@slicedearth/whoisleuth-cli 2.0.1 → 2.2.0

package/cli/runner.mjs

@@ -1,64 +1,16 @@
-import { Buffer } from 'node:buffer';
 import { createRequire } from 'node:module';
 import { abortable } from "../lib/abort.mjs";
-import { scanBoundedJson } from "../lib/bounded-json.mjs";
-import { REGISTRY_CAPABILITIES_VERSION, registryCapabilityFor } from "../lib/registry-capabilities.mjs";
-import { explainRiskScore, explainRiskScoreV6, RISK_MODEL_VERSION, RISK_REVIEW_THRESHOLD } from "../lib/risk-scoring.mjs";
-import { buildRiskCalibrationSummaryReport } from "../lib/risk-calibration-summary.mjs";
 import { parseCliArguments } from "./arguments.mjs";
-import { buildCliCommandCatalogue, formatCliCommandCatalogue, selectCliCommands } from "./command-catalogue.mjs";
-import { COMMAND_COLLECTION, COMMAND_DETAILS, COMMAND_USAGE, HELP, CLI_COMMANDS, CLI_COMMAND_REGISTRY, commandDefinition, commandHelp, } from "./command-reference.mjs";
-import { buildShellCompletion } from "./completion.mjs";
-import { buildDoctorReport, formatDoctorReport } from "./doctor.mjs";
-import { MAX_COMPARE_INPUT_BYTES, compareLookupDocument, parseCliLookupDocument, } from "./compare.mjs";
+import { HELP, commandDefinition, commandHelp, } from "./command-reference.mjs";
 import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 import { evidenceCommandFailureLabel, isEvidenceCommand, runEvidenceCommand, } from "./evidence-command-runner.mjs";
-import { buildCliEvidenceExport, formatCliEvidenceExport } from "./export-evidence.mjs";
 import EXIT_CODES from "./exit-codes.mjs";
-import { formatLookupEvidenceHtml } from "./formatters/html.mjs";
-import { buildCliCompareDocument, formatJsonDocument, } from "./formatters/json.mjs";
-import { formatLookupEvidenceMarkdown } from "./formatters/markdown.mjs";
-import { formatTerminalCompare, formatTerminalRegistrySupport, formatTerminalRiskCalibration, } from "./formatters/terminal.mjs";
-import { MAX_RETAINED_ARTIFACT_DIFF_BYTES, buildCliRetainedArtifactDiff, formatCliRetainedArtifactDiff, } from "./retained-artifact-diff.mjs";
-import { MAX_LOOKUP_RECONCILIATION_INPUT_BYTES, buildCliLookupReconciliation, formatCliLookupReconciliation, } from "./lookup-reconcile.mjs";
-import { MAX_SHARING_REVIEW_BYTES, buildSharingReview, formatSharingReview, } from "./sharing-review.mjs";
-import { MAX_LOOKUP_TIMELINE_INPUT_BYTES, buildCliLookupTimeline, formatCliLookupTimeline, } from "./lookup-timeline.mjs";
-import { buildCliPageComparison, formatCliPageComparison } from "./page-compare.mjs";
-import { MAX_MAIL_REVIEW_INPUT_BYTES, buildCliMailReview, formatCliMailReview, } from "./mail-review.mjs";
-import { MAX_OFFLINE_EVIDENCE_INPUT_BYTES, buildOfflineEvidenceReview, buildOfflineEvidenceReviewWithLocalResources, formatOfflineEvidenceReview, } from "./offline-evidence-review.mjs";
-import { DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA, DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, buildDomainControlManifest, formatDomainControlResult, reviewDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
-import { serializeDomainControlManifest } from "../packages/evidence/domain-control-runtime.mjs";
-import { MAX_DOMAIN_CONTROL_REVIEW_COMMAND_BYTES } from "../packages/contracts/domain-control-review.mjs";
-import { DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_SCHEMA, buildDomainControlFlightRecorder, formatDomainControlFlightRecorder, serializeDomainControlFlightRecorder, } from "../lib/domain-control-flight-recorder.mjs";
-import { CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, MAX_DOMAIN_CONTROL_REVIEW_JSON_DEPTH, MAX_DOMAIN_CONTROL_REVIEW_JSON_KEYS, MAX_DOMAIN_CONTROL_REVIEW_JSON_VALUES, buildCliDomainControlReview, formatCliDomainControlReview, } from "./domain-control-observations.mjs";
-import { buildCliLookupBrief, formatCliLookupBrief } from "./lookup-brief.mjs";
-import { buildCliCasePack, formatCliCasePack } from "./case-pack.mjs";
-import { formatDomainControlMonitor, runDomainControlMonitor } from "./domain-control-monitor.mjs";
-import { MAX_ASSURANCE_INPUT_BYTES, buildDomainAssurance, formatDomainAssurance, } from "../lib/domain-assurance.mjs";
-import { MAX_DOMAIN_CHANGE_PACKET_INPUT_BYTES, buildDomainChangePacket, formatDomainChangePacket, } from "../lib/domain-change-packet.mjs";
-import { buildCliManual } from "./manual.mjs";
-import { MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES, MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES, buildInvestigationManifest, formatInvestigationManifest, } from "./investigation-manifest.mjs";
-import { MAX_EXTERNAL_OBSERVATION_MAPPING_BYTES, mapExternalObservations, formatExternalObservationMapping, } from "./external-observation-mapping.mjs";
-import { buildOpenAssetModelBridge, formatOpenAssetModelBridge, } from "./open-asset-model-bridge.mjs";
-import { MAX_CT_EVENT_INPUT_BYTES, buildCtEventFindings, formatCtEventFindings, } from "./ct-event-intake.mjs";
-import { buildInvestigationPlan, buildWorkflowRecipeCatalogue, formatInvestigationPlan, formatWorkflowRecipeCatalogue, } from "./investigation-plan.mjs";
-import { MAX_INVESTIGATION_RUN_BYTES, formatInvestigationRun, runInvestigationRecipe } from "./investigation-run.mjs";
 import { readCliTextInput } from "./input.mjs";
-import { evaluateCliFailPolicies, formatFailPolicyNotice } from "./fail-policy.mjs";
-import { formatCliJunit } from "./ci-report.mjs";
-import { cleanupPendingOutputFiles, createBufferedOutput, writePrivateFile } from "./output-file.mjs";
+import { INLINE_CLI_COMMANDS, runInlineCommand } from "./inline-command-runner.mjs";
 import { canLaunchInteractiveCli, launchInteractiveCli, } from "./interactive-launcher.mjs";
+import { MAX_OFFLINE_PASSPHRASE_FILE_BYTES, } from "./artifact-verify.mjs";
+import { cleanupPendingOutputFiles, createBufferedOutput, writePrivateFile } from "./output-file.mjs";
 import { createTerminalProgress } from "./progress.mjs";
-import { buildRegistrySupportDocument } from "./registry-support.mjs";
-import { buildRegistryDoctorReport, formatRegistryDoctorReport } from "./registry-doctor.mjs";
-import { MAX_REGISTRY_COHORT_INPUT_BYTES, buildRegistryCohortReport, formatRegistryCohortReport, } from "./registry-cohort.mjs";
-import { buildRegistryFixtureScaffold } from "./registry-fixture-scaffold.mjs";
-import { MAX_OFFLINE_ARTIFACT_BYTES, MAX_OFFLINE_PASSPHRASE_FILE_BYTES, formatOfflineArtifactVerification, isCompleteOfflineArtifactVerification, verifyOfflineArtifact, } from "./artifact-verify.mjs";
-import { buildInterchangeFidelityReport, formatInterchangeFidelityReport, } from "./interchange-report.mjs";
-import { MAX_SOURCE_RELIABILITY_INPUT_BYTES, buildSourceReliabilityReport, formatSourceReliabilityReport, } from "./source-reliability.mjs";
