@slicedearth/whoisleuth-cli 1.47.4 → 2.0.1

package/cli/command-reference.mjs

@@ -1,101 +1,145 @@
 import { WHOISLEUTH_SOURCE_REPOSITORY_URL } from "../lib/project-metadata.mjs";
+import { LOOKUP_EVIDENCE_SCHEMA_VERSION, PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION, } from "../lib/evidence-export.mjs";
+import { RISK_CALIBRATION_DATASET_SCHEMA, RISK_CALIBRATION_REPORT_SCHEMA, } from "../packages/contracts/risk-calibration.mjs";
+import { CASE_SCHEMA_VERSION, PUBLIC_WORKSPACE_ARCHIVE_VERSION, WORKSPACE_ARCHIVE_VERSION, } from "../packages/contracts/case-portability.mjs";
+const COMMAND_ORDER = Object.freeze([
+    'completion',
+    'doctor',
+    'commands',
+    'manual',
+    'manifest',
+    'map-observations',
+    'oam-export',
+    'lookup',
+    'bulk',
+    'ct-search',
+    'ct-intake',
+    'discover',
+    'discover-scan',
+    'posture',
+    'http',
+    'tls',
+    'dnssec-validate',
+    'mail-transport',
+    'registry-support',
+    'registry-doctor',
+    'registry-cohort',
+    'registry-scaffold',
+    'risk-calibrate',
+    'lookalike-calibrate',
+    'verify-artifact',
+    'interchange-report',
+    'inspect-archive',
+    'sign-artifact',
+    'verify-signature',
+    'source-report',
+    'compare',
+    'page-compare',
+    'mail-review',
+    'review-evidence',
+    'brief',
+    'case-pack',
+    'domain-control',
+    'monitor-once',
+    'assurance',
+    'change-packet',
+    'sharing-review',
+    'workflow-plan',
+    'workflow-run',
+    'diff',
+    'reconcile',
+    'timeline',
+    'export',
+]);
+const INVESTIGATION_PLAN_RECIPES = Object.freeze([
+    'domain-triage',
+    'lookalike-review',
+    'owned-domain-review',
+    'historical-comparison',
+    'campaign-review',
+    'certificate-anomaly',
+    'registry-disagreement',
+    'evidence-handoff',
+    'planned-domain-change',
+    'post-change-verification',
+]);
+const RUNNABLE_INVESTIGATION_PLAN_RECIPES = Object.freeze([
+    'domain-triage',
+    'lookalike-review',
+    'owned-domain-review',
+    'historical-comparison',
+]);
+const CLI_META_ACTIONS = Object.freeze([
+    Object.freeze({
+        id: 'help',
+        aliases: Object.freeze(['--help', '-h']),
+        scope: 'root_or_command',
+        precedence: 'before_command_grammar',
+        bypassesOrdinaryRequirements: true,
+        acceptsAdditionalArguments: false,
+    }),
+    Object.freeze({
+        id: 'version',
+        aliases: Object.freeze(['--version', '-V']),
+        scope: 'root_only',
+        precedence: 'before_command_grammar',
+        bypassesOrdinaryRequirements: true,
+        acceptsAdditionalArguments: false,
+    }),
+]);
+const CLI_META_ACTION_BY_ID = Object.freeze(Object.fromEntries(CLI_META_ACTIONS.map((action) => [action.id, action])));
 // Human-facing command reference kept separate from command execution so
 // additions do not expand the already broad runtime controller.
-const HELP = `WHOISleuth CLI
-Source-aware domain investigation from your terminal.
+const HELP_INTRO = `WHOISleuth CLI
+Domain investigation from your terminal.
 
 Quick start:
-  whoisleuth lookup example.test
+  whoisleuth
+  whoisleuth example.test
   whoisleuth lookup example.test --deep
   cat domains.txt | whoisleuth bulk --jsonl
-
-Investigate:
-  lookup             Collect one domain, IP, or ASN.
-  bulk               Triage newline-delimited targets with bounded concurrency.
-  http               Inspect one homepage request and redirect chain.
-  tls                Inspect one hostname's current certificate connection.
-  dnssec-validate    Validate one authorised DNSSEC chain in isolation.
-  mail-transport     Review selected authorised MX transports and STARTTLS.
-  posture            Review DNS mail and domain-control posture.
-
-Discover:
-  ct-search          Search certificate-transparency observations.
-  ct-intake          Normalise a local certificate event batch for case import.
-  discover           Generate offline lookalike candidates.
-  discover-scan      Collect a bounded candidate review queue.
-  registry-support   Explain local registry coverage without a request.
-  registry-doctor    Diagnose a saved registry collection against local policy.
-  registry-cohort    Build target-free registry quality timelines.
-  registry-scaffold  Create a sanitised synthetic fixture scaffold.
-
-Review saved evidence:
-  map-observations    Apply a declarative profile to local observations.
-  oam-export          Project external findings into an open asset graph.
-  source-report      Summarise source reliability without retaining targets.
-  compare            Compare saved registry publications.
-  page-compare       Compare saved static page and TLS evidence.
-  mail-review        Review saved passive mail exposure evidence.
-  review-evidence    Review supplied DNS, routing, cryptographic, GeoIP, RDAP, or trust-store evidence offline.
-  brief              Turn one saved Lookup into a bounded decision brief.
-  case-pack          Build a reviewed browser-importable case package.
-  domain-control     Build or review an integrity-protected desired-state manifest.
-  monitor-once       Run one bounded domain-control review and checkpoint.
-  assurance          Review change, recovery, concentration, or retirement plans.
-  change-packet      Assemble a digest-protected domain change review packet.
-  sharing-review     Lint a reviewed artifact before deliberate sharing.
-  workflow-plan      Plan a fixed investigation recipe without executing it.
-  workflow-run       Execute resumable approved steps from a fixed recipe.
-  diff               Compare two compatible retained artefacts.
-  reconcile          Reconcile independently labelled observations.
-  timeline           Compare a sequence of observations for one domain.
-  export             Convert a saved lookup into an evidence report.
-  inspect-archive    Inspect a workspace archive, redacted by default.
-  verify-artifact    Validate saved evidence or an integrity envelope offline.
-  interchange-report Report preserved and excluded field groups offline.
-
-Integrity and calibration:
-  manifest           Record ordered artefact and configuration digests.
-  sign-artifact      Sign one reviewed packet or manifest locally.
-  verify-signature   Verify one signed evidence package locally.
-  risk-calibrate     Replay reviewed labels without changing the model.
-  lookalike-calibrate Summarise reviewed mutation-family yield without tuning generation.
-
-Terminal:
-  doctor             Check the local runtime; network tests require --network.
-  commands           List command contracts for people or local tooling.
-  completion         Print completion for bash, zsh, fish, or PowerShell.
-  manual             Print the generated manual page.
-
+`;
+const HELP_FOOTER = `
 Run "whoisleuth <command> --help" for focused usage and an example.
+With no arguments, an eligible interactive terminal opens a bounded launcher;
+redirected or unsupported terminals continue to print this help. No request
+starts until a Lookup plan is shown and the analyst confirms collection.
 Use --json or --jsonl where supported for machine-readable stdout.
 Use --output <file> for atomic private file output and --force to replace it.
+Use --palette auto, light, or dark after the command to select a fixed terminal
+colour palette; --no-color, NO_COLOR, and redirected output still suppress ANSI.
 Use --config <file> and --profile <name> for explicit versioned safe defaults.
+Registry scaffold is the exception: its --profile selects a fixture capability
+profile and --config is rejected, so bootstrap defaults cannot alter fixtures.
+An ICANN-recognised public domain, reserved documentation domain, IP, or ASN
+may replace "lookup"; URL-like or ambiguous input requires the explicit
+command. Both forms use the same Lookup options.
 Diagnostics are written to stderr. Fast lookup is the default; deep collection
 must be requested explicitly and can disclose a target to additional sources.
 
 Copyright 2026 slicedearth. Licensed under AGPL-3.0-only.
