@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/DISCLOSURE

@@ -1,4 +1,4 @@
-WHOISleuth is a defensive domain investigation and brand-protection tool. Its
+WHOISleuth is a defensive domain investigation and brand protection tool. Its
 command-line package can collect bounded WHOIS, RDAP, DNS, HTTP, TLS,
 certificate-transparency, website, and related infrastructure evidence. It can
 also generate and review lookalike-domain candidates, compare saved evidence,

package/NOTICE

@@ -44,8 +44,8 @@ Shalini Chandra (2024), licensed under CC BY 4.0 without warranties. The source
 and licence links, modifications and reproduction instructions are in that
 directory's README.md. This dataset is not included in the website or CLI.
 
-The generated Unicode confusable projection is derived from Unicode UTS #39
-data file confusables.txt, Unicode version 17.0.0.
+The generated Unicode confusable projection is derived from the Unicode UTS #39
+data file confusables.txt. Its source version and digest accompany the projection.
 
 UNICODE LICENSE V3 COPYRIGHT AND PERMISSION NOTICE
 Copyright © 1991-2026 Unicode, Inc.

package/cli/argument-values.mjs

@@ -0,0 +1,55 @@
+import {} from "./command-argument-grammar.mjs";
+import { CliUsageError } from "./errors.mjs";
+import { parseCliFailPolicies, } from "./fail-policy.mjs";
+import { PRESENTATION_OPTIONS } from "./command-definition.mjs";
+function terminalOptions(parsed) {
+    return { quiet: parsed.hasOption('--quiet'), color: !parsed.hasOption('--no-color') };
+}
+function jsonOutput(parsed) {
+    return parsed.hasOption('--json') ? 'json' : 'terminal';
+}
+function normalizedLabel(parsed, option, maximum) {
+    const value = parsed.optionValue(option);
+    if (value === null)
+        return null;
+    const normalized = value.replace(/\s+/gu, ' ').trim();
+    if (!normalized || normalized.length > maximum) {
+        throw new CliUsageError(`${option} requires a label of at most ${maximum} characters.`);
+    }
+    return normalized;
+}
+function failPolicies(parsed, command) {
+    const value = parsed.optionValue('--fail-on');
+    return value === null ? null : parseCliFailPolicies(value, command);
+}
+function parseOutput(parsed, definition) {
+    // Membership proves the returned literal belongs to this command's declared
+    // options. Grammar validation independently rejects conflicting selections.
+    return (PRESENTATION_OPTIONS.find(([option]) => definition.options.includes(option) && parsed.hasOption(option))?.[2] ?? 'terminal');
+}
+function parseTwoFileComparisonArguments(parsed, command) {
+    const sources = parsed.positionalValues('sources');
+    if (sources[0] === sources[1])
+        throw new CliUsageError(`${command} requires two different input files.`);
+    return {
+        leftSource: sources[0],
+        rightSource: sources[1],
+        output: jsonOutput(parsed),
+        ...terminalOptions(parsed),
+    };
+}
+function uniqueSources(parsed, command) {
+    const sources = parsed.positionalValues('sources');
+    if (new Set(sources).size !== sources.length)
+        throw new CliUsageError(`${command} input files must be different.`);
+    return sources;
+}
+function singleInputAction(action, parsed, positionalName = 'source') {
+    return {
+        action,
+        [positionalName]: parsed.positionalValue(positionalName),
+        output: jsonOutput(parsed),
+        ...terminalOptions(parsed),
+    };
+}
+export { terminalOptions, jsonOutput, normalizedLabel, failPolicies, parseOutput, parseTwoFileComparisonArguments, uniqueSources, singleInputAction, };

package/cli/arguments.mjs

@@ -1,482 +1,36 @@
 import { parseCommandArguments } from "./command-argument-grammar.mjs";
