enigma-memory 0.1.0

package/scripts/validate-cloudflare-credentials.mjs

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+import { writeFile, mkdir } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { dirname } from 'node:path';
+import { applyCloudflareSecretEnvFile } from './cloudflare-secret-env.mjs';
+
+export const CLOUDFLARE_CREDENTIALS_RESULT_SCHEMA = 'enigma.cloudflare_credentials_result.v1';
+
+const REQUIRED_KEYS = Object.freeze(['CLOUDFLARE_API_TOKEN', 'CLOUDFLARE_ACCOUNT_ID']);
+const SECRET_OUTPUT_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|sk-[A-Za-z0-9_-]{16,}|https?:\/\/[^\s/@]+:[^\s/@]+@|AKIA[0-9A-Z]{16})/iu;
+
+function parseArgs(argv = process.argv.slice(2)) {
+  const out = { envFile: null, out: null, help: false };
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    const readValue = () => {
+      const value = argv[index + 1];
+      if (typeof value !== 'string' || value.length === 0 || value.startsWith('--')) throw new Error(`${token} requires a value`);
+      index += 1;
+      return value;
+    };
+    if (token === '--cloudflare-env-file') out.envFile = readValue();
+    else if (typeof token === 'string' && token.startsWith('--cloudflare-env-file=')) out.envFile = token.slice('--cloudflare-env-file='.length);
+    else if (token === '--out') out.out = readValue();
+    else if (token === '--help' || token === '-h') out.help = true;
+    else throw new Error(`Unknown Cloudflare credential validator option: ${token}`);
+  }
+  return out;
+}
+
+function usage() {
+  return 'Usage: node scripts/validate-cloudflare-credentials.mjs [--cloudflare-env-file <file>] [--out <file>]\n\nValidates Cloudflare credential presence without printing token values, account ids, or local paths.\n';
+}
+
+function assertPublicSafe(result) {
+  const text = JSON.stringify(result);
+  if (SECRET_OUTPUT_RE.test(text)) throw new Error('Cloudflare credential result contains secret-looking material');
+  if (/[A-Za-z]:[\\/]/u.test(text)) throw new Error('Cloudflare credential result contains a local path');
+  return true;
+}
+
+export async function validateCloudflareCredentials(options = {}) {
+  let loaded;
+  try {
+    loaded = await applyCloudflareSecretEnvFile(options.env ?? process.env, {
+      path: options.envFile ?? null,
+      includePath: false,
+    });
+  } catch (error) {
+    const result = {
+      schema: CLOUDFLARE_CREDENTIALS_RESULT_SCHEMA,
+      ok: false,
+      credentials_present: false,
+      source_loaded: false,
+      present_keys: [],
+      loaded_key_count: 0,
+      missing_keys: REQUIRED_KEYS,
+      blockers: ['Cloudflare secret env file could not be read or parsed'],
+      token_value_printed: false,
+      account_id_printed: false,
+      claim_boundary: [
+        'This validator checks credential presence only; it does not verify Cloudflare permissions or deploy resources.',
+        'Credential values, account ids, env file paths, and contact data are intentionally omitted from output.',
+      ],
+    };
+    assertPublicSafe(result);
+    return result;
+  }
+  const present = new Set(loaded.present_keys ?? []);
+  const missing = REQUIRED_KEYS.filter((key) => !present.has(key));
+  const result = {
+    schema: CLOUDFLARE_CREDENTIALS_RESULT_SCHEMA,
+    ok: missing.length === 0,
+    credentials_present: missing.length === 0,
+    source_loaded: loaded.source !== null,
+    present_keys: REQUIRED_KEYS.filter((key) => present.has(key)),
+    loaded_key_count: Array.isArray(loaded.loaded_keys) ? loaded.loaded_keys.length : 0,
+    missing_keys: missing,
+    blockers: missing.map((key) => `${key} absent from current environment`),
+    token_value_printed: false,
+    account_id_printed: false,
+    claim_boundary: [
+      'This validator checks credential presence only; it does not verify Cloudflare permissions or deploy resources.',
+      'Credential values, account ids, env file paths, and contact data are intentionally omitted from output.',
+    ],
+  };
+  assertPublicSafe(result);
+  return result;