 Source and licence: ${WHOISLEUTH_SOURCE_REPOSITORY_URL}
 `;
-const COMMAND_USAGE = Object.freeze({
+const COMMAND_USAGE_SEED = Object.freeze({
     completion: 'whoisleuth completion <bash|zsh|fish|powershell>',
     doctor: 'whoisleuth doctor [--network] [--json] [--quiet] [--no-color]',
-    commands: 'whoisleuth commands [--json] [--quiet] [--no-color]',
+    commands: 'whoisleuth commands [--common] [--group <group>] [--mode <offline|network>] [--json] [--quiet] [--no-color]',
     manual: 'whoisleuth manual',
     manifest: 'whoisleuth manifest <artefact.json> [...] --workflow <label> [--configuration-digest <sha256:digest>] [--json] [--quiet] [--no-color]',
     'map-observations': 'whoisleuth map-observations [mapping.json] [--json] [--quiet] [--no-color]',
     'oam-export': 'whoisleuth oam-export [external-findings.json] [--json] [--quiet] [--no-color]',
-    lookup: 'whoisleuth lookup <domain|IP|ASN> [--json|--junit|--markdown|--html] [--no-attribution] [--fast|--deep] [--observer <label>] [--vantage <label>] [--plan] [--summary|--verbose] [--strict-exit] [--fail-on <policies>] [--events] [--quiet] [--no-color]',
-    bulk: 'whoisleuth bulk [file] [--json|--jsonl|--junit|--csv|--domains|--queries] [--registered-only|--inconclusive-only|--errors-only] [--fast|--deep] [--concurrency <1-8>] [--checkpoint <file> [--resume]] [--events] [--plan] [--fail-on <policies>]',
-    'ct-search': 'whoisleuth ct-search <keyword> [--json] [--quiet] [--no-color]',
+    lookup: 'whoisleuth lookup [domain|IP|ASN] [--json|--junit|--markdown|--html] [--no-attribution] [--fast|--deep] [--observer <label>] [--vantage <label>] [--plan] [--summary|--verbose|--browse [--save-lookup <file>]] [--palette <auto|light|dark>] [--strict-exit] [--fail-on <policies>] [--events] [--quiet] [--no-color]',
+    bulk: 'whoisleuth bulk [file] [--json|--jsonl|--junit|--csv|--domains|--queries] [--registered-only|--inconclusive-only|--errors-only] [--fast|--deep] [--concurrency <1-8>] [--checkpoint <file> [--resume]] [--events] [--plan] [--fail-on <policies>] [--quiet] [--no-color]',
+    'ct-search': 'whoisleuth ct-search [keyword] [--json] [--quiet] [--no-color]',
     'ct-intake': 'whoisleuth ct-intake [events.json] [--json] [--quiet] [--no-color]',
-    discover: 'whoisleuth discover <brand|domain> [--tlds <list>] [--preset <name>|--families <ids>] [--keyboard <layout>] [--dictionary <file>] [--snapshot <file>] [--json|--jsonl|--domains]',
-    'discover-scan': 'whoisleuth discover-scan <brand|domain> [--fast|--deep] [--scan-limit <n>] [--chunk-size <n>] [--concurrency <n>] [--resolver <IPs>] [--allowlist <file>] [--checkpoint <file> [--resume]] [--observation-snapshot <file>] [--json|--jsonl|--csv|--domains] [--plan] [--fail-on <policies>]',
-    posture: 'whoisleuth posture <domain> [--selectors <list>] [--retired-selectors <list>] [--mail-profile <profile>] [--json|--sarif --owned-domain] [--quiet] [--no-color]',
-    http: 'whoisleuth http <domain> [--json] [--quiet] [--no-color]',
-    tls: 'whoisleuth tls <hostname> [--json] [--quiet] [--no-color]',
+    discover: 'whoisleuth discover [brand|domain] [--tlds <list>] [--preset <name>|--families <ids>] [--keyboard <layout>] [--dictionary <file>] [--snapshot <file>] [--json|--jsonl|--domains] [--quiet] [--no-color]',
+    'discover-scan': 'whoisleuth discover-scan [brand|domain] [--tlds <list>] [--preset <name>|--families <ids>] [--keyboard <layout>] [--dictionary <file>] [--fast|--deep] [--scan-limit <n>] [--chunk-size <n>] [--concurrency <n>] [--resolver <IPs>] [--allowlist <file>] [--checkpoint <file> [--resume]] [--observation-snapshot <file>] [--registered-only|--inconclusive-only|--acquisition-only|--suppressed-only] [--events] [--json|--jsonl|--csv|--domains] [--plan] [--fail-on <policies>] [--quiet] [--no-color]',
+    posture: 'whoisleuth posture [domain] [--selectors <list>] [--retired-selectors <list>] [--mail-profile <profile>] [--json|--sarif --owned-domain] [--quiet] [--no-color]',
+    http: 'whoisleuth http [domain] [--json] [--quiet] [--no-color]',
+    tls: 'whoisleuth tls [hostname] [--json] [--quiet] [--no-color]',
     'dnssec-validate': 'whoisleuth dnssec-validate <domain> --resolver <public-IP> --trust-anchor <anchor.json> --owned-or-authorized [--json] [--quiet] [--no-color]',
     'mail-transport': 'whoisleuth mail-transport [input.json] --resolver <public-IP> --trust-anchor <anchor.json> --owned-or-authorized --active-probe [--json] [--quiet] [--no-color]',
-    'registry-support': 'whoisleuth registry-support <domain|suffix> [--json] [--quiet] [--no-color]',
+    'registry-support': 'whoisleuth registry-support [domain|suffix] [--json] [--quiet] [--no-color]',
     'registry-doctor': 'whoisleuth registry-doctor [lookup.json] [--json] [--quiet] [--no-color]',
     'registry-cohort': 'whoisleuth registry-cohort [lookups-or-reports.json|jsonl] [--json] [--quiet] [--no-color]',
     'registry-scaffold': 'whoisleuth registry-scaffold --profile <id> --suffix <suffix> --scenario <registered|not_found|inconclusive>',
@@ -103,7 +147,7 @@ const COMMAND_USAGE = Object.freeze({
     'lookalike-calibrate': 'whoisleuth lookalike-calibrate [dataset.json] [--json] [--quiet] [--no-color]',
     'verify-artifact': 'whoisleuth verify-artifact [artifact.json] [--passphrase-file <file>] [--manifest <manifest.json> --manifest-entry <artifact-N>] [--json] [--strict-exit] [--quiet] [--no-color]',
     'interchange-report': 'whoisleuth interchange-report [artifact.json] [--passphrase-file <file>] [--json] [--quiet] [--no-color]',
-    'inspect-archive': 'whoisleuth inspect-archive [archive.json] [--passphrase-file <file>] [--search <value>] [--require-match] [--reveal] [--expect-content-digest <sha256:digest>] [--json]',
+    'inspect-archive': 'whoisleuth inspect-archive [archive.json] [--passphrase-file <file>] [--search <value>] [--require-match] [--reveal] [--expect-content-digest <sha256:digest>] [--json] [--quiet] [--no-color]',
     'sign-artifact': 'whoisleuth sign-artifact [artifact.json] --private-key-file <file>',
     'verify-signature': 'whoisleuth verify-signature [package.json] [--public-key-file <file>] [--json] [--quiet] [--no-color]',
     'source-report': 'whoisleuth source-report [lookup.json] [--json] [--quiet] [--no-color]',
@@ -117,15 +161,15 @@ const COMMAND_USAGE = Object.freeze({
     'monitor-once': 'whoisleuth monitor-once [manifest.json] [--previous <snapshot.json>] [--limit <1-20>] [--concurrency <1-3>] [--fail-on <policies>] [--json|--junit] [--quiet] [--no-color]',
     assurance: 'whoisleuth assurance [assurance-input.json] [--json] [--quiet] [--no-color]',
     'change-packet': 'whoisleuth change-packet [change-packet-input.json] [--json] [--quiet] [--no-color]',
-    'sharing-review': 'whoisleuth sharing-review [artifact.json] --marking <level> --recipient-scope <scope> --purpose <text> [--human-reviewed] [--personal-data-reviewed] [--redactions-confirmed] [--json]',
-    'workflow-plan': 'whoisleuth workflow-plan <recipe> <domain|brand> [--json] [--quiet] [--no-color]',
+    'sharing-review': 'whoisleuth sharing-review [artifact.json] --marking <level> --recipient-scope <scope> --purpose <text> [--human-reviewed] [--personal-data-reviewed] [--redactions-confirmed] [--json] [--quiet] [--no-color]',
+    'workflow-plan': 'whoisleuth workflow-plan <recipe> <domain|brand> | --list | --explain <recipe> [--json] [--quiet] [--no-color]',
     'workflow-run': 'whoisleuth workflow-run <recipe> <domain|brand> [--approve-network] [--resume <state.json>] [--json] [--quiet] [--no-color]',
     diff: 'whoisleuth diff <left.json> <right.json> [--left-session <id> --right-session <id>] [--json] [--quiet] [--no-color]',
     reconcile: 'whoisleuth reconcile <observation.json> <observation.json> [...] [--json] [--quiet] [--no-color]',
     timeline: 'whoisleuth timeline <observation.json> <observation.json> [...] [--json] [--quiet] [--no-color]',
     export: 'whoisleuth export [lookup.json] [--markdown|--html|--compact] [--no-attribution]',
 });
-const COMMAND_DETAILS = Object.freeze({
+const COMMAND_DETAILS_SEED = Object.freeze({
     completion: {
         description: 'Print a static shell-completion script for the installed CLI.',
         example: 'whoisleuth completion zsh > ~/.zfunc/_whoisleuth',
@@ -163,8 +207,8 @@ const COMMAND_DETAILS = Object.freeze({
     },
     lookup: {
         description: 'Collect registration evidence for one domain, IP, or ASN.',
-        example: 'whoisleuth lookup example.test --deep',
-        boundary: 'Fast is the default. Deep mode adds bounded WHOIS, DNS, HTTP, TLS, technology, posture, and network context where applicable.',
+        example: 'whoisleuth lookup example.test --deep --browse',
+        boundary: 'Fast is the default. An ICANN-recognised public domain, reserved documentation domain, IP, or ASN may occupy command position as shorthand; it delegates to this same parser and URL-like input requires the explicit lookup command. Deep mode adds bounded WHOIS, DNS, HTTP, TLS, technology, posture, and network context where applicable. A full Deep homepage observation can derive fixed publication and delivery/cache summaries from the same response without retaining raw metadata values or making another request. --browse opens before collection, shows aggregate Fast progress or independently settled planned Deep sources, and then navigates allowlisted retained fields in the completed document. Press ? for help and / to search rendered panel text only. Closing during collection cancels without a partial document. --save-lookup writes the exact completed private JSON only after a normal browser close; it can contain normalised evidence omitted from panels and refuses an existing path.',
