#!/usr/bin/env -S deno run --allow-net
// SocialGravity receipt verifier. Fetches public data, verifies LOCALLY.
//
//   deno run --allow-net verifier/verify.ts --license L55CQIONWR3
//   deno run --allow-net verifier/verify.ts --output  OUT4K2Q9Z
//   deno run --allow-net verifier/verify.ts --output  VTEUJBQIVCY      (an approved variation)
//   deno run --allow-net verifier/verify.ts --output  EQ7X2M4KTPB      (an egress release)
//   deno run --allow-net verifier/verify.ts --rider   RXA2AVS52HK      (a signed variation rider)
//   deno run --allow-net verifier/verify.ts --rider   AK2QM5RXJ7D      (a licence region rider)
//   deno run --allow-net --allow-read verifier/verify.ts --output OUT4K2Q9Z --file ./spot.wav
//   deno run --allow-net verifier/verify.ts --license L55CQIONWR3 --json > receipt.json
//
// The only thing this takes from the network is data. Every signature check, every hash and
// every piece of arithmetic happens here, against a public key pinned in verifier/lib/keys.ts
// rather than the one served alongside the record. That is the whole design: if verifying
// required trusting the issuer, there would be no point verifying.
//
// Exit codes, so this is usable in a pipeline:
//   0  every check passed
//   1  at least one check FAILED
//   2  no failures, but something could not be checked (see NOT CHECKABLE lines)
//   3  the verifier could not run at all (bad arguments, network, unparseable response)

import {
  Check,
  Checks,
  checkAssets,
  checkCredential,
  checkEgressCredential,
  checkEnvelope,
  checkLicenseFacts,
  checkLicenseChain,
  checkPlatformFee,
  checkLogInclusion,
  checkPerson,
  checkPrivateBlock,
  checkRegionRiderFacts,
  checkRegionRiderParent,
  checkRiderFacts,
  checkRiderLogEntry,
  checkSignature,
  checkVariationCredential,
  checkVariationLogEntry,
} from "./lib/checks.ts";
import { hexToBytes, verifyConsistency } from "./lib/merkle.ts";

const DEFAULT_BASE = "https://id.socialgravity.ai/functions/v1";
const DEFAULT_MIRROR = "https://raw.githubusercontent.com/socialgravity/ledger-anchors/main";

interface Args {
  license?: string;
  output?: string;
  rider?: string;
  file?: string;
  privateBlock?: string;
  base: string;
  mirror: string;
  json: boolean;
  quiet: boolean;
  noLog: boolean;
}

function parseArgs(argv: string[]): Args {
  const a: Args = { base: DEFAULT_BASE, mirror: DEFAULT_MIRROR, json: false, quiet: false, noLog: false };
  for (let i = 0; i < argv.length; i++) {
    const k = argv[i];
    const next = () => {
      const v = argv[++i];
      if (v === undefined) die(3, `${k} needs a value`);
      return v;
    };
    switch (k) {
      case "--license": case "-l": a.license = next().toUpperCase(); break;
      case "--output": case "-o": a.output = next().toUpperCase(); break;
      case "--rider": case "-r": a.rider = next().toUpperCase(); break;
      case "--file": case "-f": a.file = next(); break;
      case "--private-block": a.privateBlock = next(); break;
      case "--base": a.base = next().replace(/\/+$/, ""); break;
      case "--json": a.json = true; break;
      case "--quiet": case "-q": a.quiet = true; break;
      case "--no-log": a.noLog = true; break;
      case "--mirror": a.mirror = next(); break;
      case "--help": case "-h": usage(); Deno.exit(0); break;
      default: die(3, `unknown argument ${k}`);
    }
  }
  if (!a.license && !a.output && !a.rider) {
    die(3, "one of --license, --output or --rider is required");
  }
  return a;
}

function usage(): void {
  console.log(`
Verify a SocialGravity identity licensing receipt locally.

