry-support.mjs";
 import { buildRegistryDoctorReport, formatRegistryDoctorReport } from "./registry-doctor.mjs";
 import { MAX_REGISTRY_COHORT_INPUT_BYTES, buildRegistryCohortReport, formatRegistryCohortReport, } from "./registry-cohort.mjs";
 import { buildRegistryFixtureScaffold } from "./registry-fixture-scaffold.mjs";
-import { MAX_OFFLINE_ARTIFACT_BYTES, MAX_OFFLINE_PASSPHRASE_FILE_BYTES, formatOfflineArtifactVerification, verifyOfflineArtifact, } from "./artifact-verify.mjs";
+import { MAX_OFFLINE_ARTIFACT_BYTES, MAX_OFFLINE_PASSPHRASE_FILE_BYTES, formatOfflineArtifactVerification, isCompleteOfflineArtifactVerification, verifyOfflineArtifact, } from "./artifact-verify.mjs";
+import { buildInterchangeFidelityReport, formatInterchangeFidelityReport, } from "./interchange-report.mjs";
 import { MAX_SOURCE_RELIABILITY_INPUT_BYTES, buildSourceReliabilityReport, formatSourceReliabilityReport, } from "./source-reliability.mjs";
-import { MAX_RISK_CALIBRATION_INPUT_BYTES, buildRiskCalibrationReport, parseRiskCalibrationDataset, readRiskCalibrationInputBounded, } from "./risk-calibration.mjs";
+import { MAX_RISK_CALIBRATION_INPUT_BYTES, buildRiskCalibrationReport, parseRiskCalibrationDataset, serializeRiskCalibrationReport, } from "./risk-calibration.mjs";
 import { MAX_LOOKALIKE_CALIBRATION_BYTES, buildLookalikeCalibration, formatLookalikeCalibration, } from "./lookalike-calibration.mjs";
-import { MAX_SAVED_LOOKUP_INPUT_BYTES, readSavedLookupInputBounded } from "./saved-lookup.mjs";
+import { MAX_SAVED_LOOKUP_INPUT_BYTES } from "./saved-lookup.mjs";
 import { presentTerminalOutput, terminalPresentation, } from "./terminal-presentation.mjs";
 const require = createRequire(import.meta.url);
 const { version: VERSION } = require('../package.json');
 const MAX_STDIN_BYTES = 4096;
 async function readStdinBounded(stream, limit = MAX_STDIN_BYTES, signal) {
-    if (!stream || stream.isTTY)
-        return '';
-    const abort = () => stream.destroy?.(new DOMException('Aborted', 'AbortError'));
-    if (signal?.aborted)
-        throw new DOMException('Aborted', 'AbortError');
-    signal?.addEventListener('abort', abort, { once: true });
-    const chunks = [];
-    let total = 0;
-    try {
-        for await (const chunk of stream) {
-            if (signal?.aborted)
-                throw new DOMException('Aborted', 'AbortError');
-            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-            total += buffer.length;
-            if (total > limit)
-                throw new CliUsageError(`Standard input is limited to ${limit} bytes.`);
-            chunks.push(buffer);
-        }
-    }
-    finally {
-        signal?.removeEventListener('abort', abort);
-    }
-    const text = Buffer.concat(chunks).toString('utf8').trim();
+    const text = (await readCliTextInput(null, stream, {
+        maximumBytes: limit,
+        label: 'Standard input',
+        ...(signal ? { signal } : {}),
+    })).trim();
     const lines = text.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
     if (lines.length > 1)
         throw new CliUsageError('Single-value commands accept one stdin line. Use the bulk command for multiple inputs.');
@@ -90,10 +78,13 @@ function write(stream, value) {
     if (stream && typeof stream.write === 'function')
         stream.write(value);
 }
-function formatForTerminal(value, stream, color, environment) {
-    return presentTerminalOutput(value, terminalPresentation(stream, color, environment));
+function formatForTerminal(value, stream, color, environment, palette) {
+    return presentTerminalOutput(value, terminalPresentation(stream, color, environment, palette));
 }
 function isCancellation(error, signal) {
+    if (error instanceof AggregateError) {
+        return error.errors.length > 0 && error.errors.every((item) => isCancellation(item));
+    }
     return signal?.aborted === true
         || Boolean(error && typeof error === 'object' && 'name' in error && error.name === 'AbortError');
 }
@@ -107,6 +98,16 @@ function usageEventReason(error) {
         return 'missing_input';
     return 'invalid_input';
 }
+const INLINE_CLI_COMMANDS = Object.freeze([
+    'completion', 'doctor', 'commands', 'manual', 'manifest', 'map-observations',
+    'oam-export', 'ct-intake', 'registry-support', 'registry-doctor',
+    'registry-cohort', 'registry-scaffold', 'risk-calibrate', 'lookalike-calibrate',
+    'verify-artifact', 'interchange-report', 'source-report', 'compare',
+    'page-compare', 'mail-review', 'review-evidence', 'brief', 'case-pack',
+    'domain-control', 'monitor-once', 'assurance', 'change-packet',
+    'sharing-review', 'workflow-plan', 'workflow-run', 'diff', 'reconcile',
+    'timeline', 'export',
+]);
 async function runParsedCli(args, dependencies = {}) {
     const stdout = dependencies.stdout || process.stdout;
     const stderr = dependencies.stderr || process.stderr;
@@ -115,7 +116,8 @@ async function runParsedCli(args, dependencies = {}) {
     const eventProgress = { current: null };
     let failureLabel = 'Lookup';
     try {
-        const terminal = (value, color = true) => formatForTerminal(value, stdout, color, environment);
+        const palette = args.palette || 'auto';
+        const terminal = (value, color = true) => formatForTerminal(value, stdout, color, environment, palette);
         const beginProgress = (message) => {
             const terminalOutput = 'output' in args
                 && args.output === 'terminal'
@@ -127,6 +129,7 @@ async function runParsedCli(args, dependencies = {}) {
                 enabled,
                 color: terminalOutput ? args.color : false,
                 environment,
+                palette,
                 ...(dependencies.nowMs ? { now: dependencies.nowMs } : {}),