     },
     bulk: {
         description: 'Triage newline-delimited domains, IPs, or ASNs with bounded concurrency.',
@@ -199,7 +243,7 @@ const COMMAND_DETAILS = Object.freeze({
     http: {
         description: 'Inspect one homepage request, redirects, and bounded response metadata.',
         example: 'whoisleuth http example.test --json',
-        boundary: 'Requests use the shared public-address and redirect guards. This is not a rendered browser or vulnerability scan.',
+        boundary: 'Requests use the shared public-address and redirect guards. Fixed content-coding and cache-policy metadata describes only the selected response, excludes raw header values, and does not prove caching, transfer savings, performance, privacy, or safety. This is not a rendered browser or vulnerability scan.',
     },
     tls: {
         description: 'Inspect one hostname certificate through a bounded TLS connection.',
@@ -234,7 +278,7 @@ const COMMAND_DETAILS = Object.freeze({
     'registry-scaffold': {
         description: 'Create a bounded synthetic WHOIS fixture scaffold for one existing capability profile.',
         example: 'whoisleuth registry-scaffold --profile example-profile --suffix test --scenario registered',
-        boundary: 'The output is a sanitised template only. Contributors must not paste live responses or personal registration data into fixtures.',
+        boundary: 'The output is a sanitised template only. Its command-owned --profile selects fixture capability, --config is rejected, and contributors must not paste live responses or personal registration data into fixtures.',
     },
     'risk-calibrate': {
         description: 'Replay reviewed labels against the current explainable Risk model.',
@@ -257,9 +301,9 @@ const COMMAND_DETAILS = Object.freeze({
         boundary: 'The report is offline and metadata-only. It does not echo targets, contacts, notes, passphrases, evidence values, or an unrecognised schema string.',
     },
     'inspect-archive': {
-        description: 'Summarise or search one workspace archive with redacted output by default.',
+        description: `Summarise or search one current version-${WORKSPACE_ARCHIVE_VERSION} workspace archive, with exact public version-${PUBLIC_WORKSPACE_ARCHIVE_VERSION} support and redacted output by default.`,
         example: 'whoisleuth inspect-archive workspace.json --search example.test --json',
-        boundary: 'Exact matches require --reveal. Content identity excludes export time and formatting. The archive is read locally and is never uploaded.',
+        boundary: 'Exact matches require --reveal. Retired and future archive versions are rejected without changing data. The archive is read locally and is never uploaded.',
     },
     'sign-artifact': {
         description: 'Sign one reviewed response packet or supported manifest with a local private key.',
@@ -267,9 +311,9 @@ const COMMAND_DETAILS = Object.freeze({
         boundary: 'The command never creates, stores, or transmits keys. Key custody and signer identity remain the operator\'s responsibility.',
     },
     'verify-signature': {
-        description: 'Verify the cryptographic signature of one signed evidence package and report embedded-artifact assurance separately.',
+        description: 'Verify the cryptographic signature of one signed evidence package and report embedded-artefact assurance separately.',
         example: 'whoisleuth verify-signature packet.signed.json --json',
-        boundary: 'A valid signature proves package consistency for the embedded key. It does not upgrade failed or unsupported embedded-artifact assurance or establish the holder\'s real-world identity or authority.',
+        boundary: 'A valid signature proves package consistency for the embedded key. It does not upgrade failed or unsupported embedded-artefact assurance or establish the holder\'s real-world identity or authority.',
     },
     'source-report': {
         description: 'Create a target-free reliability summary from a saved lookup.',
@@ -302,7 +346,7 @@ const COMMAND_DETAILS = Object.freeze({
         boundary: 'The command is offline, excludes raw upstream payloads, and does not create an analyst assertion or claim that the saved observation is current.',
     },
     'case-pack': {
-        description: 'Build a reviewed, audience-specific and browser-importable case package.',
+        description: `Build a reviewed, audience-specific Case-pack v2 from an exact Case-schema-${CASE_SCHEMA_VERSION} export.`,
         example: 'whoisleuth case-pack cases.json --audience trusted --reviewed --json',
         boundary: 'The command is offline, creates a new package, never mutates the source archive, and requires an explicit review acknowledgement.',
     },
@@ -359,10 +403,10 @@ const COMMAND_DETAILS = Object.freeze({
     export: {
         description: 'Convert one saved lookup into a versioned evidence report.',
         example: 'whoisleuth export lookup.json --markdown',
-        boundary: 'The saved Lookup is capped at 8 MiB and scanned for duplicate keys, the prototype-sensitive __proto__ key, and bounded nesting, key, value, and per-container counts before parsing. Exports preserve evidence-source attribution and limitations. Markdown and HTML include a presentation-only generator footer unless --no-attribution is selected; JSON retains bounded generator provenance. Compact output intentionally omits raw registry payloads.',
+        boundary: `Saved Lookup versions 1 and 2 are capped at 8 MiB and scanned for duplicate keys, the prototype-sensitive __proto__ key, and bounded nesting, key, value, and per-container counts before parsing. Current schema-${LOOKUP_EVIDENCE_SCHEMA_VERSION} exports preserve evidence-source attribution and limitations; exact public schema ${PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION} remains readable with its strict source/publication binding, while other historical and unreleased shapes are unsupported. Markdown and HTML include a presentation-only generator footer unless --no-attribution is selected; JSON retains bounded generator provenance. Compact output intentionally omits raw registry payloads.`,
     },
 });
-const COMMAND_COLLECTION = Object.freeze({
+const COMMAND_COLLECTION_SEED = Object.freeze({
     completion: { mode: 'offline', scope: 'Prints one static script and changes no shell configuration.' },
     doctor: { mode: 'network', scope: 'Network access is opt-in with --network and is limited to fixed public DNS, HTTPS, and WHOIS diagnostics.' },
     commands: { mode: 'offline', scope: 'Reads the embedded command catalogue and performs no collection.' },
@@ -376,7 +420,7 @@ const COMMAND_COLLECTION = Object.freeze({
     'ct-intake': { mode: 'offline', scope: 'Reads one source-qualified event batch capped at 4 MiB and makes no request.' },
     discover: { mode: 'offline', scope: 'Generates a bounded candidate set from local rules, dictionaries, and optional saved snapshots.' },
     'discover-scan': { mode: 'network', scope: 'Scans at most 500 fast or 50 deep candidates, with concurrency capped at 8 fast or 3 deep.' },
-    posture: { mode: 'network', scope: 'Accepts one domain and performs bounded DNS queries only.' },
+    posture: { mode: 'network', scope: 'Accepts one domain and performs bounded RDAP, DNS, and conditional MTA-STS HTTPS requests.' },
     http: { mode: 'network', scope: 'Accepts one domain and follows only the bounded SSRF-guarded homepage redirect workflow.' },
     tls: { mode: 'network', scope: 'Accepts one public hostname and opens one bounded certificate connection.' },
     'dnssec-validate': { mode: 'network', scope: 'Accepts one authorised domain, one public resolver IP, and one local trust-anchor file; DNS-over-TCP validation is capped at 32 queries and 15 seconds.' },
@@ -389,7 +433,7 @@ const COMMAND_COLLECTION = Object.freeze({
     'lookalike-calibrate': { mode: 'offline', scope: 'Reads at most 5,000 reviewed candidate labels from one dataset capped at 2 MiB.' },
     'verify-artifact': { mode: 'offline', scope: 'Reads one selected bounded artefact and, when explicitly supplied, one manifest whose selected entry is compared by exact bytes and canonical identity.' },
     'interchange-report': { mode: 'offline', scope: 'Reads one selected bounded portable artefact and emits fixed compatibility metadata only.' },
-    'inspect-archive': { mode: 'offline', scope: 'Reads one selected bounded workspace archive with redacted output by default.' },
+    'inspect-archive': { mode: 'offline', scope: `Reads one selected bounded workspace archive v${WORKSPACE_ARCHIVE_VERSION}, retains exact v${PUBLIC_WORKSPACE_ARCHIVE_VERSION} compatibility, and redacts output by default.` },
