@action-state-group/capsule-viewer 0.0.0-stage → 0.1.0

package/dist/evidence-graph-view.js

@@ -0,0 +1,1480 @@
+// SPDX-License-Identifier: BSD-3-Clause
+import { buildVerifiedBundleContext, disclosureOf, isVerifiedBundleContext, withCountersigners, } from "@action-state-group/agent-action-capsule";
+import { BUILTIN_MANIFEST_COMPOSED, BUILTIN_MANIFEST_EVALUATION_SUMMARY_GRAPH, BUILTIN_MANIFEST_NO_AGGREGATE, BUILTIN_MANIFEST_REPORT_ROWS, BUILTIN_MANIFEST_RESULT, BUILTIN_MANIFEST_RESULT_COMPLIANCE, BUILTIN_MANIFEST_RESULT_OUTCOME_REPORT, } from "@action-state-group/agent-action-capsule";
+import { classifyCountersignatures, declaredProducerKeys, } from "@action-state-group/agent-action-capsule";
+import { buildEvidenceGraph, EvidenceGraphError, zoneStatement, } from "@action-state-group/agent-action-capsule";
+import { digestCapability } from "@action-state-group/agent-action-capsule";
+import { renderOutcomeReportPage } from "./outcome-report-view.js";
+import { readOutcomeReportPresentation, } from "@action-state-group/agent-action-capsule";
+import { renderCompliancePage } from "./compliance-view.js";
+import { composedSectionModule } from "./composed-view.js";
+import { readCompliancePresentation, } from "./compliance-presentation.js";
+import { readPresentationBlock } from "@action-state-group/agent-action-capsule";
+import { bundleVerified, PresentationAmbiguityError, PresentationRegistry, } from "@action-state-group/agent-action-capsule";
+import { buildReportRows, } from "@action-state-group/agent-action-capsule";
+import { buildResultRoot, isResultRoot, UNVERIFIED_KEY_LABEL, } from "@action-state-group/agent-action-capsule";
+import { buildVerificationPageModel, CHECKED_ON_THIS_PAGE, CHECKS_SCOPE_LINE, FAILED_ON_THIS_PAGE, FULL_VERIFIER_LINE, NOT_CHECKED_ON_THIS_PAGE, RECEIPT_GRADE_DISPLAY, verificationCheckWords, unboundRecordIds, } from "@action-state-group/agent-action-capsule";
+function element(tag, text) {
+    const value = document.createElement(tag);
+    if (text !== undefined)
+        value.textContent = text;
+    return value;
+}
+function display(value) {
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+function appendValue(parent, label, value) {
+    parent.append(element("dt", label));
+    parent.append(element("dd", display(value)));
+}
+// A written time is printed exactly as the source wrote it. When it states no
+// zone, a visible marker follows it; no zone is ever assigned and no `Z` or
+// UTC label is ever printed on a time that did not carry one.
+function renderTime(value) {
+    const zone = zoneStatement(value);
+    const time = element("span", value);
+    time.dataset.tz = zone;
+    if (zone === "not-stated") {
+        const marker = element("span", " (timezone not stated)");
+        marker.dataset.tzMarker = "not-stated";
+        time.append(marker);
+    }
+    return time;
+}
+function appendTime(parent, label, value, absent) {
+    parent.append(element("dt", label));
+    const cell = element("dd");
+    if (value === undefined) {
+        cell.textContent = absent;
+        cell.dataset.time = "not-stated";
+    }
+    else {
+        cell.append(renderTime(value));
+    }
+    parent.append(cell);
+}
+const recordsWord = (count) => `${count} ${count === 1 ? "record" : "records"}`;
+// The banner is drawn from the verification result alone and precedes every
+// row in the DOM; an unverified bundle gets the refusal line here and no
+// rows at all, so a reader never meets a payload before the verdict on the
+// bundle that carries it. It says what IS proven: a verified bundle with
+// records outside the checkpoint names their count up front.
+function renderVerificationBanner(root, verified, coverage) {
+    const banner = element("p", verified
+        ? coverage.uncheckpointed === 0
+            ? "Bundle verification passed"
+            : `Bundle verification passed; ${coverage.uncheckpointed} of ${recordsWord(coverage.total)} uncheckpointed`
+        : "Bundle verification failed");
+    banner.dataset.verify = verified ? "verified" : "failed";
+    banner.dataset.uncheckpointed = String(coverage.uncheckpointed);
+    root.append(banner);
+    if (verified)
+        return banner;
+    const refusal = element("p", "This bundle did not verify. Its records, rows and payloads are not shown; the verification page below lists which checks failed.");
+    refusal.dataset.refusal = "unverified-bundle";
+    root.append(refusal);
+    return banner;
+}
+/** The words a page says when this viewer cannot verify the bundle at all. */
+export const UNABLE_TO_VERIFY_LINES = {
+    banner: "Unable to verify in this viewer",
+    reason: "This viewer cannot compute the SHA-256 digests the checks need, so nothing was checked and no records are shown. This is not a failed check: the file may well be valid.",
+    command: "To check this file, run:",
+    noCommand: "To check this file, open it from a secure (https) page, or check it with a verifier outside this viewer.",
+};
+/**
+ * Render the "unable to verify in this viewer" state into `root`: drawn,
+ * in place of any verification result, when this runtime has no SHA-256
+ * (`digestCapability() === "none"`). It never says the bundle failed, and
+ * it shows no record. `verifyCommand` is the exact command a reader runs
+ * to check the file elsewhere; without one, the page says where to check
+ * it instead.
+ */
+export function renderUnableToVerify(root, options = {}) {
+    root.replaceChildren();
+    const banner = element("p", UNABLE_TO_VERIFY_LINES.banner);
+    banner.dataset.verify = "unable";
+    const reason = element("p", UNABLE_TO_VERIFY_LINES.reason);
+    reason.dataset.refusal = "unable-to-verify";
+    root.append(banner, reason);
+    if (options.verifyCommand === undefined) {
+        root.append(element("p", UNABLE_TO_VERIFY_LINES.noCommand));
+        return;
+    }
+    const command = element("code", options.verifyCommand);
+    command.dataset.verifyCommand = "";
+    const block = element("pre");
+    block.append(command);
+    root.append(element("p", UNABLE_TO_VERIFY_LINES.command), block);
+}
+// Drawn in the outcome-report card's own look when that card renders
+// (OUTCOME_REPORT_CSS's .oi-banner rules); the words and data attributes are
+// identical either way -- the class is presentation only.
+function styleBanner(banner, verified) {
+    banner.className = `oi oi-banner ${verified ? "oi-banner-ok" : "oi-banner-failed"}`;
+}
+// presentation/v1 is rendered here, in the header only, and nowhere else in
+// this module. Only readPresentationBlock's three known fields ever reach
+// the DOM -- the chrome rule holds structurally, not by a rendering-site
+// convention that a future edit could bypass.
+function renderPresentationHeader(root, bundle) {
+    const presentation = readPresentationBlock(bundle);
+    if (presentation === undefined)
+        return;
+    const header = element("header");
+    header.dataset.presentation = "header";
+    if (presentation.logoDataUrl !== undefined) {
+        const logo = document.createElement("img");
+        logo.src = presentation.logoDataUrl;
+        logo.alt = presentation.producerDisplayName ?? "producer logo";
+        header.append(logo);
+    }
+    if (presentation.producerDisplayName !== undefined) {
+        const name = element("span", presentation.producerDisplayName);
+        name.dataset.presentationField = "producer-display-name";
+        header.append(name);
+    }
+    if (presentation.title !== undefined) {
+        const title = element("strong", presentation.title);
+        title.dataset.presentationField = "title";
+        header.append(title);
+    }
+    root.append(header);
+}
+function stampText(stamp) {
+    switch (stamp.kind) {
+        case "hollow":
+            return "Countersigned: none";
+        case "unverified":
+            return stamp.reason === "no-ed25519"
+                ? `a ${stamp.type} countersignature is present; its signature is not checked in this viewer`
+                : `a ${stamp.type} countersignature is present; this viewer does not verify that type`;
+        case "invalid":
+            return "a countersignature is present but failed to verify";
+        case "not-independent":
+            return `countersigned by the producer — not independent · recomputed ${stamp.statement.recomputedAt}`;
+        case "unresolved-signer":
+            return `countersigned by an unlisted signer, not in any countersigner list consulted · recomputed ${stamp.statement.recomputedAt}`;
+        case "resolved":
+            return `Countersigned by ${stamp.name} · recomputed ${stamp.statement.recomputedAt}`;
+    }
+}
+// Each check and result is the signer's statement, listed as the signer gave
+// it: never totalled, never presented as this viewer's own finding.
