@slicedearth/whoisleuth-cli 2.3.0 → 2.4.0

package/cli/runner.mjs

@@ -50,7 +50,7 @@ function usageEventReason(error) {
         return 'missing_input';
     return 'invalid_input';
 }
-async function runParsedCli(args, dependencies = {}) {
+async function runParsedCli(args, dependencies = {}, writeBinaryOutput) {
     const stdout = dependencies.stdout || process.stdout;
     const stderr = dependencies.stderr || process.stderr;
     const environment = dependencies.environment || process.env;
@@ -128,6 +128,7 @@ async function runParsedCli(args, dependencies = {}) {
             terminal,
             presentation: (color) => terminalPresentation(stdout, color, environment, palette),
             writeStdout: (value) => write(stdout, value),
+            ...(writeBinaryOutput ? { writeBinaryOutput } : {}),
             writeStderr: (value) => write(stderr, value),
             readSingleInput,
             readInput,
@@ -305,15 +306,58 @@ async function runCliCommand(argv, dependencies = {}) {
     }
     if (!args.destination)
         return runParsedCli(args, dependencies);
-    const buffered = createBufferedOutput();
-    const code = await runParsedCli(args, { ...dependencies, stdout: buffered.stream });
-    if (code !== EXIT_CODES.SUCCESS && code !== EXIT_CODES.PARTIAL_FAILURE)
-        return code;
+    const buffered = createBufferedOutput({ binary: args.action === 'manifest' && args.package === true });
+    let checkpoint = null;
+    let capturedSource = null;
     try {
-        await writePrivateFile(args.destination, buffered.value(), { force: args.force === true });
+        if (args.action === 'workflow-run') {
+            const { prepareInvestigationCheckpoint } = await import("./investigation-checkpoint.mjs");
+            const workflowCheckpoint = await prepareInvestigationCheckpoint({
+                destination: args.destination, resumeSource: args.resumeSource, force: args.force === true,
+                ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+            });
+            checkpoint = workflowCheckpoint;
+            capturedSource = workflowCheckpoint.resumeInput;
+        }
+        else if (args.action === 'case') {
+            const { prepareLocalDocumentWrite } = await import("./local-document-checkpoint.mjs");
+            const { MAX_EDITABLE_CASE_INPUT_BYTES, MAX_EDITABLE_CASE_OUTPUT_BYTES } = await import("../packages/contracts/case-portability.mjs");
+            const caseCheckpoint = await prepareLocalDocumentWrite({
+                destination: args.destination, source: args.source, force: args.force === true, label: 'Case',
+                allowSourceReplacement: args.operation !== 'show',
+                maximumInputBytes: MAX_EDITABLE_CASE_INPUT_BYTES, maximumOutputBytes: MAX_EDITABLE_CASE_OUTPUT_BYTES,
+                ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+            });
+            checkpoint = caseCheckpoint;
+            capturedSource = caseCheckpoint.sourceInput;
+        }
+        const code = await runParsedCli(args, {
+            ...dependencies, stdout: buffered.stream,
+            ...(args.action === 'workflow-run' && args.resumeSource && capturedSource !== null
+                ? { workflowResumeInput: capturedSource }
+                : {}),
+            ...(args.action === 'case' && capturedSource !== null ? { caseFileInput: capturedSource } : {}),
+        }, buffered.writeBinary);
+        if (code !== EXIT_CODES.SUCCESS && code !== EXIT_CODES.PARTIAL_FAILURE)
+            return code;
+        const content = buffered.value();
+        if (checkpoint) {