+}
+
+export async function main(argv = process.argv.slice(2), options = {}) {
+  const args = parseArgs(argv);
+  if (args.help) return { text: usage(), status: 0 };
+  const result = await validateCloudflareCredentials({ ...options, envFile: args.envFile });
+  const json = `${JSON.stringify(result, null, 2)}\n`;
+  if (SECRET_OUTPUT_RE.test(json)) throw new Error('Cloudflare credential validator output appears to contain a secret');
+  if (args.out) {
+    await mkdir(dirname(args.out), { recursive: true });
+    await writeFile(args.out, json, 'utf8');
+  }
+  return { text: json, status: result.ok ? 0 : 1 };
+}
+
+if (fileURLToPath(import.meta.url) === process.argv[1]) {
+  main().then(({ text, status }) => {
+    process.stdout.write(text);
+    process.exitCode = status;
+  }).catch((error) => {
+    process.stdout.write(`${JSON.stringify({ schema: CLOUDFLARE_CREDENTIALS_RESULT_SCHEMA, ok: false, credentials_present: false, blockers: [error.message], token_value_printed: false, account_id_printed: false }, null, 2)}\n`);
+    process.exitCode = 1;
+  });
+}

package/scripts/validate-cloudflare-worker-inspect.mjs

@@ -0,0 +1,179 @@
+#!/usr/bin/env node
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const CLOUDFLARE_WORKER_INSPECTION_RESULT_SCHEMA = 'enigma.cloudflare_worker_inspection_result.v1';
+
+const SECRET_VALUE_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|https?:\/\/[^\s/@]+:[^\s/@]+@|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|cf-[A-Za-z0-9_-]{12,}|raw memory|private prompt|full transcript|decrypted capsule)/iu;
+const ACCOUNT_ID_RE = /\b[0-9a-f]{32}\b/iu;
+const LOCAL_PATH_RE = /(?:[A-Z]:\\Users\\[^\r\n"']+|[A-Z]:\\tmp\\[^\r\n"']+|\/Users\/[^\r\n"']+|\/home\/[^\r\n"']+|\/tmp\/[^\r\n"']+|\/private\/tmp\/[^\r\n"']+|\/var\/folders\/[^\r\n"']+)/iu;
+const FORBIDDEN_KEY_RE = /(?:password|passwd|pwd|api[_-]?key|private[_-]?key|secret|raw[_-]?memory|plaintext|plain[_-]?text|prompt|completion|transcript|provider[_-]?response|cookie|session)/iu;
+const SAFE_KEY_RE = /^(?:tokenPrinted|token_printed|requiresToken|tokenScope|claimBoundary)$/u;
+
+function isPlainObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function blocker(message, path) {
+  return { message, path };
+}
+
+function assertPublicSafe(value, path = 'worker_inspection') {
+  if (typeof value === 'string') {
+    if (SECRET_VALUE_RE.test(value) || ACCOUNT_ID_RE.test(value) || LOCAL_PATH_RE.test(value)) throw new Error(`${path} contains non-public diagnostic material`);
+    return;
+  }
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => assertPublicSafe(item, `${path}[${index}]`));
+    return;
+  }
+  if (!isPlainObject(value)) return;
+  for (const [key, child] of Object.entries(value)) {
+    const childPath = `${path}.${key}`;
+    if (FORBIDDEN_KEY_RE.test(key) && !SAFE_KEY_RE.test(key)) throw new Error(`${childPath} is not allowed in Worker inspection evidence`);
+    assertPublicSafe(child, childPath);
+  }
+}
+
+function nonEmptyString(value) {
+  return typeof value === 'string' && value.trim().length > 0;
+}
+
+function numericStatus(value) {
+  return Number.isSafeInteger(value) && value >= 100 && value <= 599;
+}
+
+function cloudflareErrorCode(evidence) {
+  const errors = evidence?.response?.payload?.errors;
+  if (!Array.isArray(errors) || errors.length === 0) return null;
+  const code = errors[0]?.code;
+  return Number.isSafeInteger(code) ? code : null;
+}
+
+export function validateCloudflareWorkerInspection(evidence, options = {}) {
+  if (!isPlainObject(evidence)) throw new Error('Cloudflare Worker inspection evidence must be an object');
+  assertPublicSafe(evidence);
+  const blockers = [];
+  const permissionBlockers = [];
+
+  if (evidence.schema !== 'enigma.cloudflare_ops.v1') blockers.push(blocker('schema must be enigma.cloudflare_ops.v1', 'schema'));
+  if (evidence.operation !== 'workers.inspect-probe') blockers.push(blocker('operation must be workers.inspect-probe', 'operation'));
