@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/cli/sharing-review.mjs

@@ -1,97 +1,25 @@
-import { hasVerifiedWholeArtifactIntegrity, UnsupportedOfflineArtifactError, verifyOfflineArtifact, } from "./artifact-verify.mjs";
-import { scanBoundedJson } from "../lib/bounded-json.mjs";
+import { hasVerifiedWholeArtifactIntegrity, MAX_OFFLINE_ARTIFACT_BYTES, parseOfflineArtifactJson, UnsupportedOfflineArtifactError, verifyOfflineArtifact, } from "./artifact-verify.mjs";
+import { TLP_MARKINGS, RECIPIENT_SCOPES, expectedScope, tlpLabel, scanSharingMetadata as scanArtifact } from "../packages/interchange/sharing-policy.mjs";
 const SHARING_REVIEW_SCHEMA = 'whoisleuth.cli.sharing-review';
 const SHARING_REVIEW_VERSION = 2;
-const MAX_SHARING_REVIEW_BYTES = 15 * 1024 * 1024;
-const TLP_MARKINGS = ['clear', 'green', 'amber', 'amber-strict', 'red'];
-const RECIPIENT_SCOPES = ['public', 'community', 'organization', 'named-recipients'];
+const MAX_SHARING_REVIEW_BYTES = MAX_OFFLINE_ARTIFACT_BYTES;
 const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
-const RISKY_KEYS = new Set([
-    'authorization', 'cookie', 'cookies', 'credential', 'credentials', 'email', 'emails',
-    'entities', 'password', 'phone', 'raw', 'rawrdap', 'rawwhois', 'registrant', 'session', 'token',
-]);
-const MARKING_KEYS = new Set([
-    'informationmarking', 'marking', 'markings', 'sharingmarking',
-    'tlp', 'tlplabel', 'tlpmarking', 'trafficlightprotocol',
-]);
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
 }
-function normalizedKey(value) {
-    return value.toLowerCase().replace(/[^a-z0-9]/gu, '');
-}
 function boundedMetadataText(value) {
     if (typeof value !== 'string' || value.length > 120 || CONTROL_RE.test(value))
         return null;
     const trimmed = value.trim();
     return trimmed || null;
 }
-function markingFromText(value) {
-    const normalized = value.toUpperCase().replace(/\s+/gu, '').replace('TLP:', '').replace('+STRICT', '-STRICT').toLowerCase();
-    return TLP_MARKINGS.includes(normalized) ? normalized : null;
-}
-function scanArtifact(root) {
-    const stack = [{ value: root, depth: 0, key: null }];
-    const markings = new Set();
-    let riskyKeyCount = 0;
-    let visited = 0;
-    let truncated = false;
-    while (stack.length && visited < 20_000) {
-        const next = stack.pop();
-        visited += 1;
-        if (next.key && RISKY_KEYS.has(normalizedKey(next.key)))
-            riskyKeyCount += 1;
-        if (typeof next.value === 'string') {
-            const marking = markingFromText(next.value);
-            if (marking && (next.key === null || MARKING_KEYS.has(normalizedKey(next.key))))
-                markings.add(marking);
-            continue;
-        }
-        if (next.depth >= 12) {
-            if (next.value && typeof next.value === 'object')
-                truncated = true;
-            continue;
-        }
-        if (Array.isArray(next.value)) {
-            for (const item of next.value.slice(0, 500))
-                stack.push({ value: item, depth: next.depth + 1, key: next.key });
-            if (next.value.length > 500)
-                truncated = true;
-            continue;
-        }
-        const valueRecord = record(next.value);
-        if (!valueRecord)
-            continue;
-        const entries = Object.entries(valueRecord);
-        for (const [key, value] of entries.slice(0, 500))
-            stack.push({ value, depth: next.depth + 1, key });
-        if (entries.length > 500)
-            truncated = true;
-    }
-    if (stack.length)
-        truncated = true;
-    return { importedMarkings: [...markings], riskyKeyCount, truncated };
-}
-function expectedScope(marking) {
-    if (marking === 'clear')
-        return 'public';
-    if (marking === 'green')