  --license, -l <id>     verify a licence by id
  --output,  -o <id>     verify a per-output receipt. A licence-key output (O...) fetches its
                         licence too; an approved variation (V...) verifies against its signed
                         approval instead, since no licence exists for it
  --rider,   -r <id>     verify a signed rider by id: a variation rider (R...) or a licence
                         region rider (A...); the register that holds the handle answers
  --file,    -f <path>   hash a local file and compare it to the credential
  --private-block <path> a private block JSON you hold, rehashed against its commitment
  --base <url>           API base (default ${DEFAULT_BASE})
  --no-log               skip the transparency-log lookup
  --mirror <url>         base URL of the public anchor mirror used for the witnessed-head
                         consistency check. Defaults to the socialgravity/ledger-anchors repo
  --json                 print the receipt document (docs/schemas/receipt-v1.schema.json)
  --quiet, -q            print only the verdict line

Exit: 0 pass, 1 fail, 2 incomplete, 3 could not run.
`.trim());
}

function die(code: number, message: string): never {
  console.error(`verify: ${message}`);
  Deno.exit(code);
}

// deno-lint-ignore no-explicit-any
async function getJson(url: string): Promise<any> {
  let res: Response;
  try {
    res = await fetch(url, { headers: { accept: "application/json" } });
  } catch (e) {
    die(3, `could not reach ${url}: ${e instanceof Error ? e.message : String(e)}`);
  }
  const text = await res.text();
  try {
    return JSON.parse(text);
  } catch {
    die(3, `${url} did not return JSON (HTTP ${res.status}): ${text.slice(0, 200)}`);
  }
}

const args = parseArgs(Deno.args);
const checks = new Checks();

// deno-lint-ignore no-explicit-any
let licenseData: any = null;
// deno-lint-ignore no-explicit-any
let outputData: any = null;
// deno-lint-ignore no-explicit-any
let riderData: any = null;

// Which kind of receipt this run is verifying. "output" is a licence-key registration and
// carries its licence; "variation" is an approved-variation registration whose authority is a
// signed permission, not an idl_licenses row, so no licence fetch exists for it and treating
// its absence as a failure would fail every genuine variation receipt (which is exactly what
// this verifier did until 2026-08-13). Decided by the served credential's signed kind, never
// by the id's prefix: the register is looked up, not dispatched on.
let mode: "license" | "output" | "variation" | "egress" | "rider" = args.rider
  ? "rider"
  : args.output
  ? "output"
  : "license";

// ---------------------------------------------------------------------------
// Fetch. A licence-key output receipt names its licence, so verifying one always verifies
// both: a credential whose licence does not check out is not a valid receipt however well it
// is signed. A variation receipt's authority is its signed approval, checked in its own right.
// ---------------------------------------------------------------------------

if (args.rider) {
  const body = await getJson(`${args.base}/idl-verify?rider=${encodeURIComponent(args.rider)}`);
  if (!checkEnvelope(checks, body)) {
    report();
    Deno.exit(finalCode());
  }
  riderData = body.data;
} else if (args.output) {
  const body = await getJson(`${args.base}/idl-verify?output=${encodeURIComponent(args.output)}`);
  if (!checkEnvelope(checks, body)) {
    report();
    Deno.exit(finalCode());
  }
  outputData = body.data;
  // Three registers answer ?output=, and the SIGNED kind decides which this is, never the handle's
  // prefix. A release names its licence and is checked against it exactly as a licence-key output
  // is; a variation's authority is a signed permission and has no licence to fetch.
  if (outputData?.credential?.kind === "approved_variation") {
    mode = "variation";
  } else if (outputData?.credential?.kind === "egress_release") {
    mode = "egress";
    const licenseId = outputData?.credential?.license_id;
    if (!licenseId) {
      checks.add(5, "credential names a licence", "fail", "no license_id on the release credential");
    } else {
      const lic = await getJson(`${args.base}/idl-verify?id=${encodeURIComponent(licenseId)}`);
      if (checkEnvelope(checks, lic)) licenseData = lic.data;
    }
  } else {
    const licenseId = outputData?.credential?.license_id;
    if (!licenseId) {
      checks.add(5, "credential names a licence", "fail", "no license_id on the credential");
    } else {
      const lic = await getJson(`${args.base}/idl-verify?id=${encodeURIComponent(licenseId)}`);
      if (checkEnvelope(checks, lic)) licenseData = lic.data;
    }
  }
} else {
  const body = await getJson(`${args.base}/idl-verify?id=${encodeURIComponent(args.license!)}`);
  if (!checkEnvelope(checks, body)) {
    report();
    Deno.exit(finalCode());
  }
  licenseData = body.data;
}