+  if (evidence.mutates_cloudflare !== false) blockers.push(blocker('mutates_cloudflare must be false', 'mutates_cloudflare'));
+  if (evidence.execute !== true) blockers.push(blocker('execute must be true for an observed API inspection', 'execute'));
+  if (evidence.tokenPrinted !== false) blockers.push(blocker('tokenPrinted must be false', 'tokenPrinted'));
+  if (!nonEmptyString(evidence.service_name)) blockers.push(blocker('service_name is required', 'service_name'));
+  if (typeof evidence.service_observed !== 'boolean') blockers.push(blocker('service_observed must be boolean', 'service_observed'));
+  if (!numericStatus(evidence.status)) blockers.push(blocker('status must be HTTP status integer', 'status'));
+  if (!isPlainObject(evidence.plan)) blockers.push(blocker('plan object is required', 'plan'));
+  else {
+    if (evidence.plan.operation !== 'workers.service') blockers.push(blocker('plan.operation must be workers.service', 'plan.operation'));
+    if (evidence.plan.method !== 'GET') blockers.push(blocker('plan.method must be GET', 'plan.method'));
+    if (evidence.plan.requiresToken !== true) blockers.push(blocker('plan.requiresToken must be true', 'plan.requiresToken'));
+    if (evidence.plan.tokenPrinted !== false) blockers.push(blocker('plan.tokenPrinted must be false', 'plan.tokenPrinted'));
+    if (evidence.plan.tokenScope !== 'account') blockers.push(blocker('plan.tokenScope must be account', 'plan.tokenScope'));
+    if (!nonEmptyString(evidence.plan.url) || !String(evidence.plan.url).includes('/accounts/<account-id>/workers/services/')) blockers.push(blocker('plan.url must be account-redacted Worker service URL', 'plan.url'));
+  }
+  if (!isPlainObject(evidence.response)) blockers.push(blocker('response object is required', 'response'));
+  else if (!numericStatus(evidence.response.status) || evidence.response.status !== evidence.status) blockers.push(blocker('response.status must match status', 'response.status'));
+
+  const code = cloudflareErrorCode(evidence);
+  const visibleServiceReady = evidence.ok === true && evidence.status >= 200 && evidence.status < 300 && evidence.service_observed === true && Array.isArray(evidence.blockers) && evidence.blockers.length === 0;
+  const missingServicePermissionReady = evidence.ok === false && evidence.status === 404 && code === 10090 && evidence.service_observed === false;
+  const workerPermissionReady = visibleServiceReady || missingServicePermissionReady;
+  if (evidence.ok === true && !visibleServiceReady) blockers.push(blocker('ok:true requires 2xx status, service_observed:true, and zero blockers', 'ok'));
+  if (evidence.ok === false) {
+    if (!Array.isArray(evidence.blockers) || evidence.blockers.length === 0) blockers.push(blocker('blocked inspection must include blockers', 'blockers'));
+    if (evidence.status === 403 || code === 10000) permissionBlockers.push('Cloudflare Worker service visibility is blocked by token/account permission');
+    else if (!missingServicePermissionReady) permissionBlockers.push('Cloudflare Worker service visibility is not ready');
+  }
+  if (visibleServiceReady && code !== null) blockers.push(blocker('ready inspection must not include Cloudflare error codes', 'response.payload.errors'));
+
+  const result = {
+    schema: CLOUDFLARE_WORKER_INSPECTION_RESULT_SCHEMA,
+    generated_at: options.generated_at ?? options.generatedAt ?? new Date(0).toISOString(),
+    ok: blockers.length === 0,
+    status: blockers.length === 0 ? 'accepted' : 'blocked',
+    worker_permission_ready: blockers.length === 0 && workerPermissionReady,
+    service_observed: evidence.service_observed === true,
+    service_missing: missingServicePermissionReady,
+    service_name: nonEmptyString(evidence.service_name) ? evidence.service_name : null,
+    observed_status: numericStatus(evidence.status) ? evidence.status : null,
+    cloudflare_error_code: code,
+    permission_blockers: blockers.length === 0 ? permissionBlockers : [],
+    blockers,
+    checked: {
+      operation: evidence.operation ?? null,