-        return 'community';
-    if (marking === 'red')
-        return 'named-recipients';
-    return 'organization';
-}
-function tlpLabel(marking) {
-    return `TLP:${marking === 'amber-strict' ? 'AMBER+STRICT' : marking.toUpperCase()}`;
-}
 async function buildSharingReview(raw, options, generatedAt = new Date().toISOString()) {
     if (Buffer.byteLength(raw, 'utf8') > MAX_SHARING_REVIEW_BYTES) {
         throw new TypeError(`Sharing review input is limited to ${MAX_SHARING_REVIEW_BYTES} bytes.`);
     }
     let artifactValue;
     try {
-        scanBoundedJson(raw);
-        artifactValue = JSON.parse(raw);
+        artifactValue = parseOfflineArtifactJson(raw);
     }
     catch {
         throw new TypeError('Sharing review input must be valid bounded JSON without duplicate keys.');
@@ -106,8 +34,10 @@ async function buildSharingReview(raw, options, generatedAt = new Date().toISOSt
     const importedRank = strictestImported === null ? -1 : TLP_MARKINGS.indexOf(strictestImported);
     const effective = importedRank > requestedRank ? strictestImported : options.marking;
     let integrity = 'unsupported';
+    let verifiedIdentity = null;
     try {
         const verification = await verifyOfflineArtifact(raw);
+        verifiedIdentity = verification.artifact;
         integrity = verification.state === 'verified' && hasVerifiedWholeArtifactIntegrity(verification)
             ? 'verified'
             : verification.state === 'integrity_valid'
@@ -147,15 +77,13 @@ async function buildSharingReview(raw, options, generatedAt = new Date().toISOSt
     add('recipient-scope', options.recipientScope === expectedScope(effective) ? 'pass' : 'block', 'Recipient scope', options.recipientScope === expectedScope(effective)
         ? `The recipient scope matches the effective ${tlpLabel(effective)} sharing boundary.`
         : `${tlpLabel(effective)} requires the ${expectedScope(effective)} recipient scope in this local policy.`);
-    if (scan.truncated)
-        add('scan-bounds', 'caution', 'Bounded content scan', 'The defensive key and marking scan reached a traversal bound; review the artefact manually.');
     const counts = {
         block: findings.filter((finding) => finding.state === 'block').length,
         caution: findings.filter((finding) => finding.state === 'caution').length,
         pass: findings.filter((finding) => finding.state === 'pass').length,
     };
-    const artifactSchema = boundedMetadataText(artifact.schema);
-    const rawArtifactVersion = artifact.version ?? artifact.schemaVersion;
+    const artifactSchema = boundedMetadataText(verifiedIdentity ? verifiedIdentity.schema : artifact.schema);
+    const rawArtifactVersion = verifiedIdentity ? verifiedIdentity.version : artifact.version ?? artifact.schemaVersion;
     const artifactVersion = Number.isSafeInteger(rawArtifactVersion)
         && Number(rawArtifactVersion) >= 1
         && Number(rawArtifactVersion) <= 10_000

package/cli/signer-trust.mjs

@@ -0,0 +1,104 @@
+import { createHash } from 'node:crypto';
+import { parseBoundedJsonObject } from "./bounded-json.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
+import { formatEvidenceSignatureVerification } from "./evidence-signing.mjs";
+export const SIGNER_TRUST_STORE_SCHEMA = 'whoisleuth.evidence-signer-trust-store';
+export const SIGNER_TRUST_STORE_VERSION = 1;
+export const SIGNER_TRUST_REPORT_SCHEMA = 'whoisleuth.evidence-signer-trust-report';
+export const SIGNER_TRUST_REPORT_VERSION = 1;
+export const MAX_SIGNER_TRUST_STORE_BYTES = 4 * 1024 * 1024;
+export const MAX_SIGNER_TRUST_ENTRIES = 1_024;
+export const MAX_SIGNER_TRUST_LABEL_LENGTH = 160;
+export const MAX_SIGNER_TRUST_NOTE_LENGTH = 2_048;
+const FINGERPRINT = /^[a-f0-9]{64}$/u;