+function renderSignerStatement(item, signer, statement) {
+    const label = element("p", `${signer}'s statement of what it recomputed:`);
+    item.append(label);
+    const checks = element("ul");
+    checks.dataset.countersignStatement = "checks";
+    statement.checks.forEach((check) => {
+        const row = element("li", `${check.name}: ${check.result}`);
+        row.dataset.checkResult = check.result;
+        checks.append(row);
+    });
+    item.append(checks);
+    if (statement.receipt === "unverified") {
+        const receipt = element("p", "receipt present, not checked by this viewer");
+        receipt.dataset.countersignReceipt = "unverified";
+        item.append(receipt);
+    }
+}
+function renderStamps(host, stamps) {
+    host.append(element("h4", "Countersignatures"));
+    const list = element("ul");
+    stamps.forEach((stamp) => {
+        const item = element("li");
+        item.dataset.stampKind = stamp.kind;
+        item.append(element("span", stampText(stamp)));
+        if (stamp.kind === "resolved") {
+            renderSignerStatement(item, stamp.name, stamp.statement);
+        }
+        else if (stamp.kind === "not-independent") {
+            renderSignerStatement(item, "The producer", stamp.statement);
+        }
+        else if (stamp.kind === "unresolved-signer") {
+            renderSignerStatement(item, "The unlisted signer", stamp.statement);
+        }
+        list.append(item);
+    });
+    host.append(list);
+}
+function renderReceipts(host, receipts) {
+    host.append(element("h4", "Receipts"));
+    if (receipts.length === 0) {
+        host.append(element("p", "no receipts disclosed"));
+        return;
+    }
+    const list = element("ul");
+    receipts.forEach((receipt) => {
+        const item = element("li", `${receipt.witness} · ${RECEIPT_GRADE_DISPLAY[receipt.grade]} · `);
+        item.append(renderTime(receipt.time));
+        list.append(item);
+    });
+    host.append(list);
+}
+const COVERAGE_LABEL = Object.freeze({
+    checkpointed: "checkpointed",
+    uncheckpointed: "uncheckpointed",
+    membership_invalid: "membership invalid",
+    unverified: "membership unverified",
+});
+// One row per supplied record, in bundle order, each with its own standing
+// under the checkpoint. When the claim established coverage the count is
+// stated in words above the list. When it did not, the line says so and
+// names the verifier's reason -- never "0 records uncheckpointed" on a
+// bundle whose memberships were never verified -- and when the claim was
+// withheld (no checkpoint to stand under) there is no list at all.
+function renderCheckpointCoverage(host, records, uncheckpointed, coverage) {
+    host.append(element("h4", "Checkpoint coverage"));
+    if (coverage.status === "established") {
+        const count = element("p", `${recordsWord(uncheckpointed)} uncheckpointed of ${recordsWord(records.length)} supplied`);
+        count.dataset.coverage = "uncheckpointed";
+        count.dataset.count = String(uncheckpointed);
+        host.append(count);
+    }
+    else {
+        const line = element("p", `coverage not established: ${coverage.reason}`);
+        line.dataset.coverage = "not-established";
+        line.dataset.claim = coverage.status;
+        host.append(line);
+        if (coverage.status === "withheld")
+            return;
+    }
+    host.append(renderCoverageStatusCounts(records));
+    const details = element("details");
+    details.dataset.records = "coverage-detail";
+    const summary = element("summary", `${recordsWord(records.length)}, by capsule id`);
+    details.append(summary);
+    const list = element("ul");
+    list.dataset.records = "coverage";
+    for (const record of records) {
+        const item = element("li", `${record.capsuleId} · `);
+        const status = element("span", COVERAGE_LABEL[record.status]);
+        status.dataset.recordStatus = record.status;
+        status.className = `seal-${record.status}`;
+        item.dataset.capsuleId = record.capsuleId;
+        item.append(status);
+        list.append(item);
+    }
+    details.append(list);
+    host.append(details);
+}
+// Counts by seal status -- the line a reader actually needs (how many of
+// each) without scrolling a list that is one row per record (500+ rows on a
+// real day's book: 50 cases x 9 criteria + 50 cases + 1 Close). The full,
+// per-capsule-id list stays available (renderCheckpointCoverage wraps it in
+// a collapsed <details>), never removed, just not the first thing rendered.
+function renderCoverageStatusCounts(records) {
+    const counts = new Map();
+    for (const record of records) {
+        counts.set(record.status, (counts.get(record.status) ?? 0) + 1);
+    }
+    const list = element("ul");
+    list.dataset.records = "coverage-summary";
+    for (const status of Object.keys(COVERAGE_LABEL)) {
+        const count = counts.get(status) ?? 0;
+        if (count === 0)
+            continue;
+        const item = element("li", `${recordsWord(count)} ${COVERAGE_LABEL[status]}`);
+        item.dataset.coverageStatus = status;
+        item.dataset.count = String(count);
+        list.append(item);
+    }
+    return list;
+}
+function renderCompletenessStatement(host, completeness) {
+    host.append(element("h4", "Completeness statement"));
+    const details = element("dl");
+    appendValue(details, "closure depth", completeness?.closureDepth ?? "unstated");
+    appendValue(details, "records mode", completeness?.recordsMode ?? "unstated");
+    appendValue(details, "payloads mode", completeness?.payloadsMode ?? "unstated");
+    appendValue(details, "suppressed fields", completeness?.suppressedFields ?? []);
+    host.append(details);
+}
+function renderChecks(host, checks) {
+    host.append(element("h4", "The ten checks"));
+    const list = element("ol");
+    checks.forEach((check) => {
+        const item = element("li");
+        item.dataset.checkStatus = check.status;
+        item.append(element("strong", check.name));
+        item.append(element("span", `: ${check.result}`));
+        list.append(item);
+    });
+    host.append(list);
+}
+// One row per extension: id, integrity, semantics. The id is the bundle's
+// own member name, set as text only. Integrity and semantics are separate
+// cells so "covered" can never read as "understood": an uninterpreted block
+// says so in words (EXTENSION_NOT_INTERPRETED). A row whose meaning a refused
+// presentation module would have applied says that instead (presentation
+// contract section 3.2), and names the module and the reason. A refused
+// module with no extension of its own gets one line after the table. Nothing
+// is drawn for a bundle with no extensions and no refusal.
+function renderExtensions(host, rows, refusals) {
+    renderExtensionTable(host, rows);
+    for (const notice of refusals) {
+        const line = element("p", notice.line);
+        line.dataset.presentationRefused = notice.id;
+        line.dataset.refusal = notice.reason;
+        host.append(line);
+    }
+}
+function renderExtensionTable(host, rows) {
+    if (rows.length === 0)
+        return;
+    host.append(element("h4", "Extensions"));
+    const table = element("table");
+    table.dataset.extensions = "";
+    const head = element("tr");
+    for (const label of ["extension", "integrity", "semantics"])
+        head.append(element("th", label));
+    const thead = element("thead");
+    thead.append(head);
+    const body = element("tbody");
+    for (const row of rows) {
+        const tr = element("tr");
+        tr.dataset.extensionId = row.id;
+        tr.dataset.integrity = row.integrity;
+        tr.dataset.semantics =
+            row.refusal !== undefined
+                ? "refused"
+                : row.interpreter === undefined
+                    ? "uninterpreted"
+                    : "interpreted";
+        if (row.refusal !== undefined) {
+            tr.dataset.refusedModule = row.refusal.id;
+            tr.dataset.refusal = row.refusal.reason;
+        }
+        tr.append(element("td", row.id), element("td", row.integrity), element("td", row.semantics));
+        body.append(tr);
+    }
+    table.append(thead, body);
+    host.append(table);
+}
+// The page's own checks in up to three lists (presentation contract section
+// 6.1): what ran here and passed, what ran here and failed, and what the
+// bundle calls for that this page did not run. A list with no entries is not
+// drawn. The not-checked list ends with the neutral pointer to a full
+// verifier and, when the host supplied one, its own verifier text (shown as
+// text, never markup).