+      mutates_cloudflare: evidence.mutates_cloudflare ?? null,
+      token_printed: evidence.tokenPrinted ?? null,
+      account_id_redacted: typeof evidence.plan?.url === 'string' && evidence.plan.url.includes('/accounts/<account-id>/'),
+      local_paths_redacted: true,
+    },
+    claim_boundary: [
+      'This validator checks public-safe Cloudflare Worker inspection evidence only; it never deploys a Worker or changes Cloudflare state.',
+      'worker_permission_ready:true means the account-scoped Worker service endpoint was visible; it does not prove the hosted relay/gateway infrastructure is live.',
+      'A redacted 403/code-10000 result remains a token/account permission blocker; a redacted 404/code-10090 result means permission is sufficient but the probe Worker still needs deployment if that evidence is required.',
+    ],
+  };
+
+  assertPublicSafe(result, 'result');
+  return result;
+}
+
+function redactDiagnosticMessage(value) {
+  return String(value)
+    .replace(SECRET_VALUE_RE, '[redacted]')
+    .replace(ACCOUNT_ID_RE, '<hex32>')
+    .replace(LOCAL_PATH_RE, '<local-path>');
+}
+
+function parseArgs(argv = process.argv.slice(2)) {
+  const out = { evidence: null, out: null, help: false };
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (token === '--help' || token === '-h') {
+      out.help = true;
+      continue;
+    }
+    const readValue = () => {
+      const value = argv[index + 1];
+      if (typeof value !== 'string' || value.length === 0 || value.startsWith('--')) throw new Error(`${token} requires a value`);
+      index += 1;
+      return value;
+    };
+    if (token === '--evidence') out.evidence = readValue();
+    else if (token === '--out') out.out = readValue();
+    else throw new Error(`unknown option ${token}`);
+  }
+  return out;
+}
+
+function usage() {
+  return 'Usage: node scripts/validate-cloudflare-worker-inspect.mjs --evidence <worker-inspect.json> [--out <file>]\n\nValidates public-safe output from `npm run cloudflare:ops -- workers inspect-probe --out <file>`. A redacted 403/code-10000 packet is accepted permission-blocked evidence; a redacted 404/code-10090 packet is accepted permission-ready missing-service evidence.\n';
+}
+
+async function runCli(argv = process.argv.slice(2)) {
+  const args = parseArgs(argv);
+  if (args.help) return { text: usage(), code: 0 };
+  if (!args.evidence) throw new Error('--evidence is required');
+  const evidence = JSON.parse(await readFile(resolve(args.evidence), 'utf8'));
+  const result = validateCloudflareWorkerInspection(evidence, { generated_at: new Date().toISOString() });
+  const json = `${JSON.stringify(result, null, 2)}\n`;
+  if (args.out) {
+    const outPath = resolve(args.out);
+    await mkdir(dirname(outPath), { recursive: true });
+    await writeFile(outPath, json, 'utf8');
+  }
+  return { text: json, code: result.ok ? 0 : 1 };
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) {
+  try {
+    const { text, code } = await runCli();
+    process.stdout.write(text);
+    process.exitCode = code;
+  } catch (error) {
+    process.stderr.write(`${redactDiagnosticMessage(error instanceof Error ? error.message : String(error))}\n`);
+    process.exitCode = 2;
+  }
+}

package/scripts/validate-domain-tls.mjs

@@ -0,0 +1,248 @@
+#!/usr/bin/env node
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const DOMAIN_TLS_EVIDENCE_SCHEMA = 'enigma.domain_tls_evidence.v1';
+export const DOMAIN_TLS_RESULT_SCHEMA = 'enigma.domain_tls_result.v1';
+
+const ACCEPTED_STATUS = new Set(['active', 'verified', 'observed', 'go']);
+const REQUIRED_SECURITY_HEADERS = Object.freeze([
+  'x-content-type-options',
+  'x-frame-options',
+  'referrer-policy',
+  'permissions-policy',
+  'content-security-policy',
+]);
+const SECRET_VALUE_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|https?:\/\/[^\s/@]+:[^\s/@]+@|raw memory|private prompt|full transcript|decrypted capsule|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16})/iu;