+            if (typeof content !== 'string')
+                throw new TypeError('Local document output must be text.');
+            await checkpoint.publish(content);
+        }
+        else
+            await writePrivateFile(args.destination, content, {
+                force: args.force === true,
+                beforePublish: async () => { dependencies.signal?.throwIfAborted(); },
+            });
         return code;
     }
     catch (error) {
+        if (isCancellation(error, dependencies.signal)) {
+            write(stderr, 'Cancelled by analyst.\n');
+            return EXIT_CODES.CANCELLED;
+        }
         if (error instanceof CliUsageError) {
             write(stderr, `Usage error: ${boundedCliErrorMessage(error, 'Output file could not be written')}\n`);
             return EXIT_CODES.USAGE;
@@ -321,6 +365,11 @@ async function runCliCommand(argv, dependencies = {}) {
         write(stderr, `Output failed: ${boundedCliErrorMessage(error, 'Output file could not be written')}\n`);
         return EXIT_CODES.LOOKUP_FAILED;
     }
+    finally {
+        if (checkpoint && await checkpoint.release() > 0) {
+            write(stderr, `${args.action === 'case' ? 'Case' : 'Workflow'} cleanup warning: File ownership changed or a lease could not be removed. Inspect the selected directory before resuming.\n`);
+        }
+    }
 }
 async function runCli(argv, dependencies = {}) {
     const stderr = dependencies.stderr || process.stderr;

package/cli/sharing-review.mjs

@@ -1,8 +1,7 @@
-import { hasVerifiedWholeArtifactIntegrity, UnsupportedOfflineArtifactError, verifyOfflineArtifact, } from "./artifact-verify.mjs";
-import { scanBoundedJson } from "../lib/bounded-json.mjs";
+import { hasVerifiedWholeArtifactIntegrity, MAX_OFFLINE_ARTIFACT_BYTES, parseOfflineArtifactJson, UnsupportedOfflineArtifactError, verifyOfflineArtifact, } from "./artifact-verify.mjs";
 const SHARING_REVIEW_SCHEMA = 'whoisleuth.cli.sharing-review';
 const SHARING_REVIEW_VERSION = 2;
-const MAX_SHARING_REVIEW_BYTES = 15 * 1024 * 1024;
+const MAX_SHARING_REVIEW_BYTES = MAX_OFFLINE_ARTIFACT_BYTES;
 const TLP_MARKINGS = ['clear', 'green', 'amber', 'amber-strict', 'red'];
 const RECIPIENT_SCOPES = ['public', 'community', 'organization', 'named-recipients'];
 const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
@@ -31,46 +30,37 @@ function markingFromText(value) {
     return TLP_MARKINGS.includes(normalized) ? normalized : null;
 }
 function scanArtifact(root) {
-    const stack = [{ value: root, depth: 0, key: null }];
+    // The caller has already enforced the JSON byte, node, nesting and container
+    // bounds. Scan that admitted tree in full without a second, smaller prefix.
+    const stack = [{ value: root, marking: false }];
     const markings = new Set();
     let riskyKeyCount = 0;
-    let visited = 0;
-    let truncated = false;
-    while (stack.length && visited < 20_000) {
+    while (stack.length) {
         const next = stack.pop();
-        visited += 1;
-        if (next.key && RISKY_KEYS.has(normalizedKey(next.key)))
-            riskyKeyCount += 1;
         if (typeof next.value === 'string') {
-            const marking = markingFromText(next.value);
-            if (marking && (next.key === null || MARKING_KEYS.has(normalizedKey(next.key))))
-                markings.add(marking);
-            continue;
-        }
-        if (next.depth >= 12) {
-            if (next.value && typeof next.value === 'object')
-                truncated = true;
+            if (next.marking) {
+                const marking = markingFromText(next.value);
+                if (marking)