// ---------------------------------------------------------------------------
// Check, link by link
// ---------------------------------------------------------------------------

let fileBytes: Uint8Array | null = null;
if (args.file) {
  try {
    fileBytes = await Deno.readFile(args.file);
  } catch (e) {
    die(3, `could not read ${args.file}: ${e instanceof Error ? e.message : String(e)}`);
  }
}

if (mode === "rider") {
  await checkSignature(checks, 3, "rider", riderData?.signature);
  // Two registers answer ?rider=, and the SERVED kind decides which facts apply, never the
  // handle's prefix: a variation rider (R...) is pinned by its instrument's document hash, a
  // licence region rider (A...) by the prose hash of the words it grants. Feeding one through
  // the other's checks fails fields the instrument never had, which reads as a forged receipt.
  if (riderData?.kind === "licence_region_rider") {
    await checkRegionRiderFacts(checks, riderData);
    // The parent is fetched and rehashed, never taken from the rider's own words. Everything the
    // receipt says about its parent comes out of the signature the server also derived the page's
    // parent block from, so a rider signed over a parent hash no licence hashes to would pass on
    // its own receipt alone (audit of PR #339, finding F2). Same shape as egress mode, which has
    // fetched and fully checked the licence behind a release since it shipped.
    const parentId = riderData?.license_id;
    if (!parentId) {
      checks.add(3, "rider names a licence", "fail", "no license_id on the rider receipt");
    } else {
      const lic = await getJson(`${args.base}/idl-verify?id=${encodeURIComponent(parentId)}`);
      await checkRegionRiderParent(checks, riderData, checkEnvelope(checks, lic) ? lic.data : null);
    }
  } else {
    checkRiderFacts(checks, riderData);
  }
  if (args.file) {
    checks.add(
      5,
      "file matches the credential",
      "not_checkable",
      "--file needs --output: a rider grants or approves a use, it does not commit to a file",
    );
  }
} else if (mode === "egress") {
  // The licence behind a release is checked in full, exactly as for a licence-key output: a
  // release whose licence does not check out is not a valid receipt however well it is signed.
  if (licenseData) {
    await checkSignature(checks, 3, "licence", licenseData.signature);
    checkPerson(checks, licenseData);
    checkAssets(checks, licenseData);
    checkLicenseFacts(checks, licenseData);
  } else {
    checks.add(3, "licence", "fail", "the licence behind this release could not be read");
  }
  await checkEgressCredential(checks, outputData, fileBytes);
  if (args.privateBlock) {
    let raw: string;
    try {
      raw = await Deno.readTextFile(args.privateBlock);
    } catch (e) {
      die(3, `could not read ${args.privateBlock}: ${e instanceof Error ? e.message : String(e)}`);
    }
    await checkPrivateBlock(checks, outputData.credential, raw);
  }
} else if (mode === "variation") {
  await checkVariationCredential(checks, outputData, fileBytes);
  if (args.privateBlock) {
    let raw: string;
    try {
      raw = await Deno.readTextFile(args.privateBlock);
    } catch (e) {
      die(3, `could not read ${args.privateBlock}: ${e instanceof Error ? e.message : String(e)}`);
    }
    await checkPrivateBlock(checks, outputData.credential, raw);
  }
} else {
  if (licenseData) {
    await checkSignature(checks, 3, "licence", licenseData.signature);
    checkPerson(checks, licenseData);
    checkAssets(checks, licenseData);
    checkLicenseFacts(checks, licenseData);
    checkPlatformFee(checks, licenseData);
  } else {
    checks.add(3, "licence", "fail", "the licence behind this receipt could not be read");
  }