     'sign-artifact': { mode: 'offline', scope: 'Reads one selected artefact and one local private key without transmitting either.' },
     'verify-signature': { mode: 'offline', scope: 'Reads one selected signed package and optional local public key.' },
     'source-report': { mode: 'offline', scope: 'Reads bounded saved evidence and emits target-free source reliability data.' },
@@ -397,8 +441,8 @@ const COMMAND_COLLECTION = Object.freeze({
     'page-compare': { mode: 'offline', scope: 'Reads two saved Lookup documents and executes no page code.' },
     'mail-review': { mode: 'offline', scope: 'Reads one saved Bulk result and sends no DNS or SMTP traffic.' },
     'review-evidence': { mode: 'offline', scope: 'Reads one bounded versioned evidence or request-planning document and performs no collection.' },
-    brief: { mode: 'offline', scope: 'Reads one bounded saved Lookup and emits a compact source-aware decision brief.' },
-    'case-pack': { mode: 'offline', scope: 'Reads one bounded browser case export and writes a separate audience-specific package.' },
+    brief: { mode: 'offline', scope: 'Reads one bounded saved Lookup and emits a compact source-attributed decision brief.' },
+    'case-pack': { mode: 'offline', scope: `Reads one bounded Case-schema-${CASE_SCHEMA_VERSION} browser export and writes a separate audience-specific Case-pack v2.` },
     'domain-control': { mode: 'offline', scope: 'Reads one bounded desired-state or review document and performs no collection or configuration change.' },
     'monitor-once': { mode: 'network', scope: 'Runs deep collection for at most 20 manifest domains with concurrency capped at 3.' },
     assurance: { mode: 'offline', scope: 'Reads one versioned plan capped at 2 MiB and makes no request or configuration change.' },
@@ -411,9 +455,783 @@ const COMMAND_COLLECTION = Object.freeze({
     timeline: { mode: 'offline', scope: 'Reads 2 to 20 saved observations for one domain, capped at 32 MiB in total.' },
     export: { mode: 'offline', scope: 'Reads one saved Lookup and writes one bounded report.' },
 });
+const COMMON_OPTIONS = Object.freeze(['--help', '--output', '--force', '--config', '--profile', '--palette']);
+const REGISTRY_SCAFFOLD_COMMON_OPTIONS = Object.freeze(COMMON_OPTIONS.filter((option) => option !== '--config' && option !== '--profile'));
+function commonOptionsSeedForCommand(command) {
+    return command === 'registry-scaffold' ? REGISTRY_SCAFFOLD_COMMON_OPTIONS : COMMON_OPTIONS;
+}
+const OPTIONS_BY_COMMAND_SEED = Object.freeze({
+    manifest: ['--workflow', '--configuration-digest', '--json', '--quiet', '--no-color'],
+    'map-observations': ['--json', '--quiet', '--no-color'],
+    'oam-export': ['--json', '--quiet', '--no-color'],
+    lookup: ['--json', '--junit', '--markdown', '--html', '--no-attribution', '--fast', '--deep', '--observer', '--vantage', '--plan', '--summary', '--verbose', '--browse', '--save-lookup', '--strict-exit', '--fail-on', '--events', '--quiet', '--no-color'],
+    bulk: ['--json', '--jsonl', '--junit', '--csv', '--domains', '--queries', '--registered-only', '--inconclusive-only', '--errors-only', '--fast', '--deep', '--concurrency', '--checkpoint', '--resume', '--events', '--plan', '--fail-on', '--quiet', '--no-color'],
+    'ct-search': ['--json', '--quiet', '--no-color'],
+    'ct-intake': ['--json', '--quiet', '--no-color'],
+    discover: ['--tlds', '--preset', '--families', '--keyboard', '--dictionary', '--snapshot', '--json', '--jsonl', '--domains', '--quiet', '--no-color'],
+    'discover-scan': ['--tlds', '--preset', '--families', '--keyboard', '--dictionary', '--fast', '--deep', '--scan-limit', '--chunk-size', '--concurrency', '--resolver', '--allowlist', '--checkpoint', '--resume', '--observation-snapshot', '--registered-only', '--inconclusive-only', '--acquisition-only', '--suppressed-only', '--events', '--plan', '--fail-on', '--json', '--jsonl', '--csv', '--domains', '--quiet', '--no-color'],
+    posture: ['--selectors', '--retired-selectors', '--mail-profile', '--json', '--sarif', '--owned-domain', '--quiet', '--no-color'],
+    http: ['--json', '--quiet', '--no-color'],
+    tls: ['--json', '--quiet', '--no-color'],
+    'dnssec-validate': ['--resolver', '--trust-anchor', '--owned-or-authorized', '--json', '--quiet', '--no-color'],
+    'mail-transport': ['--resolver', '--trust-anchor', '--owned-or-authorized', '--active-probe', '--json', '--quiet', '--no-color'],
+    'registry-support': ['--json', '--quiet', '--no-color'],
+    'registry-doctor': ['--json', '--quiet', '--no-color'],
+    'registry-cohort': ['--json', '--quiet', '--no-color'],
+    'registry-scaffold': ['--profile', '--suffix', '--scenario'],
+    'risk-calibrate': ['--json', '--summary-json', '--quiet', '--no-color'],
+    'lookalike-calibrate': ['--json', '--quiet', '--no-color'],
+    'verify-artifact': ['--passphrase-file', '--manifest', '--manifest-entry', '--json', '--strict-exit', '--quiet', '--no-color'],
+    'interchange-report': ['--passphrase-file', '--json', '--quiet', '--no-color'],
+    'inspect-archive': ['--passphrase-file', '--search', '--require-match', '--reveal', '--expect-content-digest', '--json', '--quiet', '--no-color'],
+    'sign-artifact': ['--private-key-file'],
+    'verify-signature': ['--public-key-file', '--json', '--quiet', '--no-color'],
+    'source-report': ['--json', '--quiet', '--no-color'],
+    compare: ['--json', '--quiet', '--no-color'],
+    'page-compare': ['--json', '--quiet', '--no-color'],
+    'mail-review': ['--json', '--quiet', '--no-color'],
+    'review-evidence': ['--mmdb', '--json', '--strict-exit', '--quiet', '--no-color'],
+    brief: ['--json', '--quiet', '--no-color'],
+    'case-pack': ['--audience', '--reviewed', '--json', '--quiet', '--no-color'],
+    'domain-control': ['--json', '--quiet', '--no-color'],
+    'monitor-once': ['--previous', '--limit', '--concurrency', '--fail-on', '--json', '--junit', '--quiet', '--no-color'],
+    assurance: ['--json', '--quiet', '--no-color'],
+    'change-packet': ['--json', '--quiet', '--no-color'],
+    'sharing-review': ['--marking', '--recipient-scope', '--purpose', '--human-reviewed', '--personal-data-reviewed', '--redactions-confirmed', '--json', '--quiet', '--no-color'],
+    'workflow-plan': ['--list', '--explain', '--json', '--quiet', '--no-color'],
+    'workflow-run': ['--approve-network', '--resume', '--json', '--quiet', '--no-color'],
+    diff: ['--left-session', '--right-session', '--json', '--quiet', '--no-color'],
+    reconcile: ['--json', '--quiet', '--no-color'],
+    timeline: ['--json', '--quiet', '--no-color'],
+    export: ['--markdown', '--html', '--compact', '--no-attribution'],
+    completion: [],
+    commands: ['--common', '--group', '--mode', '--json', '--quiet', '--no-color'],
+    doctor: ['--network', '--json', '--quiet', '--no-color'],
+    manual: [],
+});
+const VALUE_OPTIONS = Object.freeze({
+    '--group': Object.freeze(['investigate', 'respond', 'assure', 'utilities']),
+    '--mode': Object.freeze(['offline', 'network']),
+    '--explain': INVESTIGATION_PLAN_RECIPES,
+    '--preset': Object.freeze(['common', 'impersonation', 'all']),
+    '--keyboard': Object.freeze(['qwerty', 'azerty', 'qwertz', 'all']),
+    '--mail-profile': Object.freeze(['standard', 'defensive-no-mail', 'parked']),
+    '--marking': Object.freeze(['clear', 'green', 'amber', 'amber-strict', 'red']),
+    '--recipient-scope': Object.freeze(['public', 'community', 'organization', 'named-recipients']),
+    '--audience': Object.freeze(['internal', 'trusted', 'public']),
+    '--fail-on': Object.freeze(['source-failure', 'inconclusive', 'danger', 'material-drift']),
+    '--manifest-entry': Object.freeze(Array.from({ length: 16 }, (_, index) => `artifact-${index + 1}`)),
+    '--palette': Object.freeze(['auto', 'light', 'dark']),
+    '--scenario': Object.freeze(['registered', 'not_found', 'inconclusive']),
+});
+const STANDARD_CONCURRENCY_VALUES = Object.freeze(['1', '2', '3', '4', '5', '6', '7', '8']);
+const LIMITED_CONCURRENCY_VALUES = Object.freeze(['1', '2', '3']);
+const FILE_OPTIONS = Object.freeze([
+    '--checkpoint',
+    '--config',
+    '--allowlist',
+    '--dictionary',
+    '--manifest',
+    '--mmdb',
+    '--output',
+    '--passphrase-file',
+    '--private-key-file',
+    '--public-key-file',
+    '--snapshot',
+    '--observation-snapshot',
+    '--previous',
+    '--save-lookup',
+    '--trust-anchor',
+]);
+const FILE_OPTIONS_BY_COMMAND = Object.freeze({
+    'workflow-run': Object.freeze(['--resume']),
+});
+function positional(name, valueKind, minimum, maximum, values = [], inputSource = 'argv', requiredWhenOptions = []) {
+    return Object.freeze({
+        name,
+        valueKind,
+        minimum,
+        maximum,
+        values: Object.freeze([...values]),
+        inputSource,
+        requiredWhenOptions: Object.freeze([...requiredWhenOptions]),
+    });
+}
+const NO_POSITIONALS = Object.freeze([]);
+const OPTIONAL_FILE_POSITIONAL = Object.freeze([positional('source', 'file', 0, 1, [], 'argv_or_stdin')]);
+const OPTIONAL_TEXT_POSITIONAL = Object.freeze([positional('subject', 'text', 0, 1, [], 'argv_or_stdin')]);
+const POSITIONALS_BY_COMMAND_SEED = Object.freeze({
