@1aboveio/skills 0.20.2 → 0.20.4

package/skills/compliance/doc-authenticity/scripts/pdf_forensics.py

@@ -0,0 +1,401 @@
+# /// script
+# requires-python = ">=3.10"
+# dependencies = ["pikepdf>=8", "pdfplumber>=0.11"]
+# ///
+"""Extract forensic signals from a PDF for the doc-authenticity skill.
+
+Usage:
+    uv run pdf_forensics.py input.pdf --out outdir/
+
+Writes:
+    outdir/forensics.json   structural + metadata signals (F1-F9 inputs)
+    outdir/pages/page-N.txt extracted text per page
+    outdir/pages/page-N.fonts.tsv  word-level font map (word, font, size, x0, top)
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import re
+import sys
+from collections import Counter
+from pathlib import Path
+
+import pdfplumber
+import pikepdf
+
+
+def parse_pdf_date(raw: str | None) -> str | None:
+    """D:20260115093000+00'00' -> 2026-01-15T09:30:00+00:00 (best effort)."""
+    if not raw:
+        return None
+    s = str(raw)
+    m = re.match(r"D:(\d{4})(\d{2})?(\d{2})?(\d{2})?(\d{2})?(\d{2})?([Zz+\-].*)?", s)
+    if not m:
+        return s
+    y, mo, d, h, mi, sec, tz = m.groups()
+    iso = f"{y}-{mo or '01'}-{d or '01'}T{h or '00'}:{mi or '00'}:{sec or '00'}"
+    if tz and tz not in ("Z", "z"):
+        tz = tz.replace("'", ":").rstrip(":")
+        iso += tz if re.match(r"[+\-]\d{2}:\d{2}$", tz) else ""
+    elif tz:
+        iso += "+00:00"
+    return iso
+
+
+def scan_raw_structure(data: bytes) -> dict:
+    """Byte-level scan: save generations and objects redefined across them."""
+    eof_positions = [m.start() for m in re.finditer(rb"%%EOF", data)]
+    startxrefs = len(re.findall(rb"startxref", data))
+    prev_pointers = len(re.findall(rb"/Prev\s+\d+", data))
+
+    # Objects defined more than once = redefined in a later generation
+    # (approximation: also matched inside object streams is not possible since
+    # those are compressed; raw matches are top-level definitions).
+    defs: dict[int, list[int]] = {}
+    for m in re.finditer(rb"(?m)^\s*(\d+)\s+\d+\s+obj\b", data):
+        defs.setdefault(int(m.group(1)), []).append(m.start())
+    updated = sorted(n for n, offs in defs.items() if len(offs) > 1)
+
+    trailing = data[eof_positions[-1] + 5 :] if eof_positions else b""
+    return {
+        "file_size": len(data),
+        "eof_count": len(eof_positions),
+        "startxref_count": startxrefs,
+        "prev_pointers": prev_pointers,
+        "incremental_updates": max(0, len(eof_positions) - 1),
+        "updated_objects": updated[:50],
+        "updated_object_count": len(updated),
+        "bytes_after_last_eof": len(trailing.strip()),
+        "header": data[:16].decode("latin-1", "replace").strip(),
+    }
+
+
+def extract_metadata(pdf: pikepdf.Pdf) -> dict:
+    info = {}
+    try:
+        for k, v in (pdf.docinfo or {}).items():
+            info[str(k).lstrip("/")] = str(v)
+    except Exception as e:  # noqa: BLE001
+        info["_error"] = str(e)
+    return {
+        "producer": info.get("Producer"),
+        "creator": info.get("Creator"),
+        "author": info.get("Author"),
+        "title": info.get("Title"),
+        "creation_date_raw": info.get("CreationDate"),
+        "mod_date_raw": info.get("ModDate"),
+        "creation_date": parse_pdf_date(info.get("CreationDate")),
+        "mod_date": parse_pdf_date(info.get("ModDate")),
+        "all_docinfo": info,
+    }
+
+
+def extract_xmp(pdf: pikepdf.Pdf) -> dict:
+    out: dict = {"present": False}
+    try:
+        meta = pdf.open_metadata()
+        if not str(meta):
+            return out
+        out["present"] = True
+        keys = [
+            ("xmp:CreatorTool", "creator_tool"),
+            ("pdf:Producer", "producer"),
+            ("xmp:CreateDate", "create_date"),
+            ("xmp:ModifyDate", "modify_date"),
+            ("xmp:MetadataDate", "metadata_date"),
+            ("xmpMM:DocumentID", "document_id"),
+            ("xmpMM:InstanceID", "instance_id"),
+        ]
+        for xmp_key, name in keys:
+            try:
+                if xmp_key in meta:
+                    out[name] = str(meta[xmp_key])