  if (outputData) {
    await checkCredential(checks, outputData, licenseData ?? {}, fileBytes);

    if (args.privateBlock) {
      let raw: string;
      try {
        raw = await Deno.readTextFile(args.privateBlock);
      } catch (e) {
        die(3, `could not read ${args.privateBlock}: ${e instanceof Error ? e.message : String(e)}`);
      }
      await checkPrivateBlock(checks, outputData.credential, raw);
    }
  } else if (args.file) {
    // Hashing a file against a licence rather than an output is meaningless, and silently
    // ignoring --file would look like a pass.
    checks.add(
      5,
      "file matches the credential",
      "not_checkable",
      "--file needs --output: a licence does not commit to any particular file",
    );
  }
}

// ---------------------------------------------------------------------------
// Transparency log. Optional on purpose: the log is a separate deployment, and a receipt is
// still a receipt without it. Absence is reported as not-checkable, never as a pass.
// ---------------------------------------------------------------------------

if (!args.noLog) {
  const subjectId = args.output ?? args.rider ?? args.license;
  const sthUrl = `${args.base}/idl-log-sth`;
  // deno-lint-ignore no-explicit-any
  let logData: any = null;
  try {
    const res = await fetch(`${sthUrl}?include=${encodeURIComponent(subjectId!)}`, {
      headers: { accept: "application/json" },
    });
    if (res.ok) {
      const body = await res.json();
      if (body?.ok === true) logData = body.data;
    } else if (res.status === 404) {
      checks.add(
        0,
        "transparency log",
        "not_checkable",
        "no log endpoint is deployed at this base, so nothing pins this record into a public log",
      );
    } else {
      checks.add(0, "transparency log", "not_checkable", `log endpoint answered HTTP ${res.status}`);
    }
  } catch {
    checks.add(0, "transparency log", "not_checkable", "log endpoint unreachable");
  }

  // Whether the served head's signature binding was established. The witnessed-head consistency
  // block below is gated on this: consistency arithmetic about an unbound head prints pass lines
  // about a tree nobody signed, which is the exact transcript shape the binding rules exist to
  // stop (verification-spec-v1 section 6: on a failed binding, run no inclusion or consistency
  // arithmetic at all).
  let headBound = false;
  if (logData) {
    // The head is checked whether or not this record is in the tree. A log that answers with a
    // head it cannot sign is broken regardless of whose entry is being looked up, and finding
    // that out should not depend on asking about the right record.
    const head = logData.sth ?? logData;
    if (logData.inclusion) {
      headBound = await checkLogInclusion(checks, head, logData.inclusion);
      // The record-specific half: inclusion proves SOME entries for this subject sit under the
      // signed head; these tie the served receipt to what those entries actually say.
      if (mode === "variation") checkVariationLogEntry(checks, logData, outputData);
      if (mode === "rider") await checkRiderLogEntry(checks, head, logData, riderData);
    } else {
      // No inclusion proof, so the binding block never ran: the head counts as bound for the
      // consistency check only if it carries a signature block at all, and the signature line
      // itself still passes or fails on its own merits.
      headBound = !!head?.signature && typeof head.signature === "object";
      await checkSignature(checks, 0, "tree head", head?.signature);
      checks.add(
        0,
        "tree size",
        Number(head?.tree_size) >= 0 ? "pass" : "fail",
        `the served head claims a tree of ${head?.tree_size} entries`,
      );
      // An absent entry is not evidence against the record: everything issued before the log
      // began is legitimately missing from it. Saying "not in the log" as though it were a
      // finding would turn our own deployment date into an accusation.
      checks.add(
        0,
        "transparency log",
        "not_checkable",
        `the log holds no entry for this record (tree size ${
          logData.sth?.tree_size ?? "?"
        }); expected for records created before the log began, and not evidence against them`,
      );
    }
  }