+                    markings.add(marking);
+            }
             continue;
         }
         if (Array.isArray(next.value)) {
-            for (const item of next.value.slice(0, 500))
-                stack.push({ value: item, depth: next.depth + 1, key: next.key });
-            if (next.value.length > 500)
-                truncated = true;
+            for (const value of next.value)
+                stack.push({ value, marking: next.marking });
             continue;
         }
         const valueRecord = record(next.value);
         if (!valueRecord)
             continue;
-        const entries = Object.entries(valueRecord);
-        for (const [key, value] of entries.slice(0, 500))
-            stack.push({ value, depth: next.depth + 1, key });
-        if (entries.length > 500)
-            truncated = true;
+        for (const [key, value] of Object.entries(valueRecord)) {
+            const normalized = normalizedKey(key);
+            if (RISKY_KEYS.has(normalized))
+                riskyKeyCount += 1;
+            stack.push({ value, marking: MARKING_KEYS.has(normalized) });
+        }
     }
-    if (stack.length)
-        truncated = true;
-    return { importedMarkings: [...markings], riskyKeyCount, truncated };
+    return { importedMarkings: [...markings], riskyKeyCount };
 }
 function expectedScope(marking) {
     if (marking === 'clear')
@@ -90,8 +80,7 @@ async function buildSharingReview(raw, options, generatedAt = new Date().toISOSt
     }
     let artifactValue;
     try {
-        scanBoundedJson(raw);
-        artifactValue = JSON.parse(raw);
+        artifactValue = parseOfflineArtifactJson(raw);
     }
     catch {
         throw new TypeError('Sharing review input must be valid bounded JSON without duplicate keys.');
@@ -147,8 +136,6 @@ async function buildSharingReview(raw, options, generatedAt = new Date().toISOSt
     add('recipient-scope', options.recipientScope === expectedScope(effective) ? 'pass' : 'block', 'Recipient scope', options.recipientScope === expectedScope(effective)
         ? `The recipient scope matches the effective ${tlpLabel(effective)} sharing boundary.`
         : `${tlpLabel(effective)} requires the ${expectedScope(effective)} recipient scope in this local policy.`);
-    if (scan.truncated)
-        add('scan-bounds', 'caution', 'Bounded content scan', 'The defensive key and marking scan reached a traversal bound; review the artefact manually.');
     const counts = {
         block: findings.filter((finding) => finding.state === 'block').length,
         caution: findings.filter((finding) => finding.state === 'caution').length,

package/cli/signer-trust.mjs

@@ -0,0 +1,104 @@
+import { createHash } from 'node:crypto';
+import { parseBoundedJsonObject } from "./bounded-json.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
+import { formatEvidenceSignatureVerification } from "./evidence-signing.mjs";
+export const SIGNER_TRUST_STORE_SCHEMA = 'whoisleuth.evidence-signer-trust-store';
+export const SIGNER_TRUST_STORE_VERSION = 1;
+export const SIGNER_TRUST_REPORT_SCHEMA = 'whoisleuth.evidence-signer-trust-report';
+export const SIGNER_TRUST_REPORT_VERSION = 1;
+export const MAX_SIGNER_TRUST_STORE_BYTES = 4 * 1024 * 1024;
+export const MAX_SIGNER_TRUST_ENTRIES = 1_024;
+export const MAX_SIGNER_TRUST_LABEL_LENGTH = 160;
+export const MAX_SIGNER_TRUST_NOTE_LENGTH = 2_048;
+const FINGERPRINT = /^[a-f0-9]{64}$/u;
+const UNSAFE_TEXT = /[\x00-\x1f\x7f-\x9f\u2028\u2029]|\p{Default_Ignorable_Code_Point}/u;
+const PRIVATE_KEY_HEADER = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----/u;
