@slicedearth/whoisleuth-cli 1.32.0

package/cli/errors.mjs

@@ -0,0 +1,21 @@
+const MAX_CLI_ERROR_MESSAGE_LENGTH = 300;
+class CliUsageError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CliUsageError';
+    }
+}
+function errorMessage(error) {
+    if (error && typeof error === 'object' && 'message' in error)
+        return error.message;
+    return undefined;
+}
+function boundedCliErrorMessage(error, fallback = 'Unexpected command failure') {
+    return String(errorMessage(error) || error || fallback)
+        .replace(/[\x00-\x1f\x7f]+/g, ' ')
+        .replace(/[\u061c\u200b-\u200f\u202a-\u202e\u2060-\u2069\ufeff]/g, '')
+        .replace(/\s+/g, ' ')
+        .trim()
+        .slice(0, MAX_CLI_ERROR_MESSAGE_LENGTH) || fallback;
+}
+export { CliUsageError, MAX_CLI_ERROR_MESSAGE_LENGTH, boundedCliErrorMessage };

package/cli/evidence-command-arguments.mjs

@@ -0,0 +1,145 @@
+import { CliUsageError } from "./errors.mjs";
+export function parseInspectArchiveArguments(argv) {
+    let source = null;
+    let passphraseSource = null;
+    let search = null;
+    let reveal = false;
+    let requireMatch = false;
+    let output = 'terminal';
+    let quiet = false;
+    let color = true;
+    for (let index = 0; index < argv.length; index++) {
+        const argument = argv[index];
+        if (argument === undefined)
+            break;
+        if (argument === '--json') {
+            if (output !== 'terminal')
+                throw new CliUsageError('--json may be supplied only once.');
+            output = 'json';
+        }
+        else if (argument === '--passphrase-file') {
+            if (passphraseSource !== null)
+                throw new CliUsageError('--passphrase-file may be supplied only once.');
+            const value = argv[++index];
+            if (!value || value.startsWith('-'))
+                throw new CliUsageError('--passphrase-file requires one bounded UTF-8 file.');
+            passphraseSource = value;
+        }
+        else if (argument === '--search') {
+            if (search !== null)
+                throw new CliUsageError('--search may be supplied only once.');
+            const value = argv[++index];
+            if (!value || value.startsWith('-'))
+                throw new CliUsageError('--search requires one exact bounded value.');
+            search = value;
+        }
+        else if (argument === '--reveal') {
+            if (reveal)
+                throw new CliUsageError('--reveal may be supplied only once.');
+            reveal = true;
+        }
+        else if (argument === '--require-match') {
+            if (requireMatch)
+                throw new CliUsageError('--require-match may be supplied only once.');
+            requireMatch = true;
+        }
+        else if (argument === '--quiet')
+            quiet = true;
+        else if (argument === '--no-color')
+            color = false;
+        else if (argument.startsWith('-'))
+            throw new CliUsageError(`Unknown option "${argument}".`);
+        else if (source === null)
+            source = argument;
+        else
+            throw new CliUsageError('inspect-archive accepts one optional JSON file. Otherwise pipe one archive on stdin.');
+    }
+    if (reveal && search === null)
+        throw new CliUsageError('--reveal requires --search.');
+    if (requireMatch && search === null)
+        throw new CliUsageError('--require-match requires --search.');
+    if (quiet && output !== 'terminal')
+        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
+    return {
+        action: 'inspect-archive',
+        source,
+        passphraseSource,
+        search,
+        reveal,
+        requireMatch,
+        output,
+        quiet,
+        color,
+    };
+}
+export function parseSignArtifactArguments(argv) {
+    let source = null;
+    let privateKeySource = null;
+    for (let index = 0; index < argv.length; index++) {
+        const argument = argv[index];
+        if (argument === undefined)
+            break;
+        if (argument === '--private-key-file') {
+            if (privateKeySource !== null)
+                throw new CliUsageError('--private-key-file may be supplied only once.');
+            const value = argv[++index];
+            if (!value || value.startsWith('-'))
+                throw new CliUsageError('--private-key-file requires one bounded PEM file.');
+            privateKeySource = value;
+        }
+        else if (argument.startsWith('-'))
+            throw new CliUsageError(`Unknown option "${argument}".`);
+        else if (source === null)
+            source = argument;
+        else
+            throw new CliUsageError('sign-artifact accepts one optional JSON file. Otherwise pipe one artifact on stdin.');
+    }
+    if (!privateKeySource)
+        throw new CliUsageError('sign-artifact requires --private-key-file.');
+    return { action: 'sign-artifact', source, privateKeySource };
+}
+export function parseVerifySignatureArguments(argv) {
+    let source = null;
+    let publicKeySource = null;
+    let output = 'terminal';
+    let quiet = false;
+    let color = true;
+    for (let index = 0; index < argv.length; index++) {
+        const argument = argv[index];
+        if (argument === undefined)
+            break;
+        if (argument === '--json') {
+            if (output !== 'terminal')
+                throw new CliUsageError('--json may be supplied only once.');
+            output = 'json';
+        }
+        else if (argument === '--public-key-file') {
+            if (publicKeySource !== null)
+                throw new CliUsageError('--public-key-file may be supplied only once.');
+            const value = argv[++index];
+            if (!value || value.startsWith('-'))
+                throw new CliUsageError('--public-key-file requires one bounded PEM file.');
+            publicKeySource = value;
+        }
+        else if (argument === '--quiet')
+            quiet = true;
+        else if (argument === '--no-color')
+            color = false;
+        else if (argument.startsWith('-'))
+            throw new CliUsageError(`Unknown option "${argument}".`);
+        else if (source === null)
+            source = argument;
+        else
+            throw new CliUsageError('verify-signature accepts one optional JSON file. Otherwise pipe one package on stdin.');
+    }
+    if (quiet && output !== 'terminal')
+        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
+    return {
+        action: 'verify-signature',
+        source,
+        publicKeySource,
+        output,
+        quiet,
+        color,
+    };
+}

