@appforge-ci/core 0.3.0 → 0.3.2

package/dist/appforge-verify.test.js

@@ -0,0 +1,958 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { auditCheckpointStatement, auditEntryHash, auditGenesisHash, bytesToBase64, canonicalJson, createEd25519Signer, ed25519KeyId, ed25519SeedToPkcs8, sha256Hex, signAuditCheckpoint, } from "./attestation.js";
+import { ATTESTATION_DOMAIN, signWithDomain } from "./attestation-signing.js";
+/**
+ * Tests of `scripts/appforge-verify.mjs`, the zero-dependency offline verifier.
+ *
+ * The fixtures here are written with this package's WebCrypto signer and
+ * hashing (`packages/core/src/attestation*.ts`); the verifier uses
+ * `node:crypto` and its own canonicaliser. So every passing case is also a
+ * cross-implementation check of what the server writes versus what an
+ * auditor's copy of the script reads.
+ *
+ * A verifier that cannot fail proves nothing, so most of this file is
+ * mutations: take evidence that verifies, break exactly one property, and
+ * require the verifier to say so. The last test in the file fails the build
+ * if any check the verifier performs is never seen failing here.
+ */
+const SCRIPT = fileURLToPath(new URL("../../../scripts/appforge-verify.mjs", import.meta.url));
+const V = (await import(new URL("../../../scripts/appforge-verify.mjs", import.meta.url).href));
+const clone = (o) => JSON.parse(JSON.stringify(o));
+async function testKey(label, over = {}) {
+    const pkcs8 = ed25519SeedToPkcs8(new Uint8Array(createHash("sha256").update(`appforge-verify-test:${label}`).digest()));
+    const priv = createPrivateKey({ key: Buffer.from(pkcs8), format: "der", type: "pkcs8" });
+    const pub = createPublicKey(priv);
+    const raw = new Uint8Array(pub.export({ format: "der", type: "spki" }).subarray(-32));
+    const kid = await ed25519KeyId(raw);
+    return {
+        signer: await createEd25519Signer(kid, pkcs8),
+        kid,
+        entry: { kid, alg: "Ed25519", publicKey: bytesToBase64(raw), notBefore: "2026-01-01T00:00:00Z", status: "active", ...over },
+        pem: pub.export({ format: "pem", type: "spki" }),
+    };
+}
+const KEY = await testKey("server");
+const OTHER = await testKey("stranger");
+const keyList = [KEY.entry];
+const ORG = "org_acme";
+const at = (n) => `2026-09-${String(10 + (n % 18)).padStart(2, "0")}T10:00:${String(n % 60).padStart(2, "0")}Z`;
+async function appendEntry(chain, orgId, kind, ref, when, data, prevHashOverride) {
+    const prev = chain.length ? chain[chain.length - 1] : null;
+    const seq = (prev?.seq ?? 0) + 1;
+    const prevHash = prevHashOverride ?? prev?.hash ?? (await auditGenesisHash(orgId));
+    const payload = { v: 1, seq, orgId, kind, ref, at: when, data };
+    const row = { seq, prevHash, hash: await auditEntryHash(prevHash, payload), kind, refId: ref, payload, createdAt: when.replace("T", " ").replace("Z", "") };
+    chain.push(row);
+    return row;
+}
+const vpnData = (i, over = {}) => ({ type: i === 0 ? "tunnel_created" : ["tunnel_up", "tunnel_down", "lock_acquired"][i % 3], tunnelId: "tun_1", buildId: `bld_${i % 5}`, agentId: "agt_1", detail: null, ...over });
+async function vpnChain(orgId, n, mutate) {
+    const chain = [];
+    for (let i = 0; i < n; i++) {
+        const data = vpnData(i);
+        mutate?.(i, data);
+        await appendEntry(chain, orgId, "vpn_event", `evt_${orgId}_${i}`, at(i), data);
+    }
+    return chain;
+}
+async function checkpointFor(key, orgId, row, issuedAt) {
+    const stmt = auditCheckpointStatement({ orgId, seq: row.seq, hash: row.hash, issuedAt });
+    return { orgId, seq: row.seq, hash: row.hash, issuedAt, keyId: key.kid, signature: await signAuditCheckpoint(key.signer, stmt) };
+}
+// The NDJSON format of GET /orgs/:orgId/vpn/audit/export (the route's own test feeds the real output to this verifier too).
+function exportText(orgId, rows, checkpoints, extra = {}) {
+    const lines = [{ type: "header", format: "appforge-audit-export", version: 1, orgId, generatedAt: "2026-10-02T15:00:00Z", ...(extra.chainHeadSeq !== undefined ? { chainHeadSeq: extra.chainHeadSeq } : {}) }];
+    for (const r of rows)
+        lines.push({ type: "entry", ...r });
+    for (const c of checkpoints)
+        lines.push({ type: "checkpoint", ...c });
+    const last = rows[rows.length - 1];
+    lines.push({ type: "trailer", next: extra.next ?? null, entries: rows.length, headSeq: extra.headSeq ?? last.seq, headHash: extra.headHash ?? last.hash });
+    return lines.map((l) => JSON.stringify(l)).join("\n") + "\n";
+}
+const parseLines = (text) => text.trim().split("\n").map((l) => JSON.parse(l));
+const joinLines = (lines) => lines.map((l) => JSON.stringify(l)).join("\n") + "\n";
+const keysDoc = () => clone(keyList);
+const run = (text, keys = keysDoc(), opts = {}) => V.verifyExport(text, keys, opts);
+// Evidence used by the export tests: 30 entries, signed checkpoints at 10, 20 and 30.
+const chain30 = await vpnChain(ORG, 30);
+const cp10 = await checkpointFor(KEY, ORG, chain30[9], "2026-10-01T00:00:10Z");
+const cp20 = await checkpointFor(KEY, ORG, chain30[19], "2026-10-01T00:00:20Z");
+const cp30 = await checkpointFor(KEY, ORG, chain30[29], "2026-10-01T00:00:30Z");
+const GOOD = exportText(ORG, chain30, [cp10, cp20, cp30]);
+// ---------------------------------------------------------------- the two implementations agree
+test("the verifier's canonicaliser and hashes agree with packages/core on every value, including the ones both must reject", async () => {
+    const values = [
+        { b: 1, a: [true, null, "xé\n\u0001\"\\ 😀"], "é": { z: 0, y: -5 }, A: 9007199254740991 },
+        [], {}, "", null, 0, -0, [[[]]], { "": 1, a: { "": [] } }, "

", "😀",
+    ];
+    for (const v of values)
+        assert.equal(V.canonicalize(v), canonicalJson(v));
+    const sparse = [1, , 3]; // eslint-disable-line no-sparse-arrays
+    const rejects = [1.5, NaN, Infinity, undefined, 2 ** 60, { a: undefined }, "\ud800", sparse, new Date(), () => 1, 1n, new Map(), Object.assign(Object.create({ inherited: 1 }), { own: 1 })];
+    for (const v of rejects) {
+        assert.throws(() => canonicalJson(v), /./, `core must reject ${String(v)}`);
+        assert.throws(() => V.canonicalize(v), /./, `verifier must reject ${String(v)}`);
+    }
+    let deep = 1;
+    for (let i = 0; i < 40; i++)
+        deep = [deep];
+    assert.throws(() => canonicalJson(deep));
+    assert.throws(() => V.canonicalize(deep));
+    assert.equal(V.genesisHash(ORG), await auditGenesisHash(ORG));
+    assert.equal(V.entryHash(chain30[0].prevHash, chain30[0].payload), chain30[0].hash);
+    assert.equal(V.sha256hex("abc"), await sha256Hex("abc"));
+    assert.equal(V.keyIdOf(Buffer.from(KEY.entry.publicKey, "base64")), KEY.kid);
+    assert.deepEqual(V.DOMAIN, { attestation: ATTESTATION_DOMAIN, checkpoint: "appforge-checkpoint-v1\n", entry: "appforge-audit-v1\n" });
+});
+// ---------------------------------------------------------------- audit export: accept
+test("export: a complete, fully signed export verifies (exit 0) and reports what it covered", () => {
+    const r = run(GOOD);
+    assert.deepEqual(r.problems, []);
+    assert.equal(r.exit, 0);
+    assert.equal(r.signedThroughSeq, 30);
+    assert.equal(r.entries, 30);
+    assert.ok(r.checks.every(([, ok]) => ok));
+});
+test("export: pages concatenated, and a slice that starts after pruned history anchored by a checkpoint, verify", async () => {
+    // Three pages of ten, as the endpoint would serve them (each page repeats the checkpoint at its anchor).
+    const p1 = exportText(ORG, chain30.slice(0, 10), [cp10], { next: { fromSeq: 11 } });
+    const p2 = exportText(ORG, chain30.slice(10, 20), [cp10, cp20], { next: { fromSeq: 21 } });
+    const p3 = exportText(ORG, chain30.slice(20, 30), [cp20, cp30]);
+    const r = run(p1 + p2 + p3);
+    assert.deepEqual(r.problems, []);
+    assert.equal(r.exit, 0);
+    // Only the first page: consistent and signed, but incomplete.
+    assert.equal(run(p1).exit, 3);
+    assert.match(run(p1).notes.join("\n"), /more pages exist/);
+    // A slice from seq 11 whose anchor (seq 10) is a signed checkpoint, as after retention pruned the start.