             });
             progress.start(message);
@@ -148,6 +151,29 @@ async function runParsedCli(args, dependencies = {}) {
         const readSingleInput = async () => (dependencies.readStdin
             ? await dependencies.readStdin()
             : await readStdinBounded(dependencies.stdin || process.stdin, MAX_STDIN_BYTES, dependencies.signal));
+        const readInput = async (source, maximumBytes, label) => (readCliTextInput(source, dependencies.stdin || process.stdin, {
+            maximumBytes,
+            label,
+            ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+        }));
+        const readPassphraseSource = async (source) => {
+            let passphraseText;
+            try {
+                passphraseText = dependencies.readPassphraseFile
+                    ? await dependencies.readPassphraseFile(source)
+                    : await readInput(source, MAX_OFFLINE_PASSPHRASE_FILE_BYTES, 'Passphrase file');
+            }
+            catch (error) {
+                if (error instanceof CliUsageError)
+                    throw error;
+                throw new CliUsageError(`Could not read passphrase file: ${boundedCliErrorMessage(error, 'File could not be read')}`);
+            }
+            const passphrase = passphraseText.replace(/\r?\n$/u, '');
+            if (!passphrase || /[\r\n\u0000]/u.test(passphrase)) {
+                throw new CliUsageError('Passphrase file must contain exactly one non-empty UTF-8 line.');
+            }
+            return passphrase;
+        };
         const commandContext = Object.freeze({
             stdout,
             stderr,
@@ -155,6 +181,7 @@ async function runParsedCli(args, dependencies = {}) {
             writeStdout: (value) => write(stdout, value),
             writeStderr: (value) => write(stderr, value),
             readSingleInput,
+            readInput,
             now: () => dependencies.now ? dependencies.now() : new Date().toISOString(),
             beginProgress,
             endProgress,
@@ -171,13 +198,90 @@ async function runParsedCli(args, dependencies = {}) {
             write(stdout, `${VERSION}\n`);
             return EXIT_CODES.SUCCESS;
         }
+        const handlerOwner = commandDefinition(args.action).execution.handlerOwner;
+        if (handlerOwner === 'bulk') {
+            if (args.action !== 'bulk')
+                throw new Error('Bulk command registry ownership is inconsistent.');
+            failureLabel = 'Bulk lookup';
+            const { runBulkCommand } = await import("./bulk-command-runner.mjs");
+            return await runBulkCommand(args, dependencies, commandContext);
+        }
+        if (handlerOwner === 'discovery') {
+            if (args.action !== 'discover')
+                throw new Error('Discovery command registry ownership is inconsistent.');
+            failureLabel = 'Candidate generation';
+            const { runDiscoveryCommand } = await import("./discovery-command-runner.mjs");
+            return await runDiscoveryCommand(args, dependencies, commandContext);
+        }
+        if (handlerOwner === 'discovery_scan') {
+            if (args.action !== 'discover-scan')
+                throw new Error('Discovery-scan command registry ownership is inconsistent.');
+            failureLabel = 'Candidate scan';
+            const { runDiscoveryScanCommand } = await import("./discovery-scan-command-runner.mjs");
+            return await runDiscoveryScanCommand(args, dependencies, commandContext);
+        }
+        if (handlerOwner === 'evidence') {
+            if (!isEvidenceCommand(args))
+                throw new Error('Evidence command registry ownership is inconsistent.');
+            failureLabel = evidenceCommandFailureLabel(args.action);
+            const evidenceStdout = args.action !== 'sign-artifact' && args.output === 'terminal'
+                ? { write: (value) => write(stdout, terminal(value, args.color)) }
+                : stdout;
+            return await runEvidenceCommand(args, {
+                stdout: evidenceStdout,
+                stdin: dependencies.stdin || process.stdin,
+                readArtifactInput: dependencies.readArtifactInput,
+                readPassphraseFile: dependencies.readPassphraseFile,
+                readPrivateKeyFile: dependencies.readPrivateKeyFile,
+                readPublicKeyFile: dependencies.readPublicKeyFile,
+                now: dependencies.now,
+                signal: dependencies.signal,
+            });
+        }
+        if (handlerOwner === 'network') {
+            if (args.action !== 'ct-search'
+                && args.action !== 'posture'
+                && args.action !== 'http'
+                && args.action !== 'tls'
+                && args.action !== 'dnssec-validate'
+                && args.action !== 'mail-transport') {
+                throw new Error('Network command registry ownership is inconsistent.');
+            }
+            failureLabel = args.action === 'ct-search'
+                ? 'Certificate Transparency search'
+                : args.action === 'posture'
+                    ? 'Domain posture audit'
+                    : args.action === 'http'
+                        ? 'HTTP probe'
+                        : args.action === 'tls'
+                            ? 'TLS evidence collection'
+                            : args.action === 'dnssec-validate'
+                                ? 'DNSSEC chain validation'
+                                : 'Mail transport review';
+            const { runNetworkCommand } = await import("./network-command-runner.mjs");
+            return await runNetworkCommand(args, dependencies, commandContext);
+        }