package/cli/evidence-command-runner.mjs

@@ -0,0 +1,106 @@
+import { createReadStream } from 'node:fs';
+import { MAX_OFFLINE_ARTIFACT_BYTES, MAX_OFFLINE_PASSPHRASE_FILE_BYTES, } from "./artifact-verify.mjs";
+import { formatArchiveInspection, inspectWorkspaceArchive, } from "./archive-inspect.mjs";
+import { MAX_SIGNING_KEY_FILE_BYTES, formatEvidenceSignatureVerification, signEvidencePackage, verifyEvidencePackageSignature, } from "./evidence-signing.mjs";
+import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
+import EXIT_CODES from "./exit-codes.mjs";
+import { formatJsonDocument } from "./formatters/json.mjs";
+import { readSavedLookupInputBounded, } from "./saved-lookup.mjs";
+export function isEvidenceCommand(args) {
+    return args.action === 'inspect-archive'
+        || args.action === 'sign-artifact'
+        || args.action === 'verify-signature';
+}
+export function evidenceCommandFailureLabel(action) {
+    if (action === 'inspect-archive')
+        return 'Archive inspection';
+    if (action === 'sign-artifact')
+        return 'Evidence signing';
+    return 'Evidence signature verification';
+}
+async function readArtifact(source, label, dependencies) {
+    try {
+        return dependencies.readArtifactInput
+            ? await dependencies.readArtifactInput(source)
+            : await readSavedLookupInputBounded(source
+                ? createReadStream(source, { highWaterMark: 64 * 1024 })
+                : dependencies.stdin, {
+                limit: MAX_OFFLINE_ARTIFACT_BYTES,
+                label,
+            });
+    }
+    catch (error) {
+        if (error instanceof CliUsageError)
+            throw error;
+        throw new CliUsageError(`Could not read ${label.toLowerCase()}: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+    }
+}
+async function readKey(source, label, injected) {
+    try {
+        return injected
+            ? await injected(source)
+            : await readSavedLookupInputBounded(createReadStream(source, { highWaterMark: MAX_SIGNING_KEY_FILE_BYTES }), { limit: MAX_SIGNING_KEY_FILE_BYTES, label });
+    }
+    catch (error) {
+        if (error instanceof CliUsageError)
+            throw error;
+        throw new CliUsageError(`Could not read ${label.toLowerCase()}: ${boundedCliErrorMessage(error, 'File could not be read')}`);
+    }
+}
+async function readPassphrase(source, dependencies) {
+    const passphraseText = dependencies.readPassphraseFile
+        ? await dependencies.readPassphraseFile(source)
+        : await readSavedLookupInputBounded(createReadStream(source, { highWaterMark: MAX_OFFLINE_PASSPHRASE_FILE_BYTES }), { limit: MAX_OFFLINE_PASSPHRASE_FILE_BYTES, label: 'Passphrase file' });
+    const passphrase = passphraseText.replace(/\r?\n$/u, '');
+    if (!passphrase || /[\r\n\u0000]/u.test(passphrase)) {
+        throw new CliUsageError('Passphrase file must contain exactly one non-empty UTF-8 line.');
+    }
+    return passphrase;
+}
+export async function runEvidenceCommand(args, dependencies) {
+    if (args.action === 'inspect-archive') {
+        const input = await readArtifact(args.source, 'Archive input', dependencies);
+        if (!input.trim()) {
+            throw new CliUsageError('inspect-archive requires one workspace archive file or an archive on stdin.');
+        }
+        const passphrase = args.passphraseSource
+            ? await readPassphrase(args.passphraseSource, dependencies)
+            : null;
+        const report = await inspectWorkspaceArchive(input, {
+            passphrase,
+            search: args.search,
+            reveal: args.reveal,
+            requireMatch: args.requireMatch,
+        });
+        if (!args.quiet) {
+            dependencies.stdout.write(args.output === 'json'
+                ? formatJsonDocument(report)
+                : formatArchiveInspection(report));
+        }
+        return EXIT_CODES.SUCCESS;
+    }
+    if (args.action === 'sign-artifact') {
+        const input = await readArtifact(args.source, 'Evidence artifact input', dependencies);
+        if (!input.trim()) {
+            throw new CliUsageError('sign-artifact requires one reviewed artifact file or an artifact on stdin.');
+        }
+        const privateKey = await readKey(args.privateKeySource, 'Private key file', dependencies.readPrivateKeyFile);
+        const signed = await signEvidencePackage(input, privateKey, dependencies.now ? dependencies.now() : new Date().toISOString());
+        dependencies.stdout.write(formatJsonDocument(signed));
+        return EXIT_CODES.SUCCESS;
+    }
+    const input = await readArtifact(args.source, 'Signed evidence package input', dependencies);
+    if (!input.trim()) {
+        throw new CliUsageError('verify-signature requires one signed package file or a package on stdin.');
+    }
+    const publicKey = args.publicKeySource
+        ? await readKey(args.publicKeySource, 'Public key file', dependencies.readPublicKeyFile)
+        : null;
+    const report = await verifyEvidencePackageSignature(input, publicKey);
+    if (!args.quiet) {
+        dependencies.stdout.write(args.output === 'json'
+            ? formatJsonDocument(report)
+            : formatEvidenceSignatureVerification(report));
+    }
+    return EXIT_CODES.SUCCESS;
+}