 import { CliUsageError, hasUnsafeCliText } from "./errors.mjs";
-import { parseArchiveContentDigest } from "./archive-content-digest.mjs";
-import { parseCliFailPolicies } from "./fail-policy.mjs";
 import { isDirectLookupTarget } from "../lib/classify.mjs";
-import { MAX_INVESTIGATION_MANIFEST_ARTIFACTS } from "../packages/investigation/investigation-manifest.mjs";
-import { CLI_COMMANDS, CLI_CASE_OPERATIONS, cliMetaActionForInvocation, isCliCommand, } from "./command-reference.mjs";
-const MAX_CLI_ARGUMENTS = MAX_INVESTIGATION_MANIFEST_ARTIFACTS + 32;
-const MAX_CLI_ARGUMENT_LENGTH = 1024;
+import { MAX_CLI_ARGUMENTS, MAX_CLI_ARGUMENT_LENGTH } from "../packages/contracts/cli-grammar.mjs";
+import { CLI_COMMANDS, cliMetaActionForInvocation, isCliCommand } from "./command-reference.mjs";
+import { commandHasOwner } from "./command-reference.mjs";
+import { SUPPORT_ARGUMENT_PARSERS } from "./support-arguments.mjs";
+import { ASSURANCE_ARGUMENT_PARSERS } from "./assurance-arguments.mjs";
+import { COLLECTION_ARGUMENT_PARSERS } from "./collection-arguments.mjs";
+import { NETWORK_ARGUMENT_PARSERS } from "./network-arguments.mjs";
+import { REVIEW_ARGUMENT_PARSERS } from "./review-arguments.mjs";
+import { EVIDENCE_ARGUMENT_PARSERS } from "./evidence-arguments.mjs";
+import { WORKFLOW_ARGUMENT_PARSERS } from "./workflow-arguments.mjs";
+import { HISTORY_ARGUMENT_PARSERS } from "./history-arguments.mjs";
+const CLI_PARSERS = Object.freeze({
+    ...SUPPORT_ARGUMENT_PARSERS,
+    ...ASSURANCE_ARGUMENT_PARSERS,
+    ...COLLECTION_ARGUMENT_PARSERS,
+    ...NETWORK_ARGUMENT_PARSERS,
+    ...REVIEW_ARGUMENT_PARSERS,
+    ...EVIDENCE_ARGUMENT_PARSERS,
+    ...WORKFLOW_ARGUMENT_PARSERS,
+    ...HISTORY_ARGUMENT_PARSERS,
+});
+export function isCliCommandForOwner(args, owner) {
+    return commandHasOwner(args.action, owner);
+}
 function boundedArgument(value) {
     if (typeof value !== 'string' || value.length > MAX_CLI_ARGUMENT_LENGTH || hasUnsafeCliText(value)) {
         throw new CliUsageError('Arguments must be bounded text without control characters.');
     }
     return value;
 }
-function terminalOptions(parsed) {
-    return { quiet: parsed.hasOption('--quiet'), color: !parsed.hasOption('--no-color') };
-}
-function parseInspectArchiveArguments(parsed) {
-    const expectedContentDigest = parsed.optionValue('--expect-content-digest');
-    try {
-        parseArchiveContentDigest(expectedContentDigest);
-    }
-    catch {
-        throw new CliUsageError('--expect-content-digest requires sha256:<64 lowercase hex> or sorted-json-v2:sha256:<64 lowercase hex>.');
-    }
-    return {
-        action: 'inspect-archive',
-        source: parsed.positionalValue('source'),
-        passphraseSource: parsed.optionValue('--passphrase-file'),
-        search: parsed.optionValue('--search'),
-        reveal: parsed.hasOption('--reveal'),
-        requireMatch: parsed.hasOption('--require-match'),
-        expectedContentDigest,
-        output: parsed.hasOption('--json') ? 'json' : 'terminal',
-        ...terminalOptions(parsed),
-    };
-}
-function parseSignArtifactArguments(parsed) {
-    return {
-        action: 'sign-artifact',
-        source: parsed.positionalValue('source'),
-        privateKeySource: parsed.optionValue('--private-key-file'),
-    };
-}
-function parseVerifySignatureArguments(parsed) {
-    return {
-        action: 'verify-signature',
-        source: parsed.positionalValue('source'),
-        publicKeySource: parsed.optionValue('--public-key-file'),
-        trustStoreSource: parsed.optionValue('--trust-store-file'),
-        output: parsed.hasOption('--json') ? 'json' : 'terminal',
-        ...terminalOptions(parsed),
-    };
-}
-function jsonOutput(parsed) {