+function object(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
+}
+function text(value, maximum, label, allowEmpty = false) {
+    if (typeof value !== 'string' || value.length > maximum || (!allowEmpty && !value.trim()) || UNSAFE_TEXT.test(value) || PRIVATE_KEY_HEADER.test(value)) {
+        throw new TypeError(`Signer trust ${label} must be single-line text of at most ${maximum} characters without hidden controls.`);
+    }
+    return value;
+}
+export function parseSignerTrustStore(raw) {
+    const value = parseBoundedJsonObject(raw, { label: 'Signer trust store', maximumBytes: MAX_SIGNER_TRUST_STORE_BYTES });
+    if (value.schema !== SIGNER_TRUST_STORE_SCHEMA || value.version !== SIGNER_TRUST_STORE_VERSION
+        || Object.keys(value).some((key) => !['schema', 'version', 'entries'].includes(key))
+        || !Array.isArray(value.entries) || value.entries.length > MAX_SIGNER_TRUST_ENTRIES) {
+        throw new TypeError(`Signer trust store must use ${SIGNER_TRUST_STORE_SCHEMA} version ${SIGNER_TRUST_STORE_VERSION} with at most ${MAX_SIGNER_TRUST_ENTRIES} entries.`);
+    }
+    const seen = new Set();
+    const entries = value.entries.map((candidate) => {
+        const entry = object(candidate);
+        if (!entry || Object.keys(entry).some((key) => !['keyIdSha256', 'label', 'status', 'updatedAt', 'note', 'successorKeyIdSha256'].includes(key))
+            || typeof entry.keyIdSha256 !== 'string' || !FINGERPRINT.test(entry.keyIdSha256)
+            || typeof entry.status !== 'string' || !['trusted', 'retired', 'revoked'].includes(entry.status)) {
+            throw new TypeError('Signer trust entry requires a SHA-256 key fingerprint and trusted, retired or revoked status.');
+        }
+        if (seen.has(entry.keyIdSha256))
+            throw new TypeError('Signer trust store contains duplicate key fingerprints.');
+        seen.add(entry.keyIdSha256);
+        const updatedAt = normalizeExplicitIsoTimestamp(entry.updatedAt);
+        if (!updatedAt)
+            throw new TypeError('Signer trust entry updatedAt requires a valid timestamp with an explicit timezone.');
+        const successor = entry.successorKeyIdSha256 ?? null;
+        if (successor !== null && (typeof successor !== 'string' || !FINGERPRINT.test(successor) || successor === entry.keyIdSha256)) {
+            throw new TypeError('Signer trust successor must be a different SHA-256 fingerprint or null.');
+        }
+        return Object.freeze({
+            keyIdSha256: entry.keyIdSha256,
+            label: text(entry.label, MAX_SIGNER_TRUST_LABEL_LENGTH, 'label'),
+            status: entry.status,
+            updatedAt,
+            note: text(entry.note === undefined ? '' : entry.note, MAX_SIGNER_TRUST_NOTE_LENGTH, 'note', true),
+            successorKeyIdSha256: successor,
+        });
+    });
+    return Object.freeze({ schema: SIGNER_TRUST_STORE_SCHEMA, version: SIGNER_TRUST_STORE_VERSION, entries: Object.freeze(entries) });
+}
+export function assessEvidenceSignerTrust(verification, trustStoreRaw, checkedAt = new Date().toISOString()) {
+    const now = normalizeExplicitIsoTimestamp(checkedAt);
+    if (!now)
+        throw new TypeError('Signer trust evaluation requires a valid timestamp with an explicit timezone.');
+    const store = parseSignerTrustStore(trustStoreRaw);
+    const entry = store.entries.find((candidate) => candidate.keyIdSha256 === verification.signature.keyIdSha256) ?? null;
+    // Signing time is self-asserted. It cannot bypass the current revocation policy,
+    // and a successor reference never makes another fingerprint trusted.