+function renderCheckLists(host, lists, verifierHint) {
+    const groups = [
+        ["page", CHECKED_ON_THIS_PAGE, lists.page],
+        ["failed", FAILED_ON_THIS_PAGE, lists.failed],
+        ["not-checked", NOT_CHECKED_ON_THIS_PAGE, lists.notChecked],
+    ];
+    for (const [which, heading, ids] of groups) {
+        if (ids.length === 0)
+            continue;
+        host.append(element("h4", heading));
+        const list = element("ul");
+        list.dataset.checks = which;
+        for (const id of ids) {
+            const item = element("li", verificationCheckWords(id, which === "not-checked" ? "notChecked" : which, lists));
+            item.dataset.check = id;
+            list.append(item);
+        }
+        host.append(list);
+        if (which === "not-checked") {
+            const pointer = element("p", FULL_VERIFIER_LINE);
+            pointer.dataset.checks = "full-verifier";
+            host.append(pointer);
+            if (verifierHint !== undefined && verifierHint !== "") {
+                const hint = element("pre", verifierHint);
+                hint.dataset.verifierHint = "";
+                host.append(hint);
+            }
+        }
+    }
+    const scope = element("p", CHECKS_SCOPE_LINE);
+    scope.dataset.checks = "scope";
+    host.append(scope);
+}
+// The viewer-owned verification page: the last page of the rendering, drawn
+// entirely from VERIFIED data (the already-computed BundleVerificationResult
+// and the countersignature stamp classification), never from bundle-supplied
+// markup. It is never labeled a certificate.
+//
+// `styled` (true only when the outcome-report card rendered above it) draws
+// this same page in that card's look: the section takes the card's `.oi`
+// scope plus `.oi-vp`, and its content goes inside one `.sec` panel like
+// every card section. Content, order and data attributes are identical
+// either way, and it stays the last element of the rendering.
+//
+// `applied` is the set of extension interpreters this rendering ran; an
+// extension row says "interpreted by" only for one of them. `refused` is
+// every module this runtime refused that matched (page, then section).
+async function renderVerificationPage(root, context, styled, applied, refused, citedSigners, verifierHint) {
+    const { bundle, verification: verified, countersigners } = context;
+    const section = element("section");
+    section.dataset.page = "verification";
+    let page = section;
+    if (styled) {
+        section.className = "oi oi-vp";
+        page = element("div");
+        page.className = "sec";
+        section.append(page);
+    }
+    page.append(element("h2", "Verification"));
+    const stamps = await classifyCountersignatures(context.countersignatures.map((entry) => entry.value), verified.bundleDigest, declaredProducerKeys(bundle), countersigners);
+    const model = buildVerificationPageModel(bundle, verified, applied, refused, {
+        stamps,
+        citedSigners,
+    });
+    const summary = element("dl");
+    appendValue(summary, "bundle digest", model.bundleDigest ?? "uncomputable");
+    appendValue(summary, "checkpoint root", model.checkpointRoot ?? "absent");
+    appendValue(summary, "checkpoint size", model.checkpointSize ?? "absent");
+    page.append(summary);
+    renderReceipts(page, model.receipts);
+    if (model.selfWitnessed) {
+        // A checkpoint with no transparency-service receipt was witnessed by
+        // nobody but the log that produced it -- stated here in those words.
+        const witness = element("p", "self-witnessed: no transparency-service receipt");
+        witness.dataset.witness = "self";
+        page.append(witness);
+    }
+    renderCheckpointCoverage(page, model.records, model.uncheckpointedCount, model.coverage);
+    renderStamps(page, stamps);
+    renderCompletenessStatement(page, model.completeness);
+    renderChecks(page, model.checks);
+    renderExtensions(page, model.extensions, model.presentationRefusals);
+    renderCheckLists(page, model.checkLists, verifierHint);
+    page.append(element("p", model.verifyIndependentlyLine));
+    root.append(section);
+}
+function metRate(report) {
+    const required = report.outcomes.filter((outcome) => outcome.role === "required");
+    if (required.length === 0)
+        return "met rate unavailable";
+    const passed = required.filter((outcome) => outcome.aggregate === "pass").length;
+    return `met rate ${passed}/${required.length}`;
+}
+function renderCalibration(calibration) {
+    const section = element("section");
+    section.append(element("h2", "Human check"));
+    if (calibration === undefined) {
+        section.append(element("p", "no human-check data"));
+        return section;
+    }
+    const details = element("dl");
+    appendValue(details, "confusion matrix", calibration.confusion);
+    appendCount(details, "agreement", calibration.agreement);
+    appendCount(details, "corrected rate", calibration.correctedRate);
+    appendValue(details, "period window", calibration.periodWindow);
+    section.append(details);
+    return section;
+}
+// A calibration figure is printed as the integers it is made of, "k of n";
+// no rate is computed from them here, and a figure the producer stated only
+// as a rate is said to be that, not converted.
+function appendCount(parent, label, count) {
+    parent.append(element("dt", label));
+    const cell = element("dd");
+    if (count === undefined) {
+        cell.textContent = "not stated";
+        cell.dataset.count = "not-stated";
+    }
+    else if ("rate" in count) {
+        cell.textContent = "rate given, k and n not stated";
+        cell.dataset.count = "not-stated";
+    }
+    else {
+        cell.textContent = `${count.k} of ${count.n}`;
+        cell.dataset.k = String(count.k);
+        cell.dataset.n = String(count.n);
+    }
+    parent.append(cell);
+}
+// Both of a record's times are shown, each labelled and each as written. The
+// action time is the source's own; when the record states none it says so --
+// the seal time (the capsule's registration timestamp) never stands in for it.
+function renderProvenance(capsuleId, coordinates, times) {
+    const panel = element("section");
+    panel.append(element("h4", "Provenance"));
+    const details = element("dl");
+    appendValue(details, "capsule ID", capsuleId);
+    if (times.provenanceMode !== undefined)
+        appendValue(details, "provenance", times.provenanceMode);
+    appendTime(details, "action time", times.actionTime, "action time not stated");
+    appendTime(details, "seal time", times.sealTime, "seal time not stated");
+    // The seal status is this record's own: coordinates exist only for a
+    // record whose inclusion proof verified (the bundle renders only then), so
+    // a record without them sits outside the checkpoint and says so.
+    details.append(element("dt", "seal status"));
+    const seal = element("dd", coordinates === undefined ? "uncheckpointed" : "checkpointed");
+    seal.dataset.seal =
+        coordinates === undefined ? "uncheckpointed" : "checkpointed";
+    seal.className = `seal-${seal.dataset.seal}`;
+    details.append(seal);
+    if (coordinates !== undefined) {
+        appendValue(details, "log ID", coordinates.logId);
+        appendValue(details, "sequence", coordinates.seq);
+        appendValue(details, "leaf", coordinates.leafIndex);
+    }
+    panel.append(details);
+    return panel;
+}
+function renderJudgment(judgment) {
+    const item = element("li");
+    item.append(element("strong", `${judgment.axisId}: ${judgment.status}`));
+    item.append(element("p", judgment.rationale));
+    item.append(element("p", `evidence: ${judgment.evidenceIds.join(", ")}`));
+    return item;
+}
+function renderAct(act) {
+    const section = element("section");
+    section.append(element("h4", `Turn ${act.turnIdx}`));
+    if (act.agentInput !== undefined)
+        section.append(element("pre", display(act.agentInput)));
+    if (act.agentOutput !== undefined)
+        section.append(element("pre", display(act.agentOutput)));
+    section.append(renderProvenance(act.capsuleId, act.logCoordinates, act));
+    return section;
+}
+function object(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : {};
+}
+function renderWithheldActs(acts, host) {
+    for (const act of acts) {
+        if (act.agentInput !== undefined && act.agentOutput !== undefined)
+            continue;
+        const committed = object({
+            agent_input_digest: act.agentInputDigest,
+            agent_output_digest: act.agentOutputDigest,
+        });
+        const evidence = element("section");
+        evidence.append(element("h4", "Undisclosed payload evidence"));
+        const details = element("dl");
+        appendValue(details, "capsule ID", act.capsuleId);
+        for (const field of ["agent_input_digest", "agent_output_digest"]) {
+            if (typeof committed[field] === "string")
+                appendValue(details, field, committed[field]);
+        }
+        evidence.append(details);
+        // A supplied value that does not hash to the committed digest is never
+        // shown; the reader sees the digest above and this note, nothing else.