-    return parsed.hasOption('--json') ? 'json' : 'terminal';
-}
-function normalizedLabel(parsed, option, maximum) {
-    const value = parsed.optionValue(option);
-    if (value === null)
-        return null;
-    const normalized = value.replace(/\s+/gu, ' ').trim();
-    if (!normalized || normalized.length > maximum) {
-        throw new CliUsageError(`${option} requires a label of at most ${maximum} characters.`);
-    }
-    return normalized;
-}
-function failPolicies(parsed, command) {
-    const value = parsed.optionValue('--fail-on');
-    return value === null ? null : parseCliFailPolicies(value, command);
-}
-function parseOutput(parsed, formats) {
-    return formats.find(([option]) => parsed.hasOption(option))?.[1] ?? 'terminal';
-}
-function singleInputAction(action, parsed, positionalName = 'source') {
-    return {
-        action,
-        [positionalName === 'source' ? 'source' : positionalName]: parsed.positionalValue(positionalName),
-        output: jsonOutput(parsed),
-        ...terminalOptions(parsed),
-    };
-}
-function parseLookupArguments(parsed) {
-    const output = parseOutput(parsed, [
-        ['--json', 'json'], ['--junit', 'junit'], ['--markdown', 'markdown'], ['--html', 'html'],
-    ]);
-    const selectedFailPolicies = failPolicies(parsed, 'lookup');
-    return {
-        action: 'lookup',
-        query: parsed.positionalValue('target'),
-        output,
-        deep: parsed.hasOption('--deep'),
-        detail: parsed.hasOption('--summary') ? 'summary' : parsed.hasOption('--verbose') ? 'verbose' : 'standard',
-        strictExit: parsed.hasOption('--strict-exit'),
-        events: parsed.hasOption('--events'),
-        plan: parsed.hasOption('--plan'),
-        includeAttribution: !parsed.hasOption('--no-attribution'),
-        observerLabel: normalizedLabel(parsed, '--observer', 80),
-        vantageLabel: normalizedLabel(parsed, '--vantage', 80),
-        ...terminalOptions(parsed),
-        ...(parsed.hasOption('--browse') ? { browse: true } : {}),
-        ...(parsed.hasOption('--exact-url') ? { exactUrl: true } : {}),
-        ...(parsed.optionValue('--save-lookup') ? { saveLookup: parsed.optionValue('--save-lookup') } : {}),
-        ...(selectedFailPolicies ? { failOn: selectedFailPolicies } : {}),
-    };
-}
-function parseManifestArguments(parsed) {
-    const sources = parsed.positionalValues('artefacts');
-    if (sources.some((source) => !source))
-        throw new CliUsageError(`manifest requires from 1 to ${MAX_INVESTIGATION_MANIFEST_ARTIFACTS} artefact files.`);
-    if (new Set(sources).size !== sources.length)
-        throw new CliUsageError('manifest artefact files must be different.');
-    const configurationDigestSha256 = parsed.optionValue('--configuration-digest');
-    if (configurationDigestSha256 !== null && !/^sha256:[a-f0-9]{64}$/u.test(configurationDigestSha256)) {
-        throw new CliUsageError('--configuration-digest requires a sha256: hexadecimal digest.');
-    }
-    return {
-        action: 'manifest',
-        sources,
-        workflow: parsed.optionValue('--workflow'),
-        configurationDigestSha256,
-        ...(parsed.optionValue('--passphrase-file') ? { passphraseSource: parsed.optionValue('--passphrase-file') } : {}),
-        ...(parsed.hasOption('--package') ? { package: true } : {}),
-        ...(parsed.hasOption('--bagit') ? { bagit: true } : {}),
-        ...(parsed.optionValue('--folder') ? { folder: parsed.optionValue('--folder') } : {}),
-        output: jsonOutput(parsed),
-        ...terminalOptions(parsed),
-    };
-}
-function parseBulkArguments(parsed) {
-    const deep = parsed.hasOption('--deep');
-    const selectedFailPolicies = failPolicies(parsed, 'bulk');
