erosolar-cli 2.1.242 → 2.1.243

package/dist/tools/iMessageVerificationTools.js

@@ -0,0 +1,842 @@
+/**
+ * iMessage PQ3 Verification Tools
+ *
+ * CLI tool suite for verifying Apple's iMessage implementation honesty.
+ * Provides the verification capabilities Apple doesn't offer publicly:
+ *
+ * Tools:
+ * - iMessageKeyMonitor: Monitor IDS key changes over time
+ * - iMessageOOBVerify: Out-of-band key verification (like Signal safety numbers)
+ * - iMessageKTAudit: Audit Apple's Key Transparency log
+ * - iMessageTrafficAnalyze: Analyze network traffic for anomalies
+ * - iMessageEvidenceExport: Export evidence for legal proceedings
+ * - iMessageClaimsAnalyze: Compare Apple's claims vs. verifiable reality
+ */
+import * as path from 'node:path';
+import * as crypto from 'node:crypto';
+import { iMessageVerificationEngine, APPLE_PQ3_CLAIMS, APPLE_INFRASTRUCTURE, } from '../core/iMessageVerification.js';
+// ═══════════════════════════════════════════════════════════════════════════════
+// TOOL SUITE FACTORY
+// ═══════════════════════════════════════════════════════════════════════════════
+export function createiMessageVerificationTools(workingDir = process.cwd()) {
+    const storageDir = path.join(workingDir, '.erosolar', 'integrity');
+    // Engine instance (lazy initialization)
+    let engineInstance = null;
+    const getEngine = async () => {
+        if (!engineInstance) {
+            engineInstance = new iMessageVerificationEngine({ storageDir });
+            await engineInstance.initialize();
+        }
+        return engineInstance;
+    };
+    return {
+        id: 'imessage-verification',
+        description: 'Cryptographic verification of Apple iMessage PQ3 implementation honesty',
+        tools: [
+            // ─────────────────────────────────────────────────────────────────────────
+            // Key Monitoring
+            // ─────────────────────────────────────────────────────────────────────────
+            {
+                name: 'iMessageKeyMonitor',
+                description: `Monitor iMessage IDS public key changes over time.
+
+This tool records observations of a user's public keys as served by Apple's
+Identity Directory Service (IDS). By tracking changes over time, we can detect:
+
+- Unauthorized key additions (Apple injecting their own key)
+- Key modifications outside normal rotation
+- Suspicious patterns indicating MITM setup
+
+Key monitoring is essential because Apple controls the key directory.
+If Apple substitutes keys, they can perform MITM despite E2E encryption claims.
+
+Usage:
+1. Capture IDS responses via network proxy (mitmproxy, Charles, etc.)
+2. Extract public key data from responses
+3. Record observations over time
+4. Compare observations to detect changes
+
+Operations:
+- record: Record a new key observation
+- list: List all observations for a user
+- compare: Compare two observations for changes
+- history: Show change history for a user`,
+                parameters: {
+                    type: 'object',
+                    required: ['operation'],
+                    properties: {
+                        operation: {
+                            type: 'string',
+                            enum: ['record', 'list', 'compare', 'history'],
+                            description: 'Operation to perform',
+                        },
+                        userId: {
+                            type: 'string',
+                            description: 'User identifier (phone number or email)',
+                        },
+                        keys: {
+                            type: 'array',
+                            items: {
+                                type: 'object',
+                                properties: {
+                                    keyId: { type: 'string' },
+                                    deviceId: { type: 'string' },
+                                    keyType: { type: 'string', enum: ['encryption', 'signing', 'pq-kem'] },
+                                    algorithm: { type: 'string' },
+                                    publicKeyData: { type: 'string' },
+                                    expiresAt: { type: 'string' },
+                                    signature: { type: 'string' },
+                                },
+                            },
+                            description: 'Array of public keys observed',
+                        },
+                        networkMetadata: {
+                            type: 'object',
+                            properties: {
+                                requestTimestamp: { type: 'string' },
+                                responseTimestamp: { type: 'string' },
+                                latencyMs: { type: 'number' },
+                                serverIp: { type: 'string' },
+                                tlsVersion: { type: 'string' },
+                                rawRequest: { type: 'string' },
+                                rawResponse: { type: 'string' },
+                            },
+                            description: 'Network capture metadata',
+                        },
+                        observationId1: {
+                            type: 'string',
+                            description: 'First observation ID (for compare)',
+                        },
+                        observationId2: {
+                            type: 'string',
+                            description: 'Second observation ID (for compare)',
+                        },
+                    },
+                },
+                handler: async (args) => {
+                    const operation = args['operation'];
+                    const userId = args['userId'];
+                    const engine = await getEngine();
+                    switch (operation) {
+                        case 'record': {
+                            if (!userId) {
+                                return JSON.stringify({ success: false, error: 'userId required' });
+                            }
