@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/cli/arguments.mjs

@@ -1,420 +1,36 @@
 import { parseCommandArguments } from "./command-argument-grammar.mjs";
 import { CliUsageError, hasUnsafeCliText } from "./errors.mjs";
-import { parseCliFailPolicies } from "./fail-policy.mjs";
 import { isDirectLookupTarget } from "../lib/classify.mjs";
-import { CLI_COMMANDS, cliMetaActionForInvocation, isCliCommand, } from "./command-reference.mjs";
-const MAX_CLI_ARGUMENTS = 32;
-const MAX_CLI_ARGUMENT_LENGTH = 1024;
+import { MAX_CLI_ARGUMENTS, MAX_CLI_ARGUMENT_LENGTH } from "../packages/contracts/cli-grammar.mjs";
+import { CLI_COMMANDS, cliMetaActionForInvocation, isCliCommand } from "./command-reference.mjs";
+import { commandHasOwner } from "./command-reference.mjs";
+import { SUPPORT_ARGUMENT_PARSERS } from "./support-arguments.mjs";
+import { ASSURANCE_ARGUMENT_PARSERS } from "./assurance-arguments.mjs";
+import { COLLECTION_ARGUMENT_PARSERS } from "./collection-arguments.mjs";
+import { NETWORK_ARGUMENT_PARSERS } from "./network-arguments.mjs";
+import { REVIEW_ARGUMENT_PARSERS } from "./review-arguments.mjs";
+import { EVIDENCE_ARGUMENT_PARSERS } from "./evidence-arguments.mjs";
+import { WORKFLOW_ARGUMENT_PARSERS } from "./workflow-arguments.mjs";
+import { HISTORY_ARGUMENT_PARSERS } from "./history-arguments.mjs";
+const CLI_PARSERS = Object.freeze({
+    ...SUPPORT_ARGUMENT_PARSERS,
+    ...ASSURANCE_ARGUMENT_PARSERS,
+    ...COLLECTION_ARGUMENT_PARSERS,
+    ...NETWORK_ARGUMENT_PARSERS,
+    ...REVIEW_ARGUMENT_PARSERS,
+    ...EVIDENCE_ARGUMENT_PARSERS,
+    ...WORKFLOW_ARGUMENT_PARSERS,
+    ...HISTORY_ARGUMENT_PARSERS,
+});
+export function isCliCommandForOwner(args, owner) {
+    return commandHasOwner(args.action, owner);
+}
 function boundedArgument(value) {
     if (typeof value !== 'string' || value.length > MAX_CLI_ARGUMENT_LENGTH || hasUnsafeCliText(value)) {
         throw new CliUsageError('Arguments must be bounded text without control characters.');
     }
     return value;
 }
-function terminalOptions(parsed) {
-    return { quiet: parsed.hasOption('--quiet'), color: !parsed.hasOption('--no-color') };
-}
-function parseInspectArchiveArguments(parsed) {
-    const expectedContentDigest = parsed.optionValue('--expect-content-digest');
-    if (expectedContentDigest !== null && !/^sha256:[a-f0-9]{64}$/u.test(expectedContentDigest)) {
-        throw new CliUsageError('--expect-content-digest requires sha256 followed by 64 lowercase hexadecimal characters.');
-    }
-    return {
-        action: 'inspect-archive',
-        source: parsed.positionalValue('source'),
-        passphraseSource: parsed.optionValue('--passphrase-file'),
-        search: parsed.optionValue('--search'),
-        reveal: parsed.hasOption('--reveal'),
-        requireMatch: parsed.hasOption('--require-match'),
-        expectedContentDigest,
-        output: parsed.hasOption('--json') ? 'json' : 'terminal',
-        ...terminalOptions(parsed),
-    };
-}
-function parseSignArtifactArguments(parsed) {
-    return {
-        action: 'sign-artifact',
-        source: parsed.positionalValue('source'),
-        privateKeySource: parsed.optionValue('--private-key-file'),
-    };
-}
-function parseVerifySignatureArguments(parsed) {
-    return {
-        action: 'verify-signature',
-        source: parsed.positionalValue('source'),
-        publicKeySource: parsed.optionValue('--public-key-file'),
-        output: parsed.hasOption('--json') ? 'json' : 'terminal',
-        ...terminalOptions(parsed),
-    };
-}
-function jsonOutput(parsed) {
-    return parsed.hasOption('--json') ? 'json' : 'terminal';
-}