  // Link 4 recomputed rather than asserted. The per-licence chain is a separate structure from
  // the Merkle log: inclusion proves the log holds this record, the chain proves the licence's
  // own generation and registration history has not been edited. Fetched from the same endpoint
  // and, like the log itself, reported as not-checkable when it is not there.
  {
    const licenceForChain = licenseData?.license?.license_id ?? args.license;
    if (licenceForChain) {
      try {
        const res = await fetch(`${sthUrl}?chain=${encodeURIComponent(licenceForChain)}`, {
          headers: { accept: "application/json" },
        });
        if (res.ok) {
          const body = await res.json();
          if (body?.ok === true) await checkLicenseChain(checks, body.data);
        } else {
          checks.add(4, "licence chain", "not_checkable", `chain endpoint answered HTTP ${res.status}`);
        }
      } catch {
        checks.add(4, "licence chain", "not_checkable", "chain endpoint unreachable");
      }
    }
  }

  // Anti-rewrite: prove today's tree is an append-only extension of a head witnessed OUTSIDE
  // this infrastructure. The mirror repo is public and its default branch refuses force pushes,
  // so a head that reached it is out of the operator's hands. The mirrored root, never the
  // server's restatement of it, is the first root in the proof; a failure here means the log was
  // rewritten behind a head that is already public, which is the one thing this whole
  // construction exists to make impossible to hide.
  // Gated on the head binding above: a consistency proof joins two roots, and joining anything
  // to a root whose signature binding failed (or that carries no signature at all) would print
  // "append of the publicly witnessed head" about a tree nobody signed. The binding failure has
  // already printed its own loud FAIL and the verdict is already lost; adding arithmetic lines
  // here would only dress the transcript back up.
  if (headBound && logData?.sth?.root_hash) {
    const current = logData.sth;
    let witnessed: { tree_size?: string; root_hash?: string } | null = null;
    try {
      const latest = await fetch(`${args.mirror}/latest.json`);
      if (latest.ok) {
        const pointer = await latest.json();
        if (pointer?.path) {
          const headFile = await fetch(`${args.mirror}/${pointer.path}`);
          if (headFile.ok) witnessed = await headFile.json();
        }
      }
    } catch { /* reported as not_checkable below */ }

    if (!witnessed?.tree_size || !witnessed?.root_hash) {
      checks.add(
        0,
        "witnessed head",
        "not_checkable",
        "no publicly mirrored head could be fetched, so append-only history rests on the log alone",
      );
    } else {
      const m = Number(witnessed.tree_size);
      const n = Number(current.tree_size);
      if (!Number.isInteger(m) || !Number.isInteger(n)) {
        checks.add(0, "witnessed head", "not_checkable", "a tree size was not a whole number");
      } else if (m > n) {
        checks.add(
          0,
          "witnessed head",
          "fail",
          `the public mirror witnessed a tree of ${m} but the live log claims only ${n}; ` +
            "a log can only grow, so entries witnessed publicly have been removed",
        );
      } else if (m === n) {
        const same = witnessed.root_hash === current.root_hash;
        checks.add(
          0,
          "witnessed head",
          same ? "pass" : "fail",
          same
            ? `the live tree equals the publicly witnessed head (size ${m}) byte for byte`
            : `the live root differs from the publicly witnessed root at the same size ${m}; ` +
              "history has been rewritten",
        );
      } else {
        try {
          const res = await fetch(`${sthUrl}?consistency=${m}`, {
            headers: { accept: "application/json" },
          });
          const body = res.ok ? await res.json() : null;
          const proof = body?.ok === true ? body.data?.proof : null;
          if (!Array.isArray(proof)) {
            checks.add(0, "witnessed head", "not_checkable", "the log served no consistency proof");
          } else {
            const consistent = await verifyConsistency(
              m,
              n,
              proof.map((h: string) => hexToBytes(h)),
              hexToBytes(witnessed.root_hash),
              hexToBytes(current.root_hash),
            );
            checks.add(
              0,
              "witnessed head",
              consistent ? "pass" : "fail",
              consistent
                ? `today's tree of ${n} is a pure append of the publicly witnessed head of ${m}: ` +
                  "nothing witnessed has been altered or removed"
                : `the consistency proof from the witnessed head of ${m} to today's ${n} FAILED: ` +
                  "the log was rewritten behind a head that is already public",
            );
          }
        } catch {
          checks.add(0, "witnessed head", "not_checkable", "the consistency endpoint was unreachable");
        }
      }
    }
  }
}

