@slicedearth/whoisleuth-cli 1.47.4 → 2.0.0

package/cli/runner.mjs

@@ -5,9 +5,9 @@ import { scanBoundedJson } from "../lib/bounded-json.mjs";
 import { REGISTRY_CAPABILITIES_VERSION, registryCapabilityFor } from "../lib/registry-capabilities.mjs";
 import { explainRiskScore, explainRiskScoreV6, RISK_MODEL_VERSION, RISK_REVIEW_THRESHOLD } from "../lib/risk-scoring.mjs";
 import { buildRiskCalibrationSummaryReport } from "../lib/risk-calibration-summary.mjs";
-import { CLI_COMMANDS, parseCliArguments } from "./arguments.mjs";
-import { buildCliCommandCatalogue, formatCliCommandCatalogue } from "./command-catalogue.mjs";
-import { COMMAND_COLLECTION, COMMAND_DETAILS, COMMAND_USAGE, HELP, commandHelp, } from "./command-reference.mjs";
+import { parseCliArguments } from "./arguments.mjs";
+import { buildCliCommandCatalogue, formatCliCommandCatalogue, selectCliCommands } from "./command-catalogue.mjs";
+import { COMMAND_COLLECTION, COMMAND_DETAILS, COMMAND_USAGE, HELP, CLI_COMMANDS, CLI_COMMAND_REGISTRY, commandDefinition, commandHelp, } from "./command-reference.mjs";
 import { buildShellCompletion } from "./completion.mjs";
 import { buildDoctorReport, formatDoctorReport } from "./doctor.mjs";
 import { MAX_COMPARE_INPUT_BYTES, compareLookupDocument, parseCliLookupDocument, } from "./compare.mjs";
@@ -27,7 +27,9 @@ import { buildCliPageComparison, formatCliPageComparison } from "./page-compare.
 import { MAX_MAIL_REVIEW_INPUT_BYTES, buildCliMailReview, formatCliMailReview, } from "./mail-review.mjs";
 import { MAX_OFFLINE_EVIDENCE_INPUT_BYTES, buildOfflineEvidenceReview, buildOfflineEvidenceReviewWithLocalResources, formatOfflineEvidenceReview, } from "./offline-evidence-review.mjs";
 import { DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA, DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, buildDomainControlManifest, formatDomainControlResult, reviewDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
-import { DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_SCHEMA, buildDomainControlFlightRecorder, formatDomainControlFlightRecorder, } from "../lib/domain-control-flight-recorder.mjs";
+import { serializeDomainControlManifest } from "../packages/evidence/domain-control-runtime.mjs";
+import { MAX_DOMAIN_CONTROL_REVIEW_COMMAND_BYTES } from "../packages/contracts/domain-control-review.mjs";
+import { DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_SCHEMA, buildDomainControlFlightRecorder, formatDomainControlFlightRecorder, serializeDomainControlFlightRecorder, } from "../lib/domain-control-flight-recorder.mjs";
 import { CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, MAX_DOMAIN_CONTROL_REVIEW_JSON_DEPTH, MAX_DOMAIN_CONTROL_REVIEW_JSON_KEYS, MAX_DOMAIN_CONTROL_REVIEW_JSON_VALUES, buildCliDomainControlReview, formatCliDomainControlReview, } from "./domain-control-observations.mjs";
 import { buildCliLookupBrief, formatCliLookupBrief } from "./lookup-brief.mjs";
 import { buildCliCasePack, formatCliCasePack } from "./case-pack.mjs";
@@ -39,12 +41,13 @@ import { MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES, MAX_INVESTIGATION_MANIFEST_T
 import { MAX_EXTERNAL_OBSERVATION_MAPPING_BYTES, mapExternalObservations, formatExternalObservationMapping, } from "./external-observation-mapping.mjs";
 import { buildOpenAssetModelBridge, formatOpenAssetModelBridge, } from "./open-asset-model-bridge.mjs";
 import { MAX_CT_EVENT_INPUT_BYTES, buildCtEventFindings, formatCtEventFindings, } from "./ct-event-intake.mjs";
-import { buildInvestigationPlan, formatInvestigationPlan } from "./investigation-plan.mjs";
+import { buildInvestigationPlan, buildWorkflowRecipeCatalogue, formatInvestigationPlan, formatWorkflowRecipeCatalogue, } from "./investigation-plan.mjs";
 import { MAX_INVESTIGATION_RUN_BYTES, formatInvestigationRun, runInvestigationRecipe } from "./investigation-run.mjs";
 import { readCliTextInput } from "./input.mjs";
 import { evaluateCliFailPolicies, formatFailPolicyNotice } from "./fail-policy.mjs";
 import { formatCliJunit } from "./ci-report.mjs";
-import { createBufferedOutput, writePrivateFile } from "./output-file.mjs";
+import { cleanupPendingOutputFiles, createBufferedOutput, writePrivateFile } from "./output-file.mjs";
+import { canLaunchInteractiveCli, launchInteractiveCli, } from "./interactive-launcher.mjs";
 import { createTerminalProgress } from "./progress.mjs";
 import { buildRegistrySupportDocument } from "./registry-support.mjs";