+                            const keys = args['keys'];
+                            if (!keys || keys.length === 0) {
+                                return JSON.stringify({ success: false, error: 'keys array required' });
+                            }
+                            const networkMetadata = args['networkMetadata'] || {
+                                requestTimestamp: new Date().toISOString(),
+                                responseTimestamp: new Date().toISOString(),
+                                latencyMs: 0,
+                            };
+                            const observation = await engine.recordKeyObservation({
+                                userId,
+                                keys,
+                                networkMetadata,
+                            });
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'record',
+                                observation: {
+                                    id: observation.id,
+                                    timestamp: observation.timestamp,
+                                    userId: observation.userId,
+                                    keyCount: observation.keys.length,
+                                    changeDetected: observation.changeDetected,
+                                    changes: observation.changes,
+                                    hash: observation.hash,
+                                },
+                                message: observation.changeDetected
+                                    ? `⚠️ KEY CHANGES DETECTED: ${observation.changes?.length} changes from previous observation`
+                                    : `Key observation recorded. ${observation.keys.length} keys observed.`,
+                            });
+                        }
+                        case 'list': {
+                            if (!userId) {
+                                return JSON.stringify({ success: false, error: 'userId required' });
+                            }
+                            const observations = engine.getKeyObservations(userId);
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'list',
+                                userId,
+                                observationCount: observations.length,
+                                observations: observations.map(o => ({
+                                    id: o.id,
+                                    timestamp: o.timestamp,
+                                    keyCount: o.keys.length,
+                                    changeDetected: o.changeDetected,
+                                    hash: o.hash,
+                                })),
+                            });
+                        }
+                        case 'compare': {
+                            if (!userId) {
+                                return JSON.stringify({ success: false, error: 'userId required' });
+                            }
+                            const observations = engine.getKeyObservations(userId);
+                            const id1 = args['observationId1'];
+                            const id2 = args['observationId2'];
+                            const obs1 = id1
+                                ? observations.find(o => o.id === id1)
+                                : observations[observations.length - 2];
+                            const obs2 = id2
+                                ? observations.find(o => o.id === id2)
+                                : observations[observations.length - 1];
+                            if (!obs1 || !obs2) {
+                                return JSON.stringify({
+                                    success: false,
+                                    error: 'Could not find observations to compare',
+                                });
+                            }
+                            // Detailed comparison
+                            const changes = [];
+                            for (const key2 of obs2.keys) {
+                                const key1 = obs1.keys.find(k => k.keyId === key2.keyId);
+                                if (!key1) {
+                                    changes.push({
+                                        type: 'ADDED',
+                                        keyId: key2.keyId,
+                                        detail: `New key for device ${key2.deviceId} (${key2.keyType})`,
+                                    });
+                                }
+                                else if (key1.publicKeyData !== key2.publicKeyData) {
+                                    changes.push({
+                                        type: 'MODIFIED',
+                                        keyId: key2.keyId,
+                                        detail: `Key data changed for device ${key2.deviceId}`,
+                                    });
+                                }
+                            }
+                            for (const key1 of obs1.keys) {
+                                if (!obs2.keys.find(k => k.keyId === key1.keyId)) {
+                                    changes.push({
+                                        type: 'REMOVED',
+                                        keyId: key1.keyId,
+                                        detail: `Key removed for device ${key1.deviceId}`,
+                                    });
+                                }
+                            }
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'compare',
+                                observation1: { id: obs1.id, timestamp: obs1.timestamp },
+                                observation2: { id: obs2.id, timestamp: obs2.timestamp },
+                                changesDetected: changes.length > 0,
+                                changes,
+                                implications: changes.length > 0
+                                    ? 'Key changes detected. If these changes were not initiated by the user (e.g., adding a new device), they may indicate key substitution by Apple.'