-    const output = parseOutput(parsed, [
-        ['--json', 'json'], ['--jsonl', 'jsonl'], ['--csv', 'csv'], ['--domains', 'domains'],
-        ['--csv-with-metadata', 'csv_metadata'],
-        ['--queries', 'queries'], ['--junit', 'junit'],
-    ]);
-    const filter = parsed.hasOption('--registered-only') ? 'registered'
-        : parsed.hasOption('--inconclusive-only') ? 'inconclusive'
-            : parsed.hasOption('--errors-only') ? 'errors' : 'all';
-    return {
-        action: 'bulk',
-        source: parsed.positionalValue('source'),
-        output,
-        deep,
-        concurrency: parsed.integerOption('--concurrency') ?? (deep ? 2 : 4),
-        checkpoint: parsed.optionValue('--checkpoint'),
-        resume: parsed.hasOption('--resume'),
-        events: parsed.hasOption('--events'),
-        plan: parsed.hasOption('--plan'),
-        filter,
-        ...terminalOptions(parsed),
-        ...(selectedFailPolicies ? { failOn: selectedFailPolicies } : {}),
-    };
-}
-function discoveryValues(parsed) {
-    const familyText = parsed.optionValue('--families');
-    return {
-        preset: (familyText ? 'custom' : parsed.optionValue('--preset') ?? 'all'),
-        keyboardLayout: (parsed.optionValue('--keyboard') ?? 'qwerty'),
-        tldText: parsed.optionValue('--tlds'),
-        dictionarySource: parsed.optionValue('--dictionary'),
-        familyText,
-    };
-}
-function parseDiscoverArguments(parsed) {
-    return {
-        action: 'discover',
-        seed: parsed.positionalValue('subject'),
-        output: parseOutput(parsed, [['--json', 'json'], ['--jsonl', 'jsonl'], ['--domains', 'domains']]),
-        ...discoveryValues(parsed),
-        snapshotSource: parsed.optionValue('--snapshot'),
-        ...terminalOptions(parsed),
-    };
-}
-function parseDiscoverScanArguments(parsed) {
-    const deep = parsed.hasOption('--deep');
-    const selectedFailPolicies = failPolicies(parsed, 'discover-scan');
-    const filter = parsed.hasOption('--registered-only') ? 'registered'
-        : parsed.hasOption('--inconclusive-only') ? 'inconclusive'
-            : parsed.hasOption('--acquisition-only') ? 'acquisition'
-                : parsed.hasOption('--suppressed-only') ? 'suppressed' : 'all';
-    return {
-        action: 'discover-scan',
-        seed: parsed.positionalValue('subject'),
-        output: parseOutput(parsed, [['--json', 'json'], ['--jsonl', 'jsonl'], ['--csv', 'csv'], ['--csv-with-metadata', 'csv_metadata'], ['--domains', 'domains']]),
-        ...discoveryValues(parsed),
-        deep,
-        scanLimit: parsed.integerOption('--scan-limit') ?? Math.min(100, deep ? 50 : 500),
-        chunkSize: parsed.integerOption('--chunk-size') ?? 25,
-        concurrency: parsed.integerOption('--concurrency') ?? (deep ? 2 : 4),
-        checkpoint: parsed.optionValue('--checkpoint'),
-        resume: parsed.hasOption('--resume'),
-        resolverText: parsed.optionValue('--resolver'),
-        observationSnapshot: parsed.optionValue('--observation-snapshot'),
-        allowlistSource: parsed.optionValue('--allowlist'),
-        filter,
-        events: parsed.hasOption('--events'),
-        plan: parsed.hasOption('--plan'),
-        ...terminalOptions(parsed),
-        ...(selectedFailPolicies ? { failOn: selectedFailPolicies } : {}),
-    };
-}
-function parsePostureArguments(parsed) {
-    const mailProfile = parsed.optionValue('--mail-profile') ?? 'standard';
-    return {
-        action: 'posture',
-        domain: parsed.positionalValue('domain'),
-        output: parseOutput(parsed, [['--json', 'json'], ['--sarif', 'sarif']]),
-        selectorText: parsed.optionValue('--selectors'),
-        retiredSelectorText: parsed.optionValue('--retired-selectors'),