 import { buildRegistryDoctorReport, formatRegistryDoctorReport } from "./registry-doctor.mjs";
@@ -53,7 +56,7 @@ import { buildRegistryFixtureScaffold } from "./registry-fixture-scaffold.mjs";
 import { MAX_OFFLINE_ARTIFACT_BYTES, MAX_OFFLINE_PASSPHRASE_FILE_BYTES, formatOfflineArtifactVerification, isCompleteOfflineArtifactVerification, verifyOfflineArtifact, } from "./artifact-verify.mjs";
 import { buildInterchangeFidelityReport, formatInterchangeFidelityReport, } from "./interchange-report.mjs";
 import { MAX_SOURCE_RELIABILITY_INPUT_BYTES, buildSourceReliabilityReport, formatSourceReliabilityReport, } from "./source-reliability.mjs";
-import { MAX_RISK_CALIBRATION_INPUT_BYTES, buildRiskCalibrationReport, parseRiskCalibrationDataset, } from "./risk-calibration.mjs";
+import { MAX_RISK_CALIBRATION_INPUT_BYTES, buildRiskCalibrationReport, parseRiskCalibrationDataset, serializeRiskCalibrationReport, } from "./risk-calibration.mjs";
 import { MAX_LOOKALIKE_CALIBRATION_BYTES, buildLookalikeCalibration, formatLookalikeCalibration, } from "./lookalike-calibration.mjs";
 import { MAX_SAVED_LOOKUP_INPUT_BYTES } from "./saved-lookup.mjs";
 import { presentTerminalOutput, terminalPresentation, } from "./terminal-presentation.mjs";
@@ -75,10 +78,13 @@ function write(stream, value) {
     if (stream && typeof stream.write === 'function')
         stream.write(value);
 }
-function formatForTerminal(value, stream, color, environment) {
-    return presentTerminalOutput(value, terminalPresentation(stream, color, environment));
+function formatForTerminal(value, stream, color, environment, palette) {
+    return presentTerminalOutput(value, terminalPresentation(stream, color, environment, palette));
 }
 function isCancellation(error, signal) {
+    if (error instanceof AggregateError) {
+        return error.errors.length > 0 && error.errors.every((item) => isCancellation(item));
+    }
     return signal?.aborted === true
         || Boolean(error && typeof error === 'object' && 'name' in error && error.name === 'AbortError');
 }
@@ -92,6 +98,16 @@ function usageEventReason(error) {
         return 'missing_input';
     return 'invalid_input';
 }
+const INLINE_CLI_COMMANDS = Object.freeze([
+    'completion', 'doctor', 'commands', 'manual', 'manifest', 'map-observations',
+    'oam-export', 'ct-intake', 'registry-support', 'registry-doctor',
+    'registry-cohort', 'registry-scaffold', 'risk-calibrate', 'lookalike-calibrate',
+    'verify-artifact', 'interchange-report', 'source-report', 'compare',
+    'page-compare', 'mail-review', 'review-evidence', 'brief', 'case-pack',
+    'domain-control', 'monitor-once', 'assurance', 'change-packet',
+    'sharing-review', 'workflow-plan', 'workflow-run', 'diff', 'reconcile',
+    'timeline', 'export',
+]);
 async function runParsedCli(args, dependencies = {}) {
     const stdout = dependencies.stdout || process.stdout;
     const stderr = dependencies.stderr || process.stderr;
@@ -100,7 +116,8 @@ async function runParsedCli(args, dependencies = {}) {
     const eventProgress = { current: null };
     let failureLabel = 'Lookup';
     try {
-        const terminal = (value, color = true) => formatForTerminal(value, stdout, color, environment);
+        const palette = args.palette || 'auto';
+        const terminal = (value, color = true) => formatForTerminal(value, stdout, color, environment, palette);
         const beginProgress = (message) => {
             const terminalOutput = 'output' in args
                 && args.output === 'terminal'
@@ -112,6 +129,7 @@ async function runParsedCli(args, dependencies = {}) {
                 enabled,
                 color: terminalOutput ? args.color : false,
                 environment,
+                palette,
                 ...(dependencies.nowMs ? { now: dependencies.nowMs } : {}),
             });
             progress.start(message);
@@ -180,13 +198,90 @@ async function runParsedCli(args, dependencies = {}) {
             write(stdout, `${VERSION}\n`);
             return EXIT_CODES.SUCCESS;
         }
+        const handlerOwner = commandDefinition(args.action).execution.handlerOwner;
+        if (handlerOwner === 'bulk') {
+            if (args.action !== 'bulk')
+                throw new Error('Bulk command registry ownership is inconsistent.');
+            failureLabel = 'Bulk lookup';
+            const { runBulkCommand } = await import("./bulk-command-runner.mjs");
+            return await runBulkCommand(args, dependencies, commandContext);