+        for (const [field, state] of [
+            ["agent_input", act.agentInputDisclosure],
+            ["agent_output", act.agentOutputDisclosure],
+        ]) {
+            if (state !== "disclosure_mismatch")
+                continue;
+            const note = element("p", `${field}: the disclosed value does not match the committed digest and is withheld`);
+            note.dataset.disclosure = state;
+            evidence.append(note);
+        }
+        host.append(evidence);
+    }
+}
+function renderCase(caseNode, host) {
+    host.replaceChildren();
+    host.append(element("h3", `Case ${caseNode.caseId}`));
+    const judgments = element("ul");
+    caseNode.judgments.forEach((judgment) => judgments.append(renderJudgment(judgment)));
+    host.append(element("h4", "Axis judgments"), judgments);
+    host.append(element("h4", "Disclosed transcript"));
+    caseNode.acts.forEach((act) => host.append(renderAct(act)));
+    renderWithheldActs(caseNode.acts, host);
+}
+function renderReport(report, host, _records) {
+    host.replaceChildren();
+    const heading = element("h2", "Cases for ");
+    heading.append(renderTime(report.date));
+    host.append(heading);
+    const outcomes = element("ul");
+    report.outcomes.forEach((outcome) => {
+        outcomes.append(element("li", `${outcome.outcomeId} (${outcome.role}): ${outcome.aggregate ?? "unrated"}`));
+    });
+    host.append(element("h3", "Outcome rollup"), outcomes);
+    renderWithheldActs(report.withheldActs, host);
+    const cases = element("section");
+    const detail = element("section");
+    report.cases.forEach((caseNode) => {
+        const item = element("button", `${caseNode.taskId}, trial ${caseNode.trial}: ${caseNode.aggregate ?? "unrated"}`);
+        item.setAttribute("type", "button");
+        item.dataset.caseId = caseNode.caseId;
+        item.addEventListener("click", () => renderCase(caseNode, detail));
+        cases.append(item);
+    });
+    host.append(cases, detail, renderProvenance(report.capsuleId, report.logCoordinates, report));
+}
+// report/v1: the generic row path. Every row is rendered from its own data
+// -- label, status, reason, citations -- never from report-specific markup,
+// so a pack this module has never heard of (obligations, Consumer Duty,
+// anything else) renders the same way an outcomes report does.
+function renderCitation(citation) {
+    const section = element("section");
+    section.append(renderProvenance(citation.capsuleId, citation.logCoordinates, citation));
+    if (citation.disclosure === "disclosed") {
+        section.append(element("pre", display(citation.disclosedPayload)));
+    }
+    else {
+        const note = element("p", citation.disclosure === "disclosure_mismatch"
+            ? "withheld: the disclosed value does not match the committed digest"
+            : "withheld");
+        note.dataset.disclosure = citation.disclosure;
+        section.append(note);
+    }
+    return section;
+}
+function renderReportRow(row, host) {
+    host.replaceChildren();
+    host.append(element("h3", row.label));
+    const status = element("p", row.status.replaceAll("_", " "));
+    status.dataset.rowStatus = row.status;
+    host.append(status);
+    if (row.reason !== undefined)
+        host.append(element("p", row.reason));
+    host.append(element("h4", "Evidence"));
+    if (row.citations.length === 0) {
+        host.append(element("p", "no citation"));
+    }
+    else {
+        row.citations.forEach((citation) => host.append(renderCitation(citation)));
+    }
+}
+function renderReportRowsTable(reportRows, root) {
+    const section = element("section");
+    section.dataset.page = "report-rows";
+    section.append(element("h1", reportRows.title ?? "Report"));
+    const table = document.createElement("table");
+    const detail = element("section");
+    reportRows.rows.forEach((row) => {
+        const tr = document.createElement("tr");
+        const labelCell = document.createElement("td");
+        const button = element("button", row.label);
+        button.setAttribute("type", "button");
+        button.dataset.rowId = row.rowId;
+        button.addEventListener("click", () => renderReportRow(row, detail));
+        labelCell.append(button);
+        const statusCell = element("td", row.status.replaceAll("_", " "));
+        statusCell.dataset.rowStatus = row.status;
+        tr.append(labelCell, statusCell);
+        table.append(tr);
+    });
+    section.append(table, detail, renderProvenance(reportRows.capsuleId, reportRows.logCoordinates, reportRows));
+    root.append(section);
+}
+// Result v0 root: headlines from the root Result, drill-downs from the
+// records it cites. A cited record is drawn from its own data -- provenance,
+// each committed member as disclosed or as `withheld · <digest>`, and the
+// records it cites in turn -- so aggregate → daily → case → act is a walk
+// over citations, never report-specific markup.
+function renderCitedMember(host, field, resolution, committed) {
+    if (resolution.state !== "disclosed" && committed === undefined)
+        return;
+    host.append(element("h5", field));
+    if (resolution.state === "disclosed") {
+        host.append(element("pre", display(resolution.payload)));
+        return;
+    }
+    // A withheld member shows the digest the record committed to; a supplied
+    // value that does not hash to it is never shown, only noted.
+    const note = element("p", resolution.state === "disclosure_mismatch"
+        ? `withheld · ${committed}: the disclosed value does not match the committed digest`
+        : `withheld · ${committed}`);
+    note.dataset.disclosure = resolution.state;
+    host.append(note);
+}
+function renderCitedRecord(record, records, host) {
+    const section = element("section");
+    section.dataset.citedRecord = record.capsuleId;
+    section.append(renderProvenance(record.capsuleId, record.logCoordinates, record));
+    renderCitedMember(section, "agent_input", record.agentInput, record.agentInputDigest);
+    renderCitedMember(section, "agent_output", record.agentOutput, record.agentOutputDigest);
+    if (record.cites.length > 0) {
+        section.append(element("h5", "Cites"));
+        renderCitationList(record.cites, records, section);
+    }
+    host.append(section);
+}
+// One row per cited id, in citation order: a record supplied in this bundle
+// opens under the list on click; one that is not says so and stays.
+function renderCitationList(ids, records, host) {
+    const list = element("ul");
+    const detail = element("section");
+    for (const id of ids) {
+        const item = element("li");
+        const target = records.get(id);
+        if (target === undefined) {
+            item.textContent = `${id} · not in this bundle`;
+            item.dataset.citation = "missing";
+        }
+        else {
+            const button = element("button", id);
+            button.setAttribute("type", "button");
+            button.dataset.citedId = id;
+            button.addEventListener("click", () => {
+                detail.replaceChildren();
+                renderCitedRecord(target, records, detail);
+            });
+            item.append(button);
+        }
+        list.append(item);
+    }
+    host.append(list, detail);
+    return list;
+}
+const CLAIM_TYPE_LABEL = (claim) => claim.recognized ? claim.type : `unrecognized (${claim.type})`;
+// A recomputed headline number never wears the producer's value. When the
+// two disagree the recomputed value is drawn and a `count mismatch` marker
+// sits beside it; the stated value is kept on the marker's data attribute,
+// never in the text a reader takes as the number.