+        if (handlerOwner === 'lookup') {
+            if (args.action !== 'lookup')
+                throw new Error('Lookup command registry ownership is inconsistent.');
+            const { runLookupCommand } = await import("./lookup-command-runner.mjs");
+            return await runLookupCommand(args, dependencies, commandContext);
+        }
+        if (handlerOwner !== 'inline' || !INLINE_CLI_COMMANDS.includes(args.action)) {
+            throw new Error('No CLI execution route is registered for the parsed command.');
+        }
         if (args.action === 'completion') {
             write(stdout, buildShellCompletion(args.shell));
             return EXIT_CODES.SUCCESS;
         }
         if (args.action === 'commands') {
+            const selectedCommands = selectCliCommands(CLI_COMMAND_REGISTRY, {
+                common: args.common,
+                group: args.group,
+                mode: args.mode,
+            });
             const catalogue = buildCliCommandCatalogue({
-                commands: CLI_COMMANDS,
+                commands: selectedCommands,
                 collections: COMMAND_COLLECTION,
                 details: COMMAND_DETAILS,
                 usage: COMMAND_USAGE,
@@ -202,11 +306,16 @@ async function runParsedCli(args, dependencies = {}) {
         if (args.action === 'manifest') {
             failureLabel = 'Investigation manifest';
             const artifacts = [];
+            let totalBytes = 0;
             try {
                 for (const source of args.sources) {
                     const content = dependencies.readDiffInput
                         ? await dependencies.readDiffInput(source)
-                        : await readSavedLookupInputBounded(createReadStream(source, { highWaterMark: 64 * 1024 }), { limit: MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES, label: 'Manifest artefact input' });
+                        : await readInput(source, MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES, 'Manifest artefact input');
+                    totalBytes += Buffer.byteLength(content, 'utf8');
+                    if (totalBytes > MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES) {
+                        throw new CliUsageError(`Manifest artefacts exceed the ${MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES}-byte combined limit.`);
+                    }
                     artifacts.push({ content });
                 }
             }
@@ -239,12 +348,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_EXTERNAL_OBSERVATION_MAPPING_BYTES,
-                        label: mapping ? 'External observation mapping input' : 'Open Asset Model bridge input',
-                    });
+                    : await readInput(args.source, MAX_EXTERNAL_OBSERVATION_MAPPING_BYTES, mapping ? 'External observation mapping input' : 'Open Asset Model bridge input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -255,10 +359,11 @@ async function runParsedCli(args, dependencies = {}) {
                 throw new CliUsageError(`${args.action} requires one versioned JSON file or a document on stdin.`);
             let parsed;
             try {
+                scanBoundedJson(input);
                 parsed = JSON.parse(input);
             }
             catch {
-                throw new CliUsageError(`${mapping ? 'External observation mapping' : 'Open Asset Model bridge'} input is not valid JSON.`);
+                throw new CliUsageError(`${mapping ? 'External observation mapping' : 'Open Asset Model bridge'} input is not valid bounded JSON without duplicate keys.`);
             }
             let document;
             try {
@@ -283,7 +388,7 @@ async function runParsedCli(args, dependencies = {}) {
                 version: VERSION,
                 generatedAt: dependencies.now ? dependencies.now() : new Date().toISOString(),
                 network: args.network,
-                presentation: terminalPresentation(stdout, args.color, environment),
+                presentation: terminalPresentation(stdout, args.color, environment, palette),
                 ...(dependencies.resolvePublicAddresses ? { resolveAddresses: dependencies.resolvePublicAddresses } : {}),
                 ...(dependencies.safeFetch ? { fetchHttps: dependencies.safeFetch } : {}),
                 ...(dependencies.whoisQuery ? { queryWhois: dependencies.whoisQuery } : {}),
@@ -321,12 +426,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readCompareInput
                     ? await dependencies.readCompareInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_SAVED_LOOKUP_INPUT_BYTES,
-                        label: 'Registry doctor input',
-                    });
+                    : await readInput(args.source, MAX_SAVED_LOOKUP_INPUT_BYTES, 'Registry doctor input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -348,12 +448,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readCompareInput
                     ? await dependencies.readCompareInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_REGISTRY_COHORT_INPUT_BYTES,
-                        label: 'Registry cohort input',
-                    });
+                    : await readInput(args.source, MAX_REGISTRY_COHORT_INPUT_BYTES, 'Registry cohort input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -385,9 +480,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readRiskCalibrationInput
                     ? await dependencies.readRiskCalibrationInput(args.source)
-                    : await readRiskCalibrationInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, MAX_RISK_CALIBRATION_INPUT_BYTES);
+                    : await readInput(args.source, MAX_RISK_CALIBRATION_INPUT_BYTES, 'Risk calibration input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -407,7 +500,11 @@ async function runParsedCli(args, dependencies = {}) {