// ---------------------------------------------------------------------------
// Report
// ---------------------------------------------------------------------------

if (args.json) {
  console.log(JSON.stringify(buildReceipt(), null, 2));
} else {
  report();
}
Deno.exit(finalCode());

function finalCode(): number {
  const v = checks.verdict;
  return v === "fail" ? 1 : v === "incomplete" ? 2 : 0;
}

function report(): void {
  // The rider IS the permission instrument (link 3's role) and a variation credential is the
  // content credential (link 5's role), so the labels name what was actually checked rather
  // than borrowing the licence vocabulary for records that have no licence.
  const LINKS: Record<number, string> = mode === "egress"
    ? {
      0: "document and log",
      1: "link 1: person",
      2: "link 2: asset version",
      3: "link 3: licence",
      4: "link 4: authorising decision",
      5: "link 5: released artifact",
    }
    : mode === "rider"
    ? {
      0: "document and log",
      3: "link 3: rider (signed permission)",
      4: "link 4: approval event",
      5: "link 5: content credential",
    }
    : mode === "variation"
    ? {
      0: "document and log",
      3: "link 3: permission",
      4: "link 4: registration event",
      5: "link 5: variation credential",
    }
    : {
      0: "document and log",
      1: "link 1: person",
      2: "link 2: asset version",
      3: "link 3: licence",
      4: "link 4: generation event",
      5: "link 5: content credential",
    };
  const mark = (r: Check["result"]) =>
    r === "pass" ? "PASS         " : r === "fail" ? "FAIL         " : "NOT CHECKABLE";

  if (!args.quiet) {
    const subject = args.rider
      ? `rider ${args.rider}`
      : args.output
      ? `output ${args.output}`
      : `licence ${args.license}`;
    console.log(`\nSocialGravity receipt verification: ${subject}`);
    console.log(`base: ${args.base}\n`);

    // A demo mark is not a verification failure: the signature over test data is genuine, which
    // is exactly why the warning cannot be inferred from any check line and is shouted instead.
    const demoNote = riderData?.demo_note ?? outputData?.demo_note ?? licenseData?.demo_note;
    if (riderData?.demo || outputData?.demo || licenseData?.demo) {
      console.log(`DEMO RECORD. ${demoNote ?? "This is test data and must not be quoted as a deal."}\n`);
    }

    for (const link of [0, 1, 2, 3, 4, 5]) {
      const group = checks.list.filter((c) => c.link === link);
      if (!group.length) continue;
      console.log(LINKS[link]);
      for (const c of group) {
        // The code beside the prose name, same rendering as packages/verify: a pipeline switches
        // on the code, and a code that only exists inside an English sentence is not one it can
        // act on. Checks that exist only in this network verifier carry no code, and print none.
        console.log(`  ${mark(c.result)}  ${c.name}${c.code ? `  [${c.code}]` : ""}`);
        if (c.detail) console.log(`                 ${c.detail}`);
      }
      console.log("");
    }
  }

  const v = checks.verdict;
  const counts = `${checks.list.length - checks.failed - checks.unchecked} passed, ${checks.failed} failed, ${checks.unchecked} not checkable`;
  if (v === "pass") console.log(`VERDICT: PASS. ${counts}.`);
  else if (v === "fail") console.log(`VERDICT: FAIL. ${counts}.`);
  else {
    console.log(
      `VERDICT: INCOMPLETE. ${counts}. Nothing contradicted the receipt, but the lines above ` +
        `marked NOT CHECKABLE are assertions or unavailable data, not proofs.`,
    );
  }
}