+    const slice = exportText(ORG, chain30.slice(10, 30), [cp10, cp20, cp30]);
+    const s = run(slice);
+    assert.deepEqual(s.problems, []);
+    assert.equal(s.exit, 0);
+    assert.equal(s.firstSeq, 11);
+});
+test("export: entries after the newest signed checkpoint are 'incomplete' (3) unless the reader opts in; a file with no signed checkpoint is never 0", async () => {
+    const tail = exportText(ORG, chain30, [cp10, cp20]);
+    const r = run(tail);
+    assert.equal(r.exit, 3);
+    assert.equal(r.unsignedTail, 10);
+    assert.match(r.notes.join("\n"), /10 entries after the newest signed checkpoint/);
+    assert.equal(run(tail, keysDoc(), { allowUnsignedTail: true }).exit, 0);
+    // Nothing signed in the slice: opting in to an unsigned tail does not make it authentic.
+    const none = exportText(ORG, chain30, []);
+    assert.equal(run(none).exit, 3);
+    assert.equal(run(none, keysDoc(), { allowUnsignedTail: true }).exit, 3);
+    // A slice whose only signed checkpoint is its anchor: the entries themselves are unsigned.
+    const anchored = exportText(ORG, chain30.slice(10, 20), [cp10]);
+    assert.equal(run(anchored, keysDoc(), { allowUnsignedTail: true }).exit, 3);
+});
+// ---------------------------------------------------------------- audit export: break one property at a time
+function expectFail(name, text, keys = keysDoc(), opts = {}, re) {
+    const r = run(text, keys, opts);
+    assert.equal(r.exit, 1, `${name}: expected exit 1, got ${r.exit} (${r.problems.join("; ")})`);
+    if (re)
+        assert.match(r.problems.join("\n"), re, name);
+    return r;
+}
+test("export: gaps, reordering, edits, splices and truncation are all caught", async () => {
+    const L = () => parseLines(GOOD);
+    const entryIdx = (lines, seq) => lines.findIndex((l) => l.type === "entry" && l.seq === seq);
+    let lines = L();
+    lines.splice(entryIdx(lines, 15), 1);
+    expectFail("a removed entry (gap)", joinLines(lines), keysDoc(), {}, /expected seq 15, found 16/);
+    lines = L();
+    const i14 = entryIdx(lines, 14);
+    [lines[i14], lines[i14 + 1]] = [lines[i14 + 1], lines[i14]];
+    expectFail("two entries swapped", joinLines(lines), keysDoc(), {}, /expected seq 14/);
+    lines = L();
+    lines[entryIdx(lines, 5)].payload.data.detail = "edited";
+    expectFail("an edited payload", joinLines(lines), keysDoc(), {}, /entry 5 .*hash|entry 5 .*tampered/);
+    // Edited AND its own hash recomputed: the next link breaks. At the very end, the checkpoint and trailer do.
+    for (const seq of [5, 30]) {
+        lines = L();
+        const e = lines[entryIdx(lines, seq)];
+        e.payload.data.detail = "edited";
+        e.hash = V.entryHash(e.prevHash, e.payload);
+        expectFail(`an edited payload with a recomputed hash (seq ${seq})`, joinLines(lines));
+    }
+    lines = L();
+    const dup = lines[entryIdx(lines, 7)];
+    lines.splice(entryIdx(lines, 8), 0, clone(dup));
+    expectFail("a duplicated entry", joinLines(lines), keysDoc(), {}, /expected seq 8, found 7/);
+    // Truncation: the last entries removed, with and without the trailer fixed up, with and without the later checkpoint left in.
+    lines = L();
+    const kept = lines.filter((l) => !(l.type === "entry" && l.seq > 20));
+    expectFail("last 10 entries cut, trailer untouched", joinLines(kept), keysDoc(), {}, /trailer head does not match/);
+    const fixedTrailer = clone(kept);
+    const trailer = fixedTrailer[fixedTrailer.length - 1];
+    trailer.headSeq = 20;
+    trailer.headHash = chain30[19].hash;
+    expectFail("last 10 entries cut and the trailer rewritten (the signed checkpoint at 30 gives it away)", joinLines(fixedTrailer), keysDoc(), {}, /beyond the end of the chain/);
+    const stripped = fixedTrailer.filter((l) => !(l.type === "checkpoint" && l.seq > 20));
+    const strippedRun = run(joinLines(stripped));
+    assert.equal(strippedRun.exit, 0, "a clean prefix with every later trace removed IS a valid shorter export: only a head you pinned earlier can reveal it");
+    expectFail("the same cut, caught by the head the customer pinned earlier", joinLines(stripped), keysDoc(), { pinHead: `30:${chain30[29].hash}` }, /pinned head hash is NOT in this chain/);
+    expectFail("no trailer", joinLines(L().slice(0, -1)), keysDoc(), {}, /no closing trailer/);
+    expectFail("download cut mid-line", GOOD.slice(0, GOOD.length - 40), keysDoc(), {}, /not valid JSON|no closing trailer/);
+    expectFail("no header", joinLines(L().slice(1)), keysDoc(), {}, /no valid header/);
+    expectFail("no entries", exportText(ORG, [chain30[0]], []).replace(/.*"type":"entry".*\n/, ""), keysDoc(), {}, /no entries/);
+    expectFail("a line of an unknown type", joinLines([...L().slice(0, 3), { type: "mystery" }, ...L().slice(3)]), keysDoc(), {}, /unknown line type/);
+    expectFail("a garbage line", GOOD.replace("\n", "\nnot json at all\n"), keysDoc(), {}, /not valid JSON/);
+    // A missing middle page.
+    const p1 = exportText(ORG, chain30.slice(0, 10), [cp10], { next: { fromSeq: 11 } });
+    const p3 = exportText(ORG, chain30.slice(20, 30), [cp20, cp30]);
+    expectFail("page 2 of 3 missing", p1 + p3, keysDoc(), {}, /expected seq 11, found 21/);
+    // Another org's evidence.
+    const header = parseLines(GOOD)[0];
+    const evil = await vpnChain("org_evil", 30);
+    expectFail("another org's whole chain under this org's header", joinLines([header, ...evil.map((r) => ({ type: "entry", ...r })), { type: "trailer", next: null, entries: 30, headSeq: 30, headHash: evil[29].hash }]), keysDoc(), {}, /prevHash does not link/);
+    // Even re-linked to this org's genesis, with every hash valid, payloads naming another org are refused.
+    const relinked = [];
+    await appendEntry(relinked, "org_evil", "vpn_event", "evt_1", at(0), vpnData(0), await auditGenesisHash(ORG));
+    for (let i = 1; i < 5; i++)
+        await appendEntry(relinked, "org_evil", "vpn_event", `evt_${i}`, at(i), vpnData(i));
+    expectFail("another org's entries re-linked to this org's genesis", exportText(ORG, relinked, []), keysDoc(), {}, /payload belongs to another org/);
+    // Splice: the first 15 entries of this org then org_evil's 16.. re-linked so every hash is "valid".
+    const spliced = chain30.slice(0, 15);
+    for (let i = 15; i < 30; i++)
+        await appendEntry(spliced, ORG, "vpn_event", `evt_evil_${i}`, at(i), vpnData(i, { detail: "spliced" }));
+    expectFail("a re-linked splice, rejected by the signed checkpoints that disagree", exportText(ORG, spliced, [cp10, cp20, cp30]), keysDoc(), {}, /checkpoint@20 does not match the chain/);
+});
+test("export: payload and kind rules fail closed", async () => {
+    const rebuild = async (mutate) => {
+        const c = chain30.slice(0, 12).map((r) => clone(r));
+        await mutate(c);
+        return exportText(ORG, c, []);
+    };
+    // An entry of a kind this verifier does not know is rejected, not skipped (hash and links are all valid).
+    const unknownKind = chain30.slice(0, 5);
+    await appendEntry(unknownKind, ORG, "mystery", "x", at(5), { a: 1 });
+    expectFail("unknown kind", exportText(ORG, unknownKind, []), keysDoc(), {}, /kind "mystery" is not known/);
+    // Known kinds that later changes add are accepted.
+    const futureKinds = chain30.slice(0, 5);
+    await appendEntry(futureKinds, ORG, "attestation", "att_1", at(5), { buildId: "bld_1", docSha256: "ab".repeat(32) });
+    await appendEntry(futureKinds, ORG, "gap", "gap_1", at(6), { reason: "agent crashed" });
+    assert.equal(run(exportText(ORG, futureKinds, [])).exit, 3, "valid structure, nothing signed -> incomplete, not failed");
+    assert.deepEqual(run(exportText(ORG, futureKinds, [])).problems, []);
+    // Row columns that disagree with the hashed payload.
+    let text = await rebuild(async (c) => { c[3].kind = "attestation"; });
+    expectFail("row kind differs from its payload", text, keysDoc(), {}, /disagree with its payload/);
+    text = await rebuild(async (c) => { c[3].refId = "other"; });
+    expectFail("row refId differs from its payload", text, keysDoc(), {}, /disagree with its payload/);
+    // An unexpected field smuggled into a hashed vpn_event.
+    const extra = chain30.slice(0, 3);
+    await appendEntry(extra, ORG, "vpn_event", "evt_x", at(3), { ...vpnData(3), note: "hidden" });
+    expectFail("extra field inside vpn_event data", exportText(ORG, extra, []), keysDoc(), {}, /unknown fields/);
+    // A float in a payload cannot be hashed identically everywhere.
+    const floats = chain30.slice(0, 3).map((r) => clone(r));
+    floats[2].payload.data.detail = 1.5;
+    expectFail("float in payload", exportText(ORG, floats, []), keysDoc(), {}, /canonical JSON/);
+    // A string payload must be canonical text.
+    const stringy = chain30.slice(0, 3).map((r) => clone(r));
+    stringy[1].payload = JSON.stringify(stringy[1].payload, null, 1);
+    expectFail("non-canonical string payload", exportText(ORG, stringy, []), keysDoc(), {}, /not canonical JSON/);
+    const canonicalString = chain30.slice(0, 3).map((r) => clone(r));
+    for (const r of canonicalString)
+        r.payload = canonicalJson(r.payload);
+    assert.deepEqual(run(exportText(ORG, canonicalString, [])).problems, [], "canonical string payloads (as the database stores them) are fine");
+    // Malformed hashes.