+const FORBIDDEN_KEY_RE = /(?:password|passwd|pwd|token|api[_-]?key|private[_-]?key|secret|raw[_-]?memory|plaintext|plain[_-]?text|prompt|completion|transcript|provider[_-]?response|cookie|session)/iu;
+const SAFE_FIELD_NAMES = new Set(['token_roi_claim', 'provider_invoice_savings_claim', 'credential_claim', 'security_headers']);
+
+function isPlainObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function nonEmptyString(value) {
+  return typeof value === 'string' && value.trim().length > 0;
+}
+
+function isoLike(value) {
+  return nonEmptyString(value) && !Number.isNaN(Date.parse(value));
+}
+
+function blocker(message, path) {
+  return { message, path };
+}
+
+function assertNoSensitivePayload(value, path = 'domain_tls') {
+  if (typeof value === 'string') {
+    if (!/\.(claim_boundary\[\d+\]|blockers\[\d+\]\.message)$/.test(path) && SECRET_VALUE_RE.test(value)) throw new Error(`${path} contains secret-looking data`);
+    return;
+  }
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => assertNoSensitivePayload(item, `${path}[${index}]`));
+    return;
+  }
+  if (!isPlainObject(value)) return;
+  for (const [key, child] of Object.entries(value)) {
+    const childPath = `${path}.${key}`;
+    if (FORBIDDEN_KEY_RE.test(key) && !SAFE_FIELD_NAMES.has(key) && !/^result\.blockers\[\d+\]\.message$/.test(childPath)) throw new Error(`${childPath} is not allowed in domain/TLS evidence`);
+    assertNoSensitivePayload(child, childPath);
+  }
+}
+
+function normalizeDomain(value) {
+  if (!nonEmptyString(value)) return null;
+  const domain = value.trim().toLowerCase().replace(/\.$/, '');
+  return /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/.test(domain) ? domain : null;
+}
+
+function httpsUrl(value, path, blockers) {
+  if (!nonEmptyString(value)) {
+    blockers.push(blocker(`${path} is required`, path));
+    return null;
+  }
+  try {
+    const url = new URL(value);
+    if (url.protocol !== 'https:') blockers.push(blocker(`${path} must use https`, path));
+    if (url.username || url.password) blockers.push(blocker(`${path} must not include credentials`, path));
+    return url;
+  } catch {
+    blockers.push(blocker(`${path} must be a valid URL`, path));
+    return null;
+  }
+}
+
+function statusOk(value) {
+  return typeof value === 'string' && ACCEPTED_STATUS.has(value.trim().toLowerCase());
+}
+
+function validateDns(dns, domain, blockers) {
+  if (!isPlainObject(dns)) {
+    blockers.push(blocker('dns object is required', 'dns'));
+    return { records: 0 };
+  }
+  for (const field of ['provider', 'zone_ref', 'propagation_ref', 'status']) {
+    if (!nonEmptyString(dns[field])) blockers.push(blocker(`dns.${field} is required`, `dns.${field}`));
+  }
+  if (!statusOk(dns.status)) blockers.push(blocker('dns.status must be active/verified/observed/go', 'dns.status'));
+  if (!Array.isArray(dns.records) || dns.records.length === 0) {
+    blockers.push(blocker('dns.records must be non-empty array', 'dns.records'));
+    return { records: 0 };
+  }
+  let coveredApexOrWww = false;
+  dns.records.forEach((record, index) => {
+    const path = `dns.records[${index}]`;
+    if (!isPlainObject(record)) {
+      blockers.push(blocker('dns record must be object', path));
+      return;
+    }
+    for (const field of ['type', 'name', 'value_ref', 'status']) {
+      if (!nonEmptyString(record[field])) blockers.push(blocker(`${path}.${field} is required`, `${path}.${field}`));
+    }
+    const type = String(record.type ?? '').toUpperCase();
+    if (!['A', 'AAAA', 'CNAME', 'ALIAS'].includes(type)) blockers.push(blocker(`${path}.type must be A/AAAA/CNAME/ALIAS`, `${path}.type`));
+    if (!statusOk(record.status)) blockers.push(blocker(`${path}.status must be active/verified/observed/go`, `${path}.status`));
+    const name = normalizeDomain(record.name);
+    if (domain && name && (name === domain || name === `www.${domain}`)) coveredApexOrWww = true;
+  });
+  if (!coveredApexOrWww) blockers.push(blocker('dns.records must cover apex domain or www domain', 'dns.records'));
+  return { records: dns.records.length };
+}