-import { MAX_RISK_CALIBRATION_INPUT_BYTES, buildRiskCalibrationReport, parseRiskCalibrationDataset, serializeRiskCalibrationReport, } from "./risk-calibration.mjs";
-import { MAX_LOOKALIKE_CALIBRATION_BYTES, buildLookalikeCalibration, formatLookalikeCalibration, } from "./lookalike-calibration.mjs";
-import { MAX_SAVED_LOOKUP_INPUT_BYTES } from "./saved-lookup.mjs";
 import { presentTerminalOutput, terminalPresentation, } from "./terminal-presentation.mjs";
 const require = createRequire(import.meta.url);
 const { version: VERSION } = require('../package.json');
@@ -98,16 +50,6 @@ function usageEventReason(error) {
         return 'missing_input';
     return 'invalid_input';
 }
-const INLINE_CLI_COMMANDS = Object.freeze([
-    'completion', 'doctor', 'commands', 'manual', 'manifest', 'map-observations',
-    'oam-export', 'ct-intake', 'registry-support', 'registry-doctor',
-    'registry-cohort', 'registry-scaffold', 'risk-calibrate', 'lookalike-calibrate',
-    'verify-artifact', 'interchange-report', 'source-report', 'compare',
-    'page-compare', 'mail-review', 'review-evidence', 'brief', 'case-pack',
-    'domain-control', 'monitor-once', 'assurance', 'change-packet',
-    'sharing-review', 'workflow-plan', 'workflow-run', 'diff', 'reconcile',
-    'timeline', 'export',
-]);
 async function runParsedCli(args, dependencies = {}) {
     const stdout = dependencies.stdout || process.stdout;
     const stderr = dependencies.stderr || process.stderr;
@@ -175,13 +117,16 @@ async function runParsedCli(args, dependencies = {}) {
             return passphrase;
         };
         const commandContext = Object.freeze({
+            packageVersion: VERSION,
             stdout,
             stderr,
             terminal,
+            presentation: (color) => terminalPresentation(stdout, color, environment, palette),
             writeStdout: (value) => write(stdout, value),
             writeStderr: (value) => write(stderr, value),
             readSingleInput,
             readInput,
+            readPassphraseSource,
             now: () => dependencies.now ? dependencies.now() : new Date().toISOString(),
             beginProgress,
             endProgress,
@@ -189,6 +134,13 @@ async function runParsedCli(args, dependencies = {}) {
             setEventProgress: (next) => {
                 eventProgress.current = next;
             },
+            setFailureLabel: (label) => {
+                failureLabel = label;
+            },
+            executeCli: (argv, overrides = {}) => runCli(argv, {
+                ...dependencies,
+                ...overrides,
+            }),
         });
         if (args.action === 'help') {
             write(stdout, terminal(args.command ? commandHelp(args.command) : HELP));
@@ -270,916 +222,7 @@ async function runParsedCli(args, dependencies = {}) {
         if (handlerOwner !== 'inline' || !INLINE_CLI_COMMANDS.includes(args.action)) {
             throw new Error('No CLI execution route is registered for the parsed command.');
         }
-        if (args.action === 'completion') {
-            write(stdout, buildShellCompletion(args.shell));
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'commands') {
-            const selectedCommands = selectCliCommands(CLI_COMMAND_REGISTRY, {
-                common: args.common,
-                group: args.group,
-                mode: args.mode,
-            });
-            const catalogue = buildCliCommandCatalogue({
-                commands: selectedCommands,
-                collections: COMMAND_COLLECTION,
-                details: COMMAND_DETAILS,
-                usage: COMMAND_USAGE,
-                packageVersion: VERSION,
-            });
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(catalogue)
-                    : terminal(formatCliCommandCatalogue(catalogue), args.color));
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'manual') {
-            write(stdout, buildCliManual({
-                commands: CLI_COMMANDS,
-                collections: COMMAND_COLLECTION,
-                details: COMMAND_DETAILS,
-                usage: COMMAND_USAGE,
-                version: VERSION,
-            }));
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'manifest') {
-            failureLabel = 'Investigation manifest';
-            const artifacts = [];
-            let totalBytes = 0;
-            try {
-                for (const source of args.sources) {
-                    const content = dependencies.readDiffInput
-                        ? await dependencies.readDiffInput(source)
-                        : await readInput(source, MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES, 'Manifest artefact input');
-                    totalBytes += Buffer.byteLength(content, 'utf8');
-                    if (totalBytes > MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES) {
-                        throw new CliUsageError(`Manifest artefacts exceed the ${MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES}-byte combined limit.`);
-                    }
-                    artifacts.push({ content });
-                }
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read manifest artefact input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            let document;
-            try {
-                document = await buildInvestigationManifest({
-                    workflow: args.workflow,
-                    configurationDigestSha256: args.configurationDigestSha256,
-                    artifacts,
-                }, commandContext.now(), VERSION);
-            }
-            catch (error) {
-                throw new CliUsageError(boundedCliErrorMessage(error, 'Investigation manifest input is invalid'));
-            }
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(document)
-                    : terminal(formatInvestigationManifest(document), args.color));
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'map-observations' || args.action === 'oam-export') {
-            const mapping = args.action === 'map-observations';
-            failureLabel = mapping ? 'External observation mapping' : 'Open Asset Model export';
-            let input;
-            try {
-                input = dependencies.readArtifactInput
-                    ? await dependencies.readArtifactInput(args.source)
-                    : await readInput(args.source, MAX_EXTERNAL_OBSERVATION_MAPPING_BYTES, mapping ? 'External observation mapping input' : 'Open Asset Model bridge input');
