@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/cli/command-definition.mjs

@@ -0,0 +1,330 @@
+import { INVESTIGATION_PLAN_RECIPES } from "./investigation-recipes.mjs";
+import { WHOISLEUTH_SOURCE_REPOSITORY_URL } from "../packages/analysis/project-metadata.mjs";
+import { LOOKUP_EVIDENCE_SCHEMA_VERSION, SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS, V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION } from "../packages/contracts/lookup-evidence.mjs";
+import { SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS, WORKSPACE_ARCHIVE_VERSION } from "../packages/contracts/case-portability.mjs";
+import {} from "../packages/contracts/cli-command-semantics.mjs";
+import { CLI_FAIL_POLICIES_BY_COMMAND } from "./fail-policy.mjs";
+import { MAX_INVESTIGATION_MANIFEST_ARTIFACTS } from "../packages/investigation/investigation-manifest.mjs";
+import { IDENTITY_ACTIONS } from "../packages/contracts/message-intake.mjs";
+import { bulkQueryLimit, bulkConcurrencyLimit } from "../lib/bulk-limits.mjs";
+const LEGACY_WORKSPACE_ARCHIVE_VERSIONS = SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS
+    .filter((version) => version !== WORKSPACE_ARCHIVE_VERSION);
+const LEGACY_WORKSPACE_ARCHIVE_DESCRIPTION = LEGACY_WORKSPACE_ARCHIVE_VERSIONS
+    .map((version) => `version-${version}`)
+    .join(' and ');
+const PUBLISHED_V2_LOOKUP_EVIDENCE_VERSIONS = SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS
+    .filter((version) => version > V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION && version !== LOOKUP_EVIDENCE_SCHEMA_VERSION)
+    .join(', ');
+const LEGACY_WORKSPACE_ARCHIVE_SCOPE = LEGACY_WORKSPACE_ARCHIVE_VERSIONS
+    .map((version) => `v${version}`)
+    .join(' and ');
+const INLINE_COMMAND_FAMILIES = ['support', 'review', 'assurance', 'workflow', 'history'];
+const CLI_CASE_OPERATIONS = ['show', 'open', 'note', 'pin', 'link', 'withdraw-link', 'assess', 'recheck', 'incident-link', 'action', 'action-event', 'recheck-question', 'close-object'];
+const CLI_INDICATOR_OPERATIONS = ['revise', 'inspect', 'stix', 'misp'];
+const CLI_META_ACTIONS = Object.freeze([
+    Object.freeze({
+        id: 'help',
+        aliases: Object.freeze(['--help', '-h']),
+        scope: 'root_or_command',
+        precedence: 'before_command_grammar',
+        bypassesOrdinaryRequirements: true,
+        acceptsAdditionalArguments: false,
+    }),
+    Object.freeze({
+        id: 'version',
+        aliases: Object.freeze(['--version', '-V']),
+        scope: 'root_only',
+        precedence: 'before_command_grammar',
+        bypassesOrdinaryRequirements: true,
+        acceptsAdditionalArguments: false,
+    }),
+]);
+const CLI_META_ACTION_BY_ID = Object.freeze(Object.fromEntries(CLI_META_ACTIONS.map((action) => [action.id, action])));
+// Human-facing command reference kept separate from command execution so
+// additions do not expand the already broad runtime controller.
+const HELP_INTRO = `WHOISleuth CLI
+Domain investigation from your terminal.
+
+Quick start:
+  whoisleuth
+  whoisleuth example.test
+  whoisleuth lookup example.test --deep
+  cat domains.txt | whoisleuth bulk --jsonl
+`;
+const HELP_FOOTER = `
+Run "whoisleuth <command> --help" for focused usage and an example.
+With no arguments, an eligible interactive terminal opens a bounded launcher;
+redirected or unsupported terminals continue to print this help. No request
+starts until a Lookup plan is shown and the analyst confirms collection.
+Use --json or --jsonl where supported for machine-readable stdout.
+Use --output <file> for atomic private file output and --force to replace it.
+Use -- before positional filenames that begin with a hyphen; ./ also makes a
+filename unambiguous, for example: whoisleuth verify-artifact -- ./-evidence.json.