+const UNSAFE_TEXT = /[\x00-\x1f\x7f-\x9f\u2028\u2029]|\p{Default_Ignorable_Code_Point}/u;
+const PRIVATE_KEY_HEADER = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----/u;
+function object(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
+}
+function text(value, maximum, label, allowEmpty = false) {
+    if (typeof value !== 'string' || value.length > maximum || (!allowEmpty && !value.trim()) || UNSAFE_TEXT.test(value) || PRIVATE_KEY_HEADER.test(value)) {
+        throw new TypeError(`Signer trust ${label} must be single-line text of at most ${maximum} characters without hidden controls.`);
+    }
+    return value;
+}
+export function parseSignerTrustStore(raw) {
+    const value = parseBoundedJsonObject(raw, { label: 'Signer trust store', maximumBytes: MAX_SIGNER_TRUST_STORE_BYTES });
+    if (value.schema !== SIGNER_TRUST_STORE_SCHEMA || value.version !== SIGNER_TRUST_STORE_VERSION
+        || Object.keys(value).some((key) => !['schema', 'version', 'entries'].includes(key))
+        || !Array.isArray(value.entries) || value.entries.length > MAX_SIGNER_TRUST_ENTRIES) {
+        throw new TypeError(`Signer trust store must use ${SIGNER_TRUST_STORE_SCHEMA} version ${SIGNER_TRUST_STORE_VERSION} with at most ${MAX_SIGNER_TRUST_ENTRIES} entries.`);
+    }
+    const seen = new Set();
+    const entries = value.entries.map((candidate) => {
+        const entry = object(candidate);
+        if (!entry || Object.keys(entry).some((key) => !['keyIdSha256', 'label', 'status', 'updatedAt', 'note', 'successorKeyIdSha256'].includes(key))
+            || typeof entry.keyIdSha256 !== 'string' || !FINGERPRINT.test(entry.keyIdSha256)
+            || typeof entry.status !== 'string' || !['trusted', 'retired', 'revoked'].includes(entry.status)) {
+            throw new TypeError('Signer trust entry requires a SHA-256 key fingerprint and trusted, retired or revoked status.');
+        }
+        if (seen.has(entry.keyIdSha256))
+            throw new TypeError('Signer trust store contains duplicate key fingerprints.');
+        seen.add(entry.keyIdSha256);
+        const updatedAt = normalizeExplicitIsoTimestamp(entry.updatedAt);
+        if (!updatedAt)
+            throw new TypeError('Signer trust entry updatedAt requires a valid timestamp with an explicit timezone.');
+        const successor = entry.successorKeyIdSha256 ?? null;
+        if (successor !== null && (typeof successor !== 'string' || !FINGERPRINT.test(successor) || successor === entry.keyIdSha256)) {
+            throw new TypeError('Signer trust successor must be a different SHA-256 fingerprint or null.');
+        }
+        return Object.freeze({
+            keyIdSha256: entry.keyIdSha256,
+            label: text(entry.label, MAX_SIGNER_TRUST_LABEL_LENGTH, 'label'),
+            status: entry.status,
+            updatedAt,
+            note: text(entry.note === undefined ? '' : entry.note, MAX_SIGNER_TRUST_NOTE_LENGTH, 'note', true),
+            successorKeyIdSha256: successor,
+        });
+    });
+    return Object.freeze({ schema: SIGNER_TRUST_STORE_SCHEMA, version: SIGNER_TRUST_STORE_VERSION, entries: Object.freeze(entries) });
+}
+export function assessEvidenceSignerTrust(verification, trustStoreRaw, checkedAt = new Date().toISOString()) {
+    const now = normalizeExplicitIsoTimestamp(checkedAt);
+    if (!now)
+        throw new TypeError('Signer trust evaluation requires a valid timestamp with an explicit timezone.');
+    const store = parseSignerTrustStore(trustStoreRaw);
+    const entry = store.entries.find((candidate) => candidate.keyIdSha256 === verification.signature.keyIdSha256) ?? null;
+    // Signing time is self-asserted. It cannot bypass the current revocation policy,
+    // and a successor reference never makes another fingerprint trusted.