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read ${mapping ? 'observation mapping' : 'asset bridge'} input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            if (!input.trim())
-                throw new CliUsageError(`${args.action} requires one versioned JSON file or a document on stdin.`);
-            let parsed;
-            try {
-                scanBoundedJson(input);
-                parsed = JSON.parse(input);
-            }
-            catch {
-                throw new CliUsageError(`${mapping ? 'External observation mapping' : 'Open Asset Model bridge'} input is not valid bounded JSON without duplicate keys.`);
-            }
-            let document;
-            try {
-                document = mapping
-                    ? mapExternalObservations(parsed)
-                    : buildOpenAssetModelBridge(parsed, commandContext.now());
-            }
-            catch (error) {
-                throw new CliUsageError(boundedCliErrorMessage(error, `${mapping ? 'External observation mapping' : 'Open Asset Model bridge'} input is invalid`));
-            }
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(document)
-                    : terminal(mapping
-                        ? formatExternalObservationMapping(document)
-                        : formatOpenAssetModelBridge(document), args.color));
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'doctor') {
-            failureLabel = 'CLI diagnostics';
-            const buildReport = () => buildDoctorReport({
-                version: VERSION,
-                generatedAt: dependencies.now ? dependencies.now() : new Date().toISOString(),
-                network: args.network,
-                presentation: terminalPresentation(stdout, args.color, environment, palette),
-                ...(dependencies.resolvePublicAddresses ? { resolveAddresses: dependencies.resolvePublicAddresses } : {}),
-                ...(dependencies.safeFetch ? { fetchHttps: dependencies.safeFetch } : {}),
-                ...(dependencies.whoisQuery ? { queryWhois: dependencies.whoisQuery } : {}),
-            });
-            const report = args.network
-                ? await withProgress('Checking public DNS, HTTPS, and WHOIS connectivity', buildReport)
-                : await buildReport();
-            if (!args.quiet) {
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(report)
-                    : terminal(formatDoctorReport(report), args.color));
-            }
-            return report.state === 'partial' ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'registry-support') {
-            failureLabel = 'Registry support';
-            const readInput = dependencies.readStdin || (() => readStdinBounded(dependencies.stdin || process.stdin, MAX_STDIN_BYTES, dependencies.signal));
-            const requestedInput = args.target || await readInput();
-            if (!requestedInput)
-                throw new CliUsageError('registry-support requires one domain or suffix as an argument or on stdin.');
-            const lookupCapability = dependencies.registryCapabilityFor || registryCapabilityFor;
-            const capability = lookupCapability(requestedInput);
-            if (!capability)
-                throw new CliUsageError('registry-support requires a valid domain or suffix.');
-            const now = dependencies.now ? dependencies.now() : new Date().toISOString();
-            const catalogueVersion = dependencies.registryCapabilitiesVersion || REGISTRY_CAPABILITIES_VERSION;
-            const document = buildRegistrySupportDocument(requestedInput, capability, catalogueVersion, now);
-            if (!args.quiet)
-                write(stdout, args.output === 'json' ? formatJsonDocument(document) : terminal(formatTerminalRegistrySupport(document), args.color));
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'registry-doctor') {
-            failureLabel = 'Registry compatibility diagnostic';
-            let input;
-            try {
-                input = dependencies.readCompareInput
-                    ? await dependencies.readCompareInput(args.source)
-                    : await readInput(args.source, MAX_SAVED_LOOKUP_INPUT_BYTES, 'Registry doctor input');
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read registry doctor input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            if (!input.trim())
-                throw new CliUsageError('registry-doctor requires one saved Lookup JSON file or a document on stdin.');
-            const report = buildRegistryDoctorReport(input, commandContext.now());
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(report)
-                    : terminal(formatRegistryDoctorReport(report), args.color));
-            return report.summary.investigate ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'registry-cohort') {
-            failureLabel = 'Registry quality cohort';
-            let input;
-            try {
-                input = dependencies.readCompareInput
-                    ? await dependencies.readCompareInput(args.source)
-                    : await readInput(args.source, MAX_REGISTRY_COHORT_INPUT_BYTES, 'Registry cohort input');
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read registry cohort input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            const report = buildRegistryCohortReport(input, commandContext.now());
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(report)
-                    : terminal(formatRegistryCohortReport(report), args.color));
-            return report.cohorts.some((cohort) => cohort.state === 'review')
-                ? EXIT_CODES.PARTIAL_FAILURE
-                : EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'registry-scaffold') {
-            failureLabel = 'Registry fixture scaffold';
-            try {
-                write(stdout, buildRegistryFixtureScaffold(args.profile, args.suffix, args.scenario));
-            }
-            catch (error) {
-                throw new CliUsageError(boundedCliErrorMessage(error, 'Registry fixture scaffold failed'));
-            }
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'risk-calibrate') {
-            failureLabel = 'Risk calibration';
-            let input;
-            try {
-                input = dependencies.readRiskCalibrationInput
-                    ? await dependencies.readRiskCalibrationInput(args.source)
-                    : await readInput(args.source, MAX_RISK_CALIBRATION_INPUT_BYTES, 'Risk calibration input');
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read Risk calibration input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            if (!input.trim())