+    const badHash = chain30.slice(0, 3).map((r) => clone(r));
+    badHash[2].prevHash = "xyz";
+    expectFail("non-hex prevHash", exportText(ORG, badHash, []), keysDoc(), {}, /malformed hash/);
+});
+test("export: checkpoint and key rules", async () => {
+    // Untrusted / wrong / empty key sets.
+    expectFail("a key set that does not contain the signing key", GOOD, [OTHER.entry], {}, /not in the trusted key set/);
+    expectFail("an empty key set", GOOD, [], {}, /key set is empty/);
+    expectFail("a key whose kid does not match its public key", GOOD, [{ ...KEY.entry, kid: "0".repeat(16) }], {}, /does not match its public key/);
+    expectFail("a malformed key list", GOOD, { nope: true }, {}, /expected a JSON array/);
+    expectFail("an unknown field in a key entry", GOOD, [{ ...KEY.entry, extra: 1 }], {}, /unknown field/);
+    // Validity windows against each checkpoint's own issuedAt.
+    expectFail("key revoked before the checkpoints were issued", GOOD, [{ ...KEY.entry, status: "revoked", revokedAt: "2026-10-01T00:00:00Z" }], {}, /revoked as of/);
+    assert.equal(run(GOOD, [{ ...KEY.entry, status: "revoked", revokedAt: "2026-10-02T00:00:00Z" }]).exit, 0, "revoked after issue: earlier signatures stay valid");
+    expectFail("key retired before issue", GOOD, [{ ...KEY.entry, status: "retired", notAfter: "2026-10-01T00:00:15Z" }], {}, /retired or expired/);
+    assert.equal(run(GOOD, [{ ...KEY.entry, status: "retired", notAfter: "2026-10-01T00:01:00Z" }]).exit, 0, "a retired key's earlier signatures verify");
+    expectFail("key not yet valid at issue", GOOD, [{ ...KEY.entry, notBefore: "2026-10-02T00:00:00Z" }], {}, /not yet valid/);
+    // Dates that match the shape but are not real instants would be NaN to Date.parse and silently disable the window: refuse the list.
+    for (const bad of ["2026-13-01T00:00:00Z", "2026-02-30T00:00:00Z", "2026-10-32T00:00:00Z", "2026-10-01T25:00:00Z", "2026-10-01T00:60:00Z"]) {
+        expectFail(`revokedAt ${bad}`, GOOD, [{ ...KEY.entry, status: "revoked", revokedAt: bad }], {}, /revokedAt must be an ISO-8601/);
+        expectFail(`notAfter ${bad}`, GOOD, [{ ...KEY.entry, status: "retired", notAfter: bad }], {}, /notAfter must be an ISO-8601/);
+        expectFail(`notBefore ${bad}`, GOOD, [{ ...KEY.entry, notBefore: bad }], {}, /notBefore must be an ISO-8601/);
+    }
+    // Rotation: checkpoints 10 and 20 by the old key, 30 by the new one. Both listed.
+    const next = await testKey("next-generation", { notBefore: "2026-10-01T00:00:25Z" });
+    const cp30new = await checkpointFor(next, ORG, chain30[29], "2026-10-01T00:00:30Z");
+    const rotated = exportText(ORG, chain30, [cp10, cp20, cp30new]);
+    const both = [{ ...KEY.entry, status: "retired", notAfter: "2026-10-01T00:00:25Z" }, next.entry];
+    assert.equal(run(rotated, both).exit, 0, "old and new key both verify after rotation");
+    expectFail("rotation list without the new key", rotated, [KEY.entry].map((k) => ({ ...k, status: "retired", notAfter: "2026-10-01T00:00:25Z" })), {}, /not in the trusted key set/);
+    expectFail("rotation list that dropped the old key", rotated, [next.entry], {}, /not in the trusted key set/);
+    // Checkpoint tampering.
+    const tamper = async (mutate, re, name) => {
+        const lines = parseLines(GOOD);
+        const idx = lines.findIndex((l) => l.type === "checkpoint" && l.seq === 20);
+        mutate(lines[idx]);
+        expectFail(name, joinLines(lines), keysDoc(), {}, re);
+    };
+    await tamper((c) => { c.hash = "0".repeat(64); }, /signature does not verify/, "checkpoint hash edited");
+    await tamper((c) => { c.issuedAt = "2026-10-03T00:00:00Z"; }, /signature does not verify/, "checkpoint issuedAt edited");
+    await tamper((c) => { c.seq = 21; }, /signature does not verify/, "checkpoint seq edited");
+    await tamper((c) => { c.orgId = "org_evil"; }, /signature does not verify/, "checkpoint org edited");
+    await tamper((c) => { c.signature = Buffer.alloc(64, 7).toString("base64"); }, /signature does not verify/, "garbage signature");
+    await tamper((c) => { c.signature = "***"; }, /signature does not verify/, "non-base64 signature");
+    await tamper((c) => { c.keyId = OTHER.kid; }, /not in the trusted key set/, "claimed under another key");
+    await tamper((c) => { delete c.signature; }, /signature does not verify/, "signature removed");
+    // A correctly signed checkpoint for a hash that is NOT the chain's.
+    const wrong = await checkpointFor(KEY, ORG, { seq: 20, hash: "ab".repeat(32) }, "2026-10-01T00:00:20Z");
+    expectFail("a validly signed checkpoint that disagrees with the chain", exportText(ORG, chain30, [cp10, wrong, cp30]), keysDoc(), {}, /checkpoint@20 does not match the chain/);
+    // Another org's validly signed checkpoint pasted in.
+    const alien = await checkpointFor(KEY, "org_evil", chain30[19], "2026-10-01T00:00:20Z");
+    expectFail("another org's checkpoint", exportText(ORG, chain30, [cp10, alien, cp30]), keysDoc(), {}, /another org/);
+    // Domain confusion: the checkpoint statement signed as an attestation.
+    const confused = { ...cp20, signature: await signWithDomain(KEY.signer, ATTESTATION_DOMAIN, { v: 1, type: "appforge.audit.checkpoint", orgId: ORG, seq: 20, hash: cp20.hash, issuedAt: cp20.issuedAt }) };
+    expectFail("a signature made under the attestation domain", exportText(ORG, chain30, [cp10, confused, cp30]), keysDoc(), {}, /signature does not verify/);
+    // Duplicates: identical is harmless (pages overlap), conflicting is not.
+    assert.equal(run(exportText(ORG, chain30, [cp10, cp20, cp20, cp30])).exit, 0);
+    const rival = await checkpointFor(KEY, ORG, chain30[19], "2026-10-01T00:00:21Z");
+    expectFail("two different checkpoints at one seq", exportText(ORG, chain30, [cp10, cp20, rival, cp30]), keysDoc(), {}, /two different checkpoints/);
+    // An export of a range of a longer chain says so in its header; the org's newest checkpoint then legitimately lies past its end...
+    const range = exportText(ORG, chain30.slice(0, 20), [cp10, cp20, cp30], { chainHeadSeq: 30 });
+    const rangeRun = run(range);
+    assert.deepEqual(rangeRun.problems, []);
+    // Not exit 0: the header's chainHeadSeq is unauthenticated, so a range export is indistinguishable from one whose newest entries were dropped.
+    assert.equal(rangeRun.exit, 3, "a signed checkpoint past the end is never reported as complete");
+    assert.match(rangeRun.notes.join("\n"), /chain that continues to seq 30/);
+    assert.match(rangeRun.notes.join("\n"), /beyond this file's last entry/);
+    // ...but a signed checkpoint beyond even the head the export claims is a contradiction: the server cut its own chain short.
+    expectFail("checkpoint past the claimed chain head", exportText(ORG, chain30.slice(0, 20), [cp10, cp20, cp30], { chainHeadSeq: 25 }), keysDoc(), {}, /cut off/);
+    expectFail("checkpoint past the end with the head claimed at the end", exportText(ORG, chain30.slice(0, 20), [cp10, cp20, cp30], { chainHeadSeq: 20 }), keysDoc(), {}, /cut off/);
+    // A checkpoint beyond the chain's end, with no later page expected, means entries were cut.
+    const cp40 = await checkpointFor(KEY, ORG, { seq: 40, hash: "cd".repeat(32) }, "2026-10-01T00:00:40Z");
+    expectFail("a signed checkpoint past the last entry", exportText(ORG, chain30, [cp10, cp20, cp30, cp40]), keysDoc(), {}, /cut off/);
+});
+test("export: a key list is rejected, not narrowed, when an entry is ambiguous or incomplete", () => {
+    // Each of these used to be a way for a revocation or a window to silently not apply.
+    expectFail("the same kid listed twice", GOOD, [KEY.entry, { ...KEY.entry }], {}, /listed twice/);
+    expectFail("a revoked key with no revokedAt (a revocation that would never apply)", GOOD, [{ ...KEY.entry, status: "revoked" }], {}, /a revoked key needs revokedAt/);
+    expectFail("revokedAt on a key that is not revoked", GOOD, [{ ...KEY.entry, revokedAt: "2026-10-01T00:00:00Z" }], {}, /revokedAt is only valid on a revoked key/);
+    expectFail("a retired key with no notAfter", GOOD, [{ ...KEY.entry, status: "retired" }], {}, /a retired key needs notAfter/);
+    expectFail("notAfter not after notBefore", GOOD, [{ ...KEY.entry, status: "retired", notAfter: KEY.entry.notBefore }], {}, /notAfter must be after notBefore/);
+    expectFail("an unknown status", GOOD, [{ ...KEY.entry, status: "paused" }], {}, /status must be active, retired or revoked/);
+    expectFail("an unsupported algorithm", GOOD, [{ ...KEY.entry, alg: "RSA" }], {}, /unsupported algorithm/);
+    expectFail("a kid that is not 16 lowercase hex characters", GOOD, [{ ...KEY.entry, kid: KEY.kid.toUpperCase() }], {}, /kid must be 16 lowercase hex/);
+    expectFail("a public key that is not 32 bytes of base64", GOOD, [{ ...KEY.entry, publicKey: "AAAA" }], {}, /publicKey must be base64 of 32 bytes/);
+    expectFail("a key entry that is not an object", GOOD, ["nope"], {}, /entry is not an object/);
+    expectFail("a key with no notBefore", GOOD, [{ ...KEY.entry, notBefore: undefined }], {}, /notBefore must be an ISO-8601/);
+    // The key list may also be the {keys: [...]} wrapper.