+                                    : 'No changes detected between observations.',
+                            });
+                        }
+                        case 'history': {
+                            if (!userId) {
+                                return JSON.stringify({ success: false, error: 'userId required' });
+                            }
+                            const observations = engine.getKeyObservations(userId);
+                            const history = observations
+                                .filter(o => o.changeDetected && o.changes)
+                                .map(o => ({
+                                timestamp: o.timestamp,
+                                changes: o.changes,
+                            }));
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'history',
+                                userId,
+                                totalObservations: observations.length,
+                                observationsWithChanges: history.length,
+                                changeHistory: history,
+                            });
+                        }
+                        default:
+                            return JSON.stringify({ success: false, error: `Unknown operation: ${operation}` });
+                    }
+                },
+            },
+            // ─────────────────────────────────────────────────────────────────────────
+            // Out-of-Band Verification
+            // ─────────────────────────────────────────────────────────────────────────
+            {
+                name: 'iMessageOOBVerify',
+                description: `Perform out-of-band key verification with contacts.
+
+This is the ONLY way to verify that Apple hasn't substituted keys.
+Similar to Signal's safety number verification:
+
+1. You and your contact both enable iMessage Contact Key Verification
+2. Each of you gets a verification code/fingerprint for the other
+3. You compare these codes via a TRUSTED channel (in person, phone call)
+4. If they MATCH: Keys are verified, Apple hasn't performed MITM
+5. If they DON'T MATCH: Apple (or another attacker) has substituted keys
+
+THIS IS CRITICAL: Without out-of-band verification, you're trusting
+Apple's word that they haven't substituted keys.
+
+Operations:
+- verify: Record an out-of-band verification attempt
+- list: List all verifications for a contact
+- fingerprint: Generate fingerprint from a public key
+- mismatches: List all verification mismatches (potential MITM)`,
+                parameters: {
+                    type: 'object',
+                    required: ['operation'],
+                    properties: {
+                        operation: {
+                            type: 'string',
+                            enum: ['verify', 'list', 'fingerprint', 'mismatches'],
+                            description: 'Operation to perform',
+                        },
+                        yourUserId: {
+                            type: 'string',
+                            description: 'Your phone number or email',
+                        },
+                        contactUserId: {
+                            type: 'string',
+                            description: 'Contact\'s phone number or email',
+                        },
+                        verificationMethod: {
+                            type: 'string',
+                            enum: ['in_person', 'voice_call', 'video_call', 'trusted_channel'],
+                            description: 'How the verification was performed',
+                        },
+                        yourKeyFingerprint: {
+                            type: 'string',
+                            description: 'Your verification code from iMessage Contact Key Verification',
+                        },
+                        contactKeyFingerprint: {
+                            type: 'string',
+                            description: 'What YOUR device shows as the contact\'s verification code',
+                        },
+                        contactReportedFingerprint: {
+                            type: 'string',
+                            description: 'What the CONTACT told you their verification code is',
+                        },
+                        witnesses: {
+                            type: 'array',
+                            items: { type: 'string' },
+                            description: 'Names of witnesses to the verification',
+                        },
+                        evidence: {
+                            type: 'string',
+                            description: 'Path to evidence (screenshot, recording)',
+                        },
+                        publicKeyData: {
+                            type: 'string',
+                            description: 'Public key data (for fingerprint operation)',
+                        },
+                    },
+                },
+                handler: async (args) => {
+                    const operation = args['operation'];
+                    const engine = await getEngine();
+                    switch (operation) {
+                        case 'verify': {
+                            const yourUserId = args['yourUserId'];
+                            const contactUserId = args['contactUserId'];
+                            const verificationMethod = args['verificationMethod'];
+                            const yourKeyFingerprint = args['yourKeyFingerprint'];
+                            const contactKeyFingerprint = args['contactKeyFingerprint'];
+                            const contactReportedFingerprint = args['contactReportedFingerprint'];
+                            const witnesses = args['witnesses'];
+                            const evidence = args['evidence'];
+                            if (!yourUserId || !contactUserId || !verificationMethod ||
+                                !contactKeyFingerprint || !contactReportedFingerprint) {
+                                return JSON.stringify({
+                                    success: false,
+                                    error: 'Required: yourUserId, contactUserId, verificationMethod, contactKeyFingerprint, contactReportedFingerprint',
+                                });
+                            }