+function countMismatchMarker(result, field) {
+    const mismatch = result.countMismatches.find((entry) => entry.field === field);
+    if (mismatch === undefined)
+        return undefined;
+    const marker = element("span", "count mismatch");
+    marker.dataset.countMismatch = field;
+    marker.dataset.stated = String(mismatch.stated);
+    marker.dataset.recomputed = String(mismatch.recomputed);
+    return marker;
+}
+// The close state a reader sees is the one this bundle's links read
+// whenever the cited Close is supplied; the Result's own value is drawn
+// only when it is not, and then under a `producer-asserted` marker. When
+// the two disagree the recomputed state is drawn with a `state mismatch`
+// marker; the asserted value stays on the data attribute, never in the
+// text. AGREED carries no mark of its own -- its label and the
+// acknowledging peer's record are the whole affordance.
+function appendCloseState(parent, close, tag) {
+    const cell = element(tag, close.state);
+    cell.dataset.closeState = close.state;
+    cell.dataset.closeDerivation = close.derivation;
+    cell.dataset.assertedState = close.asserted;
+    if (close.stateMismatch) {
+        const marker = element("span", "state mismatch");
+        marker.dataset.stateMismatch = "close_state";
+        marker.dataset.asserted = close.asserted;
+        marker.dataset.recomputed = close.state;
+        cell.append(" ", marker);
+    }
+    else if (close.derivation === "producer-asserted") {
+        const marker = element("span", "producer-asserted");
+        marker.dataset.producerAsserted = "close_state";
+        cell.append(" ", marker);
+    }
+    if (close.peerRefMismatch) {
+        const marker = element("span", "peer_close_ref carries no such link");
+        marker.dataset.peerRefMismatch = "peer_close_ref";
+        cell.append(" ", marker);
+    }
+    parent.append(cell);
+    return cell;
+}
+function renderClose(close, result, host) {
+    host.append(element("h4", "Close"));
+    const details = element("dl");
+    if (close.period !== undefined)
+        appendValue(details, "period", `${close.period.start} → ${close.period.end}`);
+    details.append(element("dt", "state"));
+    appendCloseState(details, close, "dd");
+    details.append(element("dt", "derivation"));
+    const derivation = element("dd", close.derivation === "recomputed"
+        ? `recomputed from ${close.links.length} counterparty ${close.links.length === 1 ? "link" : "links"} to the cited Close in this bundle${close.ignored.length === 0 ? "" : ` (${close.ignored.length} other ${close.ignored.length === 1 ? "link" : "links"} ignored)`}`
+        : "producer-asserted: the cited Close is not a record in this bundle, so its links could not be read");
+    derivation.dataset.closeDerivationNote = close.derivation;
+    details.append(derivation);
+    if (close.peer !== undefined)
+        appendValue(details, "peer", close.peer);
+    if (close.bookId !== undefined)
+        appendValue(details, "book", close.bookId);
+    // A signer is drawn as verified only when its Producer Envelope verified
+    // under the key_id (result-root.ts `signerOf`); otherwise it carries the
+    // label, never a bare key.
+    if (close.keyId !== undefined) {
+        details.append(element("dt", "signer"));
+        const signer = element("dd", close.keyVerified === true
+            ? `${close.keyId} (verified)`
+            : `${close.keyId} · ${UNVERIFIED_KEY_LABEL}`);
+        signer.dataset.keyVerified = String(close.keyVerified === true);
+        details.append(signer);
+    }
+    host.append(details);
+    host.append(element("h5", "Cited Close"));
+    renderCitationList([close.closeRef], result.records, host);
+    if (close.peerCloseRef !== undefined) {
+        host.append(element("h5", "Peer record"));
+        renderCitationList([close.peerCloseRef], result.records, host);
+    }
+    if (close.links.length > 0) {
+        host.append(element("h5", "Links to the cited Close"));
+        const list = element("ul");
+        for (const link of close.links) {
+            const item = element("li", `${link.type} · ${link.recordId} · signer ${link.keyId} (verified)`);
+            item.dataset.closeLink = link.type;
+            item.dataset.linkRecord = link.recordId;
+            list.append(item);
+        }
+        host.append(list);
+    }
+    // Inbound links that made no state -- from the Close's own book, a book
+    // that is not the named peer, or the Close's own key -- are listed with
+    // the reason, never counted: a reader sees why AGREED was not read.
+    if (close.ignored.length > 0) {
+        host.append(element("h5", "Links ignored (not from the counterparty)"));
+        const list = element("ul");
+        for (const link of close.ignored) {
+            const item = element("li", `${link.type} · ${link.recordId} · ${link.reason}`);
+            item.dataset.ignoredLink = link.type;
+            item.dataset.linkRecord = link.recordId;
+            list.append(item);
+        }
+        host.append(list);
+    }
+}
+// The verdict a reader sees is the Result's own only when every cited id
+// resolves in this bundle and the claim stands. A claim that FAILED
+// verification (its close state is not what the links read) reads
+// `failed` -- never `met`, never its stated verdict, which is kept on
+// `data-stated-verdict` only. Otherwise an unresolved citation reads
+// `unsupported`. The row stays in every case.
+function appendVerdict(parent, claim) {
+    const shown = claim.failed
+        ? "failed"
+        : claim.support === "supported"
+            ? claim.verdict
+            : "unsupported";
+    const cell = element(parent.tagName === "TR" ? "td" : "dd", shown);
+    cell.dataset.verdict = shown;
+    cell.dataset.support = claim.support;
+    if (claim.failed) {
+        cell.dataset.statedVerdict = claim.verdict;
+        cell.className = "claim-failed";
+    }
+    else if (claim.support === "unsupported")
+        cell.className = "claim-unsupported";
+    parent.append(cell);
+    return cell;
+}
+// A failed claim's sufficiency is the producer's word too: the cell reads
+// `failed`, the stated value on `data-stated-sufficiency` only.
+function appendSufficiency(parent, claim) {
+    const shown = claim.failed ? "failed" : claim.sufficiency;
+    const cell = element(parent.tagName === "TR" ? "td" : "dd", shown);
+    cell.dataset.sufficiency = shown;
+    if (claim.failed) {
+        cell.dataset.statedSufficiency = claim.sufficiency;
+        cell.className = "claim-failed";
+    }
+    parent.append(cell);
+    return cell;
+}
+function renderClaim(claim, result, host) {
+    host.replaceChildren();
+    host.append(element("h3", `Claim ${claim.id}`));
+    const details = element("dl");
+    appendValue(details, "contract", claim.contractRef);
+    appendValue(details, "requirement", claim.requirementRef);
+    details.append(element("dt", "type"));
+    const type = element("dd", CLAIM_TYPE_LABEL(claim));
+    type.dataset.claimType = claim.recognized ? claim.type : "unrecognized";
+    if (!claim.recognized)
+        type.className = "claim-unrecognized";
+    details.append(type);
+    appendValue(details, "tier", claim.tier);
+    appendValue(details, "grade", claim.grade);
+    details.append(element("dt", "sufficiency"));
+    appendSufficiency(details, claim);
+    details.append(element("dt", "verdict"));
+    appendVerdict(details, claim);
+    host.append(details);
+    if (claim.failed) {
+        const note = element("p", `failed: ${claim.failure ?? "verification failed"}; sufficiency and verdict withheld`);
+        note.dataset.claimFailed = claim.failedOn ?? "close_state";
+        host.append(note);
+    }
+    if (claim.close !== undefined)
+        renderClose(claim.close, result, host);
+    if (claim.support === "unsupported") {
+        const note = element("p", claim.missing.length === 0
+            ? "unsupported: this claim cites no evidence"
+            : `unsupported: cited evidence not in this bundle: ${claim.missing.join(", ")}`);
+        note.dataset.claimMissing = String(claim.missing.length);
+        host.append(note);
+    }
+    host.append(element("h4", "Presentation"));
+    const carrier = element("dl");
+    appendValue(carrier, "carrier", claim.presentation.kind);
+    appendValue(carrier, "status", claim.presentation.status);
+    if (claim.presentation.summary !== undefined)
+        appendValue(carrier, "summary", claim.presentation.summary);
+    if (claim.presentation.narrative !== undefined)
+        appendValue(carrier, "narrative", claim.presentation.narrative);
+    host.append(carrier);
+    // A disclosure carrier names the digests it discloses. They are drawn in
+    // the same row shape as any other citation, resolved against this bundle;
+    // the claim's own `evidence[]` below is the list the verdict rests on.