+    completion: Object.freeze([positional('shell', 'enum', 1, 1, ['bash', 'zsh', 'fish', 'powershell'])]),
+    doctor: NO_POSITIONALS,
+    commands: NO_POSITIONALS,
+    manual: NO_POSITIONALS,
+    manifest: Object.freeze([positional('artefacts', 'file', 1, 16)]),
+    'map-observations': OPTIONAL_FILE_POSITIONAL,
+    'oam-export': OPTIONAL_FILE_POSITIONAL,
+    lookup: Object.freeze([positional('target', 'text', 0, 1, [], 'argv_or_stdin', ['--browse'])]),
+    bulk: OPTIONAL_FILE_POSITIONAL,
+    'ct-search': Object.freeze([positional('keyword', 'text', 0, 1, [], 'argv_or_stdin')]),
+    'ct-intake': OPTIONAL_FILE_POSITIONAL,
+    discover: OPTIONAL_TEXT_POSITIONAL,
+    'discover-scan': OPTIONAL_TEXT_POSITIONAL,
+    posture: Object.freeze([positional('domain', 'text', 0, 1, [], 'argv_or_stdin')]),
+    http: Object.freeze([positional('domain', 'text', 0, 1, [], 'argv_or_stdin')]),
+    tls: Object.freeze([positional('hostname', 'text', 0, 1, [], 'argv_or_stdin')]),
+    'dnssec-validate': Object.freeze([positional('domain', 'text', 1, 1)]),
+    'mail-transport': OPTIONAL_FILE_POSITIONAL,
+    'registry-support': Object.freeze([positional('domain-or-suffix', 'text', 0, 1, [], 'argv_or_stdin')]),
+    'registry-doctor': OPTIONAL_FILE_POSITIONAL,
+    'registry-cohort': OPTIONAL_FILE_POSITIONAL,
+    'registry-scaffold': NO_POSITIONALS,
+    'risk-calibrate': OPTIONAL_FILE_POSITIONAL,
+    'lookalike-calibrate': OPTIONAL_FILE_POSITIONAL,
+    'verify-artifact': OPTIONAL_FILE_POSITIONAL,
+    'interchange-report': OPTIONAL_FILE_POSITIONAL,
+    'inspect-archive': OPTIONAL_FILE_POSITIONAL,
+    'sign-artifact': OPTIONAL_FILE_POSITIONAL,
+    'verify-signature': OPTIONAL_FILE_POSITIONAL,
+    'source-report': OPTIONAL_FILE_POSITIONAL,
+    compare: OPTIONAL_FILE_POSITIONAL,
+    'page-compare': Object.freeze([positional('sources', 'file', 2, 2)]),
+    'mail-review': OPTIONAL_FILE_POSITIONAL,
+    'review-evidence': OPTIONAL_FILE_POSITIONAL,
+    brief: OPTIONAL_FILE_POSITIONAL,
+    'case-pack': OPTIONAL_FILE_POSITIONAL,
+    'domain-control': OPTIONAL_FILE_POSITIONAL,
+    'monitor-once': OPTIONAL_FILE_POSITIONAL,
+    assurance: OPTIONAL_FILE_POSITIONAL,
+    'change-packet': OPTIONAL_FILE_POSITIONAL,
+    'sharing-review': OPTIONAL_FILE_POSITIONAL,
+    'workflow-plan': Object.freeze([
+        positional('recipe', 'enum', 0, 1, INVESTIGATION_PLAN_RECIPES),
+        positional('subject', 'text', 0, 1),
+    ]),
+    'workflow-run': Object.freeze([
+        positional('recipe', 'enum', 1, 1, RUNNABLE_INVESTIGATION_PLAN_RECIPES),
+        positional('subject', 'text', 1, 1),
+    ]),
+    diff: Object.freeze([positional('sources', 'file', 2, 2)]),
+    reconcile: Object.freeze([positional('sources', 'file', 2, 5)]),
+    timeline: Object.freeze([positional('sources', 'file', 2, 20)]),
+    export: OPTIONAL_FILE_POSITIONAL,
+});
+const TEXT_OPTIONS = Object.freeze([
+    '--families',
+    '--workflow',
+    '--configuration-digest',
+    '--resolver',
+    '--expect-content-digest',
+    '--profile',
+    '--suffix',
+    '--left-session',
+    '--right-session',
+    '--purpose',
+    '--observer',
+    '--retired-selectors',
+    '--search',
+    '--selectors',
+    '--tlds',
+    '--vantage',
+]);
+const IDEMPOTENT_OPTIONS = Object.freeze([
+    '--human-reviewed',
+    '--no-color',
+    '--personal-data-reviewed',
+    '--quiet',
+    '--redactions-confirmed',
+]);
+const INTEGER_RANGE_SEED = Object.freeze({
+    bulk: Object.freeze({
+        '--concurrency': Object.freeze([
+            Object.freeze({ minimum: 1, maximum: 8, whenOptionPresent: null }),
+            Object.freeze({ minimum: 1, maximum: 3, whenOptionPresent: '--deep' }),
+        ]),
+    }),
+    'discover-scan': Object.freeze({
+        '--scan-limit': Object.freeze([
+            Object.freeze({ minimum: 1, maximum: 500, whenOptionPresent: null }),
+            Object.freeze({ minimum: 1, maximum: 50, whenOptionPresent: '--deep' }),
+        ]),
+        '--chunk-size': Object.freeze([
+            Object.freeze({ minimum: 1, maximum: 100, whenOptionPresent: null }),
+        ]),
+        '--concurrency': Object.freeze([
+            Object.freeze({ minimum: 1, maximum: 8, whenOptionPresent: null }),
+            Object.freeze({ minimum: 1, maximum: 3, whenOptionPresent: '--deep' }),
+        ]),
+    }),
+    'monitor-once': Object.freeze({
+        '--limit': Object.freeze([
+            Object.freeze({ minimum: 1, maximum: 20, whenOptionPresent: null }),
+        ]),
+        '--concurrency': Object.freeze([
+            Object.freeze({ minimum: 1, maximum: 3, whenOptionPresent: null }),
+        ]),
+    }),
+});
+function constraint(value) {
+    if (value.kind === 'mutually_exclusive') {
+        return Object.freeze({ ...value, options: Object.freeze([...value.options]) });
+    }
+    if (value.kind === 'required') {
+        return Object.freeze({ ...value, options: Object.freeze([...value.options]) });
+    }
+    if (value.kind === 'excludes_all' || value.kind === 'value_excludes') {
+        return Object.freeze({ ...value, excludedOptions: Object.freeze([...value.excludedOptions]) });
+    }
+    return Object.freeze({ ...value, requiredOptions: Object.freeze([...value.requiredOptions]) });
+}
+const EMPTY_CONSTRAINTS = Object.freeze([]);
+const FILE_OUTPUT_CONSTRAINTS = Object.freeze([
+    constraint({ kind: 'requires_all', option: '--force', requiredOptions: ['--output'] }),
+]);
+const QUIET_OUTPUT_CONSTRAINT = constraint({
+    kind: 'mutually_exclusive',
+    options: ['--quiet', '--output'],
+});
+const MACHINE_OUTPUT_OPTIONS = Object.freeze([
+    '--json', '--jsonl', '--junit', '--csv', '--domains', '--queries', '--markdown',
+    '--html', '--sarif', '--summary-json',
+]);
+const GRAMMAR_CONSTRAINTS_SEED = Object.freeze({
+    commands: Object.freeze([]),
+    manifest: Object.freeze([
+        constraint({ kind: 'required', options: ['--workflow'] }),
+    ]),
+    lookup: Object.freeze([
+        constraint({ kind: 'mutually_exclusive', options: ['--json', '--junit', '--markdown', '--html'] }),
+        constraint({ kind: 'mutually_exclusive', options: ['--fast', '--deep'] }),
+        constraint({ kind: 'mutually_exclusive', options: ['--summary', '--verbose'] }),
+        constraint({ kind: 'requires_all', option: '--save-lookup', requiredOptions: ['--browse'] }),
+        constraint({ kind: 'excludes_all', option: '--summary', excludedOptions: ['--json', '--junit', '--markdown', '--html'] }),
+        constraint({ kind: 'excludes_all', option: '--verbose', excludedOptions: ['--json', '--junit', '--markdown', '--html'] }),
+        constraint({ kind: 'excludes_all', option: '--browse', excludedOptions: ['--json', '--junit', '--markdown', '--html', '--summary', '--verbose', '--events', '--plan', '--quiet'] }),
+        constraint({ kind: 'requires_any', option: '--no-attribution', requiredOptions: ['--markdown', '--html'] }),
+        constraint({ kind: 'excludes_all', option: '--plan', excludedOptions: ['--junit', '--markdown', '--html', '--summary', '--verbose', '--strict-exit', '--events', '--quiet', '--fail-on'] }),
+    ]),
+    bulk: Object.freeze([
+        constraint({ kind: 'mutually_exclusive', options: ['--json', '--jsonl', '--junit', '--csv', '--domains', '--queries'] }),
+        constraint({ kind: 'mutually_exclusive', options: ['--registered-only', '--inconclusive-only', '--errors-only'] }),
+        constraint({ kind: 'mutually_exclusive', options: ['--fast', '--deep'] }),
+        constraint({ kind: 'requires_all', option: '--resume', requiredOptions: ['--checkpoint'] }),
+        constraint({ kind: 'excludes_all', option: '--plan', excludedOptions: ['--jsonl', '--junit', '--csv', '--domains', '--queries', '--events', '--checkpoint', '--resume', '--quiet', '--fail-on'] }),
+    ]),
+    discover: Object.freeze([
+        constraint({ kind: 'mutually_exclusive', options: ['--json', '--jsonl', '--domains'] }),
+        constraint({ kind: 'mutually_exclusive', options: ['--preset', '--families'] }),
+        constraint({ kind: 'value_excludes', option: '--preset', value: 'common', excludedOptions: ['--dictionary'] }),
+    ]),
+    'discover-scan': Object.freeze([
+        constraint({ kind: 'mutually_exclusive', options: ['--json', '--jsonl', '--csv', '--domains'] }),
+        constraint({ kind: 'mutually_exclusive', options: ['--preset', '--families'] }),
+        constraint({ kind: 'mutually_exclusive', options: ['--fast', '--deep'] }),
+        constraint({ kind: 'mutually_exclusive', options: ['--registered-only', '--inconclusive-only', '--acquisition-only', '--suppressed-only'] }),
+        constraint({ kind: 'requires_all', option: '--resume', requiredOptions: ['--checkpoint'] }),
+        constraint({ kind: 'value_excludes', option: '--preset', value: 'common', excludedOptions: ['--dictionary'] }),
+        constraint({ kind: 'excludes_all', option: '--plan', excludedOptions: ['--jsonl', '--csv', '--domains', '--events', '--checkpoint', '--resume', '--observation-snapshot', '--quiet', '--fail-on'] }),
+    ]),
+    posture: Object.freeze([
+        constraint({ kind: 'mutually_exclusive', options: ['--json', '--sarif'] }),
+        constraint({ kind: 'requires_all', option: '--sarif', requiredOptions: ['--owned-domain'] }),