+    assert.equal(run(GOOD, { keys: [KEY.entry] }).exit, 0);
+});
+test("export: structure of the file itself - header, trailer position and the slice anchor", async () => {
+    const L = () => parseLines(GOOD);
+    // The trailer must be the LAST line: a checkpoint (even an identical, harmless one) or anything else after it means the file does not end where it says it does.
+    expectFail("a checkpoint line after the trailer", GOOD + JSON.stringify({ type: "checkpoint", ...cp30 }) + "\n", keysDoc(), {}, /no closing trailer/);
+    expectFail("a second header after the trailer", GOOD + JSON.stringify(L()[0]) + "\n", keysDoc(), {}, /no closing trailer/);
+    assert.equal(run(GOOD + "\n\n  \n").exit, 0, "blank lines after the trailer are not content");
+    // Header rules: one org throughout, with format and version.
+    let lines = L();
+    lines.splice(1, 0, { ...lines[0], orgId: "org_evil" });
+    expectFail("a second page header naming another org", joinLines(lines), keysDoc(), {}, /different orgs/);
+    lines = L();
+    delete lines[0].orgId;
+    expectFail("a header with no orgId", joinLines(lines), keysDoc(), {}, /no valid header/);
+    lines = L();
+    lines[0].version = 2;
+    expectFail("a header of another version", joinLines(lines), keysDoc(), {}, /no valid header/);
+    lines = L();
+    lines[0].format = "something-else";
+    expectFail("a header of another format", joinLines(lines), keysDoc(), {}, /no valid header/);
+    // A signed checkpoint sitting exactly at the slice's anchor must agree with the anchor hash the first entry links to.
+    const wrongAnchor = await checkpointFor(KEY, ORG, { seq: 10, hash: "ab".repeat(32) }, "2026-10-01T00:00:10Z");
+    expectFail("a signed checkpoint at the anchor that disagrees with the anchor hash", exportText(ORG, chain30.slice(10, 30), [wrongAnchor, cp20, cp30]), keysDoc(), {}, /hash differs from the slice's anchor/);
+    assert.equal(run(exportText(ORG, chain30.slice(10, 30), [cp10, cp20, cp30])).exit, 0, "and the same slice with the genuine anchor checkpoint verifies");
+});
+test("export: every structural rule of an entry's payload is enforced, with the hash recomputed so only that rule can fail", () => {
+    // Three valid entries; the third one's payload is altered and its hash recomputed, so the chain links and hashes all hold.
+    const withPayload = (mutate) => {
+        const c = chain30.slice(0, 3).map((r) => clone(r));
+        const last = c[2];
+        last.payload = mutate(last.payload, last) ?? last.payload;
+        last.hash = V.entryHash(last.prevHash, last.payload);
+        return exportText(ORG, c, []);
+    };
+    const cases = [
+        ["payload.seq differs from the entry's seq", (p) => { p.seq = 99; }, /payload seq 99 does not match/],
+        ["payload.seq of another type", (p) => { p.seq = "3"; }, /payload seq "3" does not match/],
+        ["payload version 2", (p) => { p.v = 2; }, /version is not 1/],
+        ["payload of another org", (p) => { p.orgId = "org_evil"; }, /belongs to another org/],
+        ["an extra top-level payload field", (p) => { p.extra = 1; }, /missing or unknown fields/],
+        ["a missing top-level payload field", (p) => { delete p.at; }, /missing or unknown fields/],
+        ["an empty ref", (p, row) => { p.ref = ""; row.refId = ""; }, /ref is missing/],
+        ["a malformed timestamp", (p) => { p.at = "yesterday"; }, /timestamp is malformed/],
+        ["data that is an array", (p) => { p.data = []; }, /data is not an object/],
+        ["a payload that is not an object", () => "[1]", /payload is not an object/],
+        ["a missing vpn_event data field", (p) => { delete p.data.agentId; }, /vpn_event data has missing or unknown fields/],
+        ["an empty vpn_event type", (p) => { p.data.type = ""; }, /vpn_event type is malformed/],
+        ["a vpn_event type longer than 64", (p) => { p.data.type = "t".repeat(65); }, /vpn_event type is malformed/],
+        ["a vpn_event type that is not a string", (p) => { p.data.type = 7; }, /vpn_event type is malformed/],
+        ["a vpn_event tunnelId that is a number", (p) => { p.data.tunnelId = 7; }, /vpn_event field is malformed/],
+        ["a vpn_event buildId longer than 128", (p) => { p.data.buildId = "b".repeat(129); }, /vpn_event field is malformed/],
+        ["a vpn_event agentId that is an object", (p) => { p.data.agentId = {}; }, /vpn_event field is malformed/],
+        ["a vpn_event detail longer than 2000", (p) => { p.data.detail = "d".repeat(2001); }, /vpn_event field is malformed/],
+    ];
+    for (const [name, mutate, re] of cases) {
+        // A string payload (the "[1]" case) is hashed as the text it is.
+        expectFail(name, withPayload(mutate), keysDoc(), {}, re);
+    }
+    // Null is a legal value for the nullable fields, and a 2000-character detail is the longest allowed.
+    assert.equal(run(withPayload((p) => { p.data.detail = "d".repeat(2000); p.data.tunnelId = null; })).exit, 3);
+});
+test("export: --pin-head catches a history rewritten by someone who holds the signing key", async () => {
+    // The operator rewrites entry 5 and re-signs every checkpoint: it verifies as authentic...
+    const forgedChain = await vpnChain(ORG, 30, (i, d) => { if (i === 4)
+        d.detail = "FORGED"; });
+    const forged = exportText(ORG, forgedChain, [
+        await checkpointFor(KEY, ORG, forgedChain[9], "2026-10-01T00:00:10Z"),
+        await checkpointFor(KEY, ORG, forgedChain[19], "2026-10-01T00:00:20Z"),
+        await checkpointFor(KEY, ORG, forgedChain[29], "2026-10-01T00:00:30Z"),
+    ]);
+    assert.equal(run(forged).exit, 0, "without a saved head, a consistent re-signed rewrite is indistinguishable");
+    // ...but not against a head the customer kept from the genuine export.