+    if (claim.presentation.evidence !== undefined) {
+        host.append(element("h5", "Carrier evidence"));
+        const list = renderCitationList(claim.presentation.evidence, result.records, host);
+        list.dataset.carrierEvidence = String(claim.presentation.evidence.length);
+    }
+    host.append(element("h4", "Proofs"));
+    if (claim.proofs.length === 0) {
+        host.append(element("p", "no proof cited"));
+    }
+    else {
+        const proofs = element("ul");
+        for (const proof of claim.proofs)
+            proofs.append(element("li", `${proof.kind} · ${proof.digest} · not resolved here`));
+        host.append(proofs);
+    }
+    host.append(element("h4", "Evidence"));
+    for (const ref of claim.evidence) {
+        const record = result.records.get(ref.digest);
+        if (record === undefined) {
+            const missing = element("p", `${ref.digest} · not in this bundle`);
+            missing.dataset.evidence = "missing";
+            host.append(missing);
+        }
+        else {
+            renderCitedRecord(record, result.records, host);
+        }
+    }
+}
+const BUCKETS = [
+    ["met", "met"],
+    ["notMet", "not met"],
+    ["notEvaluable", "not evaluable"],
+];
+// Coverage is the first thing in the Result section after its heading, and
+// no number precedes it within the section; then the three buckets, never a
+// single figure; then one row per claim with its own tier and grade. The
+// bundle-level verification banner, drawn before every section, is the one
+// thing above coverage that can carry digits ("N of M records
+// uncheckpointed"). Every number drawn here is the recomputed one
+// (`result.coverage`, `result.bucketCounts`); a producer figure the claims
+// do not bear out shows as a `count mismatch` marker beside the recomputed
+// value. `excluded as not applicable` is the one figure carried as stated:
+// no claim backs it, by construction.
+function renderResultPage(result, root) {
+    const section = element("section");
+    section.dataset.page = "result";
+    section.append(element("h1", "Evidence result"));
+    const coverage = element("p");
+    coverage.append(`coverage: ${result.coverage.evaluatedPopulation} requirements evaluated`);
+    const evaluatedMarker = countMismatchMarker(result, "evaluated_population");
+    if (evaluatedMarker !== undefined)
+        coverage.append(" ", evaluatedMarker);
+    coverage.append(` · ${result.coverage.excludedNotApplicable} excluded as not applicable · ${result.coverage.unknownCount} unresolved`);
+    const unknownMarker = countMismatchMarker(result, "unknown_count");
+    if (unknownMarker !== undefined)
+        coverage.append(" ", unknownMarker);
+    coverage.dataset.coverage = "result";
+    coverage.dataset.evaluated = String(result.coverage.evaluatedPopulation);
+    coverage.dataset.excluded = String(result.coverage.excludedNotApplicable);
+    coverage.dataset.excludedBasis = "stated";
+    coverage.dataset.unknown = String(result.coverage.unknownCount);
+    section.append(coverage);
+    const byId = new Map(result.claims.map((claim) => [claim.id, claim]));
+    const buckets = element("section");
+    buckets.dataset.buckets = "verdict";
+    buckets.append(element("h2", "Claims by verdict"));
+    for (const [key, label] of BUCKETS) {
+        const count = result.bucketCounts[key];
+        const heading = element("h3", `${label}: ${count === 0 ? "none" : count}`);
+        heading.dataset.bucketCount = String(count);
+        heading.dataset.bucketOf = key;
+        const marker = countMismatchMarker(result, `buckets.${key === "notMet" ? "not_met" : key === "notEvaluable" ? "not_evaluable" : "met"}`);
+        if (marker !== undefined)
+            heading.append(" ", marker);
+        buckets.append(heading);
+        const ids = result.buckets[key];
+        if (ids.length === 0) {
+            buckets.append(element("p", "none"));
+            continue;
+        }
+        const list = element("ul");
+        list.dataset.bucket = key;
+        for (const id of ids) {
+            const claim = byId.get(id);
+            const item = element("li", claim?.failed
+                ? `${id} · failed`
+                : claim?.support === "unsupported"
+                    ? `${id} · unsupported`
+                    : id);
+            item.dataset.claimRef = id;
+            if (claim?.failed)
+                item.className = "claim-failed";
+            else if (claim?.support === "unsupported")
+                item.className = "claim-unsupported";
+            list.append(item);
+        }
+        buckets.append(list);
+    }
+    // The verifier's own state, after the producer's three buckets: claims
+    // that failed verification (a close state the links contradict). Drawn
+    // always, `none` when empty, so a reader never has to infer from an
+    // absent heading that nothing failed. Not a verdict bucket: a failed
+    // claim is counted here and under no verdict, whatever bucket the
+    // producer listed it in (that listing stays above, marked).
+    const failedHeading = element("h3", `failed: ${result.bucketCounts.failed === 0 ? "none" : result.bucketCounts.failed}`);
+    failedHeading.dataset.bucketCount = String(result.bucketCounts.failed);
+    failedHeading.dataset.bucketOf = "failed";
+    buckets.append(failedHeading);
+    const failedIds = result.claims
+        .filter((claim) => claim.failed)
+        .map((claim) => claim.id);
+    if (failedIds.length === 0)
+        buckets.append(element("p", "none"));
+    else {
+        const list = element("ul");
+        list.dataset.bucket = "failed";
+        for (const id of failedIds) {
+            const item = element("li", id);
+            item.dataset.claimRef = id;
+            item.className = "claim-failed";
+            list.append(item);
+        }
+        buckets.append(list);
+    }
+    section.append(buckets);
+    const table = document.createElement("table");
+    table.dataset.claims = "rows";
+    const detail = element("section");
+    for (const claim of result.claims) {
+        const tr = document.createElement("tr");
+        tr.dataset.claimRow = claim.id;
+        tr.dataset.support = claim.support;
+        if (claim.support === "unsupported")
+            tr.className = "claim-unsupported";
+        if (claim.failed) {
+            tr.classList.add("claim-failed");
+            tr.dataset.failed = claim.failedOn ?? "close_state";
+        }
+        const idCell = document.createElement("td");
+        const button = element("button", claim.id);
+        button.setAttribute("type", "button");
+        button.dataset.claimId = claim.id;
+        button.addEventListener("click", () => renderClaim(claim, result, detail));
+        idCell.append(button);
+        tr.append(idCell, element("td", claim.requirementRef));
+        appendSufficiency(tr, claim);
+        appendVerdict(tr, claim);
+        const tier = element("td", claim.tier);
+        tier.dataset.tier = claim.tier;
+        const grade = element("td", claim.grade);
+        grade.dataset.grade = claim.grade;
+        const type = element("td", CLAIM_TYPE_LABEL(claim));
+        type.dataset.claimType = claim.recognized ? claim.type : "unrecognized";
+        if (!claim.recognized)
+            type.className = "claim-unrecognized";
+        if (claim.close !== undefined) {
+            type.append(" · ");
+            appendCloseState(type, claim.close, "span");
+        }
+        tr.append(tier, grade, type);
+        table.append(tr);
+    }
+    section.append(table, detail, renderProvenance(result.capsuleId, result.logCoordinates, result));
+    root.append(section);
+}
+function renderGraph(graph, root, records) {
+    const aggregate = element("section");
+    aggregate.append(element("h1", "Evidence graph"));
+    const metrics = element("dl");
+    appendValue(metrics, "per-axis", graph.aggregate.perAxis);
+    appendValue(metrics, "counts", graph.aggregate.counts);
+    aggregate.append(metrics);
+    root.append(aggregate, renderCalibration(graph.calibration));
+    const calendar = element("section");
+    calendar.append(element("h2", "Daily reports"));
+    const detail = element("section");
+    [...graph.reports]
+        .sort((left, right) => left.date.localeCompare(right.date))
+        .forEach((report) => {
+        // The label is the report's date as the producer wrote it -- a bare
+        // day stays a day, a timestamp stays a timestamp, and one that states
+        // no zone is marked so rather than tiled under an assigned one.