package/cli/evidence-signing.mjs

@@ -0,0 +1,215 @@
+import { Buffer } from 'node:buffer';
+import { createHash, createPrivateKey, createPublicKey, sign, verify, } from 'node:crypto';
+import { canonicalArtifactJson } from "../frontend/src/lib/analysis/artifact-integrity.js";
+import { MAX_OFFLINE_ARTIFACT_BYTES, verifyOfflineArtifact, } from "./artifact-verify.mjs";
+export const SIGNED_EVIDENCE_PACKAGE_SCHEMA = 'whoisleuth.signed-evidence-package';
+export const SIGNED_EVIDENCE_PACKAGE_VERSION = 1;
+export const EVIDENCE_SIGNATURE_ALGORITHM = 'Ed25519';
+export const EVIDENCE_SIGNATURE_CANONICALIZATION = 'sorted-json-v1';
+export const MAX_SIGNING_KEY_FILE_BYTES = 16 * 1024;
+const SHA256_RE = /^[a-f0-9]{64}$/u;
+const BASE64_RE = /^[A-Za-z0-9+/]+={0,2}$/u;
+const PACKAGE_KEYS = new Set(['schema', 'version', 'signedAt', 'artifact', 'signature']);
+const SIGNATURE_KEYS = new Set([
+    'algorithm',
+    'canonicalization',
+    'publicKeySpkiDerBase64',
+    'keyIdSha256',
+    'valueBase64',
+]);
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function parseObject(raw, label) {
+    if (typeof raw !== 'string')
+        throw new TypeError(`${label} must be UTF-8 JSON text.`);
+    const bytes = Buffer.byteLength(raw, 'utf8');
+    if (bytes === 0 || bytes > MAX_OFFLINE_ARTIFACT_BYTES) {
+        throw new TypeError(`${label} must be between 1 byte and ${MAX_OFFLINE_ARTIFACT_BYTES} bytes.`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new TypeError(`${label} must be valid JSON.`);
+    }
+    const value = record(parsed);
+    if (!value)
+        throw new TypeError(`${label} must contain one JSON object.`);
+    return value;
+}
+function hasExactKeys(value, expected) {
+    const keys = Object.keys(value);
+    return keys.length === expected.size && keys.every((key) => expected.has(key));
+}
+function timestamp(value) {
+    if (typeof value !== 'string' || value.length > 64) {
+        throw new TypeError('Signature time must be a valid timestamp.');
+    }
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed))
+        throw new TypeError('Signature time must be a valid timestamp.');
+    return new Date(parsed).toISOString();
+}
+function importPrivateKey(pem) {
+    if (Buffer.byteLength(pem, 'utf8') > MAX_SIGNING_KEY_FILE_BYTES) {
+        throw new TypeError(`Private key file exceeds ${MAX_SIGNING_KEY_FILE_BYTES} bytes.`);
+    }
+    let key;
+    try {
+        key = createPrivateKey(pem);
+    }
+    catch {
+        throw new TypeError('Private key file must contain one readable PEM private key.');
+    }
+    if (key.asymmetricKeyType !== 'ed25519') {
+        throw new TypeError('Evidence signing requires an Ed25519 private key.');
+    }
+    return key;
+}
+function importPublicKey(value, label) {
+    if (Buffer.byteLength(value) > MAX_SIGNING_KEY_FILE_BYTES) {
+        throw new TypeError(`${label} exceeds ${MAX_SIGNING_KEY_FILE_BYTES} bytes.`);
+    }
+    let key;
+    try {
+        key = Buffer.isBuffer(value)
+            ? createPublicKey({ key: value, format: 'der', type: 'spki' })
+            : createPublicKey(value);
+    }
+    catch {
+        throw new TypeError(`${label} must contain one readable Ed25519 public key.`);
+    }