+    for (const pin of [chain30[9].hash, `10:${chain30[9].hash}`, `30:${chain30[29].hash}`]) {
+        assert.equal(run(GOOD, keysDoc(), { pinHead: pin }).exit, 0, `genuine export vs pin ${pin.slice(0, 12)}`);
+        assert.equal(run(forged, keysDoc(), { pinHead: pin }).exit, 1, `forged export vs pin ${pin.slice(0, 12)}`);
+    }
+    expectFail("a pin with the right hash at the wrong seq", GOOD, keysDoc(), { pinHead: `11:${chain30[9].hash}` }, /NOT in this chain/);
+    expectFail("a malformed pin", GOOD, keysDoc(), { pinHead: "not-a-hash" }, /--pin-head must be/);
+    assert.match(run(GOOD).notes.join("\n"), /no --pin-head given/);
+});
+// ---------------------------------------------------------------- evidence bundle (port of the spike's 26 mutation tests)
+const CONTROL_RESULTS = (failing) => [
+    ["NET-01", "network", "direct TCP connect to a public IP (no proxy)", "blocked"],
+    ["NET-02", "network", "direct HTTPS with the proxy environment bypassed", "blocked"],
+    ["NET-06", "network", "non-allow-listed host via the HTTP proxy", "403 from proxy"],
+    ["SEC-01", "secrets", "read the agent config", "blocked"],
+    ["SEC-13", "secrets", "sudo -n true", "blocked"],
+    ["FUNC-01", "function", "reach the LAN canary through the proxy", "allowed"],
+].map(([id, category, title, expect], i) => ({
+    id, category, title, expect,
+    verdict: failing && i === 2 ? "fail" : i === 5 && !failing ? "pass" : "pass",
+    reason: failing && i === 2 ? "reached the host through the proxy" : "as expected",
+    control: { ran: true, ok: true, exit: 0 },
+    observed: { exit: 1, timedOut: false, durationMs: 12 + i },
+}));
+const CONN_LOG = [
+    { dest: "10.20.0.5:443", route: "tunnel", decision: "allow", bytesUp: 1200, bytesDown: 88000 },
+    { dest: "10.20.0.5:443", route: "tunnel", decision: "allow", bytesUp: 300, bytesDown: 4000 },
+    { dest: "127.0.0.1:52730", route: "none", decision: "deny", bytesUp: 0, bytesDown: 0 },
+    { dest: "169.254.169.254:80", route: "none", decision: "deny", bytesUp: 0, bytesDown: 0 },
+    { dest: "one.one.one.one:443", route: "none", decision: "deny", bytesUp: 0, bytesDown: 0 },
+].map((r, i) => ({ n: i + 1, ...r }));
+async function makeBundle(buildId, issuedAt, opts = {}) {
+    const chain = [];
+    for (let i = 0; i < 40; i++) {
+        const data = vpnData(i, { buildId: `bld_old${Math.floor(i / 4)}` });
+        if (opts.forkHistory && i === 5)
+            data.detail = "FORGED";
+        await appendEntry(chain, ORG, "vpn_event", `evt_h${i}`, at(i), data);
+    }
+    const anchor = { seq: chain[39].seq, hash: chain[39].hash };
+    for (const [i, type] of ["lock_acquired", "tunnel_up", "lock_released"].entries()) {
+        await appendEntry(chain, ORG, "vpn_event", `evt_${buildId}_${i}`, "2026-10-02T14:00:01Z", { type, tunnelId: "tun_1", buildId, agentId: "agt_1", detail: null });
+    }
+    const head = chain[chain.length - 1];
+    const results = opts.noControls ? [] : CONTROL_RESULTS(!!opts.violation);
+    const summary = opts.badControlSummary ? { ...V.summariseControls(results), pass: 99 } : V.summariseControls(results);
+    const egressPolicy = { v: 1, mode: "tunnel-only", lanCidrs: ["10.20.0.0/16"], allowedDomains: ["*.corp.acme.example"], directEgress: "deny", sshViaProxyOnly: true };
+    const destinations = V.summariseConnections(CONN_LOG);
+    if (opts.badSummary)
+        destinations[0].bytesUp += 1;
+    const doc = {
+        type: "appforge.vpn.build-attestation", version: 1, id: `att_${buildId}`, issuedAt, completeness: opts.completeness ?? "full",
+        subject: { orgId: opts.subjectOrgId ?? ORG, appId: "app_1", buildId, workflow: "vpn-compliance-check", commitSha: "0123456789abcdef0123456789abcdef01234567", tunnelId: "tun_1" },
+        policy: { egressPolicy, egressPolicySha256: opts.badPolicyHash ? "0".repeat(64) : V.sha256hex(V.canonicalize(egressPolicy)) },
+        connections: {
+            totals: { allowed: 2, denied: 3, errors: 0, bytesUp: 1500, bytesDown: 92000 }, destinations, logRecords: CONN_LOG.length,
+            logSha256: V.sha256hex(CONN_LOG.map((r) => V.canonicalize(r)).join("\n") + "\n"),
+        },
+        controlTests: opts.noControls ? undefined : { packVersion: "1", phase: "preflight", results, summary, resultsSha256: opts.badResultsSha ? "0".repeat(64) : V.sha256hex(V.canonicalize(results)) },
+        auditChain: { headSeq: head.seq, headHash: opts.badHeadHash ? "0".repeat(64) : head.hash },
+        result: { buildStatus: opts.violation ? "aborted_control_failure" : "succeeded", controlsVerdict: opts.noControls ? "not_evaluated" : opts.violation ? "violations_detected" : "all_enforced" },
+    };
+    if (opts.noControls)
+        delete doc.controlTests;
+    const docSha = V.sha256hex(V.canonicalize(doc));
+    await appendEntry(chain, ORG, opts.regKind ?? "attestation", doc.id, issuedAt, { buildId: opts.regBuildId ?? buildId, docSha256: opts.regDocSha ?? docSha, keyId: KEY.kid });
+    const cp = await checkpointFor(KEY, ORG, chain[chain.length - 1], issuedAt);
+    const slice = chain.filter((r) => r.seq > anchor.seq).map(({ seq, prevHash, hash, payload }) => ({ seq, prevHash, hash, payload }));
+    return {
+        format: "appforge-evidence-bundle", version: 1,
+        attestation: { doc, signatures: [{ alg: "Ed25519", keyId: KEY.kid, role: "server", signature: await signWithDomain(KEY.signer, ATTESTATION_DOMAIN, doc) }] },
+        auditChain: { orgId: ORG, anchor, entries: slice, checkpoints: [cp] },
+        connectionLog: { encoding: "records", records: CONN_LOG.map((r) => ({ ...r })) },
+    };
+}
+const CLEAN = await makeBundle("bld_ok_0001", "2026-10-02T14:03:50Z");
+const VIOLATION = await makeBundle("bld_bad_0002", "2026-10-02T15:10:50Z", { violation: true });
+const seenFailing = new Set();
+const seenChecks = new Set();
+function expectBundle(name, bundle, want, o = {}) {
+    const r = V.verifyBundle(bundle, o.keys ?? keysDoc(), o.opts ?? {});
+    for (const [n, ok] of r.checks) {
+        seenChecks.add(n);
+        if (!ok)
+            seenFailing.add(n);
+    }
+    assert.equal(r.exit, want, `${name}: want exit ${want}, got ${r.exit} (${r.problems.join("; ")})`);
+    return r;
+}
+test("bundle: untouched evidence verifies; a recorded violation is authentic but exit 2; no controls / degraded is exit 3", async () => {
+    expectBundle("untouched clean bundle", CLEAN, 0);
+    expectBundle("untouched violation bundle: authentic, violation recorded", VIOLATION, 2);
+    expectBundle("legitimately signed but degraded attestation", await makeBundle("bld_deg", "2026-10-02T16:00:00Z", { completeness: "server_observed_only" }), 3);
+    expectBundle("attestation without control tests", await makeBundle("bld_nc", "2026-10-02T16:10:00Z", { noControls: true }), 3);
+});
+test("bundle: every way of altering the evidence is caught (port of the evidence spike's 26 mutation tests)", async () => {
+    let b;
+    b = clone(VIOLATION);
+    b.attestation.doc.controlTests.results.find((x) => x.verdict === "fail").verdict = "pass";
+    expectBundle("1 flip a FAIL control-test verdict to PASS", b, 1);
+    b = clone(VIOLATION);
+    const ct = b.attestation.doc.controlTests;
+    ct.results.find((x) => x.verdict === "fail").verdict = "pass";
+    ct.summary = { pass: ct.summary.pass + 1, fail: ct.summary.fail - 1, inconclusive: ct.summary.inconclusive };
+    ct.resultsSha256 = V.sha256hex(V.canonicalize(ct.results));
+    expectBundle("2 flip the verdict AND fix summary and hash (the signature must still catch it)", b, 1);
+    b = clone(CLEAN);
+    b.attestation.doc.connections.destinations[0].bytesUp += 1;
+    expectBundle("3 change a per-destination byte count in the signed doc", b, 1);
+    b = clone(CLEAN);
+    b.connectionLog.records[0].bytesUp += 5;
+    expectBundle("4 change a raw connection-log record", b, 1);
+    b = clone(CLEAN);
+    b.connectionLog.records = b.connectionLog.records.filter((r) => r.decision !== "deny");
+    expectBundle("5 delete the denied connections from the raw log", b, 1);
+    b = clone(CLEAN);
+    b.auditChain.entries.splice(3, 1);
+    expectBundle("6 remove one chain entry", b, 1);
+    b = clone(CLEAN);
+    [b.auditChain.entries[2], b.auditChain.entries[3]] = [b.auditChain.entries[3], b.auditChain.entries[2]];
+    expectBundle("7 reorder two chain entries", b, 1);
+    b = clone(CLEAN);
+    b.auditChain.entries[1].payload.data.detail = "edited";
+    expectBundle("8 edit an event payload inside the chain", b, 1);
+    b = clone(CLEAN);
+    b.auditChain.entries[1].payload.data.detail = "edited";
+    b.auditChain.entries[1].hash = V.entryHash(b.auditChain.entries[1].prevHash, b.auditChain.entries[1].payload);
+    expectBundle("9 edit an event AND recompute its hash (the next link breaks)", b, 1);
+    b = clone(CLEAN);
+    b.attestation.doc.subject.commitSha = "f".repeat(40);
+    expectBundle("10 change the commit sha in the attestation", b, 1);
+    b = clone(CLEAN);
+    b.attestation.doc.subject.buildId = "bld_other";
+    expectBundle("11 replay the attestation under another buildId", b, 1);
+    b = clone(CLEAN);
+    b.attestation.signatures = [];
+    expectBundle("12 strip the signatures", b, 1);
+    b = clone(CLEAN);
+    b.attestation.signatures[0].signature = Buffer.alloc(64, 7).toString("base64");
+    expectBundle("13 garbage signature", b, 1);
+    expectBundle("14 verify with a different (untrusted) key set", CLEAN, 1, { keys: [OTHER.entry] });
+    b = clone(CLEAN);
+    b.auditChain.checkpoints = [];
+    expectBundle("15 remove the signed checkpoint", b, 1);
+    b = clone(CLEAN);
+    b.auditChain.checkpoints[0].hash = "0".repeat(64);
+    expectBundle("16 tamper the checkpoint hash", b, 1);
+    b = clone(CLEAN);
+    b.auditChain.checkpoints[0].issuedAt = "2026-10-03T00:00:00Z";
+    expectBundle("17 tamper the checkpoint issuedAt (inside the signed statement)", b, 1);
+    b = clone(CLEAN);
+    b.attestation.doc.policy.egressPolicy.directEgress = "allow";
+    expectBundle("18 loosen the inlined egress policy", b, 1);
+    expectBundle("19 key revoked BEFORE the attestation was issued", CLEAN, 1, { keys: [{ ...KEY.entry, status: "revoked", revokedAt: "2026-10-01T00:00:00Z" }] });
+    expectBundle("20 key revoked AFTER issue time (still valid for this document)", CLEAN, 0, { keys: [{ ...KEY.entry, status: "revoked", revokedAt: "2026-10-03T00:00:00Z" }] });
+    expectBundle("21 key expired before issue time", CLEAN, 1, { keys: [{ ...KEY.entry, status: "retired", notAfter: "2026-10-02T00:00:00Z" }] });
+    const forged = await makeBundle("bld_ok_0001", "2026-10-02T14:03:50Z", { forkHistory: true });
+    expectBundle("22 forged history, operator re-signed: without a pin it looks authentic", forged, 0);
+    expectBundle("23 forged history vs the anchor hash the customer saved earlier -> caught", forged, 1, { opts: { pinHead: CLEAN.auditChain.anchor.hash } });
+    expectBundle("24 the genuine bundle vs the same pinned hash -> still fine", CLEAN, 0, { opts: { pinHead: CLEAN.auditChain.anchor.hash } });
+    // The attestation signature moved onto a checkpoint-style statement, and a checkpoint signature reused as the attestation's.