+        const tile = element("button");
+        tile.append(renderTime(report.date), `: ${metRate(report)}`);
+        tile.setAttribute("type", "button");
+        tile.dataset.reportDate = report.date;
+        tile.addEventListener("click", () => renderReport(report, detail, records));
+        calendar.append(tile);
+    });
+    root.append(calendar, detail);
+}
+// ---------------------------------------------------------------------------
+// The built-in presentations (spec/presentation-contract-v0.md appendix A).
+// Which one renders is decided by their manifests (builtin-manifests.ts),
+// never here: each module only builds its model and draws it.
+// ---------------------------------------------------------------------------
+// A model built by canRender is kept for buildModel, per context, so a
+// module never builds twice and canRender stays the one place that decides.
+function memo(build) {
+    const cache = new WeakMap();
+    return (context) => {
+        let value = cache.get(context);
+        if (value === undefined) {
+            value = build(context);
+            cache.set(context, value);
+        }
+        return value;
+    };
+}
+const reportRowsOf = memo(buildReportRows);
+// A Result root whose document is malformed makes buildResultRoot throw. The
+// throw rejects renderEvidenceGraph before anything is written, exactly as
+// before the registry: a malformed Result is refused, never rendered as one.
+const resultRootOf = memo(async (context) => (await isResultRoot(context)) ? buildResultRoot(context) : undefined);
+// EvidenceGraphError means "no evaluation-summary graph here" (the module
+// declines and the fallback renders); any other error propagates.
+const evidenceGraphOf = memo(async (context) => {
+    try {
+        return await buildEvidenceGraph(context);
+    }
+    catch (err) {
+        if (!(err instanceof EvidenceGraphError))
+            throw err;
+        return undefined;
+    }
+});
+function defined(value, id) {
+    if (value === undefined)
+        throw new Error(`${id}: buildModel called although canRender was false`);
+    return value;
+}
+const reportRowsModule = {
+    manifest: BUILTIN_MANIFEST_REPORT_ROWS,
+    canRender: async (context) => (await reportRowsOf(context)) !== undefined,
+    buildModel: async (context) => defined(await reportRowsOf(context), BUILTIN_MANIFEST_REPORT_ROWS.id),
+    render: (model, host) => renderReportRowsTable(model, host.L1),
+};
+const resultOutcomeReportModule = {
+    manifest: BUILTIN_MANIFEST_RESULT_OUTCOME_REPORT,
+    canRender: async (context) => readOutcomeReportPresentation(context.bundle) !== undefined &&
+        (await isResultRoot(context)),
+    buildModel: async (context) => ({
+        result: defined(await resultRootOf(context), BUILTIN_MANIFEST_RESULT_OUTCOME_REPORT.id),
+        card: defined(readOutcomeReportPresentation(context.bundle), BUILTIN_MANIFEST_RESULT_OUTCOME_REPORT.id),
+        bundle: context.bundle,
+        verification: context.verification,
+    }),
+    render: async (model, host) => {
+        // The banner and the verification page take the card's look.
+        host.setChromeClass("oi");
+        await renderOutcomeReportPage(model.result, model.card, model.bundle, model.verification, host.L1);
+    },
+};
+const resultComplianceModule = {
+    manifest: BUILTIN_MANIFEST_RESULT_COMPLIANCE,
+    canRender: async (context) => readCompliancePresentation(context.bundle) !== undefined &&
+        (await isResultRoot(context)),
+    buildModel: async (context) => ({
+        result: defined(await resultRootOf(context), BUILTIN_MANIFEST_RESULT_COMPLIANCE.id),
+        card: defined(readCompliancePresentation(context.bundle), BUILTIN_MANIFEST_RESULT_COMPLIANCE.id),
+        bundle: context.bundle,
+        verification: context.verification,
+    }),
+    render: (model, host) => renderCompliancePage(model.result, model.card, model.bundle, model.verification, host.L1),
+};
+const resultModule = {
+    manifest: BUILTIN_MANIFEST_RESULT,
+    canRender: (context) => isResultRoot(context),
+    buildModel: async (context) => defined(await resultRootOf(context), BUILTIN_MANIFEST_RESULT.id),
+    render: (model, host) => renderResultPage(model, host.L1),
+};
+const evaluationSummaryGraphModule = {
+    manifest: BUILTIN_MANIFEST_EVALUATION_SUMMARY_GRAPH,
+    canRender: async (context) => (await evidenceGraphOf(context)) !== undefined,
+    buildModel: async (context) => {
+        const records = object(context.bundle).records;
+        return {
+            graph: defined(await evidenceGraphOf(context), BUILTIN_MANIFEST_EVALUATION_SUMMARY_GRAPH.id),
+            records: Array.isArray(records) ? records : [],
+        };
+    },
+    render: (model, host) => renderGraph(model.graph, host.L1, model.records),
+};
+// The evaluation-summary/v1 aggregate is optional: a verified bundle whose
+// root is none of the other families (a deal root, for example) renders
+// without the aggregate panel and says so, instead of rendering nothing.
+const noAggregateModule = {
+    manifest: BUILTIN_MANIFEST_NO_AGGREGATE,
+    canRender: () => true,
+    buildModel: () => null,
+    render: (_model, host) => {
+        const note = document.createElement("p");
+        note.setAttribute("data-notice", "no-aggregate");
+        note.textContent =
+            "This bundle carries no evaluation summary, so there is no aggregate view. The records and their verification are below.";
+        host.L1.append(note);
+    },
+};
+// The extension interpreters each built-in module runs when it renders: a
+// Result page reads the book payload extensions, and each card reads its own
+// block. The rows table, the graph and the no-aggregate note read none.
+const BUILTIN_MODULE_INTERPRETERS = Object.freeze({
+    [BUILTIN_MANIFEST_RESULT_OUTCOME_REPORT.id]: [
+        "result-root",
+        "outcome-report-card",
+    ],
+    [BUILTIN_MANIFEST_RESULT_COMPLIANCE.id]: ["result-root", "compliance-card"],
+    [BUILTIN_MANIFEST_RESULT.id]: ["result-root"],
+    [BUILTIN_MANIFEST_COMPOSED.id]: ["aac.builtin.composed/v0"],
+});
+/** The six built-in modules, registered by default. */
+export const BUILTIN_PRESENTATIONS = Object.freeze([
+    reportRowsModule,
+    resultOutcomeReportModule,
+    resultComplianceModule,
+    resultModule,
+    evaluationSummaryGraphModule,
+    noAggregateModule,
+]);
+/** A fresh registry holding the six built-in modules. */
+export function createPresentationRegistry() {
+    const registry = new PresentationRegistry();
+    for (const module of BUILTIN_PRESENTATIONS)
+        registry.register(module);
+    return registry;
+}
+const defaultRegistry = createPresentationRegistry();
+/**
+ * The built-in sections: modules resolved after the page module, in their
+ * own registry, and rendered after its content. One today, the composition
+ * section; see BUILTIN_MANIFEST_COMPOSED for why it is not a page module.
+ */
+export const BUILTIN_SECTIONS = Object.freeze([
+    composedSectionModule,
+]);
+/**
+ * A fresh section registry holding the built-in sections. The section
+ * registry applies the presentation ABI as the page registry does: under a
+ * `runtime` that refuses a section, the section is registered as refused,
+ * never drawn, and every page it matches names it.
+ */
+export function createSectionRegistry(runtime) {
+    const registry = new PresentationRegistry(runtime);
+    for (const module of BUILTIN_SECTIONS)
+        registry.register(module);
+    return registry;
+}
+const defaultSections = createSectionRegistry();
+/**
+ * Register a module with the registry `renderEvidenceGraph` uses by default
+ * (the module-slot entry point). Throws when its manifest is malformed,
+ * dead, a duplicate, or co-matchable with a registered module of its tier.
+ * A module whose `presentation_api` this runtime does not implement (or
+ * whose `runtime_min` it does not meet) is registered as refused: it is
+ * never selected, and every page it would have rendered names it.