+    const state = !entry ? 'unknown' : entry.status !== 'trusted' ? entry.status
+        : Date.parse(entry.updatedAt) > Date.parse(now) ? 'review_required' : 'trusted';
+    return Object.freeze({
+        schema: SIGNER_TRUST_REPORT_SCHEMA,
+        version: SIGNER_TRUST_REPORT_VERSION,
+        state: state === 'trusted' ? 'trusted' : 'not_trusted',
+        checkedAt: now,
+        verification,
+        trust: Object.freeze({ state, storeDigestSha256: createHash('sha256').update(trustStoreRaw, 'utf8').digest('hex'), entry }),
+        limitations: Object.freeze([
+            'Trust is the current policy in the explicitly selected local file. Obtain fingerprints and revocation updates through an authenticated channel; this command does not discover or refresh them.',
+            'A label or successor reference does not authenticate a person, organisation or replacement key. A trusted fingerprint does not establish evidence accuracy, authority or collection time.',
+            'Signing time is supplied by the signer, not a trusted timestamp. Retired and revoked fingerprints remain untrusted regardless of that time.',
+            'The report includes only the matching entry and a SHA-256 digest of the exact trust-file bytes, not the file path, other entries or key files. Do not put sensitive material in labels or notes.',
+        ]),
+    });
+}
+export function formatSignerTrustReport(report) {
+    const entry = report.trust.entry;
+    return [
+        `WHOISleuth signer trust: ${report.trust.state}`,
+        `Checked: ${report.checkedAt}`,
+        `Trust-file SHA-256: ${report.trust.storeDigestSha256}`,
+        ...(entry ? [
+            `Local label: ${entry.label}`,
+            `Entry reviewed: ${entry.updatedAt}`,
+            ...(entry.note ? [`Local note: ${entry.note}`] : []),
+            ...(entry.successorKeyIdSha256 ? [`Successor reference: sha256:${entry.successorKeyIdSha256} (not a trust grant)`] : []),
+        ] : ['No matching fingerprint in the selected trust file.']),
+        '',
+        'Signature checks (separate from current trust policy)',
+        formatEvidenceSignatureVerification(report.verification, false).trimEnd(),
+        ...report.limitations.map((limitation) => `Trust limitation: ${limitation}`),
+        '',
+    ].join('\n');
+}

package/cli/source-reliability.mjs

@@ -1,35 +1,23 @@
 import { Buffer } from 'node:buffer';
 import { canonicalArtifactJson } from "../packages/evidence/artifact-integrity.mjs";
-import { scanBoundedJson } from "../lib/bounded-json.mjs";
+import { scanBoundedJson } from "../packages/analysis/bounded-json.mjs";
+import { LOOKUP_SOURCE_STATES, lookupDiagnosticStates } from "../lib/lookup-diagnostics.mjs";
 import { normalizeExplicitIsoTimestamp, normalizeLegacyIsoTimestamp, } from "../packages/evidence/observation.mjs";
 import { CLI_LOOKUP_SCHEMA, MAX_CLI_LOOKUP_BYTES, } from "../packages/contracts/cli-lookup.mjs";
 import { normalizeCliLookupDocument } from "./saved-lookup.mjs";
+import { CLI_BULK_SCHEMA, CLI_BULK_ITEM_SCHEMA, CLI_BULK_SCHEMA_VERSION } from "./formatters/json.mjs";
+import { LOOKUP_THREAT_INTELLIGENCE_PROVIDERS } from "../lib/lookup-threat-provider-inventory.mjs";
+import { MAX_THREAT_INTELLIGENCE_PROVIDERS } from "../lib/lookup-response-contract.mjs";
+import { THREAT_INTELLIGENCE_SCHEMA, THREAT_INTELLIGENCE_CONTRACT_VERSION } from "../packages/analysis/threat-intelligence-types.mjs";
 export const SOURCE_RELIABILITY_REPORT_SCHEMA = 'whoisleuth.source-reliability-report';
 export const SOURCE_RELIABILITY_REPORT_VERSION = 1;
 export const MAX_SOURCE_RELIABILITY_INPUT_BYTES = 12 * 1024 * 1024;
 export const MAX_SOURCE_RELIABILITY_DOCUMENTS = 100;
 export const MAX_SOURCE_RELIABILITY_SOURCES = 64;
-export const MAX_SOURCE_RELIABILITY_TRAVERSAL_NODES = 25_000;
 const SOURCE_RE = /^[a-z][a-z0-9_-]{0,39}$/u;
-const STATES = new Set([
-    'success',
-    'partial',