+Use --palette auto, light, or dark after the command to select a fixed terminal
+colour palette; --no-color, NO_COLOR, and redirected output still suppress ANSI.
+Use --config <file> and --profile <name> for explicit versioned safe defaults.
+Registry scaffold is the exception: its --profile selects a fixture capability
+profile and --config is rejected, so bootstrap defaults cannot alter fixtures.
+An ICANN-recognised public domain, reserved documentation domain, IP, or ASN
+may replace "lookup"; URL-like or ambiguous input requires the explicit
+command. Both forms use the same Lookup options.
+Diagnostics are written to stderr. Fast lookup is the default; deep collection
+must be requested explicitly and can disclose a target to additional sources.
+
+Copyright 2026 slicedearth. Licensed under AGPL-3.0-only.
+Source and licence: ${WHOISLEUTH_SOURCE_REPOSITORY_URL}
+`;
+const COMMON_OPTIONS = Object.freeze([
+    '--help', '--output', '--force', '--config', '--profile', '--palette',
+]);
+const REGISTRY_SCAFFOLD_COMMON_OPTIONS = Object.freeze(COMMON_OPTIONS.filter((option) => option !== '--config' && option !== '--profile'));
+function commonOptionsForSeed(seed) {
+    return seed.bootstrapProfile === 'command_owned' ? REGISTRY_SCAFFOLD_COMMON_OPTIONS : COMMON_OPTIONS;
+}
+function positional(name, valueKind, minimum, maximum, values = [], inputSource = 'argv', requiredWhenOptions = []) {
+    return Object.freeze({
+        name,
+        valueKind,
+        minimum,
+        maximum,
+        values: Object.freeze([...values]),
+        inputSource,
+        requiredWhenOptions: Object.freeze([...requiredWhenOptions]),
+    });
+}
+const NO_POSITIONALS = Object.freeze([]);
+const OPTIONAL_FILE_POSITIONAL = Object.freeze([positional('source', 'file', 0, 1, [], 'argv_or_stdin')]);
+const OPTIONAL_TEXT_POSITIONAL = Object.freeze([positional('subject', 'text', 0, 1, [], 'argv_or_stdin')]);
+const NO_INTEGER_RANGES = () => Object.freeze([]);
+const BASE_INTEGER_RANGE = (minimum, maximum) => (Object.freeze({ minimum, maximum, whenOptionPresent: null }));
+const DEEP_INTEGER_RANGE = (minimum, maximum) => (Object.freeze({ minimum, maximum, whenOptionPresent: '--deep' }));
+function optionDefinition(valueKind, description, options = {}) {
+    const configuredValues = options.values;
+    const configuredDefault = options.defaultValue;
+    return Object.freeze({
+        description: typeof description === 'function' ? description : () => description,
+        defaultValue: typeof configuredDefault === 'function' ? configuredDefault : () => configuredDefault ?? null,
+        valueKind: typeof valueKind === 'function' ? valueKind : () => valueKind,
+        values: typeof configuredValues === 'function'
+            ? configuredValues
+            : () => Object.freeze([...(configuredValues ?? [])]),
+        occurrence: options.occurrence ?? 'once',
+        acceptsOptionLikeValue: options.acceptsOptionLikeValue ?? false,
+        metaAction: options.metaAction ?? null,
+        integerRanges: options.integerRanges ?? NO_INTEGER_RANGES,
+    });
+}
+const flag = (description, occurrence = 'once') => optionDefinition('flag', description, { occurrence });
+const file = (description) => optionDefinition('file', description);
+const text = (description, acceptsOptionLikeValue = false) => optionDefinition('text', description, { acceptsOptionLikeValue });
+const enumeration = (description, values, defaultValue) => optionDefinition('enum', description, { values, ...(defaultValue === undefined ? {} : { defaultValue }) });
+const integer = (description, ranges, defaultValue) => (optionDefinition('integer', description, { integerRanges: ranges, defaultValue }));
+const CLI_OPTION_DEFINITIONS = Object.freeze({
+    '--help': optionDefinition('flag', 'Show command usage, options and an example without executing it.', { metaAction: 'help' }),
+    '--output': file('Write output atomically to this local file.'),
+    '--force': flag('Allow replacement of the selected output file.'),
+    '--config': file('Load explicit versioned CLI configuration from this file.'),