/**
 * The archivable receipt document. Licence and licence-key output receipts follow
 * docs/schemas/receipt-v1.schema.json; rider and variation receipts are different instrument
 * kinds with their own document shapes (rider-receipt-v1.schema.json and
 * variation-receipt-v1.schema.json), named by receipt_kind, rather than a v2 of the five-link
 * assembly: nothing about the existing document changed, so nothing about it is versioned.
 */
// deno-lint-ignore no-explicit-any
function buildReceipt(): any {
  const verification = {
    verdict: checks.verdict,
    verified_at: new Date().toISOString(),
    checks: checks.list,
  };

  if (mode === "rider") {
    const r = riderData ?? {};
    return {
      receipt_kind: "variation_rider",
      receipt_version: "1",
      assembled_at: new Date().toISOString(),
      ...(r.demo ? { demo: true } : {}),
      rider: {
        rider_id: r.rider_id,
        variation_request_id: r.variation_request_id,
        status: r.status,
        ...(r.talent_display_name ? { talent_display_name: r.talent_display_name } : {}),
        ...(r.approved_by ? { approved_by: r.approved_by } : {}),
        proposed_use: r.proposed_use,
        ...(r.conditions_sha256 ? { conditions_sha256: r.conditions_sha256 } : {}),
        ...(r.permission_id ? { permission_id: r.permission_id } : {}),
        ...(r.agreement_id ? { agreement_id: r.agreement_id } : {}),
        document_sha256: r.document_sha256,
        ...(r.instrument_version ? { instrument_version: r.instrument_version } : {}),
        responded_at: r.responded_at,
        signed_at: r.signed_at,
        signature: r.signature,
      },
      verification,
    };
  }

  if (mode === "egress") {
    const cred = outputData?.credential ?? {};
    return {
      receipt_kind: "egress_release",
      receipt_version: "1",
      assembled_at: new Date().toISOString(),
      ...(outputData?.demo ? { demo: true } : {}),
      credential: {
        release_id: cred.release_id,
        kind: cred.kind,
        license_id: cred.license_id,
        ...(cred.talent_display_name ? { talent_display_name: cred.talent_display_name } : {}),
        ...(cred.brand_name ? { brand_name: cred.brand_name } : {}),
        output_sha256: cred.output_sha256,
        media_kind: cred.media_kind,
        content_type: cred.content_type,
        model: cred.model,
        byte_size: cred.byte_size,
        watermark: cred.watermark,
        ...(cred.fingerprints ? { fingerprints: cred.fingerprints } : {}),
        decision: cred.decision,
        released_at: cred.released_at,
        ...(cred.signature?.signed_payload?.private_sha256
          ? { private_sha256: cred.signature.signed_payload.private_sha256 }
          : {}),
        signature: cred.signature,
        ...(cred.verify_url ? { verify_url: cred.verify_url } : {}),
      },
      ...(outputData?.license_status ? { license_status: outputData.license_status } : {}),
      ...(outputData?.register_record_hash
        ? { register_record_hash: outputData.register_record_hash }
        : {}),
      verification,
    };
  }