+    b = clone(CLEAN);
+    b.attestation.signatures[0].signature = await signWithDomain(KEY.signer, "appforge-checkpoint-v1\n", b.attestation.doc);
+    expectBundle("25 attestation signature made under the checkpoint domain", b, 1);
+    b = clone(CLEAN);
+    b.auditChain.orgId = "org_evil";
+    expectBundle("26 chain presented for another org", b, 1);
+    // Extras that are not in the spike's list.
+    b = clone(CLEAN);
+    b.auditChain.anchor = null;
+    expectBundle("27 anchor removed from a slice that does not start at genesis", b, 1);
+    b = clone(CLEAN);
+    b.auditChain.entries[b.auditChain.entries.length - 1].payload.data.docSha256 = "0".repeat(64);
+    expectBundle("28 the chain's registration of the attestation edited", b, 1);
+    b = clone(CLEAN);
+    b.auditChain.entries.pop();
+    expectBundle("29 the registering entry (and so the checkpoint's seq) cut off", b, 1);
+    b = clone(CLEAN);
+    b.format = "something-else";
+    expectBundle("30 wrong bundle format", b, 1);
+    expectBundle("31 empty trusted key set", CLEAN, 1, { keys: [] });
+    b = clone(CLEAN);
+    b.attestation.doc.connections.logSha256 = "0".repeat(64);
+    expectBundle("32 log hash edited in the document", b, 1);
+});
+/** A bundle that must fail, for the stated reason: the message AND the named check must both say so, so a second check cannot be what is hiding a removed one. */
+function expectBundleFails(name, bundle, problem, failedCheck, o = {}) {
+    const r = V.verifyBundle(bundle, o.keys ?? keysDoc(), o.opts ?? {});
+    for (const [n, ok] of r.checks) {
+        seenChecks.add(n);
+        if (!ok)
+            seenFailing.add(n);
+    }
+    assert.equal(r.exit, 1, `${name}: want exit 1, got ${r.exit} (${r.problems.join("; ")})`);
+    assert.match(r.problems.join("\n"), problem, name);
+    if (failedCheck !== null)
+        assert.ok(r.checks.some(([n, ok]) => n === failedCheck && !ok), `${name}: check "${failedCheck}" should have failed; failed: ${r.checks.filter(([, ok]) => !ok).map(([n]) => n).join(" | ")}`);
+}
+const C_SERVER = "attestation signed by a trusted server key valid at issue time";
+const C_CHAIN = "hash chain recomputes from anchor to head";
+const C_REGISTERED = "attestation is registered in the chain (docSha256 matches)";
+const C_CPS = "signed checkpoint(s) verify and match the chain";
+const C_LOGHASH = "connection log sha256 matches the attestation";
+const C_LOGSUM = "per-destination summary recomputes from the raw log";
+const C_CONTROLS = "control-test summary and resultsSha256 recompute";
+const C_POLICY = "egress policy hash matches the inlined policy";
+test("bundle: each check is pinned on its own, by a bundle whose ONLY defect is that one (the signatures and hashes are all valid)", async () => {
+    let b;
+    // A signature by a key the verifier trusts, over the right document, but not in the server role.
+    b = clone(CLEAN);
+    b.attestation.signatures[0].role = "agent";
+    expectBundleFails("an agent-role signature alone", b, /no valid server signature/, C_SERVER);
+    b = clone(CLEAN);
+    b.attestation.signatures[0].role = undefined;
+    expectBundleFails("a signature with no role", b, /no valid server signature/, C_SERVER);
+    b = clone(CLEAN);
+    b.attestation.signatures = [{ ...b.attestation.signatures[0], role: "agent" }, { ...b.attestation.signatures[0], signature: Buffer.alloc(64, 7).toString("base64") }];
+    expectBundleFails("a valid agent signature next to a garbage server one", b, /signature does not verify/, C_SERVER);
+    b = clone(CLEAN);
+    b.attestation.signatures = [{ ...b.attestation.signatures[0], role: "agent" }, { ...b.attestation.signatures[0] }];
+    expectBundle("an agent signature next to the valid server one is fine", b, 0);
+    // The chain belongs to the org the document is about.
+    expectBundleFails("a validly signed document about another org, shipped with this org's chain", await makeBundle("bld_org", "2026-10-02T16:20:00Z", { subjectOrgId: "org_other" }), /audit chain missing or belongs to a different org/, C_CHAIN);
+    b = clone(CLEAN);
+    delete b.auditChain;
+    expectBundleFails("no audit chain at all", b, /audit chain missing/, C_CHAIN);
+    // The chain registers THIS attestation: kind, build and document hash.
+    expectBundleFails("the registration entry carries another document hash", await makeBundle("bld_reg1", "2026-10-02T16:30:00Z", { regDocSha: "ab".repeat(32) }), /does not contain this exact attestation/, C_REGISTERED);
+    expectBundleFails("the registration entry carries another build", await makeBundle("bld_reg2", "2026-10-02T16:31:00Z", { regBuildId: "bld_other" }), /does not contain this exact attestation/, C_REGISTERED);
+    expectBundleFails("the registration entry is of another kind", await makeBundle("bld_reg3", "2026-10-02T16:32:00Z", { regKind: "gap" }), /does not contain this exact attestation/, C_REGISTERED);
+    expectBundleFails("a signed head hash that is not the chain's head entry", await makeBundle("bld_head", "2026-10-02T16:33:00Z", { badHeadHash: true }), /chain head is not in the supplied chain/, "attestation's audit-chain head exists in the chain and matches");
+    // Checkpoints: at least one must verify and cover the slice.
+    b = clone(CLEAN);
+    b.auditChain.checkpoints = [];
+    expectBundleFails("no checkpoint at all", b, /no signed checkpoint covers this chain slice/, C_CPS);
+    b = clone(CLEAN);
+    delete b.auditChain.checkpoints;
+    expectBundleFails("no checkpoints field", b, /no signed checkpoint covers this chain slice/, C_CPS);
+    // A checkpoint at the anchor is genuine but covers none of the slice's entries.
+    b = clone(CLEAN);
+    b.auditChain.checkpoints = [await checkpointFor(KEY, ORG, b.auditChain.anchor, "2026-10-02T14:03:50Z")];
+    expectBundleFails("only a checkpoint at the anchor (before the attestation)", b, /no checkpoint at or after the attestation's chain head/, "a checkpoint covers the attestation's head or later");
+    // The slice: anchor and entries.
+    b = clone(CLEAN);
+    b.auditChain.anchor = null;
+    expectBundleFails("no anchor, and not starting at seq 1", b, /no anchor and does not start at seq 1/, C_CHAIN);
+    b = clone(CLEAN);
+    b.auditChain.anchor = { seq: "40", hash: b.auditChain.anchor.hash };
+    expectBundleFails("an anchor whose seq is not an integer", b, /chain anchor is malformed/, C_CHAIN);
+    b = clone(CLEAN);
+    b.auditChain.anchor = { seq: 40, hash: "xyz" };
+    expectBundleFails("an anchor whose hash is not hex", b, /chain anchor is malformed/, C_CHAIN);
+    b = clone(CLEAN);
+    b.auditChain.entries = [];
+    expectBundleFails("an empty slice", b, /the slice contains no entries/, C_CHAIN);
+    // Derived data inside the SIGNED document must recompute from the raw data.
+    expectBundleFails("a signed per-destination summary that disagrees with the raw log", await makeBundle("bld_sum", "2026-10-02T16:40:00Z", { badSummary: true }), /per-destination summary does not match the raw connection log/, C_LOGSUM);
+    expectBundleFails("a signed control summary that disagrees with the results", await makeBundle("bld_ctl1", "2026-10-02T16:41:00Z", { badControlSummary: true }), /control-test summary does not match the individual results/, C_CONTROLS);
+    expectBundleFails("a signed resultsSha256 that disagrees with the results", await makeBundle("bld_ctl2", "2026-10-02T16:42:00Z", { badResultsSha: true }), /control-test summary does not match the individual results/, C_CONTROLS);
+    expectBundleFails("a signed egress policy hash that disagrees with the inlined policy", await makeBundle("bld_pol", "2026-10-02T16:43:00Z", { badPolicyHash: true }), /egress policy hash does not match the inlined policy/, C_POLICY);
+    b = clone(CLEAN);
+    b.connectionLog.records[0].bytesUp += 1;
+    expectBundleFails("a raw log record changed", b, /connection log was altered \(sha256 mismatch\)/, C_LOGHASH);
+    // A bundle with no raw log checks only the signed summary, and says so.
+    b = clone(CLEAN);
+    delete b.connectionLog;
+    expectBundle("no raw connection log is not a failure", b, 0);
+});
+test("bundle: the checks are exhaustive - no check the verifier performs is untested for failure", () => {
+    // Re-run the clean bundle with a pin so the pin check is listed, then compare with everything seen failing above.
+    expectBundle("clean with pin", CLEAN, 0, { opts: { pinHead: CLEAN.auditChain.anchor.hash } });
+    const never = [...seenChecks].filter((c) => !seenFailing.has(c));
+    assert.deepEqual(never, [], `these checks never failed in any mutation, so nothing proves they can: ${never.join(" | ")}`);
+    assert.ok(seenChecks.size >= 10, "the bundle verifier reports its checks");
+    // Check names are fixed text, never built from the file, which is why they need no escaping of their own when printed.