+            except Exception:  # noqa: BLE001, S110
+                pass
+        raw = str(meta)
+        out["xmp_toolkit"] = None
+        tk = re.search(r'x:xmptk="([^"]+)"', raw)
+        if tk:
+            out["xmp_toolkit"] = tk.group(1)
+        out["has_history"] = "xmpMM:History" in raw
+        out["has_derived_from"] = "xmpMM:DerivedFrom" in raw
+        agents = sorted(set(re.findall(r"softwareAgent>([^<]+)<", raw)))
+        agents += sorted(set(re.findall(r'softwareAgent="([^"]+)"', raw)))
+        out["history_software_agents"] = sorted(set(agents))
+    except Exception as e:  # noqa: BLE001
+        out["_error"] = str(e)
+    return out
+
+
+def extract_signatures(pdf: pikepdf.Pdf, file_size: int) -> list[dict]:
+    sigs = []
+    try:
+        root = pdf.Root
+        acro = root.get("/AcroForm")
+        if acro is None:
+            return sigs
+        for field in acro.get("/Fields", []):
+            try:
+                if str(field.get("/FT", "")) != "/Sig":
+                    continue
+                v = field.get("/V")
+                entry: dict = {"field_name": str(field.get("/T", ""))}
+                if v is None:
+                    entry["signed"] = False
+                    sigs.append(entry)
+                    continue
+                entry["signed"] = True
+                entry["cryptographic_validation"] = "not_performed"
+                entry["sub_filter"] = str(v.get("/SubFilter", "")) or None
+                entry["signer_name"] = str(v.get("/Name", "")) or None
+                entry["sign_date"] = parse_pdf_date(
+                    str(v.get("/M")) if v.get("/M") is not None else None
+                )
+                br = v.get("/ByteRange")
+                if br is not None:
+                    br = [int(x) for x in br]
+                    entry["byte_range"] = br
+                    # This checks structural coverage only; it does not verify
+                    # the signature value, certificate chain, or trust anchor.
+                    entry["byte_range_covers_file"] = (
+                        len(br) == 4
+                        and br[0] == 0
+                        and br[1] >= 0
+                        and br[2] >= br[1]
+                        and br[3] >= 0
+                        and br[2] + br[3] >= file_size - 4
+                    )
+                sigs.append(entry)
+            except Exception as e:  # noqa: BLE001
+                sigs.append({"_error": str(e)})
+    except Exception as e:  # noqa: BLE001
+        sigs.append({"_error": str(e)})
+    return sigs
+
+
+def extract_fonts_and_annots(pdf: pikepdf.Pdf) -> tuple[list[dict], list[dict], dict]:
+    fonts: dict[tuple, dict] = {}
+    annots: list[dict] = []
+    doc_flags = {
+        "has_javascript": False,
+        "has_embedded_files": False,
+        "has_open_action": False,
+    }
+    try:
+        names = pdf.Root.get("/Names")
+        if names is not None:
+            if names.get("/JavaScript") is not None:
+                doc_flags["has_javascript"] = True
+            if names.get("/EmbeddedFiles") is not None:
+                doc_flags["has_embedded_files"] = True
+        if pdf.Root.get("/OpenAction") is not None:
+            doc_flags["has_open_action"] = True
+    except Exception:  # noqa: BLE001, S110
+        pass
+
+    for pageno, page in enumerate(pdf.pages, 1):
+        try:
+            res = page.get("/Resources", {})
+            fdict = res.get("/Font", {}) if res is not None else {}
+            for _, fobj in fdict.items() if fdict is not None else []:
+                try:
+                    base = str(fobj.get("/BaseFont", "unknown")).lstrip("/")
+                    desc = fobj.get("/FontDescriptor")
+                    if desc is None and fobj.get("/DescendantFonts") is not None:
+                        desc = fobj.get("/DescendantFonts")[0].get("/FontDescriptor")
+                    embedded = bool(
+                        desc is not None
+                        and any(
+                            desc.get(k) is not None