-                throw new CliUsageError('risk-calibrate requires one dataset JSON file or a dataset on stdin.');
-            const dataset = parseRiskCalibrationDataset(input);
-            const report = buildRiskCalibrationReport(dataset, dependencies.explainRiskScore || explainRiskScore, {
-                generatedAt: dependencies.now ? dependencies.now() : new Date().toISOString(),
-                modelVersion: dependencies.riskModelVersion || RISK_MODEL_VERSION,
-                reviewThreshold: dependencies.riskReviewThreshold || RISK_REVIEW_THRESHOLD,
-                ...(!dependencies.explainRiskScore ? {
-                    previousModelVersion: 6,
-                    explainPreviousRiskScore: explainRiskScoreV6,
-                } : {}),
-            });
-            if (!args.quiet)
-                write(stdout, args.output === 'summary_json'
-                    ? serializeRiskCalibrationReport(buildRiskCalibrationSummaryReport(report))
-                    : args.output === 'json'
-                        ? serializeRiskCalibrationReport(report)
-                        : terminal(formatTerminalRiskCalibration(report), args.color));
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'lookalike-calibrate') {
-            failureLabel = 'Lookalike review-yield calibration';
-            let input;
-            try {
-                input = dependencies.readRiskCalibrationInput
-                    ? await dependencies.readRiskCalibrationInput(args.source)
-                    : await readInput(args.source, MAX_LOOKALIKE_CALIBRATION_BYTES, 'Lookalike calibration input');
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read lookalike calibration input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            if (!input.trim())
-                throw new CliUsageError('lookalike-calibrate requires one dataset JSON file or a document on stdin.');
-            let report;
-            try {
-                report = buildLookalikeCalibration(input, commandContext.now());
-            }
-            catch (error) {
-                throw new CliUsageError(boundedCliErrorMessage(error, 'Lookalike calibration input is invalid'));
-            }
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(report)
-                    : terminal(formatLookalikeCalibration(report), args.color));
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'verify-artifact') {
-            failureLabel = 'Artefact verification';
-            let input;
-            try {
-                input = dependencies.readArtifactInput
-                    ? await dependencies.readArtifactInput(args.source)
-                    : await readInput(args.source, MAX_OFFLINE_ARTIFACT_BYTES, 'Artefact input');
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read artifact input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            if (!input.trim())
-                throw new CliUsageError('verify-artifact requires one JSON file or an artefact on stdin.');
-            const passphrase = args.passphraseSource ? await readPassphraseSource(args.passphraseSource) : null;
-            let manifest = null;
-            if (args.manifestSource && args.manifestEntryId) {
-                let raw;
-                try {
-                    raw = dependencies.readArtifactInput
-                        ? await dependencies.readArtifactInput(args.manifestSource)
-                        : await readInput(args.manifestSource, MAX_OFFLINE_ARTIFACT_BYTES, 'Investigation manifest input');
-                }
-                catch (error) {
-                    if (error instanceof CliUsageError)
-                        throw error;
-                    throw new CliUsageError(`Could not read investigation manifest input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-                }
-                if (!raw.trim())
-                    throw new CliUsageError('The investigation manifest input is empty.');
-                manifest = Object.freeze({ raw, entryId: args.manifestEntryId });
-            }
-            const report = await verifyOfflineArtifact(input, { passphrase, manifest });
-            if (!args.quiet) {
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(report)
-                    : terminal(formatOfflineArtifactVerification(report), args.color));
-            }
-            return args.strictExit && !isCompleteOfflineArtifactVerification(report)
-                ? EXIT_CODES.PARTIAL_FAILURE
-                : EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'interchange-report') {
-            failureLabel = 'Interchange fidelity report';
-            let input;
-            try {
-                input = dependencies.readArtifactInput
-                    ? await dependencies.readArtifactInput(args.source)
-                    : await readInput(args.source, MAX_OFFLINE_ARTIFACT_BYTES, 'Interchange input');
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read interchange input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            if (!input.trim())
-                throw new CliUsageError('interchange-report requires one JSON file or an artefact on stdin.');
-            const passphrase = args.passphraseSource ? await readPassphraseSource(args.passphraseSource) : null;
-            const report = await buildInterchangeFidelityReport(input, {
-                generatedAt: commandContext.now(),
-                passphrase,
-            });
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(report)
-                    : terminal(formatInterchangeFidelityReport(report), args.color));
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'source-report') {
-            failureLabel = 'Source reliability report';
-            let input;
-            try {
-                input = dependencies.readSourceReliabilityInput
-                    ? await dependencies.readSourceReliabilityInput(args.source)
-                    : await readInput(args.source, MAX_SOURCE_RELIABILITY_INPUT_BYTES, 'Source reliability input');
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read source reliability input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            if (!input.trim())
-                throw new CliUsageError('source-report requires one JSON file or lookup documents on stdin.');
-            const report = buildSourceReliabilityReport(input, dependencies.now ? dependencies.now() : new Date().toISOString());
-            if (!args.quiet) {
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(report)
-                    : terminal(formatSourceReliabilityReport(report), args.color));
-            }
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'compare') {