+        }
+        if (handlerOwner === 'discovery') {
+            if (args.action !== 'discover')
+                throw new Error('Discovery command registry ownership is inconsistent.');
+            failureLabel = 'Candidate generation';
+            const { runDiscoveryCommand } = await import("./discovery-command-runner.mjs");
+            return await runDiscoveryCommand(args, dependencies, commandContext);
+        }
+        if (handlerOwner === 'discovery_scan') {
+            if (args.action !== 'discover-scan')
+                throw new Error('Discovery-scan command registry ownership is inconsistent.');
+            failureLabel = 'Candidate scan';
+            const { runDiscoveryScanCommand } = await import("./discovery-scan-command-runner.mjs");
+            return await runDiscoveryScanCommand(args, dependencies, commandContext);
+        }
+        if (handlerOwner === 'evidence') {
+            if (!isEvidenceCommand(args))
+                throw new Error('Evidence command registry ownership is inconsistent.');
+            failureLabel = evidenceCommandFailureLabel(args.action);
+            const evidenceStdout = args.action !== 'sign-artifact' && args.output === 'terminal'
+                ? { write: (value) => write(stdout, terminal(value, args.color)) }
+                : stdout;
+            return await runEvidenceCommand(args, {
+                stdout: evidenceStdout,
+                stdin: dependencies.stdin || process.stdin,
+                readArtifactInput: dependencies.readArtifactInput,
+                readPassphraseFile: dependencies.readPassphraseFile,
+                readPrivateKeyFile: dependencies.readPrivateKeyFile,
+                readPublicKeyFile: dependencies.readPublicKeyFile,
+                now: dependencies.now,
+                signal: dependencies.signal,
+            });
+        }
+        if (handlerOwner === 'network') {
+            if (args.action !== 'ct-search'
+                && args.action !== 'posture'
+                && args.action !== 'http'
+                && args.action !== 'tls'
+                && args.action !== 'dnssec-validate'
+                && args.action !== 'mail-transport') {
+                throw new Error('Network command registry ownership is inconsistent.');
+            }
+            failureLabel = args.action === 'ct-search'
+                ? 'Certificate Transparency search'
+                : args.action === 'posture'
+                    ? 'Domain posture audit'
+                    : args.action === 'http'
+                        ? 'HTTP probe'
+                        : args.action === 'tls'
+                            ? 'TLS evidence collection'
+                            : args.action === 'dnssec-validate'
+                                ? 'DNSSEC chain validation'
+                                : 'Mail transport review';
+            const { runNetworkCommand } = await import("./network-command-runner.mjs");
+            return await runNetworkCommand(args, dependencies, commandContext);
+        }
+        if (handlerOwner === 'lookup') {
+            if (args.action !== 'lookup')
+                throw new Error('Lookup command registry ownership is inconsistent.');
+            const { runLookupCommand } = await import("./lookup-command-runner.mjs");
+            return await runLookupCommand(args, dependencies, commandContext);
+        }
+        if (handlerOwner !== 'inline' || !INLINE_CLI_COMMANDS.includes(args.action)) {
+            throw new Error('No CLI execution route is registered for the parsed command.');
+        }
         if (args.action === 'completion') {
             write(stdout, buildShellCompletion(args.shell));
             return EXIT_CODES.SUCCESS;
         }
         if (args.action === 'commands') {
+            const selectedCommands = selectCliCommands(CLI_COMMAND_REGISTRY, {
+                common: args.common,
+                group: args.group,
+                mode: args.mode,
+            });
             const catalogue = buildCliCommandCatalogue({
-                commands: CLI_COMMANDS,
+                commands: selectedCommands,
                 collections: COMMAND_COLLECTION,
                 details: COMMAND_DETAILS,
                 usage: COMMAND_USAGE,
@@ -264,10 +359,11 @@ async function runParsedCli(args, dependencies = {}) {
                 throw new CliUsageError(`${args.action} requires one versioned JSON file or a document on stdin.`);