+    '--profile': text('Select a named profile from the supplied configuration.', true),
+    '--palette': enumeration('Choose the terminal colour palette; redirected output and no-colour settings still take precedence.', ['auto', 'light', 'dark']),
+    '--network': flag('Include the optional public DNS and port 43 runtime checks.'),
+    '--json': flag('Write structured JSON to stdout or the selected output file.'),
+    '--reported-action': optionDefinition('enum', 'Record an analyst-reported identity action; repeat for separate actions.', { values: IDENTITY_ACTIONS.map(action => action.id), occurrence: 'repeatable' }),
+    '--trusted-auth-header': optionDefinition('text', 'Select a recognised receiver header by part:header-index. This records analyst trust, not independent authentication; repeat for separate headers.', { occurrence: 'repeatable' }),
+    '--intake-context': optionDefinition('file', 'Read one selected version-1 distribution declaration or version-2 digest-bound phone/destination selection file. Declarations remain attributed claims.'),
+    '--package': flag('Verify a portable evidence ZIP or encrypted package rather than a single report.'),
+    '--folder': file('Verify the evidence package within this selected folder.'),
+    '--quiet': flag('Suppress ordinary terminal presentation.', 'idempotent'),
+    '--no-color': flag('Suppress ANSI colour in terminal output.', 'idempotent'),
+    '--common': flag('Show only commands marked as common.'),
+    '--group': enumeration('Filter commands by task group.', ['investigate', 'respond', 'assure', 'utilities']),
+    '--mode': enumeration('Filter commands by offline or network collection mode.', ['offline', 'network']),
+    '--workflow': text('Label the workflow recorded in the evidence manifest.', true),
+    '--configuration-digest': text('Record a supplied configuration digest in the manifest provenance.', true),
+    '--junit': flag('Write JUnit XML for automated result reporting.'),
+    '--markdown': flag('Write a Markdown report.'),
+    '--html': flag('Write an HTML report.'),
+    '--no-attribution': flag('Omit the optional product attribution from presentation output.'),
+    '--fast': flag('Select registration-first Fast collection.'),
+    '--deep': flag('Select broader Deep collection and its additional source requests.'),
+    '--exact-url': flag('With Deep Lookup, send the selected URL path and query to the website; omit its fragment.'),
+    '--observer': text('Attach the supplied observer label to the retained observation.'),
+    '--vantage': text('Attach the supplied collection-vantage label.'),
+    '--plan': flag('Describe intended collection and limits without making requests.'),
+    '--summary': flag('Show a concise terminal result.'),
+    '--verbose': flag('Show the detailed terminal result.'),
+    '--browse': flag('Open the interactive terminal evidence browser.'),
+    '--interactive': flag('Prompt for missing supported inputs on an interactive terminal.'),
+    '--save-lookup': file('After a normal evidence-browser close, save the completed private Lookup JSON to a new file.'),
+    '--strict-exit': flag('Use the command’s strict outcome policy when deciding the exit status.'),
+    '--fail-on': optionDefinition('policy_list', 'Return a failure-policy exit status for the selected comma-separated outcomes.', {
+        values: (command) => CLI_FAIL_POLICIES_BY_COMMAND[command] ?? [],
+    }),
+    '--events': flag('Emit collection progress events on stderr.'),
+    '--jsonl': flag('Write one JSON record per line.'),
+    '--csv': flag('Write compact CSV rows.'),
+    '--csv-with-metadata': flag('Write CSV with source, observation-time and collection-state metadata.'),
+    '--domains': flag('Write the selected domain names only.'),
+    '--queries': flag('Write the selected original queries only.'),
+    '--registered-only': flag('Keep registered results in the presented output.'),
+    '--inconclusive-only': flag('Keep inconclusive results in the presented output.'),
+    '--errors-only': flag('Keep error results in the presented output.'),
+    // Higher ceilings do not automatically increase the default collection load.