-    'not_found',
-    'skipped',
-    'error',
-    'unsupported',
-    'not_applicable',
-    'unavailable',
-    'rate_limited',
-    'complete',
-    'disabled',
-    'stale',
-]);
-const LOOKUP_SCHEMAS = new Set([
-    CLI_LOOKUP_SCHEMA,
-    'whoisleuth.cli.bulk',
-    'whoisleuth.cli.bulk.item',
-]);
+const STATES = new Set(LOOKUP_SOURCE_STATES);
+const BULK_HEALTH_VERSIONS = new Set([1, 2, CLI_BULK_SCHEMA_VERSION]);
+const PROVIDER_IDS = new Set(LOOKUP_THREAT_INTELLIGENCE_PROVIDERS.map((provider) => provider.id));
 const REPORT_KEYS = new Set([
     'schema',
     'version',
@@ -175,9 +163,9 @@ function parseLookupDocuments(values) {
                 throw new TypeError('Source reliability input requires a supported bounded CLI Lookup document.');
             }
         }
-        const supported = document.version === 1;
-        if (!LOOKUP_SCHEMAS.has(schema) || !supported) {
-            throw new TypeError('Source reliability input requires CLI Lookup version 1 or 2, version 1 Bulk or Bulk-item documents, or only source reliability reports.');
+        if ((schema !== CLI_BULK_SCHEMA && schema !== CLI_BULK_ITEM_SCHEMA)
+            || typeof document.version !== 'number' || !BULK_HEALTH_VERSIONS.has(document.version)) {
+            throw new TypeError('Source reliability input requires supported CLI Lookup, Bulk or Bulk-item documents, or only source reliability reports.');
         }
         return document;
     });
@@ -232,35 +220,21 @@ function collectTiming(document, store) {
     }
 }
 function collectDiagnostics(document, store) {
-    const diagnostics = record(document.diagnostics);
-    if (!diagnostics)
-        return;
-    const fixed = [
-        ['rdap', record(diagnostics.rdap)?.status],
-        ['registrar_rdap', record(record(diagnostics.rdap)?.registrar)?.status],
-        ['whois', record(diagnostics.whois)?.status],
-        ['availability', record(diagnostics.availability)?.status],
-        ['reverse_dns', record(diagnostics.reverseDns)?.status],
-        ['network_context', record(diagnostics.network)?.status],
-        ['security_txt', record(diagnostics.securityTxt)?.status],
-        ['sslbl', record(diagnostics.sslbl)?.status],
-    ];
-    for (const [source, value] of fixed) {
-        const state = safeState(value);
+    for (const [source, state] of Object.entries(lookupDiagnosticStates(document.diagnostics))) {
         if (state)
             addState(store, source, state);
     }
 }
-function collectObservation(value, store) {
-    if (value.version !== 1
+function collectObservation(raw, source, store) {
+    const value = record(raw);
+    if (!value || value.version !== 1 || value.source !== source
         || typeof value.observedAt !== 'string'
         || typeof value.complete !== 'boolean'
         || typeof value.truncated !== 'boolean'
         || !Array.isArray(value.limitations))
         return;
-    const source = safeSource(value.source);
     const state = safeState(value.status);
-    if (!source || !state)
+    if (!state)
         return;
     const item = accumulator(store, source);
     item.observationSamples += 1;
@@ -271,48 +245,65 @@ function collectObservation(value, store) {
     if (value.truncated === true)
         item.truncated += 1;
 }
-function traverse(document, store) {
-    let visited = 0;
-    const stack = [{ value: document, depth: 0 }];
-    while (stack.length) {
-        const current = stack.pop();
-        if (!current)
+function collectLookupHealth(document, store) {
+    collectDiagnostics(document, store);
+    collectTiming(document, store);
+    const availability = record(document.availability);
+    const dns = record(availability?.dns);
+    const technology = record(availability?.technologyProfile);
+    // Only collector-owned envelopes have health semantics. Raw publications,
+    // parsed registration extensions and nested provider findings remain opaque.