                 } : {}),
             });
             if (!args.quiet)
-                write(stdout, args.output === 'json' ? formatJsonDocument(report) : terminal(formatTerminalRiskCalibration(report), args.color));
+                write(stdout, args.output === 'summary_json'
+                    ? serializeRiskCalibrationReport(buildRiskCalibrationSummaryReport(report))
+                    : args.output === 'json'
+                        ? serializeRiskCalibrationReport(report)
+                        : terminal(formatTerminalRiskCalibration(report), args.color));
             return EXIT_CODES.SUCCESS;
         }
         if (args.action === 'lookalike-calibrate') {
@@ -416,12 +513,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readRiskCalibrationInput
                     ? await dependencies.readRiskCalibrationInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_LOOKALIKE_CALIBRATION_BYTES,
-                        label: 'Lookalike calibration input',
-                    });
+                    : await readInput(args.source, MAX_LOOKALIKE_CALIBRATION_BYTES, 'Lookalike calibration input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -449,12 +541,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_OFFLINE_ARTIFACT_BYTES,
-                        label: 'Artefact input',
-                    });
+                    : await readInput(args.source, MAX_OFFLINE_ARTIFACT_BYTES, 'Artefact input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -463,49 +550,59 @@ async function runParsedCli(args, dependencies = {}) {
             }
             if (!input.trim())
                 throw new CliUsageError('verify-artifact requires one JSON file or an artefact on stdin.');
-            let passphrase = null;
-            if (args.passphraseSource) {
-                let passphraseText;
+            const passphrase = args.passphraseSource ? await readPassphraseSource(args.passphraseSource) : null;
+            let manifest = null;
+            if (args.manifestSource && args.manifestEntryId) {
+                let raw;
                 try {
-                    passphraseText = dependencies.readPassphraseFile
-                        ? await dependencies.readPassphraseFile(args.passphraseSource)
-                        : await readSavedLookupInputBounded(createReadStream(args.passphraseSource, { highWaterMark: MAX_OFFLINE_PASSPHRASE_FILE_BYTES }), {
-                            limit: MAX_OFFLINE_PASSPHRASE_FILE_BYTES,
-                            label: 'Passphrase file',
-                        });
+                    raw = dependencies.readArtifactInput
+                        ? await dependencies.readArtifactInput(args.manifestSource)
+                        : await readInput(args.manifestSource, MAX_OFFLINE_ARTIFACT_BYTES, 'Investigation manifest input');
                 }
                 catch (error) {
                     if (error instanceof CliUsageError)
                         throw error;
-                    throw new CliUsageError(`Could not read passphrase file: ${boundedCliErrorMessage(error, 'File could not be read')}`);
-                }
-                passphrase = passphraseText.replace(/\r?\n$/u, '');
-                if (!passphrase || /[\r\n\u0000]/u.test(passphrase)) {
-                    throw new CliUsageError('Passphrase file must contain exactly one non-empty UTF-8 line.');
+                    throw new CliUsageError(`Could not read investigation manifest input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
                 }
+                if (!raw.trim())
+                    throw new CliUsageError('The investigation manifest input is empty.');
+                manifest = Object.freeze({ raw, entryId: args.manifestEntryId });
             }
-            const report = await verifyOfflineArtifact(input, { passphrase });
+            const report = await verifyOfflineArtifact(input, { passphrase, manifest });
             if (!args.quiet) {
                 write(stdout, args.output === 'json'
                     ? formatJsonDocument(report)
                     : terminal(formatOfflineArtifactVerification(report), args.color));
             }
-            return EXIT_CODES.SUCCESS;
+            return args.strictExit && !isCompleteOfflineArtifactVerification(report)
+                ? EXIT_CODES.PARTIAL_FAILURE
+                : EXIT_CODES.SUCCESS;
         }
-        if (isEvidenceCommand(args)) {
-            failureLabel = evidenceCommandFailureLabel(args.action);
-            const evidenceStdout = args.action !== 'sign-artifact' && args.output === 'terminal'
-                ? { write: (value) => write(stdout, terminal(value, args.color)) }
-                : stdout;
-            return await runEvidenceCommand(args, {
-                stdout: evidenceStdout,
-                stdin: dependencies.stdin || process.stdin,
-                readArtifactInput: dependencies.readArtifactInput,
-                readPassphraseFile: dependencies.readPassphraseFile,
-                readPrivateKeyFile: dependencies.readPrivateKeyFile,
-                readPublicKeyFile: dependencies.readPublicKeyFile,
-                now: dependencies.now,
+        if (args.action === 'interchange-report') {
+            failureLabel = 'Interchange fidelity report';
+            let input;
+            try {
+                input = dependencies.readArtifactInput
+                    ? await dependencies.readArtifactInput(args.source)
+                    : await readInput(args.source, MAX_OFFLINE_ARTIFACT_BYTES, 'Interchange input');
+            }
+            catch (error) {