-function normalizedLabel(parsed, option, maximum) {
-    const value = parsed.optionValue(option);
-    if (value === null)
-        return null;
-    const normalized = value.replace(/\s+/gu, ' ').trim();
-    if (!normalized || normalized.length > maximum) {
-        throw new CliUsageError(`${option} requires a label of at most ${maximum} characters.`);
-    }
-    return normalized;
-}
-function failPolicies(parsed, command) {
-    const value = parsed.optionValue('--fail-on');
-    return value === null ? null : parseCliFailPolicies(value, command);
-}
-function parseOutput(parsed, formats) {
-    return formats.find(([option]) => parsed.hasOption(option))?.[1] ?? 'terminal';
-}
-function singleInputAction(action, parsed, positionalName = 'source') {
-    return {
-        action,
-        [positionalName === 'source' ? 'source' : positionalName]: parsed.positionalValue(positionalName),
-        output: jsonOutput(parsed),
-        ...terminalOptions(parsed),
-    };
-}
-function parseLookupArguments(parsed) {
-    const output = parseOutput(parsed, [
-        ['--json', 'json'], ['--junit', 'junit'], ['--markdown', 'markdown'], ['--html', 'html'],
-    ]);
-    const selectedFailPolicies = failPolicies(parsed, 'lookup');
-    return {
-        action: 'lookup',
-        query: parsed.positionalValue('target'),
-        output,
-        deep: parsed.hasOption('--deep'),
-        detail: parsed.hasOption('--summary') ? 'summary' : parsed.hasOption('--verbose') ? 'verbose' : 'standard',
-        strictExit: parsed.hasOption('--strict-exit'),
-        events: parsed.hasOption('--events'),
-        plan: parsed.hasOption('--plan'),
-        includeAttribution: !parsed.hasOption('--no-attribution'),
-        observerLabel: normalizedLabel(parsed, '--observer', 80),
-        vantageLabel: normalizedLabel(parsed, '--vantage', 80),
-        ...terminalOptions(parsed),
-        ...(parsed.hasOption('--browse') ? { browse: true } : {}),
-        ...(parsed.optionValue('--save-lookup') ? { saveLookup: parsed.optionValue('--save-lookup') } : {}),
-        ...(selectedFailPolicies ? { failOn: selectedFailPolicies } : {}),
-    };
-}
-function parseManifestArguments(parsed) {
-    const sources = parsed.positionalValues('artefacts');
-    if (sources.some((source) => !source))
-        throw new CliUsageError('manifest requires from 1 to 16 JSON artefact files.');
-    if (new Set(sources).size !== sources.length)
-        throw new CliUsageError('manifest artefact files must be different.');
-    const configurationDigestSha256 = parsed.optionValue('--configuration-digest');
-    if (configurationDigestSha256 !== null && !/^sha256:[a-f0-9]{64}$/u.test(configurationDigestSha256)) {
-        throw new CliUsageError('--configuration-digest requires a sha256: hexadecimal digest.');
-    }
-    return {
-        action: 'manifest',
-        sources,
-        workflow: parsed.optionValue('--workflow'),
-        configurationDigestSha256,
-        output: jsonOutput(parsed),
-        ...terminalOptions(parsed),
-    };
-}
-function parseBulkArguments(parsed) {
-    const deep = parsed.hasOption('--deep');
-    const selectedFailPolicies = failPolicies(parsed, 'bulk');
-    const output = parseOutput(parsed, [
-        ['--json', 'json'], ['--jsonl', 'jsonl'], ['--csv', 'csv'], ['--domains', 'domains'],
-        ['--queries', 'queries'], ['--junit', 'junit'],
-    ]);
-    const filter = parsed.hasOption('--registered-only') ? 'registered'
-        : parsed.hasOption('--inconclusive-only') ? 'inconclusive'
-            : parsed.hasOption('--errors-only') ? 'errors' : 'all';
-    return {
-        action: 'bulk',