-        mailProfile: mailProfile === 'defensive-no-mail' ? 'defensive_no_mail' : mailProfile,
-        ownedDomain: parsed.hasOption('--owned-domain'),
-        ...(parsed.hasOption('--include-inherited-dns') ? { includeInheritedDns: true } : {}),
-        ...terminalOptions(parsed),
-    };
-}
-function parseDnssecValidateArguments(parsed) {
-    return {
-        action: 'dnssec-validate',
-        target: parsed.positionalValue('domain'),
-        resolver: parsed.optionValue('--resolver'),
-        trustAnchorSource: parsed.optionValue('--trust-anchor'),
-        ownedOrAuthorized: true,
-        output: jsonOutput(parsed),
-        ...terminalOptions(parsed),
-    };
-}
-function parseMailTransportArguments(parsed) {
-    return {
-        action: 'mail-transport',
-        source: parsed.positionalValue('source'),
-        resolver: parsed.optionValue('--resolver'),
-        trustAnchorSource: parsed.optionValue('--trust-anchor'),
-        ownedOrAuthorized: true,
-        activeProbeAcknowledged: true,
-        output: jsonOutput(parsed),
-        ...terminalOptions(parsed),
-    };
-}
-function parseTwoFileComparisonArguments(parsed, command) {
-    const sources = parsed.positionalValues('sources');
-    if (sources[0] === sources[1])
-        throw new CliUsageError(`${command} requires two different input files.`);
-    return { leftSource: sources[0], rightSource: sources[1], output: jsonOutput(parsed), ...terminalOptions(parsed) };
-}
-function parseVerifyArtifactArguments(parsed) {
-    if (parsed.hasOption('--folder') && parsed.positionalValue('source'))
-        throw new CliUsageError('--folder selects its own input; do not also supply a file or stdin marker.');
-    return {
-        action: 'verify-artifact',
-        source: parsed.positionalValue('source'),
-        passphraseSource: parsed.optionValue('--passphrase-file'),
-        manifestSource: parsed.optionValue('--manifest'),
-        manifestEntryId: parsed.optionValue('--manifest-entry'),
-        ...(parsed.hasOption('--package') ? { package: true } : {}),
-        ...(parsed.hasOption('--bagit') ? { bagit: true } : {}),
-        ...(parsed.optionValue('--folder') ? { folder: parsed.optionValue('--folder') } : {}),
-        output: jsonOutput(parsed),
-        strictExit: parsed.hasOption('--strict-exit'),
-        ...terminalOptions(parsed),
-    };
-}
-function parseMonitorOnceArguments(parsed) {
-    const selectedFailPolicies = failPolicies(parsed, 'monitor-once');
-    return {
-        action: 'monitor-once',
-        source: parsed.positionalValue('source'),
-        previousSource: parsed.optionValue('--previous'),
-        output: parseOutput(parsed, [['--json', 'json'], ['--junit', 'junit']]),
-        limit: parsed.integerOption('--limit') ?? 20,
-        concurrency: parsed.integerOption('--concurrency') ?? 2,
-        ...terminalOptions(parsed),
-        ...(selectedFailPolicies ? { failOn: selectedFailPolicies } : {}),
-    };
-}
-function parseSharingReviewArguments(parsed) {
-    const purpose = parsed.optionValue('--purpose').replace(/\s+/gu, ' ').trim();
-    if (!purpose || purpose.length > 200)
-        throw new CliUsageError('--purpose is limited to 200 characters.');
-    return {
-        action: 'sharing-review',
-        source: parsed.positionalValue('source'),
-        output: jsonOutput(parsed),
-        marking: parsed.optionValue('--marking'),
-        recipientScope: parsed.optionValue('--recipient-scope'),
-        purpose,
-        humanReviewed: parsed.hasOption('--human-reviewed'),
-        personalDataReviewed: parsed.hasOption('--personal-data-reviewed'),
-        redactionsConfirmed: parsed.hasOption('--redactions-confirmed'),