+                if (error instanceof CliUsageError)
+                    throw error;
+                throw new CliUsageError(`Could not read interchange input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+            }
+            if (!input.trim())
+                throw new CliUsageError('interchange-report requires one JSON file or an artefact on stdin.');
+            const passphrase = args.passphraseSource ? await readPassphraseSource(args.passphraseSource) : null;
+            const report = await buildInterchangeFidelityReport(input, {
+                generatedAt: commandContext.now(),
+                passphrase,
             });
+            if (!args.quiet)
+                write(stdout, args.output === 'json'
+                    ? formatJsonDocument(report)
+                    : terminal(formatInterchangeFidelityReport(report), args.color));
+            return EXIT_CODES.SUCCESS;
         }
         if (args.action === 'source-report') {
             failureLabel = 'Source reliability report';
@@ -513,12 +610,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readSourceReliabilityInput
                     ? await dependencies.readSourceReliabilityInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_SOURCE_RELIABILITY_INPUT_BYTES,
-                        label: 'Source reliability input',
-                    });
+                    : await readInput(args.source, MAX_SOURCE_RELIABILITY_INPUT_BYTES, 'Source reliability input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -541,9 +633,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readCompareInput
                     ? await dependencies.readCompareInput(args.source)
-                    : await readCompareInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, MAX_COMPARE_INPUT_BYTES);
+                    : await readInput(args.source, MAX_COMPARE_INPUT_BYTES, 'Comparison input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -564,10 +654,8 @@ async function runParsedCli(args, dependencies = {}) {
         }
         if (args.action === 'page-compare') {
             failureLabel = 'Static page comparison';
-            const readDiffInput = dependencies.readDiffInput || (async (source) => (readSavedLookupInputBounded(createReadStream(source, { highWaterMark: 64 * 1024 }), {
-                limit: MAX_SAVED_LOOKUP_INPUT_BYTES,
-                label: 'Page comparison input',
-            })));
+            const readDiffInput = dependencies.readDiffInput
+                || ((source) => readInput(source, MAX_SAVED_LOOKUP_INPUT_BYTES, 'Page comparison input'));
             let leftInput;
             let rightInput;
             try {
@@ -594,12 +682,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readMailReviewInput
                     ? await dependencies.readMailReviewInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_MAIL_REVIEW_INPUT_BYTES,
-                        label: 'Mail review input',
-                    });
+                    : await readInput(args.source, MAX_MAIL_REVIEW_INPUT_BYTES, 'Mail review input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -619,12 +702,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_OFFLINE_EVIDENCE_INPUT_BYTES,
-                        label: 'Offline evidence input',
-                    });
+                    : await readInput(args.source, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, 'Offline evidence input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -662,12 +740,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: isBrief ? MAX_SAVED_LOOKUP_INPUT_BYTES : 4 * 1024 * 1024,
-                        label: isBrief ? 'Lookup brief input' : 'Case-pack input',
-                    });
+                    : await readInput(args.source, isBrief ? MAX_SAVED_LOOKUP_INPUT_BYTES : 4 * 1024 * 1024, isBrief ? 'Lookup brief input' : 'Case-pack input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -698,12 +771,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_OFFLINE_EVIDENCE_INPUT_BYTES,
-                        label: 'Domain control input',
-                    });
+                    : await readInput(args.source, MAX_DOMAIN_CONTROL_REVIEW_COMMAND_BYTES, 'Domain control input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -712,11 +780,21 @@ async function runParsedCli(args, dependencies = {}) {
             }
             if (!input.trim())
                 throw new CliUsageError('domain-control requires one JSON file or a document on stdin.');
+            const normalizedDomainControlInput = input.replace(/^\uFEFF/u, '');
             let parsed;
             try {
-                parsed = JSON.parse(input);
+                scanBoundedJson(normalizedDomainControlInput, {
+                    maximumDepth: MAX_DOMAIN_CONTROL_REVIEW_JSON_DEPTH,
+                    maximumKeys: MAX_DOMAIN_CONTROL_REVIEW_JSON_KEYS,
+                    maximumValues: MAX_DOMAIN_CONTROL_REVIEW_JSON_VALUES,
+                });
+                parsed = JSON.parse(normalizedDomainControlInput);
             }
-            catch {
+            catch (cause) {
+                const detail = cause instanceof Error ? cause.message : '';
+                if (detail.startsWith('Artefact JSON ')) {
+                    throw new CliUsageError(`Domain control input ${detail.slice('Artefact JSON '.length)}`);
+                }
                 throw new CliUsageError('Domain control input is not valid JSON.');
             }
             const schema = parsed && typeof parsed === 'object' && !Array.isArray(parsed)
@@ -741,7 +819,11 @@ async function runParsedCli(args, dependencies = {}) {
                     : formatDomainControlResult(document);
             if (!args.quiet)