-            failureLabel = 'Registry comparison';
-            let input;
-            try {
-                input = dependencies.readCompareInput
-                    ? await dependencies.readCompareInput(args.source)
-                    : await readInput(args.source, MAX_COMPARE_INPUT_BYTES, 'Comparison input');
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read comparison input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            if (!input.trim())
-                throw new CliUsageError('compare requires one lookup JSON file or a lookup document on stdin.');
-            const parsed = parseCliLookupDocument(input);
-            const loadComparison = dependencies.loadRegistryComparison || (() => import("../lib/registry-comparison.mjs"));
-            const comparisonModule = await loadComparison();
-            const result = compareLookupDocument(parsed, comparisonModule.compareRegistrySources, comparisonModule.compareRdapPublications);
-            const now = dependencies.now ? dependencies.now() : new Date().toISOString();
-            const document = buildCliCompareDocument(result, now);
-            if (!args.quiet)
-                write(stdout, args.output === 'json' ? formatJsonDocument(document) : terminal(formatTerminalCompare(document), args.color));
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'page-compare') {
-            failureLabel = 'Static page comparison';
-            const readDiffInput = dependencies.readDiffInput
-                || ((source) => readInput(source, MAX_SAVED_LOOKUP_INPUT_BYTES, 'Page comparison input'));
-            let leftInput;
-            let rightInput;
-            try {
-                [leftInput, rightInput] = await Promise.all([
-                    readDiffInput(args.leftSource),
-                    readDiffInput(args.rightSource),
-                ]);
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read page comparison input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            const document = buildCliPageComparison(leftInput, rightInput, commandContext.now());
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(document)
-                    : terminal(formatCliPageComparison(document), args.color));
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'mail-review') {
-            failureLabel = 'Passive mail review';
-            let input;
-            try {
-                input = dependencies.readMailReviewInput
-                    ? await dependencies.readMailReviewInput(args.source)
-                    : await readInput(args.source, MAX_MAIL_REVIEW_INPUT_BYTES, 'Mail review input');
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read mail review input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            const document = buildCliMailReview(input, commandContext.now());
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(document)
-                    : terminal(formatCliMailReview(document), args.color));
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'review-evidence') {
-            failureLabel = 'Offline evidence review';
-            let input;
-            try {
-                input = dependencies.readArtifactInput
-                    ? await dependencies.readArtifactInput(args.source)
-                    : await readInput(args.source, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, 'Offline evidence input');
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read offline evidence input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            if (!input.trim())
-                throw new CliUsageError('review-evidence requires one JSON file or a document on stdin.');
-            const document = args.mmdbSource
-                ? await buildOfflineEvidenceReviewWithLocalResources(input, commandContext.now(), { mmdbPath: args.mmdbSource })
-                : buildOfflineEvidenceReview(input, commandContext.now());
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(document)
-                    : terminal(formatOfflineEvidenceReview(document), args.color));
-            if (args.strictExit) {
-                const result = document.result && typeof document.result === 'object' && !Array.isArray(document.result)
-                    ? document.result
-                    : {};
-                const gate = result.gate && typeof result.gate === 'object' && !Array.isArray(result.gate)
-                    ? result.gate
-                    : null;
-                const zoneMismatch = document.kind === 'zone_intent' && (result.complete !== true
-                    || (result.counts && typeof result.counts === 'object' && !Array.isArray(result.counts)
-                        && ['different', 'missing', 'unexpected', 'incomplete'].some((key) => Number(result.counts[key]) > 0)));
-                if (gate?.pass === false || zoneMismatch)
-                    return EXIT_CODES.PARTIAL_FAILURE;
-            }
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'brief' || args.action === 'case-pack') {
-            const isBrief = args.action === 'brief';
-            failureLabel = isBrief ? 'Lookup brief' : 'Case pack';
-            let input;
-            try {
-                input = dependencies.readArtifactInput
-                    ? await dependencies.readArtifactInput(args.source)
-                    : await readInput(args.source, isBrief ? MAX_SAVED_LOOKUP_INPUT_BYTES : 4 * 1024 * 1024, isBrief ? 'Lookup brief input' : 'Case-pack input');
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read ${isBrief ? 'Lookup brief' : 'case-pack'} input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            if (!input.trim())
-                throw new CliUsageError(`${args.action} requires one JSON file or a document on stdin.`);
-            if (args.action === 'brief') {
-                const document = buildCliLookupBrief(input, commandContext.now());
-                if (!args.quiet)
-                    write(stdout, args.output === 'json'
-                        ? formatJsonDocument(document)
-                        : terminal(formatCliLookupBrief(document), args.color));
-            }
-            else {
-                const document = buildCliCasePack(input, { audience: args.audience, reviewed: args.reviewed }, commandContext.now());
-                if (!args.quiet)
-                    write(stdout, args.output === 'json'
-                        ? formatJsonDocument(document)
-                        : terminal(formatCliCasePack(document), args.color));
-            }
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'domain-control') {
-            failureLabel = 'Domain control review';