+    ]),
+    'dnssec-validate': Object.freeze([
+        constraint({ kind: 'required', options: ['--resolver', '--trust-anchor', '--owned-or-authorized'] }),
+    ]),
+    'mail-transport': Object.freeze([
+        constraint({ kind: 'required', options: ['--resolver', '--trust-anchor', '--owned-or-authorized', '--active-probe'] }),
+    ]),
+    'registry-scaffold': Object.freeze([
+        constraint({ kind: 'required', options: ['--profile', '--suffix', '--scenario'] }),
+    ]),
+    'risk-calibrate': Object.freeze([
+        constraint({ kind: 'mutually_exclusive', options: ['--json', '--summary-json'] }),
+    ]),
+    'verify-artifact': Object.freeze([
+        constraint({ kind: 'requires_all', option: '--manifest', requiredOptions: ['--manifest-entry'] }),
+        constraint({ kind: 'requires_all', option: '--manifest-entry', requiredOptions: ['--manifest'] }),
+    ]),
+    'inspect-archive': Object.freeze([
+        constraint({ kind: 'requires_all', option: '--reveal', requiredOptions: ['--search'] }),
+        constraint({ kind: 'requires_all', option: '--require-match', requiredOptions: ['--search'] }),
+    ]),
+    'sign-artifact': Object.freeze([
+        constraint({ kind: 'required', options: ['--private-key-file'] }),
+    ]),
+    'case-pack': Object.freeze([
+        constraint({ kind: 'required', options: ['--audience', '--reviewed'] }),
+    ]),
+    'monitor-once': Object.freeze([
+        constraint({ kind: 'mutually_exclusive', options: ['--json', '--junit'] }),
+    ]),
+    'sharing-review': Object.freeze([
+        constraint({ kind: 'required', options: ['--marking', '--recipient-scope', '--purpose'] }),
+    ]),
+    'workflow-plan': Object.freeze([
+        constraint({ kind: 'mutually_exclusive', options: ['--list', '--explain'] }),
+    ]),
+    export: Object.freeze([
+        constraint({ kind: 'mutually_exclusive', options: ['--markdown', '--html'] }),
+        constraint({ kind: 'excludes_all', option: '--compact', excludedOptions: ['--markdown', '--html'] }),
+        constraint({ kind: 'requires_any', option: '--no-attribution', requiredOptions: ['--markdown', '--html'] }),
+    ]),
+});
+function optionValueKind(command, option) {
+    if (Object.hasOwn(VALUE_OPTIONS, option))
+        return option === '--fail-on' ? 'policy_list' : 'enum';
+    if (INTEGER_RANGE_SEED[command]?.[option])
+        return 'integer';
+    if (FILE_OPTIONS.includes(option) || FILE_OPTIONS_BY_COMMAND[command]?.includes(option))
+        return 'file';
+    if (TEXT_OPTIONS.includes(option))
+        return 'text';
+    return 'flag';
+}
+function optionSpec(command, option, scope) {
+    const valueKind = optionValueKind(command, option);
+    return Object.freeze({
+        option,
+        scope,
+        arity: valueKind === 'flag' ? 0 : 1,
+        valueKind,
+        values: Object.freeze([...(VALUE_OPTIONS[option] ?? [])]),
+        integerRanges: Object.freeze([...(INTEGER_RANGE_SEED[command]?.[option] ?? [])]),
+        occurrence: IDEMPOTENT_OPTIONS.includes(option) ? 'idempotent' : 'once',
+        metaAction: option === '--help' ? 'help' : null,
+    });
+}
+function grammarConstraints(command) {
+    const commandOptions = OPTIONS_BY_COMMAND_SEED[command];
+    const machineOutputOptions = commandOptions.filter((option) => MACHINE_OUTPUT_OPTIONS.includes(option));
+    return Object.freeze([
+        ...FILE_OUTPUT_CONSTRAINTS,
+        ...(commandOptions.includes('--quiet') ? [QUIET_OUTPUT_CONSTRAINT] : []),
+        ...(commandOptions.includes('--quiet') && machineOutputOptions.length > 0
+            ? [constraint({ kind: 'excludes_all', option: '--quiet', excludedOptions: machineOutputOptions })]
+            : []),
+        ...(commandOptions.includes('--events')
+            ? [constraint({ kind: 'mutually_exclusive', options: ['--events', '--output'] })]
+            : []),
+        ...(commandOptions.includes('--browse')
+            ? [constraint({ kind: 'mutually_exclusive', options: ['--browse', '--output'] })]
+            : []),
+        ...(GRAMMAR_CONSTRAINTS_SEED[command] ?? EMPTY_CONSTRAINTS),
+    ]);
+}
+const COMMAND_DESCRIPTIONS_SEED = Object.freeze({
+    manifest: 'Build an evidence manifest offline',
+    'map-observations': 'Apply a declarative observation map offline',
+    'oam-export': 'Project external findings to Open Asset Model',
+    lookup: 'Collect one domain, IP, or ASN',
+    bulk: 'Run bounded multi-target collection',
+    'ct-search': 'Search certificate observations',
+    'ct-intake': 'Normalise certificate observations offline',
+    discover: 'Generate lookalike candidates offline',
+    'discover-scan': 'Collect a supervised candidate review queue',
+    posture: 'Review DNS and mail posture',
+    http: 'Inspect one homepage request',
+    tls: 'Inspect one TLS connection',
+    'dnssec-validate': 'Validate an authorised DNSSEC chain',
+    'mail-transport': 'Review selected authorised SMTP transports',
+    'registry-support': 'Explain local registry coverage',
+    'registry-doctor': 'Diagnose saved registry collection',
+    'registry-cohort': 'Build target-free registry quality timelines',
+    'registry-scaffold': 'Create a sanitised registry fixture scaffold',
+    'risk-calibrate': 'Replay reviewed Risk labels offline',
+    'lookalike-calibrate': 'Summarise reviewed lookalike yield offline',
+    'verify-artifact': 'Validate saved evidence offline',
+    'interchange-report': 'Report portable artefact fidelity offline',
+    'inspect-archive': 'Inspect an archive locally',
+    'sign-artifact': 'Sign a reviewed artefact locally',
+    'verify-signature': 'Verify a signed evidence package',
+    'source-report': 'Build a target-free source report',
+    compare: 'Compare registry publications in one lookup',
+    'page-compare': 'Compare saved static page evidence',
+    'mail-review': 'Review saved passive mail evidence',
+    'review-evidence': 'Review supplied evidence offline',
+    brief: 'Build a decision brief from a saved lookup',
+    'case-pack': 'Build a reviewed case package',
+    'domain-control': 'Build or review a domain control manifest',
+    'monitor-once': 'Run one bounded domain control review',
+    assurance: 'Review domain change, recovery, or retirement plans',
+    'change-packet': 'Build a reviewed change packet offline',
+    'sharing-review': 'Lint an artefact before deliberate sharing',
+    'workflow-plan': 'Plan a fixed investigation recipe',
+    'workflow-run': 'Execute approved fixed-recipe steps',
+    diff: 'Compare two compatible retained artefacts',
+    reconcile: 'Reconcile independently labelled observations',
+    timeline: 'Build same-domain history from saved lookups',
+    export: 'Convert a lookup to an evidence report',
+    completion: 'Print shell completion',
+    commands: 'List installed command contracts',
+    doctor: 'Check the local CLI runtime',
+    manual: 'Print the generated manual page',
+});
+const HELP_COMMANDS_BY_GROUP = Object.freeze({
+    investigate: Object.freeze([
+        'lookup', 'bulk', 'ct-search', 'ct-intake', 'discover', 'discover-scan',
+        'posture', 'http', 'tls', 'registry-support', 'registry-doctor',
+        'registry-cohort', 'source-report', 'compare', 'page-compare', 'mail-review',
+        'review-evidence', 'brief',
+    ]),
+    respond: Object.freeze([
+        'map-observations', 'oam-export', 'case-pack', 'change-packet',
+        'sharing-review', 'export',
+    ]),
+    assure: Object.freeze([
+        'dnssec-validate', 'mail-transport', 'domain-control', 'monitor-once',
+        'assurance', 'workflow-plan', 'workflow-run', 'diff', 'reconcile', 'timeline',
+        'inspect-archive', 'verify-artifact', 'interchange-report', 'manifest',
+        'sign-artifact', 'verify-signature', 'risk-calibrate', 'lookalike-calibrate',
+    ]),
+    utilities: Object.freeze([
+        'registry-scaffold', 'doctor', 'commands', 'completion', 'manual',
+    ]),
+});
+const HELP_GROUP_BY_COMMAND = Object.freeze(Object.fromEntries(Object.entries(HELP_COMMANDS_BY_GROUP).flatMap(([group, commands]) => (commands.map((command) => [command, group])))));
+const HANDLER_OWNER_BY_COMMAND = Object.freeze({
+    completion: 'inline',
+    doctor: 'inline',
+    commands: 'inline',
+    manual: 'inline',
+    manifest: 'inline',
+    'map-observations': 'inline',
+    'oam-export': 'inline',
+    lookup: 'lookup',
+    bulk: 'bulk',
+    'ct-search': 'network',
+    'ct-intake': 'inline',
+    discover: 'discovery',
+    'discover-scan': 'discovery_scan',
+    posture: 'network',
+    http: 'network',
+    tls: 'network',
+    'dnssec-validate': 'network',
+    'mail-transport': 'network',
+    'registry-support': 'inline',
+    'registry-doctor': 'inline',
+    'registry-cohort': 'inline',
+    'registry-scaffold': 'inline',
+    'risk-calibrate': 'inline',
+    'lookalike-calibrate': 'inline',
+    'verify-artifact': 'inline',
+    'interchange-report': 'inline',
+    'inspect-archive': 'evidence',
+    'sign-artifact': 'evidence',
+    'verify-signature': 'evidence',
+    'source-report': 'inline',
+    compare: 'inline',
+    'page-compare': 'inline',
+    'mail-review': 'inline',
+    'review-evidence': 'inline',
+    brief: 'inline',