+    '--concurrency': integer('Set the maximum number of concurrent collection tasks.', () => Object.freeze([
+        BASE_INTEGER_RANGE(1, bulkConcurrencyLimit('fast')),
+        DEEP_INTEGER_RANGE(1, bulkConcurrencyLimit('deep')),
+    ]), (_command, deep) => Math.min(deep ? 2 : 4, bulkConcurrencyLimit(deep ? 'deep' : 'fast'))),
+    '--checkpoint': file('Save resumable collection state to this local file.'),
+    '--resume': flag('Resume collection from the selected checkpoint.'),
+    '--tlds': text('Use this comma-separated set of domain endings.', true),
+    '--preset': enumeration('Choose candidate-generation families; explicit families select a custom set instead.', ['common', 'impersonation', 'all'], 'all'),
+    '--families': text('Select the candidate-generation families explicitly.'),
+    '--keyboard': enumeration('Choose keyboard layouts for adjacent-key candidates.', ['qwerty', 'azerty', 'qwertz', 'all'], 'qwerty'),
+    '--dictionary': file('Read candidate words from this local dictionary.'),
+    '--snapshot': file('Use this retained observation snapshot.'),
+    '--scan-limit': integer('Limit the number of generated candidates to collect.', () => Object.freeze([
+        BASE_INTEGER_RANGE(1, bulkQueryLimit('fast')),
+        DEEP_INTEGER_RANGE(1, bulkQueryLimit('deep')),
+    ]), (_command, deep) => Math.min(deep ? 50 : 100, bulkQueryLimit(deep ? 'deep' : 'fast'))),
+    '--chunk-size': integer('Set the number of candidates processed per checkpoint chunk.', () => Object.freeze([BASE_INTEGER_RANGE(1, 100)]), () => 25),
+    '--resolver': text('Choose the supported DNS resolver for collection.'),
+    '--allowlist': file('Read reviewed domains whose priority should be suppressed, without changing their evidence.'),
+    '--observation-snapshot': file('Compare with this retained observation snapshot.'),
+    '--acquisition-only': flag('Present only acquisition candidates.'),
+    '--suppressed-only': flag('Present only candidates suppressed by the allowlist.'),
+    '--selectors': text('Supply explicit DKIM selectors; no selector enumeration is performed.', true),
+    '--retired-selectors': text('Supply previously retired DKIM selectors for review.', true),
+    '--mail-profile': enumeration('Choose the expected mail posture for the review.', ['standard', 'defensive-no-mail', 'parked'], 'standard'),
+    '--sarif': flag('Write the posture review as SARIF.'),
+    '--owned-domain': flag('Declare that the reviewed domain is owned by the analyst.'),
+    '--include-inherited-dns': flag('Explicitly review inherited DMARC, reporting boundaries and parent-delegation evidence.'),
+    '--trust-anchor': file('Read the analyst-selected DNSSEC trust anchor.'),
+    '--owned-or-authorized': flag('Acknowledge ownership or permission for this active collection.'),
+    '--active-probe': flag('Explicitly enable the bounded active protocol exchange.'),
+    '--suffix': text('Select the registry suffix.', true),
+    '--scenario': enumeration('Choose the expected registry fixture outcome.', ['registered', 'not_found', 'inconclusive']),
+    '--summary-json': flag('Write the concise structured summary.'),
+    '--passphrase-file': file('Read the archive passphrase from a local file, not a command-line value.'),
+    '--manifest': file('Use the selected investigation manifest.'),
+    '--bagit': flag('Verify the selected package as BagIt 1.0.'),
+    '--manifest-entry': enumeration('Select an artefact entry from the supplied manifest.', Array.from({ length: MAX_INVESTIGATION_MANIFEST_ARTIFACTS }, (_, index) => `artifact-${index + 1}`)),
+    '--search': text('Search the selected local archive.'),
+    '--require-match': flag('Require the local archive search to find a match.'),
+    '--reveal': flag('Include retained values otherwise redacted by archive inspection.'),
+    '--expect-content-digest': text('Compare archive content with the supplied version-qualified or historical digest.', true),