+    const state = !entry ? 'unknown' : entry.status !== 'trusted' ? entry.status
+        : Date.parse(entry.updatedAt) > Date.parse(now) ? 'review_required' : 'trusted';
+    return Object.freeze({
+        schema: SIGNER_TRUST_REPORT_SCHEMA,
+        version: SIGNER_TRUST_REPORT_VERSION,
+        state: state === 'trusted' ? 'trusted' : 'not_trusted',
+        checkedAt: now,
+        verification,
+        trust: Object.freeze({ state, storeDigestSha256: createHash('sha256').update(trustStoreRaw, 'utf8').digest('hex'), entry }),
+        limitations: Object.freeze([
+            'Trust is the current policy in the explicitly selected local file. Obtain fingerprints and revocation updates through an authenticated channel; this command does not discover or refresh them.',
+            'A label or successor reference does not authenticate a person, organisation or replacement key. A trusted fingerprint does not establish evidence accuracy, authority or collection time.',
+            'Signing time is supplied by the signer, not a trusted timestamp. Retired and revoked fingerprints remain untrusted regardless of that time.',
+            'The report includes only the matching entry and a SHA-256 digest of the exact trust-file bytes, not the file path, other entries or key files. Do not put sensitive material in labels or notes.',
+        ]),
+    });
+}
+export function formatSignerTrustReport(report) {
+    const entry = report.trust.entry;
+    return [
+        `WHOISleuth signer trust: ${report.trust.state}`,
+        `Checked: ${report.checkedAt}`,
+        `Trust-file SHA-256: ${report.trust.storeDigestSha256}`,
+        ...(entry ? [
+            `Local label: ${entry.label}`,
+            `Entry reviewed: ${entry.updatedAt}`,
+            ...(entry.note ? [`Local note: ${entry.note}`] : []),
+            ...(entry.successorKeyIdSha256 ? [`Successor reference: sha256:${entry.successorKeyIdSha256} (not a trust grant)`] : []),
+        ] : ['No matching fingerprint in the selected trust file.']),
+        '',
+        'Signature checks (separate from current trust policy)',
+        formatEvidenceSignatureVerification(report.verification, false).trimEnd(),
+        ...report.limitations.map((limitation) => `Trust limitation: ${limitation}`),
+        '',
+    ].join('\n');
+}

package/cli/source-reliability.mjs

@@ -1,35 +1,23 @@
 import { Buffer } from 'node:buffer';
 import { canonicalArtifactJson } from "../packages/evidence/artifact-integrity.mjs";
 import { scanBoundedJson } from "../lib/bounded-json.mjs";
+import { LOOKUP_SOURCE_STATES, lookupDiagnosticStates } from "../lib/lookup-diagnostics.mjs";
 import { normalizeExplicitIsoTimestamp, normalizeLegacyIsoTimestamp, } from "../packages/evidence/observation.mjs";
 import { CLI_LOOKUP_SCHEMA, MAX_CLI_LOOKUP_BYTES, } from "../packages/contracts/cli-lookup.mjs";
 import { normalizeCliLookupDocument } from "./saved-lookup.mjs";
+import { CLI_BULK_SCHEMA, CLI_BULK_ITEM_SCHEMA, CLI_BULK_SCHEMA_VERSION } from "./formatters/json.mjs";
+import { LOOKUP_THREAT_INTELLIGENCE_PROVIDERS } from "../lib/lookup-threat-provider-inventory.mjs";
+import { MAX_THREAT_INTELLIGENCE_PROVIDERS } from "../lib/lookup-response-contract.mjs";
+import { THREAT_INTELLIGENCE_SCHEMA, THREAT_INTELLIGENCE_CONTRACT_VERSION } from "../lib/threat-intelligence-types.mjs";
 export const SOURCE_RELIABILITY_REPORT_SCHEMA = 'whoisleuth.source-reliability-report';
 export const SOURCE_RELIABILITY_REPORT_VERSION = 1;
 export const MAX_SOURCE_RELIABILITY_INPUT_BYTES = 12 * 1024 * 1024;
 export const MAX_SOURCE_RELIABILITY_DOCUMENTS = 100;
 export const MAX_SOURCE_RELIABILITY_SOURCES = 64;
-export const MAX_SOURCE_RELIABILITY_TRAVERSAL_NODES = 25_000;
 const SOURCE_RE = /^[a-z][a-z0-9_-]{0,39}$/u;
-const STATES = new Set([
-    'success',
-    'partial',
-    'not_found',
-    'skipped',
-    'error',