+    if (key.asymmetricKeyType !== 'ed25519')
+        throw new TypeError(`${label} must be an Ed25519 public key.`);
+    return key;
+}
+function spkiDer(key) {
+    const publicKey = key.type === 'public'
+        ? key
+        : createPublicKey(key.export({ type: 'pkcs8', format: 'pem' }));
+    return publicKey.export({ type: 'spki', format: 'der' });
+}
+function keyId(publicDer) {
+    return createHash('sha256').update(publicDer).digest('hex');
+}
+function payloadBytes(payload) {
+    return Buffer.from(canonicalArtifactJson(payload), 'utf8');
+}
+async function signableArtifact(raw) {
+    const artifact = parseObject(raw, 'Evidence artifact');
+    const verification = await verifyOfflineArtifact(raw);
+    if (!['case_response_packet', 'signed_review_artifact'].includes(verification.artifact.kind)) {
+        throw new TypeError('Only reviewed response packets and supported review manifests can be signed.');
+    }
+    return { artifact, verification };
+}
+export async function signEvidencePackage(raw, privateKeyPem, signedAt = new Date().toISOString()) {
+    const { artifact } = await signableArtifact(raw);
+    const privateKey = importPrivateKey(privateKeyPem);
+    const publicDer = spkiDer(privateKey);
+    const payload = Object.freeze({
+        schema: SIGNED_EVIDENCE_PACKAGE_SCHEMA,
+        version: SIGNED_EVIDENCE_PACKAGE_VERSION,
+        signedAt: timestamp(signedAt),
+        artifact,
+    });
+    return Object.freeze({
+        ...payload,
+        signature: Object.freeze({
+            algorithm: EVIDENCE_SIGNATURE_ALGORITHM,
+            canonicalization: EVIDENCE_SIGNATURE_CANONICALIZATION,
+            publicKeySpkiDerBase64: publicDer.toString('base64'),
+            keyIdSha256: keyId(publicDer),
+            valueBase64: sign(null, payloadBytes(payload), privateKey).toString('base64'),
+        }),
+    });
+}
+export async function verifyEvidencePackageSignature(raw, trustedPublicKeyPem) {
+    const value = parseObject(raw, 'Signed evidence package');
+    const signature = record(value.signature);
+    const artifact = record(value.artifact);
+    if (!hasExactKeys(value, PACKAGE_KEYS)
+        || value.schema !== SIGNED_EVIDENCE_PACKAGE_SCHEMA
+        || value.version !== SIGNED_EVIDENCE_PACKAGE_VERSION
+        || !artifact
+        || !signature
+        || !hasExactKeys(signature, SIGNATURE_KEYS)
+        || signature.algorithm !== EVIDENCE_SIGNATURE_ALGORITHM
+        || signature.canonicalization !== EVIDENCE_SIGNATURE_CANONICALIZATION
+        || typeof signature.publicKeySpkiDerBase64 !== 'string'
+        || signature.publicKeySpkiDerBase64.length > 4096
+        || !BASE64_RE.test(signature.publicKeySpkiDerBase64)
+        || typeof signature.valueBase64 !== 'string'
+        || signature.valueBase64.length > 4096
+        || !BASE64_RE.test(signature.valueBase64)
+        || typeof signature.keyIdSha256 !== 'string'
+        || !SHA256_RE.test(signature.keyIdSha256)) {
+        throw new TypeError('Signed evidence package has an unsupported or malformed envelope.');
+    }
+    const signedAt = timestamp(value.signedAt);
+    const publicDer = Buffer.from(signature.publicKeySpkiDerBase64, 'base64');
+    if (keyId(publicDer) !== signature.keyIdSha256) {