+    'case-pack': 'inline',
+    'domain-control': 'inline',
+    'monitor-once': 'inline',
+    assurance: 'inline',
+    'change-packet': 'inline',
+    'sharing-review': 'inline',
+    'workflow-plan': 'inline',
+    'workflow-run': 'inline',
+    diff: 'inline',
+    reconcile: 'inline',
+    timeline: 'inline',
+    export: 'inline',
+});
+const NETWORK_EFFECT_BY_COMMAND = Object.freeze({
+    completion: 'offline',
+    doctor: 'conditional_network',
+    commands: 'offline',
+    manual: 'offline',
+    manifest: 'offline',
+    'map-observations': 'offline',
+    'oam-export': 'offline',
+    lookup: 'conditional_network',
+    bulk: 'conditional_network',
+    'ct-search': 'always_network',
+    'ct-intake': 'offline',
+    discover: 'offline',
+    'discover-scan': 'conditional_network',
+    posture: 'always_network',
+    http: 'always_network',
+    tls: 'always_network',
+    'dnssec-validate': 'always_network',
+    'mail-transport': 'always_network',
+    'registry-support': 'offline',
+    'registry-doctor': 'offline',
+    'registry-cohort': 'offline',
+    'registry-scaffold': 'offline',
+    'risk-calibrate': 'offline',
+    'lookalike-calibrate': 'offline',
+    'verify-artifact': 'offline',
+    'interchange-report': 'offline',
+    'inspect-archive': 'offline',
+    'sign-artifact': 'offline',
+    'verify-signature': 'offline',
+    'source-report': 'offline',
+    compare: 'offline',
+    'page-compare': 'offline',
+    'mail-review': 'offline',
+    'review-evidence': 'offline',
+    brief: 'offline',
+    'case-pack': 'offline',
+    'domain-control': 'offline',
+    'monitor-once': 'always_network',
+    assurance: 'offline',
+    'change-packet': 'offline',
+    'sharing-review': 'offline',
+    'workflow-plan': 'offline',
+    'workflow-run': 'conditional_network',
+    diff: 'offline',
+    reconcile: 'offline',
+    timeline: 'offline',
+    export: 'offline',
+});
+const COMMON_COMMANDS = Object.freeze([
+    'doctor', 'commands', 'lookup', 'bulk', 'discover', 'discover-scan', 'verify-artifact',
+    'review-evidence', 'case-pack', 'workflow-plan', 'diff', 'export',
+]);
+const SCHEMA_IDENTIFIERS_BY_COMMAND = Object.freeze({
+    commands: Object.freeze(['whoisleuth.cli.command-catalogue']),
+    doctor: Object.freeze(['whoisleuth.cli.doctor']),
+    manifest: Object.freeze(['whoisleuth.investigation-manifest']),
+    'map-observations': Object.freeze(['whoisleuth.external-observation-mapping']),
+    'oam-export': Object.freeze(['whoisleuth.open-asset-model-bridge']),
+    lookup: Object.freeze(['whoisleuth.cli.lookup', 'whoisleuth.cli.lookup-plan']),
+    bulk: Object.freeze(['whoisleuth.cli.bulk', 'whoisleuth.cli.bulk.item', 'whoisleuth.cli.bulk-checkpoint']),
+    'ct-search': Object.freeze(['whoisleuth.cli.ct-search']),
+    'ct-intake': Object.freeze(['whoisleuth.ct-event-batch', 'whoisleuth.external-findings']),
+    discover: Object.freeze(['whoisleuth.cli.discover', 'whoisleuth.cli.discover.item', 'whoisleuth.cli.discovery-snapshot']),
+    'discover-scan': Object.freeze(['whoisleuth.cli.discovery-scan', 'whoisleuth.cli.discovery-scan.item', 'whoisleuth.cli.discovery-observation-snapshot']),
+    posture: Object.freeze(['whoisleuth.cli.posture']),
+    http: Object.freeze(['whoisleuth.cli.http']),
+    tls: Object.freeze(['whoisleuth.cli.tls']),
+    'dnssec-validate': Object.freeze(['whoisleuth.dnssec-chain-validation', 'whoisleuth.dnssec-trust-anchor']),
+    'mail-transport': Object.freeze(['whoisleuth.mail-transport.input', 'whoisleuth.cli.mail-transport-review']),
+    'registry-support': Object.freeze(['whoisleuth.cli.registry-support', 'whoisleuth.registry-standards-coverage']),
+    'registry-doctor': Object.freeze(['whoisleuth.cli.registry-doctor']),
+    'registry-cohort': Object.freeze(['whoisleuth.cli.registry-cohort']),
+    'risk-calibrate': Object.freeze([RISK_CALIBRATION_DATASET_SCHEMA, RISK_CALIBRATION_REPORT_SCHEMA]),
+    'lookalike-calibrate': Object.freeze(['whoisleuth.lookalike-calibration-input', 'whoisleuth.lookalike-calibration']),
+    'verify-artifact': Object.freeze(['whoisleuth.offline-artifact-verification']),
+    'interchange-report': Object.freeze(['whoisleuth.interchange-fidelity-report']),
+    'inspect-archive': Object.freeze(['whoisleuth.workspace-archive-inspection']),
+    'sign-artifact': Object.freeze(['whoisleuth.signed-evidence-package']),
+    'verify-signature': Object.freeze(['whoisleuth.evidence-signature-verification']),
+    'source-report': Object.freeze(['whoisleuth.source-reliability-report']),
+    compare: Object.freeze(['whoisleuth.cli.compare']),
+    'page-compare': Object.freeze(['whoisleuth.cli.page-compare']),
+    'mail-review': Object.freeze(['whoisleuth.cli.mail-review']),
+    'review-evidence': Object.freeze([
+        'whoisleuth.cli.offline-evidence-review',
+        'whoisleuth.rdap-search-input',
+        'whoisleuth.dnssec-evidence-input',
+        'whoisleuth.tlsa-evidence-input',
+        'whoisleuth.rpki-route-input',
+        'whoisleuth.local-geoip-query',
+        'whoisleuth.encrypted-dns-plan-input',
+    ]),
+    brief: Object.freeze(['whoisleuth.cli.lookup-brief']),
+    'case-pack': Object.freeze(['whoisleuth.cli.case-pack', 'whoisleuth.case-report']),
+    'domain-control': Object.freeze(['whoisleuth.cli.domain-control-review-input', 'whoisleuth.cli.domain-control-review']),
+    'monitor-once': Object.freeze(['whoisleuth.cli.domain-control-monitor', 'whoisleuth.domain-control-flight-recorder.input']),
+    assurance: Object.freeze(['whoisleuth.domain-assurance.input', 'whoisleuth.domain-assurance']),
+    'change-packet': Object.freeze(['whoisleuth.domain-change-packet.input', 'whoisleuth.domain-change-packet']),
+    'sharing-review': Object.freeze(['whoisleuth.cli.sharing-review']),
+    'workflow-plan': Object.freeze(['whoisleuth.cli.investigation-plan', 'whoisleuth.cli.workflow-recipe-catalogue']),
+    'workflow-run': Object.freeze(['whoisleuth.cli.investigation-run']),
+    diff: Object.freeze(['whoisleuth.cli.lookup-diff']),
+    reconcile: Object.freeze(['whoisleuth.cli.lookup-reconciliation']),
+    timeline: Object.freeze(['whoisleuth.cli.lookup-timeline']),
+    export: Object.freeze(['whoisleuth.lookup-evidence']),
+});
+const PRIMARY_ARTEFACTS_BY_COMMAND = Object.freeze({
+    lookup: Object.freeze(['Source-qualified Lookup', 'Lookup request plan']),
+    bulk: Object.freeze(['Bulk result', 'Bulk checkpoint']),
+    discover: Object.freeze(['Candidate set', 'Discovery snapshot']),
+    'discover-scan': Object.freeze(['Reviewed candidate queue', 'Observation snapshot']),
+    'verify-artifact': Object.freeze(['Offline verification report']),
+    'case-pack': Object.freeze(['Reviewed Case-pack v2']),
+    'workflow-plan': Object.freeze(['Plan-only workflow document']),
+    'workflow-run': Object.freeze(['Resumable workflow state']),
+    diff: Object.freeze(['Retained-evidence comparison']),
+    timeline: Object.freeze(['Bounded retained-observation timeline']),
+    export: Object.freeze(['Portable evidence report']),
+});
+function documentationMetadata(command, commandOptions, positionals) {
+    const effect = NETWORK_EFFECT_BY_COMMAND[command];
+    const explicitAuthorisationRequired = commandOptions.some((option) => (option === '--owned-or-authorized' || option === '--active-probe' || option === '--approve-network'));
+    const outputOptionFormats = [
+        ['--json', 'JSON'], ['--jsonl', 'JSON Lines'], ['--junit', 'JUnit XML'],
+        ['--csv', 'CSV'], ['--domains', 'domain list'], ['--queries', 'query list'],
+        ['--markdown', 'Markdown'], ['--html', 'HTML'], ['--sarif', 'SARIF'],
+        ['--summary-json', 'summary JSON'],
+    ];
+    const outputFormats = new Set(['terminal']);
+    for (const [option, label] of outputOptionFormats) {
+        if (commandOptions.includes(option))
+            outputFormats.add(label);
+    }
+    if (command === 'export')
+        outputFormats.add('JSON');
+    const positionalLimits = positionals.map((item) => (`${item.name}: ${item.minimum}-${item.maximum} ${item.valueKind} value${item.maximum === 1 ? '' : 's'}`));
+    return Object.freeze({
+        common: COMMON_COMMANDS.includes(command),
+        disclosureClass: effect === 'offline'
+            ? 'none'
+            : explicitAuthorisationRequired
+                ? 'bounded_authorised_active'
+                : effect === 'conditional_network'
+                    ? 'conditional_bounded_passive'
+                    : 'bounded_passive',
+        explicitAuthorisationRequired,
+        planSupport: commandOptions.includes('--plan') || command === 'workflow-plan',
+        failurePolicySupport: commandOptions.includes('--fail-on') || commandOptions.includes('--strict-exit'),
+        supportedSchemaIdentifiers: Object.freeze([...(SCHEMA_IDENTIFIERS_BY_COMMAND[command] ?? [])]),
+        inputLimits: Object.freeze([COMMAND_COLLECTION_SEED[command].scope, ...positionalLimits]),
+        outputLimits: Object.freeze([
+            'Output is bounded by the command-owned formatter and document contract.',
+            ...(commonOptionsSeedForCommand(command).includes('--output')
+                ? ['Selected file output is atomic and replacement requires --force.']