+                            for k in ("/FontFile", "/FontFile2", "/FontFile3")
+                        )
+                    )
+                    m = re.match(r"^([A-Z]{6})\+(.+)$", base)
+                    key = (base, embedded)
+                    rec = fonts.setdefault(
+                        key,
+                        {
+                            "base_font": base,
+                            "family": m.group(2) if m else base,
+                            "subset_prefix": m.group(1) if m else None,
+                            "embedded": embedded,
+                            "subtype": str(fobj.get("/Subtype", "")).lstrip("/"),
+                            "pages": [],
+                        },
+                    )
+                    if pageno not in rec["pages"]:
+                        rec["pages"].append(pageno)
+                except Exception:  # noqa: BLE001, S112
+                    continue
+        except Exception:  # noqa: BLE001, S110
+            pass
+        try:
+            for a in page.get("/Annots", []) or []:
+                sub = str(a.get("/Subtype", "")).lstrip("/")
+                annots.append(
+                    {
+                        "page": pageno,
+                        "subtype": sub,
+                        "contents": str(a.get("/Contents", ""))[:200] or None,
+                        "rect": [float(x) for x in a.get("/Rect", [])] or None,
+                    }
+                )
+        except Exception:  # noqa: BLE001, S110
+            pass
+
+    font_list = sorted(fonts.values(), key=lambda f: f["base_font"])
+    # duplicate subset embeddings of the same family = edit trace (F5)
+    fam_prefixes: dict[str, set] = {}
+    for f in font_list:
+        if f["subset_prefix"]:
+            fam_prefixes.setdefault(f["family"], set()).add(f["subset_prefix"])
+    doc_flags["families_with_multiple_subsets"] = sorted(
+        fam for fam, p in fam_prefixes.items() if len(p) > 1
+    )
+    return font_list, annots, doc_flags
+
+
+def analyze_text(pdf_path: Path, pages_dir: Path) -> tuple[list[dict], list[dict]]:
+    """Per-page text + font map; returns (page_stats, font_anomalies)."""
+    pages_dir.mkdir(parents=True, exist_ok=True)
+    page_stats: list[dict] = []
+    anomalies: list[dict] = []
+    with pdfplumber.open(pdf_path) as pdf:
+        for i, page in enumerate(pdf.pages, 1):
+            text = page.extract_text() or ""
+            (pages_dir / f"page-{i}.txt").write_text(text, encoding="utf-8")
+            words = page.extract_words(extra_attrs=["fontname", "size"]) or []
+            with (pages_dir / f"page-{i}.fonts.tsv").open("w", encoding="utf-8") as fh:
+                fh.write("word\tfont\tsize\tx0\ttop\n")
+                for w in words:
+                    fh.write(
+                        f"{w['text']}\t{w.get('fontname')}\t"
+                        f"{round(float(w.get('size', 0)), 2)}\t"
+                        f"{round(w['x0'], 1)}\t{round(w['top'], 1)}\n"
+                    )
+            page_area = float(page.width) * float(page.height) or 1.0
+            img_area = sum(
+                max(0.0, (im["x1"] - im["x0"]) * (im["bottom"] - im["top"]))
+                for im in page.images
+            )
+            page_stats.append(
+                {
+                    "page": i,
+                    "char_count": len(text),
+                    "word_count": len(words),
+                    "image_count": len(page.images),
+                    "image_coverage": round(min(1.0, img_area / page_area), 3),
+                }
+            )
+            # group words into lines by 'top', find words whose font deviates
+            # from the line's modal font (F6 splice candidates)
+            lines: dict[int, list[dict]] = {}
+            for w in words:
+                lines.setdefault(round(w["top"] / 3.0), []).append(w)
+            for line_words in lines.values():
+                if len(line_words) < 3:
+                    continue
+                fnames = Counter(w.get("fontname") for w in line_words)