+        throw new TypeError('Signed evidence package public-key identifier does not match its embedded key.');
+    }
+    const embeddedPublicKey = importPublicKey(publicDer, 'Embedded evidence-signing public key');
+    const payload = {
+        schema: SIGNED_EVIDENCE_PACKAGE_SCHEMA,
+        version: SIGNED_EVIDENCE_PACKAGE_VERSION,
+        signedAt,
+        artifact,
+    };
+    const signatureBytes = Buffer.from(signature.valueBase64, 'base64');
+    if (signatureBytes.length !== 64
+        || !verify(null, payloadBytes(payload), embeddedPublicKey, signatureBytes)) {
+        throw new TypeError('Signed evidence package failed Ed25519 verification.');
+    }
+    const artifactVerification = await verifyOfflineArtifact(JSON.stringify(artifact));
+    let publicKeyMatched = null;
+    if (trustedPublicKeyPem) {
+        const trustedDer = spkiDer(importPublicKey(trustedPublicKeyPem, 'Trusted public key file'));
+        publicKeyMatched = trustedDer.equals(publicDer);
+        if (!publicKeyMatched)
+            throw new TypeError('Signed evidence package does not match the trusted public key.');
+    }
+    return Object.freeze({
+        schema: 'whoisleuth.evidence-signature-verification',
+        version: 1,
+        valid: true,
+        state: 'signature_valid',
+        signerTrust: trustedPublicKeyPem ? 'trusted_key' : 'embedded_key_only',
+        signedAt,
+        keyIdSha256: signature.keyIdSha256,
+        publicKeyMatched,
+        artifact: Object.freeze({
+            schema: artifactVerification.artifact.schema,
+            version: artifactVerification.artifact.version,
+            kind: artifactVerification.artifact.kind,
+        }),
+        limitations: Object.freeze([
+            trustedPublicKeyPem
+                ? 'The signature and supplied public key match; recipient trust still depends on obtaining that public key through an authenticated channel.'
+                : 'The signature is internally valid for the embedded public key, but signer identity was not authenticated because no trusted public key was supplied.',
+            'The signature authenticates the canonical sorted-JSON content, not the original whitespace, indentation, or object-key order of the serialized file.',
+            'A valid signature proves the canonical package content has not changed since signing; it does not establish that the retained observations or analyst statements are accurate.',
+            'WHOISleuth does not generate, store, recover, rotate, or publish signing keys.',
+        ]),
+    });
+}
+export function formatEvidenceSignatureVerification(report) {
+    const lines = [
+        'WHOISleuth evidence signature verification',
+        `State: ${report.state}`,
+        `Signer trust: ${report.signerTrust}`,
+        `Artifact: ${report.artifact.kind} · ${report.artifact.schema} v${report.artifact.version}`,
+        `Signed: ${report.signedAt}`,
+        `Key ID: sha256:${report.keyIdSha256}`,
+        `Trusted public key: ${report.publicKeyMatched === null ? 'not supplied' : 'matched'}`,
+    ];
+    for (const limitation of report.limitations)
+        lines.push(`Limitation: ${limitation}`);
+    return `${lines.join('\n')}\n`;
+}