+    const observations = [
+        ['dns', dns], ['dns', dns?.caaPolicy], ['dns_delegation', dns?.delegation],
+        ['http', availability?.http], ['tls', availability?.tls],
+        ['html', availability?.pageIdentity],
+    ];
+    const fullLookup = document.schema === CLI_LOOKUP_SCHEMA;
+    if (fullLookup)
+        observations.push(['html', availability?.credentialSurfaceProfile], ['html', availability?.structuredDataIdentity], ['derived', technology], ['derived', technology?.browserLibraryProfile], ['derived', availability?.pageRoleProfile], ['derived', availability?.clientBehaviorProfile], ['derived', availability?.securityPosture], ['reverse_dns', document.reverseDns], ['ip_rdap', document.networkContext], ['security_txt', document.securityTxt], ['sslbl', document.sslbl]);
+    for (const [source, observation] of observations)
+        collectObservation(observation, source, store);
+    if (!fullLookup)
+        return;
+    const providers = record(document.threatIntelligence)?.providers;
+    if (providers === undefined)
+        return;
+    if (!Array.isArray(providers) || providers.length > MAX_THREAT_INTELLIGENCE_PROVIDERS) {
+        throw new TypeError(`Source reliability input exceeds the ${MAX_THREAT_INTELLIGENCE_PROVIDERS}-provider health boundary.`);
+    }
+    const seen = new Set();
+    for (const rawProvider of providers) {
+        const provider = record(rawProvider);
+        const source = record(provider?.provider)?.id;
+        if (provider?.schema !== THREAT_INTELLIGENCE_SCHEMA || provider.version !== THREAT_INTELLIGENCE_CONTRACT_VERSION
+            || typeof source !== 'string' || !PROVIDER_IDS.has(source)
+            || record(provider.observation)?.source !== source)
             continue;
-        if (current.depth > 12) {
-            throw new TypeError('Source reliability input exceeds the 12-level traversal limit.');
-        }
-        if (visited >= MAX_SOURCE_RELIABILITY_TRAVERSAL_NODES) {
-            throw new TypeError(`Source reliability input exceeds the ${MAX_SOURCE_RELIABILITY_TRAVERSAL_NODES}-node traversal limit.`);
-        }
-        visited += 1;
-        const object = record(current.value);
-        if (object) {
-            collectDiagnostics(object, store);
-            collectTiming(object, store);
-            collectObservation(object, store);
-            if (object.state === 'rate_limited') {
-                const source = safeSource(record(object.observation)?.source);
-                if (source)
-                    addState(store, source, 'rate_limited');
-            }
-            const children = Object.values(object);
-            if (children.length > 200) {
-                throw new TypeError('Source reliability input contains an object with more than 200 fields.');
-            }
-            for (const child of children) {
-                if (child && typeof child === 'object')
-                    stack.push({ value: child, depth: current.depth + 1 });
-            }
-        }
-        else if (Array.isArray(current.value)) {
-            if (current.value.length > 1_000) {
-                throw new TypeError('Source reliability input contains an array with more than 1000 items.');
-            }
-            for (const child of current.value) {
-                if (child && typeof child === 'object')
-                    stack.push({ value: child, depth: current.depth + 1 });
-            }
+        if (seen.has(source))