+    for (const n of seenChecks)
+        assert.ok(!/[^\x20-\x7e]/.test(n), `check name must be plain printable ASCII: ${JSON.stringify(n)}`);
+});
+test("export: the same exhaustiveness rule - every check of the export verifier is seen failing", async () => {
+    const names = new Set(run(GOOD, keysDoc(), { pinHead: chain30[9].hash }).checks.map(([n]) => n));
+    const failing = new Set();
+    const probe = (text, keys = keysDoc(), opts = {}) => { for (const [n, ok] of run(text, keys, opts).checks)
+        if (!ok)
+            failing.add(n); };
+    const lines = parseLines(GOOD);
+    probe(GOOD.replace("\n", "\nnot json\n"));
+    probe(joinLines(lines.slice(1)));
+    probe(joinLines(lines.slice(0, -1)));
+    const gap = clone(lines);
+    gap.splice(gap.findIndex((l) => l.type === "entry" && l.seq === 9), 1);
+    probe(joinLines(gap));
+    const cut = lines.filter((l) => !(l.type === "entry" && l.seq > 25));
+    probe(joinLines(cut));
+    probe(GOOD, [OTHER.entry]);
+    probe(GOOD, keysDoc(), { pinHead: "ab".repeat(32) });
+    const never = [...names].filter((n) => !failing.has(n));
+    assert.deepEqual(never, [], `export checks never seen failing: ${never.join(" | ")}`);
+    for (const n of names)
+        assert.ok(!/[^\x20-\x7e]/.test(n), `check name must be plain printable ASCII: ${JSON.stringify(n)}`);
+});
+// ---------------------------------------------------------------- printable HTML and --render-check
+async function renderedHtml(bundle) {
+    return V.renderEvidenceHtml(bundle, { docSha256: V.sha256hex(V.canonicalize(bundle.attestation.doc)) });
+}
+test("html: the embedded JSON verifies, and --render-check proves the visible text is what the JSON says", async () => {
+    const html = await renderedHtml(CLEAN);
+    assert.deepEqual(V.renderCheck(html), []);
+    assert.deepEqual(V.detectInput(html).bundle, CLEAN);
+    expectBundle("bundle read back out of the page", V.detectInput(html).bundle, 0);
+    // The page shows the verdict derived from the JSON.
+    assert.match(html, /All network and isolation controls were enforced/);
+    assert.match(await renderedHtml(VIOLATION), /Control violations were detected/);
+    // Known limitation, stated by the test: editing the visible text is invisible to the JSON verifier...
+    const lie = html.replace("All network and isolation controls were enforced", "ALL GOOD, TRUST US");
+    assert.notEqual(lie, html);
+    expectBundle("JSON of the edited page still verifies (the limitation)", V.detectInput(lie).bundle, 0);
+    // ...which is exactly what --render-check closes.
+    assert.match(V.renderCheck(lie).join("\n"), /does not match a re-render/);
+    const edits = [
+        ["a destination row", html.replace(/(<td class="mono">127\.0\.0\.1:52730<\/td><td>none<\/td><td>)deny/, "$1allow")],
+        ["a control-test verdict cell", html.replace(/>PASS<\/td>/, ">FAIL</td>")],
+        ["the document hash shown", html.replace(/Document sha256<\/dt><dd><code>[0-9a-f]{64}/, "Document sha256</dt><dd><code>" + "0".repeat(64))],
+        ["an appended paragraph", html.replace("</main>", "<p>Independently audited.</p></main>")],
+    ];
+    for (const [name, edited] of edits) {
+        assert.notEqual(edited, html, name);
+        assert.notEqual(V.renderCheck(edited).length, 0, `render-check must catch: ${name}`);
+    }
+    // Two embedded blocks, or none, are refused rather than "first one wins".
+    const block = html.match(/<script type="application\/json" id="appforge-evidence">[\s\S]*?<\/script>/)[0];
+    assert.match(V.renderCheck(html.replace("</main>", `${block}</main>`)).join("\n"), /more than one embedded/);
+    assert.match(V.renderCheck(html.replace(block, "")).join("\n"), /no embedded appforge-evidence block/);
+    assert.throws(() => V.detectInput(html.replace("</main>", `${block}</main>`)), /more than one/);
+    // The embedded JSON is escaped so a hostile string cannot close the script tag.
+    const hostile = clone(CLEAN);
+    hostile.attestation.doc.subject.workflow = "</script><script>alert(1)</script>";
+    const hostileHtml = await renderedHtml(hostile);
+    assert.ok(!/<script>alert/.test(hostileHtml));
+});
+// ---------------------------------------------------------------- the command line
+function cli(args, files = {}) {
+    const dir = mkdtempSync(join(tmpdir(), "appforge-verify-"));
+    try {
+        for (const [name, body] of Object.entries(files))
+            writeFileSync(join(dir, name), body);
+        const argv = args.map((a) => (a.startsWith("@") ? join(dir, a.slice(1)) : a));
+        const res = spawnSync(process.execPath, [SCRIPT, ...argv], { encoding: "utf8", cwd: dir });
+        return { status: res.status, out: res.stdout, err: res.stderr };
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+test("cli: exit codes are 0 / 1 / 2 / 3 / 64 as documented, for exports, bundles and pages", async () => {
+    const keys = JSON.stringify(keyList);
+    assert.equal(cli(["@export.ndjson", "--keys", "@keys.json"], { "export.ndjson": GOOD, "keys.json": keys }).status, 0);
+    assert.equal(cli(["@export.ndjson", "--keys", "@keys.json"], { "export.ndjson": exportText(ORG, chain30, [cp10, cp20]), "keys.json": keys }).status, 3);
+    assert.equal(cli(["@export.ndjson", "--keys", "@keys.json", "--allow-unsigned-tail"], { "export.ndjson": exportText(ORG, chain30, [cp10, cp20]), "keys.json": keys }).status, 0);
+    const broken = parseLines(GOOD);
+    broken.splice(5, 1);
+    assert.equal(cli(["@export.ndjson", "--keys", "@keys.json"], { "export.ndjson": joinLines(broken), "keys.json": keys }).status, 1);
+    assert.equal(cli(["@bundle.json", "--keys", "@keys.json"], { "bundle.json": JSON.stringify(CLEAN), "keys.json": keys }).status, 0);
+    assert.equal(cli(["@bundle.json", "--keys", "@keys.json"], { "bundle.json": JSON.stringify(VIOLATION, null, 2), "keys.json": keys }).status, 2);
+    assert.equal(cli(["@page.html", "--keys", "@keys.json", "--render-check"], { "page.html": await renderedHtml(CLEAN), "keys.json": keys }).status, 0);
+    // Unreadable / missing input and bad key files fail closed (1), usage errors are 64.
+    assert.equal(cli(["@missing.ndjson", "--keys", "@keys.json"], { "keys.json": keys }).status, 1);
+    assert.equal(cli(["@export.ndjson", "--keys", "@keys.json"], { "export.ndjson": GOOD, "keys.json": "{not json" }).status, 1);
+    assert.equal(cli([]).status, 64);
+    assert.equal(cli(["a", "b"]).status, 64);
+    assert.equal(cli(["@export.ndjson", "--bogus"], { "export.ndjson": GOOD }).status, 64);
+    assert.equal(cli(["@export.ndjson", "--keys"], { "export.ndjson": GOOD }).status, 64);
+    assert.equal(cli(["@export.ndjson", "--keys", "@keys.json", "--render-check"], { "export.ndjson": GOOD, "keys.json": keys }).status, 64);
+});
+test("cli: --render-check fails a page whose visible text was edited, and plain verification does not (the documented limitation)", async () => {
+    const keys = JSON.stringify(keyList);
+    const lie = (await renderedHtml(CLEAN)).replace("All network and isolation controls were enforced", "ALL GOOD, TRUST US");
+    const plain = cli(["@page.html", "--keys", "@keys.json"], { "page.html": lie, "keys.json": keys });
+    assert.equal(plain.status, 0);
+    assert.match(plain.out, /NOT authenticated, only its embedded JSON/);
+    const checked = cli(["@page.html", "--keys", "@keys.json", "--render-check"], { "page.html": lie, "keys.json": keys });
+    assert.equal(checked.status, 1);
+    assert.match(checked.out, /does not match a re-render/);
+});
+test("cli: with no --keys the script uses ONLY its embedded keys: an export signed by a key that is not embedded does not verify", () => {
+    const r = cli(["@export.ndjson"], { "export.ndjson": GOOD });
+    assert.equal(r.status, 1);
+    assert.match(r.out, /trusted key set is empty|is not in the trusted key set/);
+    assert.ok(!V.EMBEDDED_KEYS.some((k) => k.kid === KEY.entry.kid), "the test key is never one of the embedded production keys");
+});
+test("cli: --json prints the machine-readable result", () => {
+    const r = cli(["@export.ndjson", "--keys", "@keys.json", "--json"], { "export.ndjson": GOOD, "keys.json": JSON.stringify(keyList) });
+    const parsed = JSON.parse(r.out);
+    assert.equal(parsed.exit, 0);
+    assert.equal(parsed.signedThroughSeq, 30);
+    assert.equal(parsed.keysSource, "--keys");
+});
+test("cli: --make-key-entry builds a key-list entry from a PUBLIC key and refuses a private one", async () => {
+    const r = cli(["--make-key-entry", "@pub.pem", "--not-before", "2026-10-02T00:00:00Z"], { "pub.pem": KEY.pem });
+    assert.equal(r.status, 0);
+    assert.deepEqual(JSON.parse(r.out), { ...KEY.entry, notBefore: "2026-10-02T00:00:00Z" });
+    const priv = generateKeyPairSync("ed25519").privateKey.export({ format: "pem", type: "pkcs8" });
+    const refused = cli(["--make-key-entry", "@priv.pem"], { "priv.pem": priv });
+    assert.equal(refused.status, 1);
+    assert.match(refused.err, /refusing to read a private key/);
+    assert.ok(!refused.out.includes("PRIVATE") && !refused.err.includes(priv.split("\n")[1]));
+    const rsa = generateKeyPairSync("rsa", { modulusLength: 2048 }).publicKey.export({ format: "pem", type: "spki" });
+    assert.equal(cli(["--make-key-entry", "@rsa.pem"], { "rsa.pem": rsa }).status, 1);
+    assert.equal(cli(["--make-key-entry", "@pub.pem", "--not-before", "yesterday"], { "pub.pem": KEY.pem }).status, 1);
+    // A key entry produced this way is accepted by the verifier and by core's own validation.