-        ...terminalOptions(parsed),
-    };
-}
-function parseWorkflowPlanArguments(parsed) {
-    const options = { output: jsonOutput(parsed), ...terminalOptions(parsed) };
-    if (parsed.hasOption('--list')) {
-        if (parsed.allPositionals.length > 0)
-            throw new CliUsageError('workflow-plan discovery options do not accept a subject.');
-        return { action: 'workflow-plan', discovery: 'list', ...options };
-    }
-    if (parsed.hasOption('--explain')) {
-        if (parsed.allPositionals.length > 0)
-            throw new CliUsageError('workflow-plan discovery options do not accept a subject.');
-        return { action: 'workflow-plan', discovery: 'explain', recipe: parsed.optionValue('--explain'), ...options };
-    }
-    if (parsed.allPositionals.length !== 2) {
-        throw new CliUsageError('workflow-plan requires one fixed recipe and one subject, --list, or --explain <recipe>.');
-    }
-    return {
-        action: 'workflow-plan',
-        recipe: parsed.positionalValue('recipe'),
-        subject: parsed.positionalValue('subject'),
-        ...options,
-    };
-}
-function parseWorkflowRunArguments(parsed) {
-    const artifactBindings = parsed.optionValues('--use-artifact').map((value) => {
-        const match = /^([a-z0-9]+(?:-[a-z0-9]+)*):([1-9][0-9]?)=([a-z0-9]+(?:-[a-z0-9]+)*)$/u.exec(value);
-        if (!match)
-            throw new CliUsageError('--use-artifact requires <step-id>:<input-number>=<earlier-step-id>.');
-        return Object.freeze({ stepId: match[1], input: Number(match[2]), sourceStepId: match[3] });
-    });
-    const selections = parsed.optionValues('--select').map((value) => {
-        const separator = value.indexOf('=');
-        const stepId = separator === -1 ? '' : value.slice(0, separator);
-        const selection = separator === -1 ? '' : value.slice(separator + 1);
-        if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(stepId) || !selection.trim()) {
-            throw new CliUsageError('--select requires <step-id>=<path-or-value>.');
-        }
-        if (selection.startsWith('-')) {
-            throw new CliUsageError('--select values cannot start with a hyphen; prefix a file path with ./ when needed.');
-        }
-        return Object.freeze({ stepId, value: selection });
-    });
-    return {
-        action: 'workflow-run',
-        recipe: parsed.positionalValue('recipe'),
-        subject: parsed.positionalValue('subject'),
-        resumeSource: parsed.optionValue('--resume'),
-        selections: Object.freeze(selections),
-        artifactBindings: Object.freeze(artifactBindings),
-        confirmedReviews: Object.freeze(parsed.optionValues('--confirm-review')),
-        approveNetwork: parsed.hasOption('--approve-network'),
-        interactive: parsed.hasOption('--interactive'),
-        output: jsonOutput(parsed),
-        ...terminalOptions(parsed),
-    };
-}
-function parseDiffArguments(parsed) {
-    const compared = parseTwoFileComparisonArguments(parsed, 'diff');
-    const leftSessionId = parsed.optionValue('--left-session');
-    const rightSessionId = parsed.optionValue('--right-session');
-    for (const [option, value] of [['--left-session', leftSessionId], ['--right-session', rightSessionId]]) {
-        if (value !== null && !/^[A-Za-z0-9_-]{1,128}$/u.test(value)) {
-            throw new CliUsageError(`${option} requires one bounded saved-session ID.`);
-        }
-    }
-    return { action: 'diff', ...compared, leftSessionId, rightSessionId };
-}
-function uniqueSources(parsed, command) {
-    const sources = parsed.positionalValues('sources');
-    if (new Set(sources).size !== sources.length)
-        throw new CliUsageError(`${command} input files must be different.`);