package/cli/exit-codes.mjs

@@ -0,0 +1,9 @@
+const EXIT_CODES = Object.freeze({
+    SUCCESS: 0,
+    USAGE: 2,
+    LOOKUP_FAILED: 3,
+    PARTIAL_FAILURE: 4,
+    INTERNAL_ERROR: 70,
+    CANCELLED: 130,
+});
+export default EXIT_CODES;

package/cli/export-evidence.mjs

@@ -0,0 +1,28 @@
+import { projectCliLookupComparisonInput } from "./compare.mjs";
+import { parseSavedLookupDocument } from "./saved-lookup.mjs";
+function objectOrNull(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+}
+function buildCliEvidenceExport(text, evidenceModule, generatedAt = new Date().toISOString()) {
+    const source = parseSavedLookupDocument(text, { label: 'Evidence export input' });
+    // Revalidate every normalized field consumed by the shared comparison
+    // model. Raw source payloads are retained deliberately, but remain bounded
+    // by the saved-document byte ceiling and are never interpreted here.
+    projectCliLookupComparisonInput(source);
+    const dependency = objectOrNull(evidenceModule);
+    if (!dependency || typeof dependency.buildLookupEvidence !== 'function') {
+        throw new TypeError('Lookup evidence export dependency is required.');
+    }
+    const buildLookupEvidence = dependency.buildLookupEvidence;
+    const result = objectOrNull(buildLookupEvidence(source, { generatedAt, idnAnalysis: null }));
+    if (!result
+        || result.schema !== dependency.LOOKUP_EVIDENCE_SCHEMA
+        || result.schemaVersion !== dependency.LOOKUP_EVIDENCE_SCHEMA_VERSION) {
+        throw new TypeError('Lookup evidence builder returned an unsupported report contract.');
+    }
+    return result;
+}
+function formatCliEvidenceExport(document, compact = false) {
+    return `${JSON.stringify(document, null, compact ? 0 : 2)}\n`;
+}
+export { buildCliEvidenceExport, formatCliEvidenceExport };