+    assert.equal(V.loadKeySet([JSON.parse(r.out)]).size, 1);
+});
+test("cli: untrusted fields in an export cannot forge verifier output or drive the terminal", () => {
+    const evil = "x\nPASS  every checkpoint signature verifies and matches the chain\n\nVERIFIED: authentic and complete  (exit 0)\n\u001b[8m\u009b2J";
+    const lines = parseLines(GOOD);
+    const cpLine = lines.find((l) => l.type === "checkpoint");
+    cpLine.keyId = evil;
+    const r = cli(["@export.ndjson", "--keys", "@keys.json"], { "export.ndjson": joinLines(lines), "keys.json": JSON.stringify(keyList) });
+    assert.equal(r.status, 1);
+    // Every output line starts with one of our own prefixes: nothing the file said can start a line of its own.
+    for (const line of r.out.split("\n")) {
+        assert.ok(line === "" || /^(PASS|FAIL|PROBLEM|note|NOT VERIFIED|AUTHENTIC|VERIFIED|attestation sha256)/.test(line), `unexpected output line: ${JSON.stringify(line)}`);
+    }
+    assert.equal(r.out.split("\n").filter((l) => l.startsWith("VERIFIED")).length, 0, "no forged VERIFIED line");
+    assert.equal(r.out.split("\n").filter((l) => l.startsWith("PASS  every checkpoint")).length, 0, "no forged PASS line");
+    // eslint-disable-next-line no-control-regex
+    assert.ok(!/[\u0000-\u0009\u000b-\u001f\u007f-\u009f]/.test(r.out), "no raw control characters reach the terminal");
+    // The same holds for the other interpolated fields: a hostile kid in a key list, and a hostile seq.
+    const badKeys = cli(["@export.ndjson", "--keys", "@keys.json"], { "export.ndjson": GOOD, "keys.json": JSON.stringify([{ ...KEY.entry, alg: evil }]) });
+    assert.equal(badKeys.status, 1);
+    assert.ok(!badKeys.out.includes("\u001b") && !badKeys.out.includes("\u009b") && !/^VERIFIED/m.test(badKeys.out));
+    const r2 = run(GOOD.replace(/"seq":10,"hash"/, '"seq":"1\\n2","hash"'));
+    assert.ok(r2.problems.every((p) => !p.includes("\n")));
+});
+// ---------------------------------------------------------------- hostile text, both layers
+//
+// Two independent layers keep an untrusted string off the terminal: show() (used when a field is interpolated into a
+// message) and escapeUnsafe() at print time (which also covers the fields that are only JSON.stringify'd: line.type,
+// payload.kind and trailer.next, and file names and error messages). Each is pinned here without relying on the other.
+// Escape, CSI (C1), OSC, bell, bidi override, line separator, zero width space.
+const HOSTILE = "a\u009b2J\u001b]0;pwn\u0007\u202egnp.exe\u2028\u200b";
+// Everything but \n, which is ours.
+// eslint-disable-next-line no-control-regex
+const UNSAFE = /[\u0000-\u0009\u000b-\u001f\u007f-\u009f\u00ad\u061c\u200b-\u200f\u2028-\u202e\u2060-\u206f\ufeff\ufff9-\ufffb]/;
+const OURS = /^(PASS|FAIL|PROBLEM|note|NOT VERIFIED|AUTHENTIC|VERIFIED|attestation sha256|usage:|\s+appforge-verify)/;
+function assertTerminalSafe(name, r, expectEscaped) {
+    assert.ok(!UNSAFE.test(r.out), `${name}: raw unsafe character on stdout: ${JSON.stringify(r.out)}`);
+    assert.ok(!UNSAFE.test(r.err), `${name}: raw unsafe character on stderr: ${JSON.stringify(r.err)}`);
+    assert.match(r.out + r.err, expectEscaped, `${name}: the hostile text should be shown escaped, not dropped`);
+    // On stdout every line starts with one of our own prefixes: nothing the file said can start a line of its own.
+    for (const line of r.out.split("\n"))
+        assert.ok(line === "" || OURS.test(line), `${name}: unexpected output line ${JSON.stringify(line)}`);
+}
+test("cli: fields that are not run through show() (line.type, payload.kind, trailer.next, file names, option names) are still escaped when printed", async () => {
+    const keys = JSON.stringify(keyList);
+    const files = (text) => ({ "export.ndjson": text, "keys.json": keys });
+    // line.type: "unknown line type" prints JSON.stringify(type), which leaves C1, bidi and U+2028 as they are.
+    const lines = parseLines(GOOD);
+    lines.splice(1, 0, { type: HOSTILE });
+    let r = cli(["@export.ndjson", "--keys", "@keys.json"], files(joinLines(lines)));
+    assert.equal(r.status, 1);
+    assert.match(r.out, /unknown line type/);
+    assertTerminalSafe("line.type", r, /\\u009b2J.*\\u202e/);
+    // payload.kind: a validly hashed entry of a hostile kind.
+    const evilKind = chain30.slice(0, 3);
+    await appendEntry(evilKind, ORG, HOSTILE, "x", at(3), { a: 1 });
+    r = cli(["@export.ndjson", "--keys", "@keys.json"], files(exportText(ORG, evilKind, [])));
+    assert.equal(r.status, 1);
+    assert.match(r.out, /is not known to this verifier/);
+    assertTerminalSafe("payload.kind", r, /\\u009b2J.*\\u202e/);
+    // trailer.next: the "more pages exist" note prints it.
+    r = cli(["@export.ndjson", "--keys", "@keys.json"], files(exportText(ORG, chain30.slice(0, 10), [cp10], { next: HOSTILE })));
+    assert.equal(r.status, 3);
+    assert.match(r.out, /more pages exist/);
+    assertTerminalSafe("trailer.next", r, /\\u009b2J.*\\u202e/);
+    // A hostile option name, a hostile input path (the read error names it) and a hostile --make-key-entry path.
+    r = cli([`--${HOSTILE}`]);
+    assert.equal(r.status, 64);
+    assertTerminalSafe("option name", r, /unknown option/);
+    r = cli([HOSTILE, "--keys", "@keys.json"], { "keys.json": keys });
+    assert.equal(r.status, 1);
+    assertTerminalSafe("input path", r, /\\u009b2J.*\\u202e/);
+    r = cli(["--make-key-entry", HOSTILE]);
+    assert.equal(r.status, 1);
+    assertTerminalSafe("key entry path", r, /\\u009b2J.*\\u202e/);
+});
+test("export: values interpolated into a message are escaped by show() itself, before anything is printed", async () => {
+    const safe = (name, r) => {
+        for (const m of [...r.problems, ...r.notes]) {
+            assert.ok(!UNSAFE.test(m), `${name}: message has a raw unsafe character: ${JSON.stringify(m)}`);
+            assert.ok(!m.includes("\n"), `${name}: message spans lines: ${JSON.stringify(m)}`);
+        }
+        assert.ok(r.problems.length > 0, `${name}: expected a problem to inspect`);
+    };
+    // The signing key id named by a checkpoint.
+    let lines = parseLines(GOOD);
+    lines.find((l) => l.type === "checkpoint").keyId = HOSTILE;
+    let r = run(joinLines(lines));
+    assert.match(r.problems.join("\n"), /not in the trusted key set/);
+    safe("keyId", r);
+    // A checkpoint seq, an entry seq.
+    lines = parseLines(GOOD);
+    lines.find((l) => l.type === "checkpoint").seq = HOSTILE;
+    r = run(joinLines(lines));
+    assert.match(r.problems.join("\n"), /malformed/);
+    safe("checkpoint seq", r);
+    lines = parseLines(GOOD);
+    lines.find((l) => l.type === "entry" && l.seq === 3).seq = HOSTILE;
+    r = run(joinLines(lines));
+    assert.match(r.problems.join("\n"), /is malformed/);
+    safe("entry seq", r);
+    // Fields of a key list: algorithm, kid, an unknown field name, a bad time.
+    for (const [name, entry, re] of [
+        ["alg", { ...KEY.entry, alg: HOSTILE }, /unsupported algorithm/],
+        ["unknown field", { ...KEY.entry, [HOSTILE]: 1 }, /unknown field/],
+        ["notBefore", { ...KEY.entry, notBefore: HOSTILE }, /notBefore must be/],
+        ["status", { ...KEY.entry, status: HOSTILE }, /status must be/],
+    ]) {
+        r = run(GOOD, [entry]);
+        assert.match(r.problems.join("\n"), re, name);
+        safe(`key ${name}`, r);
+    }
+    r = run(GOOD, [{ ...KEY.entry, kid: HOSTILE, publicKey: "AAAA" }]);
+    safe("key kid", r);
+    // A hostile key id never reaches a message unescaped through a bundle either.
+    const b = clone(CLEAN);
+    b.attestation.signatures[0].keyId = HOSTILE;
+    b.attestation.signatures[0].role = HOSTILE;
+    const br = V.verifyBundle(b, keysDoc(), {});
+    assert.match(br.problems.join("\n"), /not in the trusted key set/);
+    safe("bundle signature role/keyId", br);
+});
+//# sourceMappingURL=appforge-verify.test.js.map