                 write(stdout, args.output === 'json'
-                    ? formatJsonDocument(document)
+                    ? schema === DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA
+                        ? serializeDomainControlManifest(document)
+                        : schema === DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_SCHEMA
+                            ? serializeDomainControlFlightRecorder(document)
+                            : formatJsonDocument(document)
                     : terminal(terminalDocument, args.color));
             return EXIT_CODES.SUCCESS;
         }
@@ -752,19 +834,11 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 manifestInput = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_OFFLINE_EVIDENCE_INPUT_BYTES,
-                        label: 'Domain-control manifest input',
-                    });
+                    : await readInput(args.source, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, 'Domain-control manifest input');
                 if (args.previousSource) {
                     previousInput = dependencies.readDiffInput
                         ? await dependencies.readDiffInput(args.previousSource)
-                        : await readSavedLookupInputBounded(createReadStream(args.previousSource, { highWaterMark: 64 * 1024 }), {
-                            limit: MAX_OFFLINE_EVIDENCE_INPUT_BYTES,
-                            label: 'Prior monitor snapshot',
-                        });
+                        : await readInput(args.previousSource, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, 'Prior monitor snapshot');
                 }
             }
             catch (error) {
@@ -807,12 +881,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_ASSURANCE_INPUT_BYTES,
-                        label: 'Domain assurance input',
-                    });
+                    : await readInput(args.source, MAX_ASSURANCE_INPUT_BYTES, 'Domain assurance input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -823,10 +892,11 @@ async function runParsedCli(args, dependencies = {}) {
                 throw new CliUsageError('assurance requires one versioned JSON file or a document on stdin.');
             let parsed;
             try {
+                scanBoundedJson(input);
                 parsed = JSON.parse(input);
             }
             catch {
-                throw new CliUsageError('Domain assurance input is not valid JSON.');
+                throw new CliUsageError('Domain assurance input is not valid bounded JSON without duplicate keys.');
             }
             let document;
             try {
@@ -847,12 +917,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_DOMAIN_CHANGE_PACKET_INPUT_BYTES,
-                        label: 'Domain change packet input',
-                    });
+                    : await readInput(args.source, MAX_DOMAIN_CHANGE_PACKET_INPUT_BYTES, 'Domain change packet input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -863,10 +928,11 @@ async function runParsedCli(args, dependencies = {}) {
                 throw new CliUsageError('change-packet requires one versioned JSON file or a document on stdin.');
             let parsed;
             try {
+                scanBoundedJson(input);
                 parsed = JSON.parse(input);
             }
             catch {
-                throw new CliUsageError('Domain change packet input is not valid JSON.');
+                throw new CliUsageError('Domain change packet input is not valid bounded JSON without duplicate keys.');
             }
             let document;
             try {
@@ -887,12 +953,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_SHARING_REVIEW_BYTES,
-                        label: 'Sharing review input',
-                    });
+                    : await readInput(args.source, MAX_SHARING_REVIEW_BYTES, 'Sharing review input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -923,6 +984,14 @@ async function runParsedCli(args, dependencies = {}) {
         }
         if (args.action === 'workflow-plan') {
             failureLabel = 'Investigation plan';
+            if ('discovery' in args) {
+                const catalogue = buildWorkflowRecipeCatalogue(args.discovery === 'explain' ? args.recipe : null);
+                if (!args.quiet)
+                    write(stdout, args.output === 'json'
+                        ? formatJsonDocument(catalogue)
+                        : terminal(formatWorkflowRecipeCatalogue(catalogue), args.color));
+                return EXIT_CODES.SUCCESS;
+            }
             const document = buildInvestigationPlan(args.recipe, args.subject, commandContext.now());
             if (!args.quiet)
                 write(stdout, args.output === 'json'
@@ -937,10 +1006,7 @@ async function runParsedCli(args, dependencies = {}) {
                 try {
                     resumeInput = dependencies.readDiffInput
                         ? await dependencies.readDiffInput(args.resumeSource)
-                        : await readSavedLookupInputBounded(createReadStream(args.resumeSource, { highWaterMark: 64 * 1024 }), {
-                            limit: 24 * 1024 * 1024,
-                            label: 'Investigation resume state',
-                        });
+                        : await readInput(args.resumeSource, MAX_INVESTIGATION_RUN_BYTES, 'Investigation resume state');
                 }
                 catch (error) {
                     if (error instanceof CliUsageError)
@@ -952,6 +1018,7 @@ async function runParsedCli(args, dependencies = {}) {
                 approveNetwork: args.approveNetwork,
                 resumeInput,
                 generatedAt: commandContext.now(),