+                : []),
+        ]),
+        outputFormats: Object.freeze([...outputFormats]),
+        primaryEvidenceArtefacts: Object.freeze([...(PRIMARY_ARTEFACTS_BY_COMMAND[command] ?? [])]),
+    });
+}
+const CLI_COMMAND_REGISTRY = Object.freeze(COMMAND_ORDER.map((command, order) => {
+    const commonOptions = Object.freeze([...commonOptionsSeedForCommand(command)]);
+    const commandOptions = Object.freeze([...OPTIONS_BY_COMMAND_SEED[command]]);
+    const grammarOptions = Object.freeze([
+        ...commonOptions.map((option) => optionSpec(command, option, 'common')),
+        ...commandOptions.map((option) => optionSpec(command, option, 'command')),
+    ]);
+    return Object.freeze({
+        command,
+        order,
+        reference: Object.freeze({
+            usage: COMMAND_USAGE_SEED[command],
+            ...COMMAND_DETAILS_SEED[command],
+        }),
+        collection: Object.freeze({ ...COMMAND_COLLECTION_SEED[command] }),
+        completion: Object.freeze({
+            description: COMMAND_DESCRIPTIONS_SEED[command],
+            commonOptions,
+            options: commandOptions,
+        }),
+        grammar: Object.freeze({
+            parserKey: command,
+            bootstrapProfile: command === 'registry-scaffold' ? 'command_owned' : 'allowed',
+            options: grammarOptions,
+            positionals: POSITIONALS_BY_COMMAND_SEED[command],
+            constraints: grammarConstraints(command),
+            metaActions: Object.freeze(['help']),
+        }),
+        execution: Object.freeze({
+            handlerOwner: HANDLER_OWNER_BY_COMMAND[command],
+            networkEffect: NETWORK_EFFECT_BY_COMMAND[command],
+        }),
+        help: Object.freeze({
+            group: HELP_GROUP_BY_COMMAND[command],
+            summary: COMMAND_DESCRIPTIONS_SEED[command],
+        }),
+        documentation: documentationMetadata(command, commandOptions, POSITIONALS_BY_COMMAND_SEED[command]),
+    });
+}));
+const CLI_COMMANDS = Object.freeze(CLI_COMMAND_REGISTRY.map((definition) => definition.command));
+const FILE_POSITIONAL_COMMANDS = Object.freeze(CLI_COMMAND_REGISTRY
+    .filter((definition) => definition.grammar.positionals.some((item) => item.valueKind === 'file'))
+    .map((definition) => definition.command));
+const CLI_COMMAND_BY_NAME = Object.freeze(Object.fromEntries(CLI_COMMAND_REGISTRY.map((definition) => [definition.command, definition])));
+function isCliCommand(value) {
+    return typeof value === 'string' && Object.hasOwn(CLI_COMMAND_BY_NAME, value);
+}
+function commandDefinition(command) {
+    return CLI_COMMAND_BY_NAME[command];
+}
+function metaActionDefinition(id) {
+    return CLI_META_ACTION_BY_ID[id];
+}
+function cliMetaActionForInvocation(argv) {
+    for (const action of CLI_META_ACTIONS) {
+        const matches = action.scope === 'root_only'
+            ? action.aliases.includes(argv[0] ?? '')
+            : argv.some((argument) => action.aliases.includes(argument));
+        if (matches)
+            return action;
+    }
+    return null;
+}
+const COMMAND_USAGE = Object.freeze(Object.fromEntries(CLI_COMMAND_REGISTRY.map((definition) => [definition.command, definition.reference.usage])));
+const COMMAND_DETAILS = Object.freeze(Object.fromEntries(CLI_COMMAND_REGISTRY.map((definition) => [definition.command, Object.freeze({
+        description: definition.reference.description,
+        example: definition.reference.example,
+        boundary: definition.reference.boundary,
+    })])));
+const COMMAND_COLLECTION = Object.freeze(Object.fromEntries(CLI_COMMAND_REGISTRY.map((definition) => [definition.command, definition.collection])));
+const COMMAND_DESCRIPTIONS = Object.freeze(Object.fromEntries(CLI_COMMAND_REGISTRY.map((definition) => [definition.command, definition.completion.description])));
+const OPTIONS_BY_COMMAND = Object.freeze(Object.fromEntries(CLI_COMMAND_REGISTRY.map((definition) => [definition.command, Object.freeze(definition.grammar.options
+        .filter((option) => option.scope === 'command')
+        .map((option) => option.option))])));
+function commonOptionsForCommand(command) {
+    return Object.freeze(commandDefinition(command).grammar.options
+        .filter((option) => option.scope === 'common')
+        .map((option) => option.option));
+}
+function commandOptionSpec(command, option) {
+    return commandDefinition(command).grammar.options.find((candidate) => candidate.option === option) ?? null;
+}
+function commandPositionalSpecs(command) {
+    return commandDefinition(command).grammar.positionals;
+}
+const HELP_GROUP_LABELS = Object.freeze({
+    investigate: 'Investigate',
+    respond: 'Respond',
+    assure: 'Assure',
+    utilities: 'Utilities',
+});
+function renderRootHelpCommands() {
+    return Object.keys(HELP_COMMANDS_BY_GROUP).map((group) => {
+        const lines = HELP_COMMANDS_BY_GROUP[group].map((command) => {
+            const definition = commandDefinition(command);
+            return `  ${command.padEnd(20, ' ')} ${definition.help.summary}.`;
+        });
+        return `${HELP_GROUP_LABELS[group]}:\n${lines.join('\n')}`;
+    }).join('\n\n');
+}
+const HELP = `${HELP_INTRO}\n${renderRootHelpCommands()}\n${HELP_FOOTER}`;
+function commandOwnsOption(command, option) {
+    return commandDefinition(command).grammar.options.some((candidate) => candidate.option === option);
+}
+function invocationHasFlag(command, args, flag) {
+    for (let index = 0; index < args.length; index += 1) {
+        const argument = args[index];
+        if (argument === flag)
+            return true;
+        const specification = argument ? commandOptionSpec(command, argument) : null;
+        if (specification?.arity === 1)
+            index += 1;
+    }
+    return false;
+}
+function cliInvocationNetworkEffect(command, args) {
+    const effect = commandDefinition(command).execution.networkEffect;
+    if (effect === 'offline')
+        return 'offline';
+    if (effect === 'always_network')
+        return 'network';
+    if (command === 'doctor')
+        return invocationHasFlag(command, args, '--network') ? 'network' : 'offline';
+    if (command === 'lookup' || command === 'bulk' || command === 'discover-scan') {
+        return invocationHasFlag(command, args, '--plan') ? 'offline' : 'network';
+    }
+    if (command === 'workflow-run') {
+        return invocationHasFlag(command, args, '--approve-network') ? 'network' : 'offline';
+    }
+    throw new Error(`Conditional network effect is not implemented for ${command}.`);
+}
 function commandHelp(command) {
     const detail = COMMAND_DETAILS[command];
     const collection = COMMAND_COLLECTION[command];
     return `WHOISleuth ${command}\n${detail.description}\n\nUsage:\n  ${COMMAND_USAGE[command]}\n\nExample:\n  ${detail.example}\n\nCollection:\n  ${collection.mode === 'offline' ? 'Offline' : 'Network'}: ${collection.scope}\n\nBoundary:\n  ${detail.boundary}\n\nRun "whoisleuth --help" to see the grouped command list.\n`;
 }
-export { COMMAND_COLLECTION, COMMAND_DETAILS, COMMAND_USAGE, HELP, commandHelp };
+export { CLI_COMMAND_REGISTRY, CLI_COMMANDS, CLI_META_ACTIONS, COMMAND_COLLECTION, COMMAND_DESCRIPTIONS, COMMAND_DETAILS, COMMAND_USAGE, COMMON_OPTIONS, FILE_OPTIONS, FILE_OPTIONS_BY_COMMAND, FILE_POSITIONAL_COMMANDS, HELP, HELP_COMMANDS_BY_GROUP, INVESTIGATION_PLAN_RECIPES, RUNNABLE_INVESTIGATION_PLAN_RECIPES, LIMITED_CONCURRENCY_VALUES, OPTIONS_BY_COMMAND, STANDARD_CONCURRENCY_VALUES, TEXT_OPTIONS, VALUE_OPTIONS, cliMetaActionForInvocation, cliInvocationNetworkEffect, commandOptionSpec, commandOwnsOption, commandPositionalSpecs, commonOptionsForCommand, commandDefinition, commandHelp, isCliCommand, metaActionDefinition, };