+            throw new TypeError('Source reliability input contains duplicate provider health identities.');
+        seen.add(source);
+        collectObservation(provider?.observation, source, store);
+        if (provider?.state === 'rate_limited')
+            addState(store, source, 'rate_limited');
+    }
+}
+function collectDocumentHealth(document, store) {
+    if (document.schema === CLI_LOOKUP_SCHEMA) {
+        collectLookupHealth(document, store);
+        return;
+    }
+    const items = document.schema === CLI_BULK_SCHEMA ? document.results : [document];
+    if (!Array.isArray(items) || items.length > 1_000) {
+        throw new TypeError('Source reliability Bulk input requires at most 1000 result items.');
+    }
+    for (const rawItem of items) {
+        const item = record(rawItem);
+        if (!item || item.schema !== CLI_BULK_ITEM_SCHEMA || item.version !== document.version
+            || typeof item.ok !== 'boolean') {
+            throw new TypeError('Source reliability Bulk input contains an invalid result envelope.');
         }
+        if (item.ok)
+            collectLookupHealth(item, store);
     }
 }
 function percentile(sorted, ratio) {
@@ -663,7 +654,7 @@ export function buildSourceReliabilityReport(raw, generatedAt = new Date().toISO
             const sampleDate = lookupDocumentTimestamp(document);
             if (sampleDate)
                 sampleDates.push(sampleDate);
-            traverse(document, store);
+            collectDocumentHealth(document, store);
         }
     }
     sampleDates.sort();

package/cli/support-arguments.mjs

@@ -0,0 +1,49 @@
+import {} from "./command-argument-grammar.mjs";
+import {} from "./command-reference.mjs";
+import { terminalOptions, jsonOutput, singleInputAction } from "./argument-values.mjs";
+export const SUPPORT_ARGUMENT_PARSERS = Object.freeze({
+    completion: (parsed) => ({
+        action: 'completion',
+        shell: parsed.positionalValue('shell'),
+    }),
+    doctor: (parsed) => ({
+        action: 'doctor',
+        network: parsed.hasOption('--network'),
+        output: jsonOutput(parsed),
+        ...terminalOptions(parsed),
+    }),
+    commands: (parsed) => ({
+        action: 'commands',
+        output: jsonOutput(parsed),
+        common: parsed.hasOption('--common'),
+        group: parsed.optionValue('--group'),
+        mode: parsed.optionValue('--mode'),
+        ...terminalOptions(parsed),
+    }),
+    manual: () => ({ action: 'manual' }),
+    'registry-support': (parsed) => ({
+        action: 'registry-support',
+        target: parsed.positionalValue('domain-or-suffix'),
+        output: jsonOutput(parsed),
+        ...terminalOptions(parsed),
+    }),
+    'registry-doctor': (parsed) => singleInputAction('registry-doctor', parsed),
+    'registry-cohort': (parsed) => singleInputAction('registry-cohort', parsed),
+    'registry-scaffold': (parsed) => ({
+        action: 'registry-scaffold',
+        profile: parsed.optionValue('--profile'),
+        suffix: parsed.optionValue('--suffix'),
+        scenario: parsed.optionValue('--scenario'),
+    }),
+    'risk-calibrate': (parsed) => ({
+        action: 'risk-calibrate',
+        source: parsed.positionalValue('source'),
+        output: parsed.hasOption('--json')
+            ? 'json'
+            : parsed.hasOption('--summary-json')
+                ? 'summary_json'
+                : 'terminal',
+        ...terminalOptions(parsed),
+    }),
+    'lookalike-calibrate': (parsed) => singleInputAction('lookalike-calibrate', parsed),
+});