+                modal, modal_n = fnames.most_common(1)[0]
+                if len(fnames) == 1 or modal_n < max(3, len(line_words) - 2):
+                    continue
+                for w in line_words:
+                    if w.get("fontname") != modal:
+                        anomalies.append(
+                            {
+                                "page": i,
+                                "word": w["text"],
+                                "font": w.get("fontname"),
+                                "line_modal_font": modal,
+                                "size": round(float(w.get("size", 0)), 2),
+                                "x0": round(w["x0"], 1),
+                                "top": round(w["top"], 1),
+                                "line_text": " ".join(
+                                    x["text"]
+                                    for x in sorted(line_words, key=lambda x: x["x0"])
+                                )[:200],
+                            }
+                        )
+    return page_stats, anomalies
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("pdf", type=Path)
+    ap.add_argument(
+        "--out",
+        type=Path,
+        default=None,
+        help="output dir (default: ./doc-authenticity-out/<stem>)",
+    )
+    args = ap.parse_args()
+
+    if not args.pdf.is_file():
+        print(f"error: {args.pdf} not found", file=sys.stderr)
+        return 2
+    outdir = args.out or Path("doc-authenticity-out") / args.pdf.stem
+    outdir.mkdir(parents=True, exist_ok=True)
+
+    data = args.pdf.read_bytes()
+    result: dict = {
+        "input": str(args.pdf.resolve()),
+        "media_type": "application/pdf",
+        "size_bytes": len(data),
+        "sha256": hashlib.sha256(data).hexdigest(),
+        "extension_magic_match": args.pdf.suffix.lower() == ".pdf",
+        "structure": scan_raw_structure(data),
+    }
+
+    repairs: list[str] = []
+    try:
+        import warnings
+
+        with warnings.catch_warnings(record=True) as caught:
+            warnings.simplefilter("always")
+            pdf = pikepdf.open(args.pdf)
+            repairs = [str(w.message) for w in caught]
+    except pikepdf.PasswordError:
+        result["error"] = "encrypted: password required"
+        (outdir / "forensics.json").write_text(json.dumps(result, indent=2))
+        print(json.dumps(result, indent=2))
+        return 1
+    except Exception as exc:  # noqa: BLE001
+        result["error"] = f"PDF parsing failed: {exc}"
+        (outdir / "forensics.json").write_text(json.dumps(result, indent=2))
+        print(json.dumps(result, indent=2))
+        return 1
+
+    with pdf:
+        result["pdf_version"] = str(pdf.pdf_version)
+        result["encrypted"] = pdf.is_encrypted
+        result["linearized"] = pdf.is_linearized
+        result["page_count"] = len(pdf.pages)
+        result["metadata"] = extract_metadata(pdf)
+        result["xmp"] = extract_xmp(pdf)
+        result["signatures"] = extract_signatures(pdf, result["structure"]["file_size"])
+        fonts, annots, doc_flags = extract_fonts_and_annots(pdf)
+        result["fonts"] = fonts
+        result["annotations"] = annots
+        result["structure"].update(doc_flags)
+        result["structure"]["repairs"] = repairs
+
+    try:
+        page_stats, anomalies = analyze_text(args.pdf, outdir / "pages")
+        result["pages"] = page_stats
+        result["text_font_anomalies"] = anomalies
+    except Exception as e:  # noqa: BLE001
+        result["pages_error"] = str(e)
+
+    out_path = outdir / "forensics.json"
+    out_path.write_text(json.dumps(result, indent=2), encoding="utf-8")
+    print(json.dumps(result, indent=2))
+    print(f"\n[written] {out_path}", file=sys.stderr)
+    print(f"[written] {outdir}/pages/page-N.txt + .fonts.tsv", file=sys.stderr)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/skills/compliance/doc-authenticity/scripts/validate_codes.py

@@ -0,0 +1,224 @@
+# /// script
+# requires-python = ">=3.10"
+# dependencies = []
+# ///
+"""Mechanical validation of banking identifiers (doc-authenticity D1/D2).