             let parsed;
             try {
+                scanBoundedJson(input);
                 parsed = JSON.parse(input);
             }
             catch {
-                throw new CliUsageError(`${mapping ? 'External observation mapping' : 'Open Asset Model bridge'} input is not valid JSON.`);
+                throw new CliUsageError(`${mapping ? 'External observation mapping' : 'Open Asset Model bridge'} input is not valid bounded JSON without duplicate keys.`);
             }
             let document;
             try {
@@ -292,7 +388,7 @@ async function runParsedCli(args, dependencies = {}) {
                 version: VERSION,
                 generatedAt: dependencies.now ? dependencies.now() : new Date().toISOString(),
                 network: args.network,
-                presentation: terminalPresentation(stdout, args.color, environment),
+                presentation: terminalPresentation(stdout, args.color, environment, palette),
                 ...(dependencies.resolvePublicAddresses ? { resolveAddresses: dependencies.resolvePublicAddresses } : {}),
                 ...(dependencies.safeFetch ? { fetchHttps: dependencies.safeFetch } : {}),
                 ...(dependencies.whoisQuery ? { queryWhois: dependencies.whoisQuery } : {}),
@@ -405,9 +501,9 @@ async function runParsedCli(args, dependencies = {}) {
             });
             if (!args.quiet)
                 write(stdout, args.output === 'summary_json'
-                    ? formatJsonDocument(buildRiskCalibrationSummaryReport(report))
+                    ? serializeRiskCalibrationReport(buildRiskCalibrationSummaryReport(report))
                     : args.output === 'json'
-                        ? formatJsonDocument(report)
+                        ? serializeRiskCalibrationReport(report)
                         : terminal(formatTerminalRiskCalibration(report), args.color));
             return EXIT_CODES.SUCCESS;
         }
@@ -508,22 +604,6 @@ async function runParsedCli(args, dependencies = {}) {
                     : terminal(formatInterchangeFidelityReport(report), args.color));
             return EXIT_CODES.SUCCESS;
         }
-        if (isEvidenceCommand(args)) {
-            failureLabel = evidenceCommandFailureLabel(args.action);
-            const evidenceStdout = args.action !== 'sign-artifact' && args.output === 'terminal'
-                ? { write: (value) => write(stdout, terminal(value, args.color)) }
-                : stdout;
-            return await runEvidenceCommand(args, {
-                stdout: evidenceStdout,
-                stdin: dependencies.stdin || process.stdin,
-                readArtifactInput: dependencies.readArtifactInput,
-                readPassphraseFile: dependencies.readPassphraseFile,
-                readPrivateKeyFile: dependencies.readPrivateKeyFile,
-                readPublicKeyFile: dependencies.readPublicKeyFile,
-                now: dependencies.now,
-                signal: dependencies.signal,
-            });
-        }
         if (args.action === 'source-report') {
             failureLabel = 'Source reliability report';
             let input;
@@ -691,7 +771,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readInput(args.source, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, 'Domain control input');
+                    : await readInput(args.source, MAX_DOMAIN_CONTROL_REVIEW_COMMAND_BYTES, 'Domain control input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -739,7 +819,11 @@ async function runParsedCli(args, dependencies = {}) {
                     : formatDomainControlResult(document);
             if (!args.quiet)
                 write(stdout, args.output === 'json'
-                    ? formatJsonDocument(document)
+                    ? schema === DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA
+                        ? serializeDomainControlManifest(document)
+                        : schema === DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_SCHEMA
+                            ? serializeDomainControlFlightRecorder(document)
+                            : formatJsonDocument(document)
                     : terminal(terminalDocument, args.color));
             return EXIT_CODES.SUCCESS;
         }
@@ -808,10 +892,11 @@ async function runParsedCli(args, dependencies = {}) {
                 throw new CliUsageError('assurance requires one versioned JSON file or a document on stdin.');
             let parsed;