-    return sources;
-}
-function parseCaseArguments(parsed) {
-    const operation = parsed.positionalValue('operation');
-    const source = parsed.positionalValue('source');
-    const domain = parsed.optionValue('--domain');
-    const caseId = parsed.optionValue('--case-id');
-    const title = parsed.optionValue('--title');
-    const newIncident = parsed.hasOption('--new-incident');
-    const text = parsed.optionValue('--text');
-    const noteSource = parsed.optionValue('--note-file');
-    const inputSource = parsed.optionValue('--input');
-    const expectedFileDigest = parsed.optionValue('--expect-file-digest');
-    if (source === '-' || inputSource === '-' || noteSource === '-')
-        throw new CliUsageError('Case operations require selected files, not stdin.');
-    if (operation !== 'open' && !source)
-        throw new CliUsageError(`${operation} requires a Case file.`);
-    if (operation !== 'show' && !parsed.hasOption('--output'))
-        throw new CliUsageError('Case mutations require --output; nothing was changed.');
-    if (operation === 'open' && !domain)
-        throw new CliUsageError('case open requires --domain.');
-    if (operation !== 'open' && (title || newIncident))
-        throw new CliUsageError('--title and --new-incident belong to case open.');
-    if (newIncident && (!title || caseId))
-        throw new CliUsageError('--new-incident requires a distinguishing --title and cannot select an existing --case-id.');
-    if (operation === 'note' ? (text === null && !noteSource) : (text !== null || noteSource !== null)) {
-        throw new CliUsageError('Only case note accepts and requires --text or --note-file.');
-    }
-    if (['pin', 'assess', 'recheck'].includes(operation) ? !inputSource : inputSource !== null) {
-        throw new CliUsageError('Only case pin, assess and recheck accept and require --input.');
-    }
-    if (expectedFileDigest !== null && (!source || !/^sha256:[a-f0-9]{64}$/u.test(expectedFileDigest))) {
-        throw new CliUsageError('--expect-file-digest requires a source file and sha256:<64 lowercase hexadecimal characters>.');
-    }
-    return { action: 'case', operation, source, caseId, domain, title, newIncident, text, noteSource, inputSource, expectedFileDigest, output: jsonOutput(parsed), ...terminalOptions(parsed) };
-}
-const CLI_PARSERS = Object.freeze({
-    completion: (parsed) => ({ action: 'completion', shell: parsed.positionalValue('shell') }),
-    doctor: (parsed) => ({ action: 'doctor', network: parsed.hasOption('--network'), output: jsonOutput(parsed), ...terminalOptions(parsed) }),
-    commands: (parsed) => ({
-        action: 'commands', output: jsonOutput(parsed), common: parsed.hasOption('--common'),
-        group: parsed.optionValue('--group'),
-        mode: parsed.optionValue('--mode'),
-        ...terminalOptions(parsed),
-    }),
-    manual: () => ({ action: 'manual' }),
-    manifest: parseManifestArguments,
-    'map-observations': (parsed) => singleInputAction('map-observations', parsed),
-    'oam-export': (parsed) => singleInputAction('oam-export', parsed),
-    lookup: parseLookupArguments,
-    bulk: parseBulkArguments,
-    'ct-search': (parsed) => singleInputAction('ct-search', parsed, 'keyword'),
-    'ct-intake': (parsed) => singleInputAction('ct-intake', parsed),
-    discover: parseDiscoverArguments,
-    'discover-scan': parseDiscoverScanArguments,
-    posture: parsePostureArguments,
-    http: (parsed) => singleInputAction('http', parsed, 'domain'),
-    tls: (parsed) => singleInputAction('tls', parsed, 'hostname'),
-    'dnssec-validate': parseDnssecValidateArguments,
-    'mail-transport': parseMailTransportArguments,
-    'registry-support': (parsed) => ({