package/cli/formatters/evidence-report.mjs

@@ -0,0 +1,3 @@
+// Compatibility re-export for CLI consumers. The bounded projection is shared
+// with the browser-local readable Lookup report.
+export * from "../../lib/evidence-report.mjs";

package/cli/formatters/html.mjs

@@ -0,0 +1,69 @@
+import { buildLookupEvidenceReport, cleanReportText } from "./evidence-report.mjs";
+function escapeHtml(value, fallback = 'Not reported') {
+    return cleanReportText(value, fallback)
+        .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+}
+function renderFields(fields) {
+    return `<dl class="fields">${fields.map((field) => `<div><dt>${escapeHtml(field.label)}</dt><dd>${escapeHtml(field.value)}</dd></div>`).join('')}</dl>`;
+}
+function renderGroups(groups) {
+    return `<div class="card-grid">${groups.map((group) => `<section class="card"><h3>${escapeHtml(group.title)}</h3>${renderFields(group.fields)}</section>`).join('')}</div>`;
+}
+function renderComparison(comparison) {
+    if (!comparison.fields.length)
+        return '<p class="empty">No comparable normalized fields were published.</p>';
+    const rows = comparison.fields.map((field) => `<tr><th scope="row">${escapeHtml(field.label)}</th><td><span class="status">${escapeHtml(field.status)}</span></td><td>${escapeHtml(field.rdap)}</td><td>${escapeHtml(field.whois)}</td></tr>`).join('');
+    const omitted = comparison.omitted
+        ? `<p class="omission">${escapeHtml(comparison.omitted)} additional comparison fields omitted.</p>`
+        : '';
+    return `<div class="table-scroll"><table><caption>Normalized registry publication comparison</caption><thead><tr><th scope="col">Field</th><th scope="col">Result</th><th scope="col">RDAP</th><th scope="col">WHOIS</th></tr></thead><tbody>${rows}</tbody></table></div>${omitted}`;
+}
+function renderRegistrarComparison(comparison) {
+    const rows = comparison.fields.map((field) => `<tr><th scope="row">${escapeHtml(field.label)}</th><td><span class="status">${escapeHtml(field.status)}</span></td><td>${escapeHtml(field.registry)}</td><td>${escapeHtml(field.registrar)}</td></tr>`).join('');
+    const omitted = comparison.omitted
+        ? `<p class="omission">${escapeHtml(comparison.omitted)} additional comparison fields omitted.</p>`
+        : '';
+    return `<div class="table-scroll"><table><caption>Normalized registry and registrar RDAP publication comparison</caption><thead><tr><th scope="col">Field</th><th scope="col">Result</th><th scope="col">Registry RDAP</th><th scope="col">Registrar RDAP</th></tr></thead><tbody>${rows}</tbody></table></div>${omitted}`;
+}
+function formatLookupEvidenceHtml(document) {
+    const report = buildLookupEvidenceReport(document);
+    const title = `Lookup evidence report — ${report.title}`;
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'">
+  <meta name="referrer" content="no-referrer">
+  <title>${escapeHtml(title)}</title>
+  <style>
+    :root{color-scheme:dark;--bg:#07110d;--panel:#0d1b15;--panel2:#10241b;--line:#254837;--text:#d8f5e4;--muted:#91b7a0;--accent:#6dff9d;--shadow:rgba(0,0,0,.28)}