             try {
+                scanBoundedJson(input);
                 parsed = JSON.parse(input);
             }
             catch {
-                throw new CliUsageError('Domain assurance input is not valid JSON.');
+                throw new CliUsageError('Domain assurance input is not valid bounded JSON without duplicate keys.');
             }
             let document;
             try {
@@ -843,10 +928,11 @@ async function runParsedCli(args, dependencies = {}) {
                 throw new CliUsageError('change-packet requires one versioned JSON file or a document on stdin.');
             let parsed;
             try {
+                scanBoundedJson(input);
                 parsed = JSON.parse(input);
             }
             catch {
-                throw new CliUsageError('Domain change packet input is not valid JSON.');
+                throw new CliUsageError('Domain change packet input is not valid bounded JSON without duplicate keys.');
             }
             let document;
             try {
@@ -898,6 +984,14 @@ async function runParsedCli(args, dependencies = {}) {
         }
         if (args.action === 'workflow-plan') {
             failureLabel = 'Investigation plan';
+            if ('discovery' in args) {
+                const catalogue = buildWorkflowRecipeCatalogue(args.discovery === 'explain' ? args.recipe : null);
+                if (!args.quiet)
+                    write(stdout, args.output === 'json'
+                        ? formatJsonDocument(catalogue)
+                        : terminal(formatWorkflowRecipeCatalogue(catalogue), args.color));
+                return EXIT_CODES.SUCCESS;
+            }
             const document = buildInvestigationPlan(args.recipe, args.subject, commandContext.now());
             if (!args.quiet)
                 write(stdout, args.output === 'json'
@@ -924,6 +1018,7 @@ async function runParsedCli(args, dependencies = {}) {
                 approveNetwork: args.approveNetwork,
                 resumeInput,
                 generatedAt: commandContext.now(),
+                ...(dependencies.signal ? { signal: dependencies.signal } : {}),
                 execute: async (command, stepArguments) => {
                     const stepStdout = createBufferedOutput();
                     const stepStderr = createBufferedOutput();
@@ -1048,21 +1143,6 @@ async function runParsedCli(args, dependencies = {}) {
             write(stdout, output);
             return EXIT_CODES.SUCCESS;
         }
-        if (args.action === 'bulk') {
-            failureLabel = 'Bulk lookup';
-            const { runBulkCommand } = await import("./bulk-command-runner.mjs");
-            return await runBulkCommand(args, dependencies, commandContext);
-        }
-        if (args.action === 'discover') {
-            failureLabel = 'Candidate generation';
-            const { runDiscoveryCommand } = await import("./discovery-command-runner.mjs");
-            return await runDiscoveryCommand(args, dependencies, commandContext);
-        }
-        if (args.action === 'discover-scan') {
-            failureLabel = 'Candidate scan';
-            const { runDiscoveryScanCommand } = await import("./discovery-scan-command-runner.mjs");
-            return await runDiscoveryScanCommand(args, dependencies, commandContext);
-        }
         if (args.action === 'ct-intake') {
             failureLabel = 'Certificate event intake';
             let input;
@@ -1080,10 +1160,11 @@ async function runParsedCli(args, dependencies = {}) {
                 throw new CliUsageError('ct-intake requires one versioned JSON file or a document on stdin.');
             let parsed;
             try {
+                scanBoundedJson(input);
                 parsed = JSON.parse(input);
             }
             catch {
-                throw new CliUsageError('Certificate event input is not valid JSON.');
+                throw new CliUsageError('Certificate event input is not valid bounded JSON without duplicate keys.');
             }
             let document;
             try {
@@ -1098,28 +1179,7 @@ async function runParsedCli(args, dependencies = {}) {
                     : terminal(formatCtEventFindings(document), args.color));
             return EXIT_CODES.SUCCESS;
         }
-        if (args.action === 'ct-search'
-            || args.action === 'posture'
-            || args.action === 'http'
-            || args.action === 'tls'
-            || args.action === 'dnssec-validate'