+                ...(dependencies.signal ? { signal: dependencies.signal } : {}),
                 execute: async (command, stepArguments) => {
                     const stepStdout = createBufferedOutput();
                     const stepStderr = createBufferedOutput();
@@ -970,11 +1037,9 @@ async function runParsedCli(args, dependencies = {}) {
             return document.state === 'step_failed' ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
         }
         if (args.action === 'diff') {
-            failureLabel = 'Lookup evidence diff';
-            const readDiffInput = dependencies.readDiffInput || (async (source) => (readSavedLookupInputBounded(createReadStream(source, { highWaterMark: 64 * 1024 }), {
-                limit: MAX_SAVED_LOOKUP_INPUT_BYTES,
-                label: 'Lookup diff input',
-            })));
+            failureLabel = 'Retained artifact diff';
+            const readDiffInput = dependencies.readDiffInput
+                || ((source) => readInput(source, MAX_RETAINED_ARTIFACT_DIFF_BYTES, 'Retained diff input'));
             let leftInput;
             let rightInput;
             try {
@@ -986,21 +1051,19 @@ async function runParsedCli(args, dependencies = {}) {
             catch (error) {
                 if (error instanceof CliUsageError)
                     throw error;
-                throw new CliUsageError(`Could not read Lookup diff input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+                throw new CliUsageError(`Could not read retained diff input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
             }
-            const document = buildCliLookupDiff(leftInput, rightInput, dependencies.now ? dependencies.now() : new Date().toISOString());
+            const document = buildCliRetainedArtifactDiff(leftInput, rightInput, { leftSessionId: args.leftSessionId, rightSessionId: args.rightSessionId }, dependencies.now ? dependencies.now() : new Date().toISOString());
             if (!args.quiet)
                 write(stdout, args.output === 'json'
                     ? formatJsonDocument(document)
-                    : terminal(formatCliLookupDiff(document), args.color));
+                    : terminal(formatCliRetainedArtifactDiff(document), args.color));
             return EXIT_CODES.SUCCESS;
         }
         if (args.action === 'reconcile') {
             failureLabel = 'Lookup observation reconciliation';
-            const readReconciliationInput = dependencies.readDiffInput || (async (source) => (readSavedLookupInputBounded(createReadStream(source, { highWaterMark: 64 * 1024 }), {
-                limit: MAX_SAVED_LOOKUP_INPUT_BYTES,
-                label: 'Lookup reconciliation input',
-            })));
+            const readReconciliationInput = dependencies.readDiffInput
+                || ((source) => readInput(source, MAX_SAVED_LOOKUP_INPUT_BYTES, 'Lookup reconciliation input'));
             const inputs = [];
             let totalBytes = 0;
             try {
@@ -1027,10 +1090,8 @@ async function runParsedCli(args, dependencies = {}) {
         }
         if (args.action === 'timeline') {
             failureLabel = 'Lookup observation timeline';
-            const readTimelineInput = dependencies.readDiffInput || (async (source) => (readSavedLookupInputBounded(createReadStream(source, { highWaterMark: 64 * 1024 }), {
-                limit: MAX_SAVED_LOOKUP_INPUT_BYTES,
-                label: 'Lookup timeline input',
-            })));
+            const readTimelineInput = dependencies.readDiffInput
+                || ((source) => readInput(source, MAX_SAVED_LOOKUP_INPUT_BYTES, 'Lookup timeline input'));
             const inputs = [];
             let totalBytes = 0;
             try {
@@ -1061,12 +1122,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readExportInput
                     ? await dependencies.readExportInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_SAVED_LOOKUP_INPUT_BYTES,
-                        label: 'Evidence export input',
-                    });
+                    : await readInput(args.source, MAX_SAVED_LOOKUP_INPUT_BYTES, 'Evidence export input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -1080,40 +1136,20 @@ async function runParsedCli(args, dependencies = {}) {
             const now = dependencies.now ? dependencies.now() : new Date().toISOString();
             const document = buildCliEvidenceExport(input, evidenceModule, now);
             const output = args.format === 'markdown'
-                ? formatLookupEvidenceMarkdown(document)
+                ? formatLookupEvidenceMarkdown(document, { includeAttribution: args.includeAttribution })
                 : args.format === 'html'
-                    ? formatLookupEvidenceHtml(document)
+                    ? formatLookupEvidenceHtml(document, { includeAttribution: args.includeAttribution })
                     : formatCliEvidenceExport(document, args.compact);
             write(stdout, output);
             return EXIT_CODES.SUCCESS;
         }
-        if (args.action === 'bulk') {
-            failureLabel = 'Bulk lookup';
-            const { runBulkCommand } = await import("./bulk-command-runner.mjs");
-            return await runBulkCommand(args, dependencies, commandContext);
-        }
-        if (args.action === 'discover') {
-            failureLabel = 'Candidate generation';
-            const { runDiscoveryCommand } = await import("./discovery-command-runner.mjs");
-            return await runDiscoveryCommand(args, dependencies, commandContext);
-        }
-        if (args.action === 'discover-scan') {
-            failureLabel = 'Candidate scan';
-            const { runDiscoveryScanCommand } = await import("./discovery-scan-command-runner.mjs");