+
+function validateTls(tls, domain, blockers, nowMs) {
+  if (!isPlainObject(tls)) {
+    blockers.push(blocker('tls object is required', 'tls'));
+    return false;
+  }
+  for (const field of ['issuer', 'certificate_ref', 'expires_at', 'renewal_ref', 'alert_ref', 'status']) {
+    if (!nonEmptyString(tls[field])) blockers.push(blocker(`tls.${field} is required`, `tls.${field}`));
+  }
+  if (!statusOk(tls.status)) blockers.push(blocker('tls.status must be active/verified/observed/go', 'tls.status'));
+  if (!isoLike(tls.expires_at)) blockers.push(blocker('tls.expires_at must be ISO time', 'tls.expires_at'));
+  else if (Date.parse(tls.expires_at) <= nowMs) blockers.push(blocker('tls.expires_at must be in the future', 'tls.expires_at'));
+  const names = Array.isArray(tls.subject_alt_names) ? tls.subject_alt_names.map(normalizeDomain).filter(Boolean) : [];
+  if (domain && names.length > 0 && !names.includes(domain) && !names.includes(`www.${domain}`)) blockers.push(blocker('tls.subject_alt_names must include apex or www domain', 'tls.subject_alt_names'));
+  return true;
+}
+
+function validateEndpoint(endpoint, domain, blockers) {
+  if (!isPlainObject(endpoint)) {
+    blockers.push(blocker('endpoint object is required', 'endpoint'));
+    return false;
+  }
+  const url = httpsUrl(endpoint.url, 'endpoint.url', blockers);
+  if (url && domain && url.hostname.toLowerCase() !== domain && url.hostname.toLowerCase() !== `www.${domain}`) blockers.push(blocker('endpoint.url host must match domain or www domain', 'endpoint.url'));
+  if (!Number.isSafeInteger(endpoint.status_code) || endpoint.status_code < 200 || endpoint.status_code >= 400) blockers.push(blocker('endpoint.status_code must be 2xx/3xx integer', 'endpoint.status_code'));
+  if (!nonEmptyString(endpoint.content_type) || !/html|text\/plain|application\/json/i.test(endpoint.content_type)) blockers.push(blocker('endpoint.content_type must be html/text/json', 'endpoint.content_type'));
+  if (!isoLike(endpoint.observed_at)) blockers.push(blocker('endpoint.observed_at must be ISO time', 'endpoint.observed_at'));
+  if (!nonEmptyString(endpoint.public_site_security_ref)) blockers.push(blocker('endpoint.public_site_security_ref is required', 'endpoint.public_site_security_ref'));
+  const headers = endpoint.security_headers;
+  if (!isPlainObject(headers)) blockers.push(blocker('endpoint.security_headers object is required', 'endpoint.security_headers'));
+  else {
+    const lower = new Map(Object.entries(headers).map(([key, value]) => [key.toLowerCase(), String(value)]));
+    for (const header of REQUIRED_SECURITY_HEADERS) {
+      if (!lower.has(header)) blockers.push(blocker(`endpoint.security_headers missing ${header}`, 'endpoint.security_headers'));
+    }
+    if (lower.get('x-content-type-options') && lower.get('x-content-type-options') !== 'nosniff') blockers.push(blocker('x-content-type-options must be nosniff', 'endpoint.security_headers.x-content-type-options'));
+    if (lower.get('x-frame-options') && !['DENY', 'SAMEORIGIN'].includes(lower.get('x-frame-options'))) blockers.push(blocker('x-frame-options must be DENY or SAMEORIGIN', 'endpoint.security_headers.x-frame-options'));
+  }
+  return true;
+}
+
+function validateClaimBoundary(boundary, blockers) {
+  if (!isPlainObject(boundary)) {
+    blockers.push(blocker('claim_boundary object is required', 'claim_boundary'));
+    return;
+  }
+  for (const field of ['public_endpoint_only', 'backend_readiness_claim', 'credential_claim', 'token_roi_claim', 'provider_invoice_savings_claim']) {
+    if (typeof boundary[field] !== 'boolean') blockers.push(blocker(`claim_boundary.${field} must be boolean`, `claim_boundary.${field}`));
+  }
+  if (boundary.public_endpoint_only !== true) blockers.push(blocker('claim_boundary.public_endpoint_only must be true', 'claim_boundary.public_endpoint_only'));
+  for (const field of ['backend_readiness_claim', 'credential_claim', 'token_roi_claim', 'provider_invoice_savings_claim']) {