  if (mode === "variation") {
    const cred = outputData?.credential ?? {};
    return {
      receipt_kind: "approved_variation",
      receipt_version: "1",
      assembled_at: new Date().toISOString(),
      ...(outputData?.demo ? { demo: true } : {}),
      credential: {
        output_id: cred.output_id,
        kind: cred.kind,
        variation_request_id: cred.variation_request_id,
        likeness_display_name: cred.likeness_display_name,
        output_sha256: cred.output_sha256,
        media_kind: cred.media_kind,
        ...(cred.tool ? { tool: cred.tool } : {}),
        ...(cred.source_asset_sha256s ? { source_asset_sha256s: cred.source_asset_sha256s } : {}),
        permission_ref: cred.permission_ref,
        ...(cred.approved_at ? { approved_at: cred.approved_at } : {}),
        registered_at: cred.registered_at,
        ...(cred.fingerprints ? { fingerprints: cred.fingerprints } : {}),
        ...(cred.signature?.signed_payload?.private_sha256
          ? { private_sha256: cred.signature.signed_payload.private_sha256 }
          : {}),
        signature: cred.signature,
        ...(cred.verify_url ? { verify_url: cred.verify_url } : {}),
      },
      ...(outputData?.register_record_hash
        ? { register_record_hash: outputData.register_record_hash }
        : {}),
      verification,
    };
  }

  const l = licenseData;
  const cred = outputData?.credential;
  const payload = l?.signature?.signed_payload ?? {};
  // deno-lint-ignore no-explicit-any
  const doc: any = {
    receipt_version: "1",
    assembled_at: new Date().toISOString(),
    person: {
      display_name: l?.talent_display_name ?? "",
      consent_on_record: true,
      ...(l?.identity_method ? { identity_method: l.identity_method } : {}),
      ...(payload.consent_video_sha256 ? { consent_video_sha256: payload.consent_video_sha256 } : {}),
    },
    ...(Array.isArray(l?.assets_licensed) && l.assets_licensed.length
      ? { assets: l.assets_licensed }
      : {}),
    license: {
      license_id: l?.license_id,
      status: l?.status,
      brand_name: l?.brand_name ?? "",
      ...(l?.agency_name ? { agency_name: l.agency_name } : {}),
      scope: {
        assets: l?.assets,
        use_case: l?.use_case,
        media_channels: l?.media_channels,
        territories: l?.territories,
      },
      effective_at: l?.effective_at,
      expires_at: l?.expires_at,
      contract_sha256: l?.contract_sha256,
      ...(l?.asset_pack_sha256 ? { asset_pack_sha256: l.asset_pack_sha256 } : {}),
      ...(l?.post_expiry ? { post_expiry: l.post_expiry } : {}),
      signature: l?.signature,
    },
    verification: {
      verdict: checks.verdict,
      verified_at: new Date().toISOString(),
      checks: checks.list,
    },
  };

  if (cred) {
    doc.generation = {
      captured: cred.captured,
      ...(cred.model ? { model: cred.model } : {}),
      output_sha256: cred.output_sha256,
      ...(cred.registered_at ? { registered_at: cred.registered_at } : {}),
    };
    doc.credential = {
      output_id: cred.output_id,
      license_id: cred.license_id,
      ...(cred.talent_display_name ? { talent_display_name: cred.talent_display_name } : {}),
      ...(cred.brand_name ? { brand_name: cred.brand_name } : {}),
      output_sha256: cred.output_sha256,
      ...(cred.media_kind ? { media_kind: cred.media_kind } : {}),
      ...(cred.model ? { model: cred.model } : {}),
      captured: cred.captured,
      ...(cred.published_at ? { published_at: cred.published_at } : {}),
      registered_at: cred.registered_at,
      ...(cred.assets_licensed ? { assets_licensed: cred.assets_licensed } : {}),
      ...(typeof cred.license_active_at_publication === "boolean"
        ? { license_active_at_publication: cred.license_active_at_publication }
        : {}),
      ...(cred.license_term_basis ? { license_term_basis: cred.license_term_basis } : {}),
      ...(cred.signature?.signed_payload?.private_sha256
        ? { private_sha256: cred.signature.signed_payload.private_sha256 }
        : {}),
      ...(outputData?.register_record_hash
        ? { register_record_hash: outputData.register_record_hash }
        : {}),
      signature: cred.signature,
      verify_url: cred.verify_url,
    };
  }
  return doc;
}