+    *{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--text);font:15px/1.55 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}main{width:min(1120px,calc(100% - 32px));margin:0 auto;padding:42px 0 64px}header{border:1px solid var(--line);background:linear-gradient(145deg,var(--panel2),var(--panel));padding:28px;box-shadow:0 18px 50px var(--shadow)}h1,h2,h3{line-height:1.2;margin:0;color:var(--accent)}h1{font-size:clamp(1.5rem,4vw,2.35rem);overflow-wrap:anywhere}h2{font-size:1.22rem;margin-bottom:16px}h3{font-size:1rem;margin-bottom:12px}.eyebrow{margin:0 0 10px;color:var(--muted);letter-spacing:.12em;text-transform:uppercase}.notice{margin:18px 0 0;color:var(--muted);max-width:85ch}.block{margin-top:24px;border:1px solid var(--line);background:var(--panel);padding:22px}.fields{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:0 24px;margin:0}.fields div{display:grid;grid-template-columns:minmax(130px,.8fr) minmax(0,1.6fr);gap:12px;border-top:1px solid var(--line);padding:9px 0}.fields div:first-child,.fields div:nth-child(2){border-top:0}.fields dt{color:var(--muted)}.fields dd{margin:0;overflow-wrap:anywhere}.card-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,320px),1fr));gap:16px}.card{border:1px solid var(--line);background:var(--panel2);padding:18px}.card .fields{display:block}.card .fields div{grid-template-columns:minmax(120px,.8fr) minmax(0,1.4fr)}.card .fields div:nth-child(2){border-top:1px solid var(--line)}.table-scroll{overflow-x:auto}table{width:100%;border-collapse:collapse;min-width:720px}caption{text-align:left;color:var(--muted);padding:0 0 10px}th,td{border:1px solid var(--line);padding:9px 10px;text-align:left;vertical-align:top;overflow-wrap:anywhere}thead th{background:var(--panel2);color:var(--accent)}tbody th{color:var(--text)}.status{white-space:nowrap;color:var(--accent)}.empty,.omission{color:var(--muted)}ul{margin:0;padding-left:22px}li+li{margin-top:8px}footer{margin-top:24px;color:var(--muted);font-size:.88rem;text-align:center}
+    @media(max-width:700px){main{width:min(100% - 20px,1120px);padding-top:16px}header,.block{padding:17px}.fields{display:block}.fields div,.card .fields div{grid-template-columns:1fr;gap:2px}.fields div:nth-child(2){border-top:1px solid var(--line)}}
+    @media print{:root{color-scheme:light;--bg:#fff;--panel:#fff;--panel2:#f5f7f5;--line:#b9c5bd;--text:#17231b;--muted:#46564b;--accent:#155c2f;--shadow:transparent}body{font:10pt/1.42 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}main{width:100%;padding:0}header,.block,.card{box-shadow:none;break-inside:avoid}.block{margin-top:12px}}
+  </style>
+</head>
+<body>
+<main>
+  <header>
+    <p class="eyebrow">WHOISleuth evidence</p>
+    <h1>${escapeHtml(title)}</h1>
+    <p class="notice">${escapeHtml(report.notice)}</p>
+    ${renderFields(report.metadata)}
+  </header>
+  <section class="block"><h2>Query</h2>${renderFields(report.query)}</section>
+  <section class="block"><h2>Assessment</h2>${renderFields(report.assessment)}</section>
+  <section class="block"><h2>Registry sources</h2>${renderGroups(report.registryGroups)}</section>
+  <section class="block"><h2>Registry-source comparison</h2>${renderFields(report.comparison.health)}${renderComparison(report.comparison)}</section>
+  ${report.registrarComparison.fields.length ? `<section class="block"><h2>Registry / registrar RDAP comparison</h2>${renderFields(report.registrarComparison.health)}${renderRegistrarComparison(report.registrarComparison)}</section>` : ''}
+  <section class="block"><h2>Network evidence</h2>${renderGroups(report.networkGroups)}</section>
+  <section class="block"><h2>Collection diagnostics</h2>${renderFields(report.diagnostics)}</section>
+  <section class="block"><h2>Limitations</h2><ul>${report.limitations.map((item) => `<li>${escapeHtml(item)}</li>`).join('')}</ul></section>
+  <footer>Offline, self-contained report. No scripts, forms, external resources, or active links are included.</footer>
+</main>
+</body>
+</html>
+`;
+}
+export { escapeHtml, formatLookupEvidenceHtml };