-        source: parsed.positionalValue('source'),
-        output,
-        deep,
-        concurrency: parsed.integerOption('--concurrency') ?? (deep ? 2 : 4),
-        checkpoint: parsed.optionValue('--checkpoint'),
-        resume: parsed.hasOption('--resume'),
-        events: parsed.hasOption('--events'),
-        plan: parsed.hasOption('--plan'),
-        filter,
-        ...terminalOptions(parsed),
-        ...(selectedFailPolicies ? { failOn: selectedFailPolicies } : {}),
-    };
-}
-function discoveryValues(parsed) {
-    const familyText = parsed.optionValue('--families');
-    return {
-        preset: (familyText ? 'custom' : parsed.optionValue('--preset') ?? 'all'),
-        keyboardLayout: (parsed.optionValue('--keyboard') ?? 'qwerty'),
-        tldText: parsed.optionValue('--tlds'),
-        dictionarySource: parsed.optionValue('--dictionary'),
-        familyText,
-    };
-}
-function parseDiscoverArguments(parsed) {
-    return {
-        action: 'discover',
-        seed: parsed.positionalValue('subject'),
-        output: parseOutput(parsed, [['--json', 'json'], ['--jsonl', 'jsonl'], ['--domains', 'domains']]),
-        ...discoveryValues(parsed),
-        snapshotSource: parsed.optionValue('--snapshot'),
-        ...terminalOptions(parsed),
-    };
-}
-function parseDiscoverScanArguments(parsed) {
-    const deep = parsed.hasOption('--deep');
-    const selectedFailPolicies = failPolicies(parsed, 'discover-scan');
-    const filter = parsed.hasOption('--registered-only') ? 'registered'
-        : parsed.hasOption('--inconclusive-only') ? 'inconclusive'
-            : parsed.hasOption('--acquisition-only') ? 'acquisition'
-                : parsed.hasOption('--suppressed-only') ? 'suppressed' : 'all';
-    return {
-        action: 'discover-scan',
-        seed: parsed.positionalValue('subject'),
-        output: parseOutput(parsed, [['--json', 'json'], ['--jsonl', 'jsonl'], ['--csv', 'csv'], ['--domains', 'domains']]),
-        ...discoveryValues(parsed),
-        deep,
-        scanLimit: parsed.integerOption('--scan-limit') ?? Math.min(100, deep ? 50 : 500),
-        chunkSize: parsed.integerOption('--chunk-size') ?? 25,
-        concurrency: parsed.integerOption('--concurrency') ?? (deep ? 2 : 4),
-        checkpoint: parsed.optionValue('--checkpoint'),
-        resume: parsed.hasOption('--resume'),
-        resolverText: parsed.optionValue('--resolver'),
-        observationSnapshot: parsed.optionValue('--observation-snapshot'),
-        allowlistSource: parsed.optionValue('--allowlist'),
-        filter,
-        events: parsed.hasOption('--events'),
-        plan: parsed.hasOption('--plan'),
-        ...terminalOptions(parsed),
-        ...(selectedFailPolicies ? { failOn: selectedFailPolicies } : {}),
-    };
-}
-function parsePostureArguments(parsed) {
-    const mailProfile = parsed.optionValue('--mail-profile') ?? 'standard';
-    return {
-        action: 'posture',
-        domain: parsed.positionalValue('domain'),
-        output: parseOutput(parsed, [['--json', 'json'], ['--sarif', 'sarif']]),
-        selectorText: parsed.optionValue('--selectors'),
-        retiredSelectorText: parsed.optionValue('--retired-selectors'),
-        mailProfile: mailProfile === 'defensive-no-mail' ? 'defensive_no_mail' : mailProfile,
-        ownedDomain: parsed.hasOption('--owned-domain'),
-        ...terminalOptions(parsed),
-    };
-}
-function parseDnssecValidateArguments(parsed) {
-    return {
-        action: 'dnssec-validate',
-        target: parsed.positionalValue('domain'),
-        resolver: parsed.optionValue('--resolver'),
-        trustAnchorSource: parsed.optionValue('--trust-anchor'),