-            return await runDiscoveryScanCommand(args, dependencies, commandContext);
-        }
         if (args.action === 'ct-intake') {
             failureLabel = 'Certificate event intake';
             let input;
             try {
                 input = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_CT_EVENT_INPUT_BYTES,
-                        label: 'Certificate event input',
-                    });
+                    : await readInput(args.source, MAX_CT_EVENT_INPUT_BYTES, 'Certificate event input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -1124,10 +1160,11 @@ async function runParsedCli(args, dependencies = {}) {
                 throw new CliUsageError('ct-intake requires one versioned JSON file or a document on stdin.');
             let parsed;
             try {
+                scanBoundedJson(input);
                 parsed = JSON.parse(input);
             }
             catch {
-                throw new CliUsageError('Certificate event input is not valid JSON.');
+                throw new CliUsageError('Certificate event input is not valid bounded JSON without duplicate keys.');
             }
             let document;
             try {
@@ -1142,22 +1179,7 @@ async function runParsedCli(args, dependencies = {}) {
                     : terminal(formatCtEventFindings(document), args.color));
             return EXIT_CODES.SUCCESS;
         }
-        if (args.action === 'ct-search'
-            || args.action === 'posture'
-            || args.action === 'http'
-            || args.action === 'tls') {
-            failureLabel = args.action === 'ct-search'
-                ? 'Certificate Transparency search'
-                : args.action === 'posture'
-                    ? 'Domain posture audit'
-                    : args.action === 'http'
-                        ? 'HTTP probe'
-                        : 'TLS intelligence';
-            const { runNetworkCommand } = await import("./network-command-runner.mjs");
-            return await runNetworkCommand(args, dependencies, commandContext);
-        }
-        const { runLookupCommand } = await import("./lookup-command-runner.mjs");
-        return await runLookupCommand(args, dependencies, commandContext);
+        throw new Error('No CLI execution route is registered for the parsed command.');
     }
     catch (error) {
         progress?.stop();
@@ -1185,8 +1207,41 @@ async function runParsedCli(args, dependencies = {}) {
         return EXIT_CODES.LOOKUP_FAILED;
     }
 }
-async function runCli(argv, dependencies = {}) {
+async function runCliCommand(argv, dependencies = {}) {
+    const stdout = dependencies.stdout || process.stdout;
     const stderr = dependencies.stderr || process.stderr;
+    const environment = dependencies.environment || process.env;
+    if (Array.isArray(argv) && argv.length === 0) {
+        const input = (dependencies.stdin || process.stdin);
+        const output = stdout;
+        const supportsInteractiveLaunch = dependencies.canLaunchInteractiveCli || canLaunchInteractiveCli;
+        if (supportsInteractiveLaunch(input, output, environment)) {
+            const launch = dependencies.launchInteractiveCli || launchInteractiveCli;
+            try {
+                const launchedArgv = await launch({
+                    input,
+                    output,
+                    environment,
+                    ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+                });
+                if (launchedArgv === null)
+                    return EXIT_CODES.SUCCESS;
+                argv = launchedArgv;
+            }
+            catch (error) {
+                if (isCancellation(error, dependencies.signal)) {
+                    write(stderr, 'Cancelled by analyst.\n');
+                    return EXIT_CODES.CANCELLED;
+                }
+                if (error instanceof CliUsageError) {
+                    write(stderr, `Usage error: ${boundedCliErrorMessage(error, 'Invalid interactive selection')}\n`);
+                    return EXIT_CODES.USAGE;
+                }
+                write(stderr, `CLI startup failed: ${boundedCliErrorMessage(error, 'Interactive launch failed')}\n`);
+                return EXIT_CODES.INTERNAL_ERROR;
+            }
+        }
+    }
     let args;
     try {
         args = parseCliArguments(argv);
@@ -1218,4 +1273,25 @@ async function runCli(argv, dependencies = {}) {
         return EXIT_CODES.LOOKUP_FAILED;
     }
 }
-export { HELP, MAX_STDIN_BYTES, VERSION, readStdinBounded, runCli };
+async function runCli(argv, dependencies = {}) {
+    const stderr = dependencies.stderr || process.stderr;
+    try {
+        return await runCliCommand(argv, dependencies);
+    }
+    finally {
+        const cleanup = dependencies.cleanupPendingOutputFiles || cleanupPendingOutputFiles;
+        try {
+            const report = await cleanup();
+            if (report.retainedPublished > 0) {
+                write(stderr, `Output cleanup warning: Published output is intact, but ${report.retainedPublished} linked temporary output ${report.retainedPublished === 1 ? 'file remains' : 'files remain'} in the selected output directory.\n`);
+            }
+            if (report.retainedUnpublished > 0) {
+                write(stderr, `Output cleanup warning: ${report.retainedUnpublished} unpublished temporary output ${report.retainedUnpublished === 1 ? 'file remains' : 'files remain'} in the selected output directory.\n`);
+            }
+        }
+        catch {
+            write(stderr, 'Output cleanup warning: Temporary output cleanup could not be verified.\n');
+        }
+    }
+}
+export { HELP, INLINE_CLI_COMMANDS, MAX_STDIN_BYTES, VERSION, readStdinBounded, runCli };