-            || args.action === 'mail-transport') {
-            failureLabel = args.action === 'ct-search'
-                ? 'Certificate Transparency search'
-                : args.action === 'posture'
-                    ? 'Domain posture audit'
-                    : args.action === 'http'
-                        ? 'HTTP probe'
-                        : args.action === 'tls'
-                            ? 'TLS intelligence'
-                            : args.action === 'dnssec-validate'
-                                ? 'DNSSEC chain validation'
-                                : 'Mail transport review';
-            const { runNetworkCommand } = await import("./network-command-runner.mjs");
-            return await runNetworkCommand(args, dependencies, commandContext);
-        }
-        const { runLookupCommand } = await import("./lookup-command-runner.mjs");
-        return await runLookupCommand(args, dependencies, commandContext);
+        throw new Error('No CLI execution route is registered for the parsed command.');
     }
     catch (error) {
         progress?.stop();
@@ -1147,8 +1207,41 @@ async function runParsedCli(args, dependencies = {}) {
         return EXIT_CODES.LOOKUP_FAILED;
     }
 }
-async function runCli(argv, dependencies = {}) {
+async function runCliCommand(argv, dependencies = {}) {
+    const stdout = dependencies.stdout || process.stdout;
     const stderr = dependencies.stderr || process.stderr;
+    const environment = dependencies.environment || process.env;
+    if (Array.isArray(argv) && argv.length === 0) {
+        const input = (dependencies.stdin || process.stdin);
+        const output = stdout;
+        const supportsInteractiveLaunch = dependencies.canLaunchInteractiveCli || canLaunchInteractiveCli;
+        if (supportsInteractiveLaunch(input, output, environment)) {
+            const launch = dependencies.launchInteractiveCli || launchInteractiveCli;
+            try {
+                const launchedArgv = await launch({
+                    input,
+                    output,
+                    environment,
+                    ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+                });
+                if (launchedArgv === null)
+                    return EXIT_CODES.SUCCESS;
+                argv = launchedArgv;
+            }
+            catch (error) {
+                if (isCancellation(error, dependencies.signal)) {
+                    write(stderr, 'Cancelled by analyst.\n');
+                    return EXIT_CODES.CANCELLED;
+                }
+                if (error instanceof CliUsageError) {
+                    write(stderr, `Usage error: ${boundedCliErrorMessage(error, 'Invalid interactive selection')}\n`);
+                    return EXIT_CODES.USAGE;
+                }
+                write(stderr, `CLI startup failed: ${boundedCliErrorMessage(error, 'Interactive launch failed')}\n`);
+                return EXIT_CODES.INTERNAL_ERROR;
+            }
+        }
+    }
     let args;
     try {
         args = parseCliArguments(argv);
@@ -1180,4 +1273,25 @@ async function runCli(argv, dependencies = {}) {
         return EXIT_CODES.LOOKUP_FAILED;
     }
 }
-export { HELP, MAX_STDIN_BYTES, VERSION, readStdinBounded, runCli };
+async function runCli(argv, dependencies = {}) {
+    const stderr = dependencies.stderr || process.stderr;
+    try {
+        return await runCliCommand(argv, dependencies);
+    }
+    finally {
+        const cleanup = dependencies.cleanupPendingOutputFiles || cleanupPendingOutputFiles;
+        try {
+            const report = await cleanup();
+            if (report.retainedPublished > 0) {
+                write(stderr, `Output cleanup warning: Published output is intact, but ${report.retainedPublished} linked temporary output ${report.retainedPublished === 1 ? 'file remains' : 'files remain'} in the selected output directory.\n`);
+            }
+            if (report.retainedUnpublished > 0) {
+                write(stderr, `Output cleanup warning: ${report.retainedUnpublished} unpublished temporary output ${report.retainedUnpublished === 1 ? 'file remains' : 'files remain'} in the selected output directory.\n`);
+            }
+        }
+        catch {
+            write(stderr, 'Output cleanup warning: Temporary output cleanup could not be verified.\n');
+        }
+    }
+}
+export { HELP, INLINE_CLI_COMMANDS, MAX_STDIN_BYTES, VERSION, readStdinBounded, runCli };