+    '--private-key-file': file('Read the private signing key from this local file.'),
+    '--public-key-file': file('Read the public verification key from this local file.'),
+    '--trust-store-file': file('Read the analyst-selected signer trust store.'),
+    '--mmdb': file('Read one selected local MMDB (up to 512 MiB); version-2 queries require a justified freshness policy.'),
+    '--audience': enumeration('Choose the export audience and its field-disclosure policy.', ['internal', 'trusted', 'public']),
+    '--reviewed': flag('Confirm the required human review of the exported material.'),
+    '--previous': file('Compare against this earlier retained report.'),
+    '--limit': integer('Limit the number of watchlist targets checked in this run.', () => Object.freeze([BASE_INTEGER_RANGE(1, 20)]), () => 20),
+    '--marking': enumeration('Declare the information-sharing marking.', ['clear', 'green', 'amber', 'amber-strict', 'red']),
+    '--recipient-scope': enumeration('Declare the intended recipient scope.', ['public', 'community', 'organization', 'named-recipients']),
+    '--purpose': text('Record the purpose of the intended sharing.'),
+    '--human-reviewed': flag('Confirm that a person reviewed the material.', 'idempotent'),
+    '--personal-data-reviewed': flag('Confirm that personal-data disclosure was reviewed.', 'idempotent'),
+    '--redactions-confirmed': flag('Confirm that the intended redactions were checked.', 'idempotent'),
+    '--list': flag('List available workflow recipes.'),
+    '--explain': enumeration('Explain a selected workflow without executing it.', INVESTIGATION_PLAN_RECIPES),
+    '--select': optionDefinition('text', 'Bind a literal input to a workflow step; repeat for further inputs.', { occurrence: 'repeatable', acceptsOptionLikeValue: true }),
+    '--use-artifact': optionDefinition('text', 'Connect a step input to an earlier compatible output.', { occurrence: 'repeatable' }),
+    '--confirm-review': optionDefinition('text', 'Confirm human review for the named step in this invocation.', { occurrence: 'repeatable' }),
+    '--approve-network': flag('Approve the workflow’s declared network steps for this invocation.'),
+    '--preview': flag('Inspect validated retained outputs, unresolved inputs and remaining approvals without executing or writing a checkpoint.'),
+    '--left-session': text('Select the left-hand retained capture session.', true),
+    '--right-session': text('Select the right-hand retained capture session.', true),
+    '--compact': flag('Write a compact report presentation.'),
+    '--case-id': text('Select the retained Case identifier.'),
+    '--domain': text('Supply the Case domain.'),
+    '--title': text('Supply the Case title.'),
+    '--new-incident': flag('Create a separate incident instead of updating a matching Case.'),
+    '--text': text('Supply the note text directly.'),
+    '--note-file': file('Read note text from a selected local file.'),
+    '--input': file('Read the selected local input file.'),
+    '--expect-file-digest': text('Require the input file to match this SHA-256 digest.'),
+});
+function constraint(value) {
+    if (value.kind === 'mutually_exclusive') {
+        return Object.freeze({ ...value, options: Object.freeze([...value.options]) });
+    }
+    if (value.kind === 'required') {
+        return Object.freeze({ ...value, options: Object.freeze([...value.options]) });
+    }
+    if (value.kind === 'excludes_all' || value.kind === 'value_excludes') {
+        return Object.freeze({ ...value, excludedOptions: Object.freeze([...value.excludedOptions]) });
+    }
+    return Object.freeze({ ...value, requiredOptions: Object.freeze([...value.requiredOptions]) });
+}
+const EMPTY_CONSTRAINTS = Object.freeze([]);
+const FILE_OUTPUT_CONSTRAINTS = Object.freeze([
+    constraint({ kind: 'requires_all', option: '--force', requiredOptions: ['--output'] }),
+]);
+const QUIET_OUTPUT_CONSTRAINT = constraint({
+    kind: 'mutually_exclusive',
+    options: ['--quiet', '--output'],