+    if (boundary[field] !== false) blockers.push(blocker(`claim_boundary.${field} must be false`, `claim_boundary.${field}`));
+  }
+}
+
+export function validateDomainTlsEvidence(evidence, options = {}) {
+  if (!isPlainObject(evidence)) throw new Error('domain/TLS evidence must be an object');
+  assertNoSensitivePayload(evidence);
+  const blockers = [];
+  if (evidence.schema !== DOMAIN_TLS_EVIDENCE_SCHEMA) blockers.push(blocker('schema mismatch', 'schema'));
+  const domain = normalizeDomain(evidence.domain);
+  if (!domain) blockers.push(blocker('domain must be a valid domain name', 'domain'));
+  const publicUrl = httpsUrl(evidence.public_url ?? evidence.url, 'public_url', blockers);
+  if (publicUrl && domain && publicUrl.hostname.toLowerCase() !== domain && publicUrl.hostname.toLowerCase() !== `www.${domain}`) blockers.push(blocker('public_url host must match domain or www domain', 'public_url'));
+  const dns = validateDns(evidence.dns, domain, blockers);
+  validateTls(evidence.tls, domain, blockers, Date.parse(options.now ?? options.generated_at ?? new Date().toISOString()));
+  validateEndpoint(evidence.endpoint, domain, blockers);
+  validateClaimBoundary(evidence.claim_boundary, blockers);
+  const result = {
+    schema: DOMAIN_TLS_RESULT_SCHEMA,
+    generated_at: options.generated_at ?? options.generatedAt ?? new Date(0).toISOString(),
+    ok: blockers.length === 0,
+    status: blockers.length === 0 ? 'accepted' : 'blocked',
+    blockers,
+    checked: {
+      domain: domain ?? null,
+      public_url: publicUrl?.href ?? null,
+      dns_records: dns.records,
+      tls_expires_at: evidence.tls?.expires_at ?? null,
+      endpoint_status_code: evidence.endpoint?.status_code ?? null,
+      required_security_headers: REQUIRED_SECURITY_HEADERS.length,
+    },
+    claim_boundary: [
+      'Domain/TLS validation checks declared public endpoint evidence only; it does not register domains, mutate DNS, deploy Cloudflare Pages, or prove backend readiness.',
+      'A pass result is public-site reachability evidence and does not prove relay/gateway durable storage, KMS, SIEM, backup, operator acceptance, or hosted/BYOC readiness.',
+      'Credentials, API tokens, raw memory, prompts, transcripts, provider responses, and personal contact data must remain outside domain/TLS artifacts.',
+    ],
+  };
+  assertNoSensitivePayload(result, 'result');
+  return result;
+}
+
+function parseArgs(argv = process.argv.slice(2)) {
+  const flags = new Map();
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (!arg.startsWith('--')) continue;
+    const eq = arg.indexOf('=');
+    if (eq !== -1) flags.set(arg.slice(2, eq), arg.slice(eq + 1));
+    else if (!argv[index + 1] || argv[index + 1].startsWith('--')) flags.set(arg.slice(2), true);
+    else {
+      flags.set(arg.slice(2), argv[index + 1]);
+      index += 1;
+    }
+  }
+  return flags;
+}
+
+function getFlag(flags, names) {
+  for (const name of names) if (flags.has(name)) return flags.get(name);
+  return undefined;
+}
+
+async function main() {
+  const flags = parseArgs();
+  const evidencePath = getFlag(flags, ['evidence', 'domain', 'in']);
+  if (typeof evidencePath !== 'string' || evidencePath.trim() === '') throw new Error('--evidence <path> is required');
+  const evidence = JSON.parse(await readFile(resolve(evidencePath), 'utf8'));
+  const result = validateDomainTlsEvidence(evidence, { generated_at: new Date().toISOString() });
+  const out = getFlag(flags, ['out']);
+  const text = `${JSON.stringify(result, null, 2)}\n`;
+  if (out && out !== true) {
+    const outPath = resolve(String(out));
+    await mkdir(dirname(outPath), { recursive: true });
+    await writeFile(outPath, text, 'utf8');
+  }
+  process.stdout.write(text);
+  process.exitCode = result.ok ? 0 : 1;
+}
+
+const invokedPath = process.argv[1] ? resolve(process.argv[1]) : '';
+if (invokedPath === fileURLToPath(import.meta.url)) {
+  main().catch((error) => {
+    process.stderr.write(`${error.name ?? 'Error'}: ${error.message}\n`);
+    process.exitCode = 1;
+  });
+}