-        ownedOrAuthorized: true,
-        output: jsonOutput(parsed),
-        ...terminalOptions(parsed),
-    };
-}
-function parseMailTransportArguments(parsed) {
-    return {
-        action: 'mail-transport',
-        source: parsed.positionalValue('source'),
-        resolver: parsed.optionValue('--resolver'),
-        trustAnchorSource: parsed.optionValue('--trust-anchor'),
-        ownedOrAuthorized: true,
-        activeProbeAcknowledged: true,
-        output: jsonOutput(parsed),
-        ...terminalOptions(parsed),
-    };
-}
-function parseTwoFileComparisonArguments(parsed, command) {
-    const sources = parsed.positionalValues('sources');
-    if (sources[0] === sources[1])
-        throw new CliUsageError(`${command} requires two different input files.`);
-    return { leftSource: sources[0], rightSource: sources[1], output: jsonOutput(parsed), ...terminalOptions(parsed) };
-}
-function parseVerifyArtifactArguments(parsed) {
-    return {
-        action: 'verify-artifact',
-        source: parsed.positionalValue('source'),
-        passphraseSource: parsed.optionValue('--passphrase-file'),
-        manifestSource: parsed.optionValue('--manifest'),
-        manifestEntryId: parsed.optionValue('--manifest-entry'),
-        output: jsonOutput(parsed),
-        strictExit: parsed.hasOption('--strict-exit'),
-        ...terminalOptions(parsed),
-    };
-}
-function parseMonitorOnceArguments(parsed) {
-    const selectedFailPolicies = failPolicies(parsed, 'monitor-once');
-    return {
-        action: 'monitor-once',
-        source: parsed.positionalValue('source'),
-        previousSource: parsed.optionValue('--previous'),
-        output: parseOutput(parsed, [['--json', 'json'], ['--junit', 'junit']]),
-        limit: parsed.integerOption('--limit') ?? 20,
-        concurrency: parsed.integerOption('--concurrency') ?? 2,
-        ...terminalOptions(parsed),
-        ...(selectedFailPolicies ? { failOn: selectedFailPolicies } : {}),
-    };
-}
-function parseSharingReviewArguments(parsed) {
-    const purpose = parsed.optionValue('--purpose').replace(/\s+/gu, ' ').trim();
-    if (!purpose || purpose.length > 200)
-        throw new CliUsageError('--purpose is limited to 200 characters.');
-    return {
-        action: 'sharing-review',
-        source: parsed.positionalValue('source'),
-        output: jsonOutput(parsed),
-        marking: parsed.optionValue('--marking'),
-        recipientScope: parsed.optionValue('--recipient-scope'),
-        purpose,
-        humanReviewed: parsed.hasOption('--human-reviewed'),
-        personalDataReviewed: parsed.hasOption('--personal-data-reviewed'),
-        redactionsConfirmed: parsed.hasOption('--redactions-confirmed'),
-        ...terminalOptions(parsed),
-    };
-}
-function parseWorkflowPlanArguments(parsed) {
-    const options = { output: jsonOutput(parsed), ...terminalOptions(parsed) };
-    if (parsed.hasOption('--list')) {
-        if (parsed.allPositionals.length > 0)
-            throw new CliUsageError('workflow-plan discovery options do not accept a subject.');
-        return { action: 'workflow-plan', discovery: 'list', ...options };
-    }
-    if (parsed.hasOption('--explain')) {
-        if (parsed.allPositionals.length > 0)
-            throw new CliUsageError('workflow-plan discovery options do not accept a subject.');
-        return { action: 'workflow-plan', discovery: 'explain', recipe: parsed.optionValue('--explain'), ...options };
-    }
-    if (parsed.allPositionals.length !== 2) {
-        throw new CliUsageError('workflow-plan requires one fixed recipe and one subject, --list, or --explain <recipe>.');