+ */
+export function registerPresentation(module) {
+    return defaultRegistry.register(module);
+}
+/** Resolve over the default registry (spec section 4.3). */
+export function resolvePresentation(context, audience = DEFAULT_AUDIENCE, format = DEFAULT_FORMAT) {
+    return defaultRegistry.resolve(context, audience, format);
+}
+/** `"*"`: no particular audience, so only modules serving every audience. */
+const DEFAULT_AUDIENCE = "*";
+const DEFAULT_FORMAT = "html";
+/**
+ * True when the rendered page module checked the producer signature of the
+ * records it cites as signers: the built-in Result page, on a Close (or a
+ * record linking to it) that carries a `key_id` (result-root.ts `signerOf`).
+ */
+function citesCheckedSigners(selected) {
+    if (selected === undefined || selected.module !== resultModule)
+        return false;
+    return selected.model.claims.some((claim) => claim.close !== undefined &&
+        (claim.close.keyId !== undefined ||
+            [...claim.close.links, ...claim.close.ignored].some((link) => link.keyId !== undefined)));
+}
+const OUTCOME_CHROME = "oi";
+function presentationServices(context) {
+    return Object.freeze({
+        details(summary, open = false) {
+            const details = document.createElement("details");
+            if (open)
+                details.open = true;
+            details.append(element("summary", summary));
+            return details;
+        },
+        badge(state) {
+            const badge = element("span", state);
+            badge.dataset.badge = state;
+            return badge;
+        },
+        disclosure(capsuleId, member) {
+            return disclosureOf(context, capsuleId, member).state;
+        },
+    });
+}
+// The refusal for a verified bundle whose presentation could not be resolved
+// (an ambiguity) or failed (a module threw while rendering): the core's
+// words, no module content, the verification page below (contract I1).
+const PRESENTATION_REFUSALS = {
+    "presentation-unresolved": "The presentation for this bundle could not be resolved. No presentation content is shown; the verification page below lists the checks.",
+    "presentation-failed": "The presentation for this bundle failed. No presentation content is shown; the verification page below lists the checks.",
+};
+export async function renderEvidenceGraph(input, root, countersigners, options = {}) {
+    // With no SHA-256 nothing can be verified: say so, never "failed".
+    if (!isVerifiedBundleContext(input) && digestCapability() === "none") {
+        renderUnableToVerify(root, options.verifyCommand === undefined
+            ? {}
+            : { verifyCommand: options.verifyCommand });
+        return;
+    }
+    // Verify first. Nothing reaches the DOM until the verification result is
+    // in hand, and no module is consulted for a bundle that did not verify.
+    const context = isVerifiedBundleContext(input)
+        ? countersigners === undefined
+            ? input
+            : withCountersigners(input, countersigners)
+        : await buildVerifiedBundleContext(input, {
+            ...(countersigners === undefined ? {} : { countersigners }),
+        });
+    const { bundle, verification } = context;
+    const verified = bundleVerified(verification);
+    const registry = options.registry ?? defaultRegistry;
+    let refusal;
+    let selected;
+    let resolution;
+    try {
+        resolution = await registry.resolve(context, options.audience ?? DEFAULT_AUDIENCE, options.format ?? DEFAULT_FORMAT);
+    }
+    catch (err) {
+        if (!(err instanceof PresentationAmbiguityError))
+            throw err;
+        resolution = { kind: "no-presentation", refused: [] };
+        refusal = "presentation-unresolved";
+    }
+    // A module this runtime refused (spec section 3.2) is never silent: the
+    // page root names every one that matched, page and section alike, and the
+    // verification page shows the contract's words in the extension rows
+    // (presentationRefusalRow) or, for a module requiring no extension, in a
+    // line after them (presentationRefusalLine).
+    const refused = resolution.kind === "refusal" ? [] : [...resolution.refused];
+    if (resolution.kind === "refusal" && verified)
+        throw new Error("resolver refused a bundle that verified");
+    if (resolution.kind === "module" && !verified)
+        throw new Error("resolver selected a module for an unverified bundle");
+    // A module's model is built before the page is written, so a model that
+    // cannot be built rejects with nothing drawn (as it always has).
+    if (resolution.kind === "module")
+        selected = {
+            module: resolution.module,
+            model: await resolution.module.buildModel(context),
+        };
+    // The section registry is resolved the same way, after the page and only
+    // for a verified bundle whose page resolved: a section never stands in for
+    // a refusal (contract I1), and its ambiguity is the page's refusal too.
+    let section;
+    if (verified && refusal === undefined) {
+        let sectionResolution;
+        try {
+            sectionResolution = await (options.sections ?? defaultSections).resolve(context, options.audience ?? DEFAULT_AUDIENCE, options.format ?? DEFAULT_FORMAT);
+        }
+        catch (err) {
+            if (!(err instanceof PresentationAmbiguityError))
+                throw err;
+            sectionResolution = { kind: "no-presentation", refused: [] };
+            selected = undefined;
+            refusal = "presentation-unresolved";
+        }
+        // A refused section is named like a refused page module, never skipped.
+        if (sectionResolution.kind !== "refusal")
+            refused.push(...sectionResolution.refused);
+        if (sectionResolution.kind === "module")
+            section = {
+                module: sectionResolution.module,
+                model: await sectionResolution.module.buildModel(context),
+            };
+    }
+    const records = object(bundle).records;
+    const coverage = {
+        uncheckpointed: unboundRecordIds(verification).length,
+        total: Array.isArray(records) ? records.length : 0,
+    };
+    const drawFrame = () => {
+        root.replaceChildren();
+        renderPresentationHeader(root, bundle);
+        return renderVerificationBanner(root, verified, coverage);
+    };
+    let banner = drawFrame();
+    if (refused.length > 0)
+        root.dataset.presentationRefused = refused.map((r) => r.id).join(" ");
+    else
+        delete root.dataset.presentationRefused;
+    let chrome;
+    if (selected !== undefined) {
+        const host = {
+            L0: root,
+            L1: root,
+            L2: root,
+            depth: options.depth ?? "L2",
+            setChromeClass(name) {
+                if (name !== OUTCOME_CHROME)
+                    throw new Error(`unknown chrome class ${JSON.stringify(name)}`);
+                chrome = name;
+                styleBanner(banner, verified);
+            },
+        };
+        try {
+            await selected.module.render(selected.model, host, presentationServices(context));
+        }
+        catch {
+            // Everything the module wrote is discarded; no other module is tried.
+            chrome = undefined;
+            banner = drawFrame();
+            refusal = "presentation-failed";
+        }
+    }
+    if (refusal === undefined && resolution.kind === "no-presentation") {
+        const note = element("p", "No presentation is available for this bundle, audience and format. The records and their verification are below.");
+        note.dataset.notice = "no-presentation";
+        root.append(note);
+    }
+    // The section renders after the page module, into the same regions. If it
+    // throws, everything any module wrote is discarded for the refusal.
+    if (section !== undefined && refusal === undefined) {
+        try {
+            await section.module.render(section.model, {
+                L0: root,
+                L1: root,
+                L2: root,
+                depth: "L2",
+                setChromeClass() {
+                    throw new Error("a section has no chrome");
+                },
+            }, presentationServices(context));
+        }
+        catch {
+            chrome = undefined;
+            banner = drawFrame();
+            refusal = "presentation-failed";
+        }
+    }
+    if (refusal !== undefined) {
+        const note = element("p", PRESENTATION_REFUSALS[refusal]);
+        note.dataset.refusal = refusal;
+        root.append(note);
+    }
+    // The interpreters this rendering actually ran (see extension-interpreters.ts):
+    // the presentation header and the countersignature stamp always run; a
+    // module's own interpreters only when that module rendered.
+    const applied = new Set([
+        "presentation-header",
+        "countersignature-stamp",
+    ]);
+    if (refusal === undefined)
+        for (const ran of [selected, section])
+            if (ran !== undefined)
+                for (const id of BUILTIN_MODULE_INTERPRETERS[ran.module.manifest.id] ??
+                    [])
+                    applied.add(id);
+    await renderVerificationPage(root, context, chrome === OUTCOME_CHROME, applied, refused, refusal === undefined && citesCheckedSigners(selected), options.verifierHint);
+}
+//# sourceMappingURL=evidence-graph-view.js.map