+});
+const PRESENTATION_OPTIONS = Object.freeze([
+    ['--json', 'JSON', 'json'], ['--jsonl', 'JSON Lines', 'jsonl'], ['--junit', 'JUnit XML', 'junit'],
+    ['--csv', 'CSV', 'csv'],
+    ['--csv-with-metadata', 'CSV with evidence metadata', 'csv_metadata'],
+    ['--domains', 'domain list', 'domains'], ['--queries', 'query list', 'queries'],
+    ['--markdown', 'Markdown', 'markdown'], ['--html', 'HTML', 'html'], ['--sarif', 'SARIF', 'sarif'],
+    ['--summary-json', 'summary JSON', 'summary_json'],
+]);
+const MACHINE_OUTPUT_OPTIONS = Object.freeze(PRESENTATION_OPTIONS.map(([option]) => option));
+function optionSpec(command, option, scope, definition = CLI_OPTION_DEFINITIONS[option]) {
+    const valueKind = definition.valueKind(command);
+    const values = definition.values(command);
+    return Object.freeze({
+        option,
+        scope,
+        arity: valueKind === 'flag' ? 0 : 1,
+        valueKind,
+        values: Object.freeze([...values]),
+        integerRanges: Object.freeze([...definition.integerRanges(command)]),
+        occurrence: definition.occurrence,
+        acceptsOptionLikeValue: definition.acceptsOptionLikeValue,
+        metaAction: definition.metaAction,
+    });
+}
+function grammarConstraints(commandOptions, commandConstraints) {
+    const machineOutputOptions = commandOptions.filter((option) => MACHINE_OUTPUT_OPTIONS.includes(option));
+    return Object.freeze([
+        ...FILE_OUTPUT_CONSTRAINTS,
+        ...(commandOptions.includes('--quiet') ? [QUIET_OUTPUT_CONSTRAINT] : []),
+        ...(commandOptions.includes('--quiet') && machineOutputOptions.length > 0
+            ? [constraint({ kind: 'excludes_all', option: '--quiet', excludedOptions: machineOutputOptions })]
+            : []),
+        ...(commandOptions.includes('--events')
+            ? [constraint({ kind: 'mutually_exclusive', options: ['--events', '--output'] })]
+            : []),
+        ...(commandOptions.includes('--browse')
+            ? [constraint({ kind: 'mutually_exclusive', options: ['--browse', '--output'] })]
+            : []),
+        ...commandConstraints,
+    ]);
+}
+function commandSeed(seed) {
+    const admitted = new Set([...seed.options, ...commonOptionsForSeed(seed)]);
+    for (const option of Object.keys(seed.optionOverrides ?? {})) {
+        if (!admitted.has(option))
+            throw new TypeError(`Cannot override an undeclared command option: ${option}.`);
+    }
+    return Object.freeze({
+        ...seed,
+        reference: Object.freeze({ ...seed.reference }),
+        collection: Object.freeze({
+            mode: seed.networkEffect === 'offline' ? 'offline' : 'network',
+            scope: seed.collection.scope,
+        }),
+        options: Object.freeze([...seed.options]),
+        ...(seed.optionOverrides ? { optionOverrides: Object.freeze({ ...seed.optionOverrides }) } : {}),
+        positionals: Object.freeze([...seed.positionals]),
+        constraints: Object.freeze([...seed.constraints]),
+        schemaIdentifiers: Object.freeze([...seed.schemaIdentifiers]),
+        primaryArtefacts: Object.freeze([...seed.primaryArtefacts]),
+        additionalOutputFormats: Object.freeze([...seed.additionalOutputFormats]),
+    });
+}
+export { LEGACY_WORKSPACE_ARCHIVE_VERSIONS, LEGACY_WORKSPACE_ARCHIVE_DESCRIPTION, PUBLISHED_V2_LOOKUP_EVIDENCE_VERSIONS, LEGACY_WORKSPACE_ARCHIVE_SCOPE, INLINE_COMMAND_FAMILIES, CLI_CASE_OPERATIONS, CLI_INDICATOR_OPERATIONS, CLI_META_ACTIONS, CLI_META_ACTION_BY_ID, HELP_INTRO, HELP_FOOTER, COMMON_OPTIONS, REGISTRY_SCAFFOLD_COMMON_OPTIONS, commonOptionsForSeed, positional, NO_POSITIONALS, OPTIONAL_FILE_POSITIONAL, OPTIONAL_TEXT_POSITIONAL, NO_INTEGER_RANGES, BASE_INTEGER_RANGE, DEEP_INTEGER_RANGE, optionDefinition, flag, file, text, enumeration, integer, CLI_OPTION_DEFINITIONS, constraint, EMPTY_CONSTRAINTS, FILE_OUTPUT_CONSTRAINTS, QUIET_OUTPUT_CONSTRAINT, PRESENTATION_OPTIONS, MACHINE_OUTPUT_OPTIONS, optionSpec, grammarConstraints, commandSeed };