-    }
-    return {
-        action: 'workflow-plan',
-        recipe: parsed.positionalValue('recipe'),
-        subject: parsed.positionalValue('subject'),
-        ...options,
-    };
-}
-function parseWorkflowRunArguments(parsed) {
-    const selections = parsed.optionValues('--select').map((value) => {
-        const separator = value.indexOf('=');
-        const stepId = separator === -1 ? '' : value.slice(0, separator);
-        const selection = separator === -1 ? '' : value.slice(separator + 1);
-        if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(stepId) || !selection.trim()) {
-            throw new CliUsageError('--select requires <step-id>=<path-or-value>.');
-        }
-        if (selection.startsWith('-')) {
-            throw new CliUsageError('--select values cannot start with a hyphen; prefix a file path with ./ when needed.');
-        }
-        return Object.freeze({ stepId, value: selection });
-    });
-    return {
-        action: 'workflow-run',
-        recipe: parsed.positionalValue('recipe'),
-        subject: parsed.positionalValue('subject'),
-        resumeSource: parsed.optionValue('--resume'),
-        selections: Object.freeze(selections),
-        approveNetwork: parsed.hasOption('--approve-network'),
-        output: jsonOutput(parsed),
-        ...terminalOptions(parsed),
-    };
-}
-function parseDiffArguments(parsed) {
-    const compared = parseTwoFileComparisonArguments(parsed, 'diff');
-    const leftSessionId = parsed.optionValue('--left-session');
-    const rightSessionId = parsed.optionValue('--right-session');
-    for (const [option, value] of [['--left-session', leftSessionId], ['--right-session', rightSessionId]]) {
-        if (value !== null && !/^[A-Za-z0-9_-]{1,128}$/u.test(value)) {
-            throw new CliUsageError(`${option} requires one bounded saved-session ID.`);
-        }
-    }
-    return { action: 'diff', ...compared, leftSessionId, rightSessionId };
-}
-function uniqueSources(parsed, command) {
-    const sources = parsed.positionalValues('sources');
-    if (new Set(sources).size !== sources.length)
-        throw new CliUsageError(`${command} input files must be different.`);
-    return sources;
-}
-const CLI_PARSERS = Object.freeze({
-    completion: (parsed) => ({ action: 'completion', shell: parsed.positionalValue('shell') }),
-    doctor: (parsed) => ({ action: 'doctor', network: parsed.hasOption('--network'), output: jsonOutput(parsed), ...terminalOptions(parsed) }),
-    commands: (parsed) => ({
-        action: 'commands', output: jsonOutput(parsed), common: parsed.hasOption('--common'),
-        group: parsed.optionValue('--group'),
-        mode: parsed.optionValue('--mode'),
-        ...terminalOptions(parsed),
-    }),
-    manual: () => ({ action: 'manual' }),
-    manifest: parseManifestArguments,
-    'map-observations': (parsed) => singleInputAction('map-observations', parsed),
-    'oam-export': (parsed) => singleInputAction('oam-export', parsed),
-    lookup: parseLookupArguments,
-    bulk: parseBulkArguments,
-    'ct-search': (parsed) => singleInputAction('ct-search', parsed, 'keyword'),
-    'ct-intake': (parsed) => singleInputAction('ct-intake', parsed),
-    discover: parseDiscoverArguments,
-    'discover-scan': parseDiscoverScanArguments,
-    posture: parsePostureArguments,
-    http: (parsed) => singleInputAction('http', parsed, 'domain'),
-    tls: (parsed) => singleInputAction('tls', parsed, 'hostname'),
-    'dnssec-validate': parseDnssecValidateArguments,
-    'mail-transport': parseMailTransportArguments,
-    'registry-support': (parsed) => ({