-        action: 'registry-support', target: parsed.positionalValue('domain-or-suffix'),
-        output: jsonOutput(parsed), ...terminalOptions(parsed),
-    }),
-    'registry-doctor': (parsed) => singleInputAction('registry-doctor', parsed),
-    'registry-cohort': (parsed) => singleInputAction('registry-cohort', parsed),
-    'registry-scaffold': (parsed) => ({
-        action: 'registry-scaffold', profile: parsed.optionValue('--profile'), suffix: parsed.optionValue('--suffix'),
-        scenario: parsed.optionValue('--scenario'),
-    }),
-    'risk-calibrate': (parsed) => ({
-        action: 'risk-calibrate', source: parsed.positionalValue('source'),
-        output: parsed.hasOption('--json') ? 'json' : parsed.hasOption('--summary-json') ? 'summary_json' : 'terminal',
-        ...terminalOptions(parsed),
-    }),
-    'lookalike-calibrate': (parsed) => singleInputAction('lookalike-calibrate', parsed),
-    'verify-artifact': parseVerifyArtifactArguments,
-    'interchange-report': (parsed) => ({
-        action: 'interchange-report', source: parsed.positionalValue('source'),
-        passphraseSource: parsed.optionValue('--passphrase-file'), output: jsonOutput(parsed), ...terminalOptions(parsed),
-    }),
-    'inspect-archive': parseInspectArchiveArguments,
-    'sign-artifact': parseSignArtifactArguments,
-    'verify-signature': parseVerifySignatureArguments,
-    'source-report': (parsed) => singleInputAction('source-report', parsed),
-    compare: (parsed) => singleInputAction('compare', parsed),
-    'page-compare': (parsed) => ({ action: 'page-compare', ...parseTwoFileComparisonArguments(parsed, 'page-compare') }),
-    'mail-review': (parsed) => singleInputAction('mail-review', parsed),
-    'mail-headers': (parsed) => singleInputAction('mail-headers', parsed),
-    'review-evidence': (parsed) => ({
-        action: 'review-evidence', source: parsed.positionalValue('source'), mmdbSource: parsed.optionValue('--mmdb'),
-        output: jsonOutput(parsed), strictExit: parsed.hasOption('--strict-exit'), ...terminalOptions(parsed),
-    }),
-    brief: (parsed) => singleInputAction('brief', parsed),
-    case: parseCaseArguments,
-    'case-pack': (parsed) => ({
-        action: 'case-pack', source: parsed.positionalValue('source'), output: jsonOutput(parsed),
-        audience: parsed.optionValue('--audience'), reviewed: true, ...terminalOptions(parsed),
-    }),
-    'domain-control': (parsed) => singleInputAction('domain-control', parsed),
-    'monitor-once': parseMonitorOnceArguments,
-    assurance: (parsed) => singleInputAction('assurance', parsed),
-    'change-packet': (parsed) => singleInputAction('change-packet', parsed),
-    'sharing-review': parseSharingReviewArguments,
-    'workflow-plan': parseWorkflowPlanArguments,
-    'workflow-run': parseWorkflowRunArguments,
-    diff: parseDiffArguments,
-    reconcile: (parsed) => ({ action: 'reconcile', sources: uniqueSources(parsed, 'reconcile'), output: jsonOutput(parsed), ...terminalOptions(parsed) }),
-    timeline: (parsed) => ({ action: 'timeline', sources: uniqueSources(parsed, 'timeline'), output: jsonOutput(parsed), ...terminalOptions(parsed) }),
-    export: (parsed) => ({
-        action: 'export', source: parsed.positionalValue('source'),
-        format: parsed.hasOption('--markdown') ? 'markdown' : parsed.hasOption('--html') ? 'html' : 'json',
-        compact: parsed.hasOption('--compact'), includeAttribution: !parsed.hasOption('--no-attribution'),
-    }),
-});
 function parseCliArguments(rawArgv) {
     if (!Array.isArray(rawArgv) || rawArgv.length > MAX_CLI_ARGUMENTS) {
         throw new CliUsageError(`At most ${MAX_CLI_ARGUMENTS} command arguments are supported.`);