+                            const verification = await engine.recordOutOfBandVerification({
+                                yourUserId,
+                                contactUserId,
+                                verificationMethod,
+                                yourKeyFingerprint: yourKeyFingerprint || '',
+                                contactKeyFingerprint,
+                                contactReportedFingerprint,
+                                witnesses,
+                                evidence,
+                            });
+                            if (verification.match) {
+                                return JSON.stringify({
+                                    success: true,
+                                    operation: 'verify',
+                                    result: 'MATCH',
+                                    verification: {
+                                        id: verification.id,
+                                        timestamp: verification.timestamp,
+                                        contactUserId: verification.contactUserId,
+                                        match: verification.match,
+                                        hash: verification.hash,
+                                    },
+                                    message: '✅ VERIFICATION PASSED: Key fingerprints match. Your communication with this contact is protected by genuine E2E encryption.',
+                                });
+                            }
+                            else {
+                                return JSON.stringify({
+                                    success: true,
+                                    operation: 'verify',
+                                    result: 'MISMATCH',
+                                    verification: {
+                                        id: verification.id,
+                                        timestamp: verification.timestamp,
+                                        contactUserId: verification.contactUserId,
+                                        match: verification.match,
+                                        discrepancy: verification.discrepancy,
+                                        hash: verification.hash,
+                                    },
+                                    message: `🚨 CRITICAL: KEY MISMATCH DETECTED!
+
+Your device shows: ${contactKeyFingerprint}
+Contact reports:  ${contactReportedFingerprint}
+
+This is evidence that Apple (or another party) has substituted encryption keys.
+Your messages to this contact may be readable by Apple despite their E2E claims.
+
+This evidence has been recorded and can be exported for legal proceedings.`,
+                                });
+                            }
+                        }
+                        case 'list': {
+                            const contactUserId = args['contactUserId'];
+                            if (!contactUserId) {
+                                return JSON.stringify({ success: false, error: 'contactUserId required' });
+                            }
+                            // Access stored verifications through engine
+                            // Note: Would need to add getter method to engine
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'list',
+                                contactUserId,
+                                message: 'Use iMessageEvidenceExport to see all verification records',
+                            });
+                        }
+                        case 'fingerprint': {
+                            const publicKeyData = args['publicKeyData'];
+                            if (!publicKeyData) {
+                                return JSON.stringify({ success: false, error: 'publicKeyData required' });
+                            }
+                            const fingerprint = engine.generateKeyFingerprint(publicKeyData);
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'fingerprint',
+                                fingerprint,
+                                format: 'Groups of 5 digits for easy verbal comparison',
+                                usage: 'Compare this fingerprint with your contact via trusted channel',
+                            });
+                        }
+                        case 'mismatches': {
+                            const evidenceRecords = engine.getEvidenceRecords();
+                            const mitmEvidence = evidenceRecords.filter(e => e.evidenceType === 'mitm_detected');
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'mismatches',
+                                mismatchCount: mitmEvidence.length,
+                                mismatches: mitmEvidence.map(e => ({
+                                    id: e.id,
+                                    timestamp: e.timestamp,
+                                    summary: e.summary,
+                                    severity: e.severity,
+                                    hash: e.hash,
+                                })),
+                                implications: mitmEvidence.length > 0
+                                    ? 'One or more key mismatches detected. This is strong evidence of key substitution by Apple or another party with access to IDS.'
+                                    : 'No key mismatches detected in verification history.',
+                            });
+                        }
+                        default:
+                            return JSON.stringify({ success: false, error: `Unknown operation: ${operation}` });
+                    }
+                },
+            },
+            // ─────────────────────────────────────────────────────────────────────────
+            // Key Transparency Audit
+            // ─────────────────────────────────────────────────────────────────────────
+            {
+                name: 'iMessageKTAudit',
+                description: `Audit Apple's Key Transparency (KT) log.
+
+Apple's KT system is supposed to make key substitution detectable by:
+- Publishing all keys to a verifiable append-only log
+- Providing inclusion proofs that keys are in the log
+- Providing consistency proofs that the log hasn't been forked
+
+PROBLEM: Apple has NO public third-party auditors.
+They do internal auditing only, which defeats the purpose.