-        action: 'registry-support', target: parsed.positionalValue('domain-or-suffix'),
-        output: jsonOutput(parsed), ...terminalOptions(parsed),
-    }),
-    'registry-doctor': (parsed) => singleInputAction('registry-doctor', parsed),
-    'registry-cohort': (parsed) => singleInputAction('registry-cohort', parsed),
-    'registry-scaffold': (parsed) => ({
-        action: 'registry-scaffold', profile: parsed.optionValue('--profile'), suffix: parsed.optionValue('--suffix'),
-        scenario: parsed.optionValue('--scenario'),
-    }),
-    'risk-calibrate': (parsed) => ({
-        action: 'risk-calibrate', source: parsed.positionalValue('source'),
-        output: parsed.hasOption('--json') ? 'json' : parsed.hasOption('--summary-json') ? 'summary_json' : 'terminal',
-        ...terminalOptions(parsed),
-    }),
-    'lookalike-calibrate': (parsed) => singleInputAction('lookalike-calibrate', parsed),
-    'verify-artifact': parseVerifyArtifactArguments,
-    'interchange-report': (parsed) => ({
-        action: 'interchange-report', source: parsed.positionalValue('source'),
-        passphraseSource: parsed.optionValue('--passphrase-file'), output: jsonOutput(parsed), ...terminalOptions(parsed),
-    }),
-    'inspect-archive': parseInspectArchiveArguments,
-    'sign-artifact': parseSignArtifactArguments,
-    'verify-signature': parseVerifySignatureArguments,
-    'source-report': (parsed) => singleInputAction('source-report', parsed),
-    compare: (parsed) => singleInputAction('compare', parsed),
-    'page-compare': (parsed) => ({ action: 'page-compare', ...parseTwoFileComparisonArguments(parsed, 'page-compare') }),
-    'mail-review': (parsed) => singleInputAction('mail-review', parsed),
-    'mail-headers': (parsed) => singleInputAction('mail-headers', parsed),
-    'review-evidence': (parsed) => ({
-        action: 'review-evidence', source: parsed.positionalValue('source'), mmdbSource: parsed.optionValue('--mmdb'),
-        output: jsonOutput(parsed), strictExit: parsed.hasOption('--strict-exit'), ...terminalOptions(parsed),
-    }),
-    brief: (parsed) => singleInputAction('brief', parsed),
-    'case-pack': (parsed) => ({
-        action: 'case-pack', source: parsed.positionalValue('source'), output: jsonOutput(parsed),
-        audience: parsed.optionValue('--audience'), reviewed: true, ...terminalOptions(parsed),
-    }),
-    'domain-control': (parsed) => singleInputAction('domain-control', parsed),
-    'monitor-once': parseMonitorOnceArguments,
-    assurance: (parsed) => singleInputAction('assurance', parsed),
-    'change-packet': (parsed) => singleInputAction('change-packet', parsed),
-    'sharing-review': parseSharingReviewArguments,
-    'workflow-plan': parseWorkflowPlanArguments,
-    'workflow-run': parseWorkflowRunArguments,
-    diff: parseDiffArguments,
-    reconcile: (parsed) => ({ action: 'reconcile', sources: uniqueSources(parsed, 'reconcile'), output: jsonOutput(parsed), ...terminalOptions(parsed) }),
-    timeline: (parsed) => ({ action: 'timeline', sources: uniqueSources(parsed, 'timeline'), output: jsonOutput(parsed), ...terminalOptions(parsed) }),
-    export: (parsed) => ({
-        action: 'export', source: parsed.positionalValue('source'),
-        format: parsed.hasOption('--markdown') ? 'markdown' : parsed.hasOption('--html') ? 'html' : 'json',
-        compact: parsed.hasOption('--compact'), includeAttribution: !parsed.hasOption('--no-attribution'),
-    }),
-});
 function parseCliArguments(rawArgv) {
     if (!Array.isArray(rawArgv) || rawArgv.length > MAX_CLI_ARGUMENTS) {
         throw new CliUsageError(`At most ${MAX_CLI_ARGUMENTS} command arguments are supported.`);