-            let input;
-            try {
-                input = dependencies.readArtifactInput
-                    ? await dependencies.readArtifactInput(args.source)
-                    : await readInput(args.source, MAX_DOMAIN_CONTROL_REVIEW_COMMAND_BYTES, 'Domain control input');
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read domain control input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            if (!input.trim())
-                throw new CliUsageError('domain-control requires one JSON file or a document on stdin.');
-            const normalizedDomainControlInput = input.replace(/^\uFEFF/u, '');
-            let parsed;
-            try {
-                scanBoundedJson(normalizedDomainControlInput, {
-                    maximumDepth: MAX_DOMAIN_CONTROL_REVIEW_JSON_DEPTH,
-                    maximumKeys: MAX_DOMAIN_CONTROL_REVIEW_JSON_KEYS,
-                    maximumValues: MAX_DOMAIN_CONTROL_REVIEW_JSON_VALUES,
-                });
-                parsed = JSON.parse(normalizedDomainControlInput);
-            }
-            catch (cause) {
-                const detail = cause instanceof Error ? cause.message : '';
-                if (detail.startsWith('Artefact JSON ')) {
-                    throw new CliUsageError(`Domain control input ${detail.slice('Artefact JSON '.length)}`);
-                }
-                throw new CliUsageError('Domain control input is not valid JSON.');
-            }
-            const schema = parsed && typeof parsed === 'object' && !Array.isArray(parsed)
-                ? parsed.schema
-                : null;
-            const document = schema === DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA
-                ? buildDomainControlManifest(parsed, commandContext.now())
-                : schema === DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA
-                    ? reviewDomainControlManifest(parsed, commandContext.now())
-                    : schema === CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA
-                        ? buildCliDomainControlReview(input, commandContext.now())
-                        : schema === DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_SCHEMA
-                            ? buildDomainControlFlightRecorder(parsed, commandContext.now())
-                            : null;
-            if (!document) {
-                throw new CliUsageError(`Domain control input must use a supported manifest, review, saved-Lookup review, or flight-recorder schema.`);
-            }
-            const terminalDocument = schema === CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA
-                ? formatCliDomainControlReview(document)
-                : schema === DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_SCHEMA
-                    ? formatDomainControlFlightRecorder(document)
-                    : formatDomainControlResult(document);
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? schema === DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA
-                        ? serializeDomainControlManifest(document)
-                        : schema === DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_SCHEMA
-                            ? serializeDomainControlFlightRecorder(document)
-                            : formatJsonDocument(document)
-                    : terminal(terminalDocument, args.color));
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'monitor-once') {
-            failureLabel = 'One-shot domain control review';
-            let manifestInput;
-            let previousInput = null;
-            try {
-                manifestInput = dependencies.readArtifactInput
-                    ? await dependencies.readArtifactInput(args.source)
-                    : await readInput(args.source, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, 'Domain-control manifest input');
-                if (args.previousSource) {
-                    previousInput = dependencies.readDiffInput
-                        ? await dependencies.readDiffInput(args.previousSource)
-                        : await readInput(args.previousSource, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, 'Prior monitor snapshot');
-                }
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read monitor input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            if (!manifestInput.trim())
-                throw new CliUsageError('monitor-once requires one domain-control manifest file or a document on stdin.');
-            const executeLookup = dependencies.runUnifiedLookup || (await import("../lib/lookup.mjs")).runUnifiedLookup;
-            const progress = commandContext.beginProgress('Collecting bounded domain-control evidence');
-            let document;
-            try {
-                document = await runDomainControlMonitor(manifestInput, previousInput, {
-                    executeLookup,
-                    now: commandContext.now,
-                    limit: args.limit,
-                    concurrency: args.concurrency,
-                    ...(dependencies.signal ? { signal: dependencies.signal } : {}),
-                    onSettled: (completed, total) => progress.update(`Collected ${completed} of ${total} owned domains`),
-                });
-            }
-            finally {
-                commandContext.endProgress();
-            }
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(document)
-                    : args.output === 'junit'
-                        ? formatCliJunit(document)
-                        : terminal(formatDomainControlMonitor(document), args.color));
-            const policyFindings = evaluateCliFailPolicies(document, args.failOn || []);
-            if (policyFindings.length)
-                write(stderr, formatFailPolicyNotice(policyFindings));
-            return document.collection.failed || policyFindings.length ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'assurance') {
-            failureLabel = 'Domain assurance review';
-            let input;
-            try {
-                input = dependencies.readArtifactInput
-                    ? await dependencies.readArtifactInput(args.source)
-                    : await readInput(args.source, MAX_ASSURANCE_INPUT_BYTES, 'Domain assurance input');
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read domain assurance input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            if (!input.trim())
-                throw new CliUsageError('assurance requires one versioned JSON file or a document on stdin.');
-            let parsed;
-            try {