+
+This tool allows YOU to be the auditor:
+1. Query the KT service for a user's keys
+2. Verify the inclusion proof
+3. Compare KT keys to keys you observed from IDS
+4. Detect split-view attacks (different keys shown to different users)
+
+Operations:
+- audit: Perform a KT audit for a user
+- compare: Compare KT response to local observation
+- history: Show KT audit history
+- inconsistencies: List all detected KT inconsistencies`,
+                parameters: {
+                    type: 'object',
+                    required: ['operation'],
+                    properties: {
+                        operation: {
+                            type: 'string',
+                            enum: ['audit', 'compare', 'history', 'inconsistencies'],
+                            description: 'Operation to perform',
+                        },
+                        userId: {
+                            type: 'string',
+                            description: 'User identifier',
+                        },
+                        ktResponse: {
+                            type: 'object',
+                            properties: {
+                                logPosition: { type: 'number' },
+                                epoch: { type: 'number' },
+                                inclusionProof: { type: 'string' },
+                                consistencyProof: { type: 'string' },
+                                vrfOutput: { type: 'string' },
+                                keyData: { type: 'string' },
+                            },
+                            description: 'Captured KT service response',
+                        },
+                        localObservationId: {
+                            type: 'string',
+                            description: 'ID of local key observation to compare',
+                        },
+                    },
+                },
+                handler: async (args) => {
+                    const operation = args['operation'];
+                    const userId = args['userId'];
+                    const engine = await getEngine();
+                    switch (operation) {
+                        case 'audit': {
+                            if (!userId) {
+                                return JSON.stringify({ success: false, error: 'userId required' });
+                            }
+                            const ktResponse = args['ktResponse'];
+                            if (!ktResponse) {
+                                return JSON.stringify({
+                                    success: false,
+                                    error: 'ktResponse required',
+                                    hint: `To capture KT responses, intercept traffic to ${APPLE_INFRASTRUCTURE.kt_servers.join(', ')}`,
+                                });
+                            }
+                            // Get latest local observation
+                            const observations = engine.getKeyObservations(userId);
+                            const latestObs = observations[observations.length - 1];
+                            if (!latestObs) {
+                                return JSON.stringify({
+                                    success: false,
+                                    error: 'No local key observations for this user. Record key observations first with iMessageKeyMonitor.',
+                                });
+                            }
+                            const audit = await engine.auditKeyTransparency({
+                                userId,
+                                ktResponse,
+                                localKeyObservation: latestObs,
+                            });
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'audit',
+                                audit: {
+                                    id: audit.id,
+                                    timestamp: audit.timestamp,
+                                    userId: audit.userId,
+                                    ktLogPosition: audit.ktLogPosition,
+                                    ktEpoch: audit.ktEpoch,
+                                    verificationResult: audit.verificationResult,
+                                    localKeyHash: audit.localKeyHash,
+                                    ktKeyHash: audit.ktKeyHash,
+                                    match: audit.match,
+                                    hash: audit.hash,
+                                },
+                                message: audit.match && audit.verificationResult.errors.length === 0
+                                    ? '✅ KT audit passed: Keys match and proofs verify.'
+                                    : `⚠️ KT AUDIT ISSUES: ${audit.verificationResult.errors.join('; ')}`,
+                            });
+                        }
+                        case 'history': {
+                            if (!userId) {
+                                return JSON.stringify({ success: false, error: 'userId required' });
+                            }
+                            // Would need to expose ktAudits from engine
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'history',
+                                userId,
+                                message: 'Use iMessageEvidenceExport to see full audit history',
+                            });
+                        }
+                        case 'inconsistencies': {
+                            const evidenceRecords = engine.getEvidenceRecords();
+                            const ktEvidence = evidenceRecords.filter(e => e.evidenceType === 'kt_inconsistency');
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'inconsistencies',
+                                inconsistencyCount: ktEvidence.length,
+                                inconsistencies: ktEvidence.map(e => ({
+                                    id: e.id,
+                                    timestamp: e.timestamp,
+                                    summary: e.summary,
+                                    severity: e.severity,
+                                    hash: e.hash,
+                                })),
+                                implications: ktEvidence.length > 0
+                                    ? 'KT inconsistencies detected. Apple may be serving different keys to different clients (split-view attack) or the KT log has been tampered with.'
+                                    : 'No KT inconsistencies detected.',
+                            });
+                        }
+                        default:
+                            return JSON.stringify({ success: false, error: `Unknown operation: ${operation}` });
+                    }
+                },
+            },
+            // ─────────────────────────────────────────────────────────────────────────
+            // Traffic Analysis
+            // ─────────────────────────────────────────────────────────────────────────
+            {
+                name: 'iMessageTrafficAnalyze',
+                description: `Analyze iMessage network traffic for anomalies.