-    'unsupported',
-    'not_applicable',
-    'unavailable',
-    'rate_limited',
-    'complete',
-    'disabled',
-    'stale',
-]);
-const LOOKUP_SCHEMAS = new Set([
-    CLI_LOOKUP_SCHEMA,
-    'whoisleuth.cli.bulk',
-    'whoisleuth.cli.bulk.item',
-]);
+const STATES = new Set(LOOKUP_SOURCE_STATES);
+const BULK_HEALTH_VERSIONS = new Set([1, 2, CLI_BULK_SCHEMA_VERSION]);
+const PROVIDER_IDS = new Set(LOOKUP_THREAT_INTELLIGENCE_PROVIDERS.map((provider) => provider.id));
 const REPORT_KEYS = new Set([
     'schema',
     'version',
@@ -175,9 +163,9 @@ function parseLookupDocuments(values) {
                 throw new TypeError('Source reliability input requires a supported bounded CLI Lookup document.');
             }
         }
-        const supported = document.version === 1;
-        if (!LOOKUP_SCHEMAS.has(schema) || !supported) {
-            throw new TypeError('Source reliability input requires CLI Lookup version 1 or 2, version 1 Bulk or Bulk-item documents, or only source reliability reports.');
+        if ((schema !== CLI_BULK_SCHEMA && schema !== CLI_BULK_ITEM_SCHEMA)
+            || typeof document.version !== 'number' || !BULK_HEALTH_VERSIONS.has(document.version)) {
+            throw new TypeError('Source reliability input requires supported CLI Lookup, Bulk or Bulk-item documents, or only source reliability reports.');
         }
         return document;
     });
@@ -232,35 +220,21 @@ function collectTiming(document, store) {
     }
 }
 function collectDiagnostics(document, store) {
-    const diagnostics = record(document.diagnostics);
-    if (!diagnostics)
-        return;
-    const fixed = [
-        ['rdap', record(diagnostics.rdap)?.status],
-        ['registrar_rdap', record(record(diagnostics.rdap)?.registrar)?.status],
-        ['whois', record(diagnostics.whois)?.status],
-        ['availability', record(diagnostics.availability)?.status],
-        ['reverse_dns', record(diagnostics.reverseDns)?.status],
-        ['network_context', record(diagnostics.network)?.status],
-        ['security_txt', record(diagnostics.securityTxt)?.status],
-        ['sslbl', record(diagnostics.sslbl)?.status],
-    ];
-    for (const [source, value] of fixed) {
-        const state = safeState(value);
+    for (const [source, state] of Object.entries(lookupDiagnosticStates(document.diagnostics))) {
         if (state)
             addState(store, source, state);
     }
 }
-function collectObservation(value, store) {
-    if (value.version !== 1
+function collectObservation(raw, source, store) {
+    const value = record(raw);
+    if (!value || value.version !== 1 || value.source !== source
         || typeof value.observedAt !== 'string'
         || typeof value.complete !== 'boolean'
         || typeof value.truncated !== 'boolean'
         || !Array.isArray(value.limitations))
         return;
-    const source = safeSource(value.source);
     const state = safeState(value.status);
-    if (!source || !state)
+    if (!state)
         return;
     const item = accumulator(store, source);
     item.observationSamples += 1;
@@ -271,48 +245,65 @@ function collectObservation(value, store) {
     if (value.truncated === true)
         item.truncated += 1;
 }
-function traverse(document, store) {
-    let visited = 0;
-    const stack = [{ value: document, depth: 0 }];
-    while (stack.length) {
-        const current = stack.pop();
-        if (!current)
+function collectLookupHealth(document, store) {
+    collectDiagnostics(document, store);
+    collectTiming(document, store);
+    const availability = record(document.availability);
+    const dns = record(availability?.dns);
+    const technology = record(availability?.technologyProfile);
+    // Only collector-owned envelopes have health semantics. Raw publications,
+    // parsed registration extensions and nested provider findings remain opaque.