-                scanBoundedJson(input);
-                parsed = JSON.parse(input);
-            }
-            catch {
-                throw new CliUsageError('Domain assurance input is not valid bounded JSON without duplicate keys.');
-            }
-            let document;
-            try {
-                document = buildDomainAssurance(parsed, commandContext.now());
-            }
-            catch (error) {
-                throw new CliUsageError(boundedCliErrorMessage(error, 'Domain assurance input is invalid'));
-            }
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(document)
-                    : terminal(formatDomainAssurance(document), args.color));
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'change-packet') {
-            failureLabel = 'Domain change packet';
-            let input;
-            try {
-                input = dependencies.readArtifactInput
-                    ? await dependencies.readArtifactInput(args.source)
-                    : await readInput(args.source, MAX_DOMAIN_CHANGE_PACKET_INPUT_BYTES, 'Domain change packet input');
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read domain change packet input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            if (!input.trim())
-                throw new CliUsageError('change-packet requires one versioned JSON file or a document on stdin.');
-            let parsed;
-            try {
-                scanBoundedJson(input);
-                parsed = JSON.parse(input);
-            }
-            catch {
-                throw new CliUsageError('Domain change packet input is not valid bounded JSON without duplicate keys.');
-            }
-            let document;
-            try {
-                document = await buildDomainChangePacket(parsed, commandContext.now());
-            }
-            catch (error) {
-                throw new CliUsageError(boundedCliErrorMessage(error, 'Domain change packet input is invalid'));
-            }
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(document)
-                    : terminal(formatDomainChangePacket(document), args.color));
-            return document.gate.pass ? EXIT_CODES.SUCCESS : EXIT_CODES.PARTIAL_FAILURE;
-        }
-        if (args.action === 'sharing-review') {
-            failureLabel = 'Evidence sharing review';
-            let input;
-            try {
-                input = dependencies.readArtifactInput
-                    ? await dependencies.readArtifactInput(args.source)
-                    : await readInput(args.source, MAX_SHARING_REVIEW_BYTES, 'Sharing review input');
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read sharing review input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            if (!input.trim())
-                throw new CliUsageError('sharing-review requires one artefact JSON file or a document on stdin.');
-            let document;
-            try {
-                document = await buildSharingReview(input, {
-                    marking: args.marking,
-                    recipientScope: args.recipientScope,
-                    purpose: args.purpose,
-                    humanReviewed: args.humanReviewed,
-                    personalDataReviewed: args.personalDataReviewed,
-                    redactionsConfirmed: args.redactionsConfirmed,
-                }, commandContext.now());
-            }
-            catch (error) {
-                throw new CliUsageError(boundedCliErrorMessage(error, 'Sharing review input is invalid'));
-            }
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(document)
-                    : terminal(formatSharingReview(document), args.color));
-            return document.summary.status === 'blocked' ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'workflow-plan') {
-            failureLabel = 'Investigation plan';
-            if ('discovery' in args) {
-                const catalogue = buildWorkflowRecipeCatalogue(args.discovery === 'explain' ? args.recipe : null);
-                if (!args.quiet)
-                    write(stdout, args.output === 'json'
-                        ? formatJsonDocument(catalogue)
-                        : terminal(formatWorkflowRecipeCatalogue(catalogue), args.color));
-                return EXIT_CODES.SUCCESS;
-            }
-            const document = buildInvestigationPlan(args.recipe, args.subject, commandContext.now());
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(document)
-                    : terminal(formatInvestigationPlan(document), args.color));
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'workflow-run') {
-            failureLabel = 'Investigation workflow';
-            let resumeInput = null;
-            if (args.resumeSource) {
-                try {
-                    resumeInput = dependencies.readDiffInput
-                        ? await dependencies.readDiffInput(args.resumeSource)
-                        : await readInput(args.resumeSource, MAX_INVESTIGATION_RUN_BYTES, 'Investigation resume state');
-                }
-                catch (error) {
-                    if (error instanceof CliUsageError)
-                        throw error;
-                    throw new CliUsageError(`Could not read investigation resume state: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-                }
-            }
-            const document = await runInvestigationRecipe(args.recipe, args.subject, {
-                approveNetwork: args.approveNetwork,
-                resumeInput,
-                generatedAt: commandContext.now(),
-                ...(dependencies.signal ? { signal: dependencies.signal } : {}),
-                execute: async (command, stepArguments) => {
-                    const stepStdout = createBufferedOutput();
-                    const stepStderr = createBufferedOutput();
-                    const exitCode = await runCli([command, ...stepArguments], {
-                        ...dependencies,
-                        stdout: stepStdout.stream,
-                        stderr: stepStderr.stream,
-                    });
-                    return { exitCode, stdout: stepStdout.value() };
-                },
-            });
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(document)
-                    : terminal(formatInvestigationRun(document), args.color));
-            return document.state === 'step_failed' ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'diff') {
-            failureLabel = 'Retained artifact diff';
-            const readDiffInput = dependencies.readDiffInput