+
+Usage:
+    uv run validate_codes.py --iban GB29NWBK60161331926819 --bic NWBKGB2L \
+        --sort-code 60-16-13 --account 31926819 --aba 021000021
+
+Pass only the identifiers found on the document. Prints one JSON object with
+a result per identifier: valid (bool), plus detail. Pure stdlib.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+
+# ISO 13616 IBAN lengths per country (common subset)
+IBAN_LENGTHS = {
+    "AD": 24, "AE": 23, "AL": 28, "AT": 20, "AZ": 28, "BA": 20, "BE": 16,
+    "BG": 22, "BH": 22, "BR": 29, "CH": 21, "CR": 22, "CY": 28, "CZ": 24,
+    "DE": 22, "DK": 18, "DO": 28, "EE": 20, "EG": 29, "ES": 24, "FI": 18,
+    "FO": 18, "FR": 27, "GB": 22, "GE": 22, "GI": 23, "GL": 18, "GR": 27,
+    "GT": 28, "HR": 21, "HU": 28, "IE": 22, "IL": 23, "IS": 26, "IT": 27,
+    "JO": 30, "KW": 30, "KZ": 20, "LB": 28, "LI": 21, "LT": 20, "LU": 20,
+    "LV": 21, "MC": 27, "MD": 24, "ME": 22, "MK": 19, "MR": 27, "MT": 31,
+    "MU": 30, "NL": 18, "NO": 15, "PK": 24, "PL": 28, "PS": 29, "PT": 25,
+    "QA": 29, "RO": 24, "RS": 22, "SA": 24, "SE": 24, "SI": 19, "SK": 24,
+    "SM": 27, "TN": 24, "TR": 26, "UA": 29, "VA": 22, "VG": 24, "XK": 20,
+}
+
+# UK sort-code leading-pair → bank group hints (indicative, not exhaustive)
+UK_SORT_HINTS = {
+    range(1, 10): "generic clearing (01-09: various incl. NatWest 01, "
+                  "Santander 09, Nationwide 07, fintechs 04)",
+    range(10, 20): "Bank of Scotland / Halifax (10-19: 12 BoS, 11 Halifax)",
+    range(20, 30): "Barclays (20-29)",
+    range(30, 40): "Lloyds Banking Group (30-39: 30-38 Lloyds/TSB, 40s excl.)",
+    range(40, 50): "HSBC group (40-49: 40 HSBC, 40-47 first direct 40-47-xx)",
+    range(50, 60): "NatWest group (50-59: 50-55 NatWest, 56-58 Ulster)",
+    range(60, 70): "NatWest group (60-66) / others",
+    range(70, 80): "misc (77 Lloyds/TSB Scotland ranges etc.)",
+    range(80, 90): "Bank of Scotland (80-89)",
+    range(90, 100): "Bank of Ireland / NI (90-99)",
+}
+
+
+def check_iban(iban: str) -> dict:
+    s = re.sub(r"[\s\-]", "", iban).upper()
+    out: dict = {"input": iban, "normalized": s}
+    if not re.fullmatch(r"[A-Z]{2}\d{2}[A-Z0-9]{10,30}", s):
+        out.update(valid=False, reason="malformed: expected CCkk + 10-30 alphanumerics")
+        return out
+    cc = s[:2]
+    expected = IBAN_LENGTHS.get(cc)
+    if expected and len(s) != expected:
+        out.update(
+            valid=False,
+            reason=f"wrong length for {cc}: got {len(s)}, expected {expected}",
+        )
+        return out
+    if not expected:
+        out["note"] = f"country {cc} not in built-in length table; checksum only"
+    rearranged = s[4:] + s[:4]
+    digits = "".join(str(int(ch, 36)) for ch in rearranged)
+    ok = int(digits) % 97 == 1
+    out.update(
+        valid=ok,
+        country=cc,
+        check_digits=s[2:4],
+        reason=None if ok else "mod-97 checksum failed (banks do not misprint IBANs)",
+    )
+    if cc == "GB" and ok:
+        out["gb_bank_code"] = s[4:8]
+        out["gb_sort_code"] = f"{s[8:10]}-{s[10:12]}-{s[12:14]}"
+        out["gb_account"] = s[14:]
+    return out
+
+
+def check_bic(bic: str) -> dict:
+    s = re.sub(r"\s", "", bic).upper()
+    out: dict = {"input": bic, "normalized": s}
+    m = re.fullmatch(r"([A-Z]{4})([A-Z]{2})([A-Z0-9]{2})([A-Z0-9]{3})?", s)
+    if not m:
+        out.update(valid=False, reason="malformed: expected AAAA CC LL (BBB)")
+        return out
+    bank, country, location, branch = m.groups()
+    out.update(
+        valid=True,
+        bank_code=bank,
+        country=country,
+        location_code=location,
+        branch_code=branch,
+        is_test_bic=location.endswith("0"),
+        note="format-valid; confirm bank_code matches the named bank and "
+             "country matches the branch address (D2/D3)",
+    )
+    return out
+
+
+def check_sort_code(sc: str) -> dict:
+    s = re.sub(r"[\s\-]", "", sc)
+    out: dict = {"input": sc, "normalized": s}
+    if not re.fullmatch(r"\d{6}", s):
+        out.update(valid=False, reason="malformed: expected 6 digits (XX-XX-XX)")
+        return out
+    lead = int(s[:2])