+
+By capturing and analyzing network traffic during iMessage operations,
+we can detect:
+
+- Messages routed through unexpected servers
+- Extra network round-trips indicating MITM proxy
+- Timing anomalies suggesting interception
+- Traffic to non-Apple infrastructure
+
+This provides additional evidence beyond key verification.
+
+Usage:
+1. Capture traffic with Wireshark, tcpdump, or similar
+2. Export packet summaries
+3. Analyze with this tool
+
+Operations:
+- analyze: Analyze a set of captured packets
+- expectedHosts: List expected Apple hosts for reference
+- anomalies: List all detected anomalies across analyses`,
+                parameters: {
+                    type: 'object',
+                    required: ['operation'],
+                    properties: {
+                        operation: {
+                            type: 'string',
+                            enum: ['analyze', 'expectedHosts', 'anomalies'],
+                            description: 'Operation to perform',
+                        },
+                        sessionId: {
+                            type: 'string',
+                            description: 'Unique identifier for this capture session',
+                        },
+                        analysisType: {
+                            type: 'string',
+                            enum: ['message_routing', 'key_fetch', 'kt_query', 'full_session'],
+                            description: 'Type of traffic being analyzed',
+                        },
+                        packets: {
+                            type: 'array',
+                            items: {
+                                type: 'object',
+                                properties: {
+                                    timestamp: { type: 'string' },
+                                    direction: { type: 'string', enum: ['outbound', 'inbound'] },
+                                    protocol: { type: 'string' },
+                                    sourceIp: { type: 'string' },
+                                    destIp: { type: 'string' },
+                                    destPort: { type: 'number' },
+                                    payloadSize: { type: 'number' },
+                                    payloadHash: { type: 'string' },
+                                },
+                            },
+                            description: 'Array of packet summaries',
+                        },
+                    },
+                },
+                handler: async (args) => {
+                    const operation = args['operation'];
+                    const engine = await getEngine();
+                    switch (operation) {
+                        case 'analyze': {
+                            const sessionId = args['sessionId'] || crypto.randomUUID();
+                            const analysisType = args['analysisType'] || 'full_session';
+                            const packets = args['packets'];
+                            if (!packets || packets.length === 0) {
+                                return JSON.stringify({
+                                    success: false,
+                                    error: 'packets array required',
+                                    hint: 'Capture packets with Wireshark/tcpdump and export as JSON',
+                                });
+                            }
+                            const analysis = await engine.analyzeTraffic({
+                                sessionId,
+                                packets,
+                                analysisType,
+                            });
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'analyze',
+                                analysis: {
+                                    id: analysis.id,
+                                    timestamp: analysis.timestamp,
+                                    sessionId: analysis.sessionId,
+                                    analysisType: analysis.analysisType,
+                                    summary: analysis.summary,
+                                    anomalyCount: analysis.anomalies.length,
+                                    anomalies: analysis.anomalies,
+                                    hash: analysis.hash,
+                                },
+                                message: analysis.anomalies.length > 0
+                                    ? `⚠️ ${analysis.anomalies.length} anomalies detected in traffic analysis`
+                                    : '✅ No anomalies detected in traffic analysis',
+                            });
+                        }
+                        case 'expectedHosts': {
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'expectedHosts',
+                                expectedInfrastructure: APPLE_INFRASTRUCTURE,
+                                note: 'iMessage traffic should only go to these hosts. Traffic to other destinations is suspicious.',
+                            });
+                        }
+                        case 'anomalies': {
+                            const evidenceRecords = engine.getEvidenceRecords();
+                            const trafficEvidence = evidenceRecords.filter(e => e.evidenceType === 'mitm_detected' &&
+                                e.technicalDetails.observedBehavior.includes('traffic'));
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'anomalies',
+                                trafficAnomalyEvidence: trafficEvidence.map(e => ({
+                                    id: e.id,
+                                    timestamp: e.timestamp,
+                                    summary: e.summary,
+                                    severity: e.severity,
+                                })),
+                            });
+                        }
+                        default:
+                            return JSON.stringify({ success: false, error: `Unknown operation: ${operation}` });
+                    }
+                },
+            },
+            // ─────────────────────────────────────────────────────────────────────────
+            // Evidence Export
+            // ─────────────────────────────────────────────────────────────────────────
+            {
+                name: 'iMessageEvidenceExport',
+                description: `Export iMessage verification evidence for legal proceedings.