-                || ((source) => readInput(source, MAX_RETAINED_ARTIFACT_DIFF_BYTES, 'Retained diff input'));
-            let leftInput;
-            let rightInput;
-            try {
-                [leftInput, rightInput] = await Promise.all([
-                    readDiffInput(args.leftSource),
-                    readDiffInput(args.rightSource),
-                ]);
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read retained diff input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            const document = buildCliRetainedArtifactDiff(leftInput, rightInput, { leftSessionId: args.leftSessionId, rightSessionId: args.rightSessionId }, dependencies.now ? dependencies.now() : new Date().toISOString());
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(document)
-                    : terminal(formatCliRetainedArtifactDiff(document), args.color));
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'reconcile') {
-            failureLabel = 'Lookup observation reconciliation';
-            const readReconciliationInput = dependencies.readDiffInput
-                || ((source) => readInput(source, MAX_SAVED_LOOKUP_INPUT_BYTES, 'Lookup reconciliation input'));
-            const inputs = [];
-            let totalBytes = 0;
-            try {
-                for (const source of args.sources) {
-                    const input = await readReconciliationInput(source);
-                    totalBytes += Buffer.byteLength(input, 'utf8');
-                    if (totalBytes > MAX_LOOKUP_RECONCILIATION_INPUT_BYTES) {
-                        throw new CliUsageError(`Lookup reconciliation input is limited to ${MAX_LOOKUP_RECONCILIATION_INPUT_BYTES} bytes in total.`);
-                    }
-                    inputs.push(input);
-                }
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read Lookup reconciliation input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            const document = buildCliLookupReconciliation(inputs, commandContext.now());
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(document)
-                    : terminal(formatCliLookupReconciliation(document), args.color));
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'timeline') {
-            failureLabel = 'Lookup observation timeline';
-            const readTimelineInput = dependencies.readDiffInput
-                || ((source) => readInput(source, MAX_SAVED_LOOKUP_INPUT_BYTES, 'Lookup timeline input'));
-            const inputs = [];
-            let totalBytes = 0;
-            try {
-                for (const source of args.sources) {
-                    const input = await readTimelineInput(source);
-                    totalBytes += Buffer.byteLength(input, 'utf8');
-                    if (totalBytes > MAX_LOOKUP_TIMELINE_INPUT_BYTES) {
-                        throw new CliUsageError(`Lookup timeline input is limited to ${MAX_LOOKUP_TIMELINE_INPUT_BYTES} bytes in total.`);
-                    }
-                    inputs.push(input);
-                }
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read Lookup timeline input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            const document = buildCliLookupTimeline(inputs, commandContext.now());
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(document)
-                    : terminal(formatCliLookupTimeline(document), args.color));
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'export') {
-            failureLabel = 'Evidence export';
-            let input;
-            try {
-                input = dependencies.readExportInput
-                    ? await dependencies.readExportInput(args.source)
-                    : await readInput(args.source, MAX_SAVED_LOOKUP_INPUT_BYTES, 'Evidence export input');
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read evidence export input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            if (!input.trim())
-                throw new CliUsageError('export requires one lookup JSON file or a lookup document on stdin.');
-            const loadEvidence = dependencies.loadEvidenceExport || (() => import("../lib/evidence-export.mjs"));
-            const evidenceModule = await loadEvidence();
-            const now = dependencies.now ? dependencies.now() : new Date().toISOString();
-            const document = buildCliEvidenceExport(input, evidenceModule, now);
-            const output = args.format === 'markdown'
-                ? formatLookupEvidenceMarkdown(document, { includeAttribution: args.includeAttribution })
-                : args.format === 'html'
-                    ? formatLookupEvidenceHtml(document, { includeAttribution: args.includeAttribution })
-                    : formatCliEvidenceExport(document, args.compact);
-            write(stdout, output);
-            return EXIT_CODES.SUCCESS;
-        }
-        if (args.action === 'ct-intake') {
-            failureLabel = 'Certificate event intake';
-            let input;
-            try {
-                input = dependencies.readArtifactInput
-                    ? await dependencies.readArtifactInput(args.source)
-                    : await readInput(args.source, MAX_CT_EVENT_INPUT_BYTES, 'Certificate event input');
-            }
-            catch (error) {
-                if (error instanceof CliUsageError)
-                    throw error;
-                throw new CliUsageError(`Could not read certificate event input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-            }
-            if (!input.trim())
-                throw new CliUsageError('ct-intake requires one versioned JSON file or a document on stdin.');
-            let parsed;
-            try {
-                scanBoundedJson(input);
-                parsed = JSON.parse(input);
-            }
-            catch {
-                throw new CliUsageError('Certificate event input is not valid bounded JSON without duplicate keys.');
-            }
-            let document;
-            try {
-                document = buildCtEventFindings(parsed);
-            }
-            catch (error) {
-                throw new CliUsageError(boundedCliErrorMessage(error, 'Certificate event input is invalid'));
-            }
-            if (!args.quiet)
-                write(stdout, args.output === 'json'
-                    ? formatJsonDocument(document)
-                    : terminal(formatCtEventFindings(document), args.color));
-            return EXIT_CODES.SUCCESS;
-        }
-        throw new Error('No CLI execution route is registered for the parsed command.');
+        return await runInlineCommand(args, dependencies, commandContext);
     }
     catch (error) {
         progress?.stop();