+    hint = next((v for k, v in UK_SORT_HINTS.items() if lead in k), "unknown range")
+    out.update(
+        valid=True,
+        formatted=f"{s[0:2]}-{s[2:4]}-{s[4:6]}",
+        leading_pair=s[:2],
+        bank_group_hint=hint,
+        note="format-valid only; the EISCD modulus check is not public. "
+             "Verify sort code ↔ named bank (D3), by web search if available.",
+    )
+    return out
+
+
+def check_aba(aba: str) -> dict:
+    s = re.sub(r"[\s\-]", "", aba)
+    out: dict = {"input": aba, "normalized": s}
+    if not re.fullmatch(r"\d{9}", s):
+        out.update(valid=False, reason="malformed: expected 9 digits")
+        return out
+    d = [int(c) for c in s]
+    total = 3 * (d[0] + d[3] + d[6]) + 7 * (d[1] + d[4] + d[7]) + (d[2] + d[5] + d[8])
+    ok = total % 10 == 0
+    ff = int(s[:2])
+    district_ok = ff <= 12 or 21 <= ff <= 32 or 61 <= ff <= 72 or ff == 80
+    out.update(
+        valid=ok and district_ok,
+        checksum_ok=ok,
+        federal_district_prefix_ok=district_ok,
+        reason=None if ok and district_ok else (
+            "checksum failed" if not ok else "invalid Federal Reserve district prefix"
+        ),
+    )
+    return out
+
+
+def check_account(acct: str, country: str) -> dict:
+    s = re.sub(r"[\s\-]", "", acct)
+    out: dict = {"input": acct, "normalized": s, "country_assumed": country}
+    if country.upper() == "GB":
+        ok = bool(re.fullmatch(r"\d{8}", s))
+        out.update(
+            valid=ok,
+            reason=None if ok else "UK account numbers are 8 digits",
+        )
+    else:
+        ok = bool(re.fullmatch(r"\d{4,17}", s))
+        out.update(
+            valid=ok,
+            note="generic length check only (4-17 digits); no per-bank format applied",
+            reason=None if ok else "not a plausible account number",
+        )
+    return out
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("--iban")
+    ap.add_argument("--bic")
+    ap.add_argument("--sort-code")
+    ap.add_argument("--aba")
+    ap.add_argument("--account")
+    ap.add_argument("--country", default="GB",
+                    help="ISO country for --account format rules (default GB)")
+    args = ap.parse_args()
+
+    results: dict = {}
+    if args.iban:
+        results["iban"] = check_iban(args.iban)
+    if args.bic:
+        results["bic"] = check_bic(args.bic)
+    if args.sort_code:
+        results["sort_code"] = check_sort_code(args.sort_code)
+    if args.aba:
+        results["aba"] = check_aba(args.aba)
+    if args.account:
+        results["account"] = check_account(args.account, args.country)
+    if not results:
+        print("nothing to check; pass at least one identifier", file=sys.stderr)
+        return 2
+
+    # cross-checks when multiple identifiers were supplied
+    cross = []
+    if "iban" in results and "sort_code" in results:
+        gb_sc = results["iban"].get("gb_sort_code")
+        if gb_sc and gb_sc != results["sort_code"].get("formatted"):
+            cross.append(
+                f"MISMATCH: sort code embedded in IBAN ({gb_sc}) != printed "
+                f"sort code ({results['sort_code'].get('formatted')})"
+            )
+    if "iban" in results and "account" in results:
+        gb_acct = results["iban"].get("gb_account")
+        if gb_acct and gb_acct != results["account"]["normalized"]:
+            cross.append(
+                f"MISMATCH: account embedded in IBAN ({gb_acct}) != printed "
+                f"account ({results['account']['normalized']})"
+            )
+    if "iban" in results and "bic" in results:
+        if (
+            results["bic"].get("valid")
+            and results["iban"].get("valid")
+            and results["bic"]["country"] != results["iban"]["country"]
+        ):
+            cross.append(
+                f"MISMATCH: BIC country {results['bic']['country']} != IBAN "
+                f"country {results['iban']['country']}"
+            )
+    results["cross_checks"] = cross or ["no mismatches among supplied identifiers"]
+
+    print(json.dumps(results, indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())