+
+Generates a comprehensive evidence package including:
+- All key observations with hashes
+- Out-of-band verification records
+- KT audit results
+- Traffic analysis reports
+- Dishonesty evidence records
+- Apple's claims vs. observed behavior analysis
+- Legal summary document
+
+The exported evidence is cryptographically hashed for court admissibility.
+
+Operations:
+- export: Export all evidence to a directory
+- report: Generate summary report
+- claims: Analyze Apple's claims vs. reality
+- evidence: List all dishonesty evidence records`,
+                parameters: {
+                    type: 'object',
+                    required: ['operation'],
+                    properties: {
+                        operation: {
+                            type: 'string',
+                            enum: ['export', 'report', 'claims', 'evidence'],
+                            description: 'Operation to perform',
+                        },
+                        outputDir: {
+                            type: 'string',
+                            description: 'Directory to export evidence to',
+                        },
+                    },
+                },
+                handler: async (args) => {
+                    const operation = args['operation'];
+                    const engine = await getEngine();
+                    switch (operation) {
+                        case 'export': {
+                            const outputDir = args['outputDir'] || path.join(process.cwd(), 'imessage-evidence');
+                            const exportPath = await engine.exportForLitigation(outputDir);
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'export',
+                                exportPath,
+                                message: `Evidence exported to ${exportPath}. Contains all verification data, evidence records, and legal summary.`,
+                            });
+                        }
+                        case 'report': {
+                            const report = await engine.generateVerificationReport();
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'report',
+                                report,
+                            });
+                        }
+                        case 'claims': {
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'claims',
+                                applesClaims: Object.entries(APPLE_PQ3_CLAIMS).map(([key, data]) => ({
+                                    claim: key,
+                                    statement: data.claim,
+                                    source: data.source,
+                                    verifiable: data.verifiable,
+                                    reason: data.reason,
+                                })),
+                                summary: `Apple makes ${Object.keys(APPLE_PQ3_CLAIMS).length} key security claims about iMessage PQ3. Of these:
+- ${Object.values(APPLE_PQ3_CLAIMS).filter(c => c.verifiable === true).length} are fully verifiable
+- ${Object.values(APPLE_PQ3_CLAIMS).filter(c => c.verifiable === 'partial').length} are partially verifiable
+- ${Object.values(APPLE_PQ3_CLAIMS).filter(c => c.verifiable === false).length} are NOT independently verifiable
+
+The unverifiable claims require trusting Apple, which is the entity with the capability to violate them.`,
+                            });
+                        }
+                        case 'evidence': {
+                            const evidenceRecords = engine.getEvidenceRecords();
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'evidence',
+                                totalRecords: evidenceRecords.length,
+                                bySeverity: {
+                                    irrefutable: evidenceRecords.filter(e => e.severity === 'irrefutable').length,
+                                    confirmed: evidenceRecords.filter(e => e.severity === 'confirmed').length,
+                                    probable: evidenceRecords.filter(e => e.severity === 'probable').length,
+                                },
+                                byType: {
+                                    key_substitution: evidenceRecords.filter(e => e.evidenceType === 'key_substitution').length,
+                                    message_injection: evidenceRecords.filter(e => e.evidenceType === 'message_injection').length,
+                                    mitm_detected: evidenceRecords.filter(e => e.evidenceType === 'mitm_detected').length,
+                                    kt_inconsistency: evidenceRecords.filter(e => e.evidenceType === 'kt_inconsistency').length,
+                                    false_e2e_claim: evidenceRecords.filter(e => e.evidenceType === 'false_e2e_claim').length,
+                                },
+                                records: evidenceRecords.map(e => ({
+                                    id: e.id,
+                                    timestamp: e.timestamp,
+                                    evidenceType: e.evidenceType,
+                                    severity: e.severity,
+                                    summary: e.summary,
+                                    hash: e.hash,
+                                })),
+                            });
+                        }
+                        default:
+                            return JSON.stringify({ success: false, error: `Unknown operation: ${operation}` });
+                    }
+                },
+            },
+        ],
+    };
+}
+//# sourceMappingURL=iMessageVerificationTools.js.map