+    const observations = [
+        ['dns', dns], ['dns', dns?.caaPolicy], ['dns_delegation', dns?.delegation],
+        ['http', availability?.http], ['tls', availability?.tls],
+        ['html', availability?.pageIdentity],
+    ];
+    const fullLookup = document.schema === CLI_LOOKUP_SCHEMA;
+    if (fullLookup)
+        observations.push(['html', availability?.credentialSurfaceProfile], ['html', availability?.structuredDataIdentity], ['derived', technology], ['derived', technology?.browserLibraryProfile], ['derived', availability?.pageRoleProfile], ['derived', availability?.clientBehaviorProfile], ['derived', availability?.securityPosture], ['reverse_dns', document.reverseDns], ['ip_rdap', document.networkContext], ['security_txt', document.securityTxt], ['sslbl', document.sslbl]);
+    for (const [source, observation] of observations)
+        collectObservation(observation, source, store);
+    if (!fullLookup)
+        return;
+    const providers = record(document.threatIntelligence)?.providers;
+    if (providers === undefined)
+        return;
+    if (!Array.isArray(providers) || providers.length > MAX_THREAT_INTELLIGENCE_PROVIDERS) {
+        throw new TypeError(`Source reliability input exceeds the ${MAX_THREAT_INTELLIGENCE_PROVIDERS}-provider health boundary.`);
+    }
+    const seen = new Set();
+    for (const rawProvider of providers) {
+        const provider = record(rawProvider);
+        const source = record(provider?.provider)?.id;
+        if (provider?.schema !== THREAT_INTELLIGENCE_SCHEMA || provider.version !== THREAT_INTELLIGENCE_CONTRACT_VERSION
+            || typeof source !== 'string' || !PROVIDER_IDS.has(source)
+            || record(provider.observation)?.source !== source)
             continue;
-        if (current.depth > 12) {
-            throw new TypeError('Source reliability input exceeds the 12-level traversal limit.');
-        }
-        if (visited >= MAX_SOURCE_RELIABILITY_TRAVERSAL_NODES) {
-            throw new TypeError(`Source reliability input exceeds the ${MAX_SOURCE_RELIABILITY_TRAVERSAL_NODES}-node traversal limit.`);
-        }
-        visited += 1;
-        const object = record(current.value);
-        if (object) {
-            collectDiagnostics(object, store);
-            collectTiming(object, store);
-            collectObservation(object, store);
-            if (object.state === 'rate_limited') {
-                const source = safeSource(record(object.observation)?.source);
-                if (source)
-                    addState(store, source, 'rate_limited');
-            }
-            const children = Object.values(object);
-            if (children.length > 200) {
-                throw new TypeError('Source reliability input contains an object with more than 200 fields.');
-            }
-            for (const child of children) {
-                if (child && typeof child === 'object')
-                    stack.push({ value: child, depth: current.depth + 1 });
-            }
-        }
-        else if (Array.isArray(current.value)) {
-            if (current.value.length > 1_000) {
-                throw new TypeError('Source reliability input contains an array with more than 1000 items.');
-            }
-            for (const child of current.value) {
-                if (child && typeof child === 'object')
-                    stack.push({ value: child, depth: current.depth + 1 });
-            }
+        if (seen.has(source))
+            throw new TypeError('Source reliability input contains duplicate provider health identities.');
+        seen.add(source);
+        collectObservation(provider?.observation, source, store);
+        if (provider?.state === 'rate_limited')
+            addState(store, source, 'rate_limited');
+    }
+}
+function collectDocumentHealth(document, store) {
+    if (document.schema === CLI_LOOKUP_SCHEMA) {
+        collectLookupHealth(document, store);
+        return;
+    }
+    const items = document.schema === CLI_BULK_SCHEMA ? document.results : [document];
+    if (!Array.isArray(items) || items.length > 1_000) {
+        throw new TypeError('Source reliability Bulk input requires at most 1000 result items.');
+    }
+    for (const rawItem of items) {
+        const item = record(rawItem);
+        if (!item || item.schema !== CLI_BULK_ITEM_SCHEMA || item.version !== document.version
+            || typeof item.ok !== 'boolean') {
+            throw new TypeError('Source reliability Bulk input contains an invalid result envelope.');
         }
+        if (item.ok)
+            collectLookupHealth(item, store);
     }
 }
 function percentile(sorted, ratio) {
@@ -663,7 +654,7 @@ export function buildSourceReliabilityReport(raw, generatedAt = new Date().toISO
             const sampleDate = lookupDocumentTimestamp(document);
             if (sampleDate)
                 sampleDates.push(sampleDate);
-            traverse(document, store);
+            collectDocumentHealth(document, store);
         }
     }
     sampleDates.sort();