@certysign/sdk 1.0.0 → 2.0.0

package/examples/certificate-flow.js

@@ -1,198 +0,0 @@
-/**
- * Full PKI Certificate Lifecycle Example
- *
- * Demonstrates the complete X.509 certificate workflow:
- *  1. Issue a per-document certificate
- *  2. Check current status (should be 'good')
- *  3. Verify the certificate (chain, revocation, validity)
- *  4. Download CA chain and save it locally
- *  5. Perform a point-in-time verification
- *  6. Fetch and cache the CRL locally
- *  7. Check a serial number directly against the CRL JSON
- *  8. Perform an OCSP query
- *
- * This pattern is used by HIE systems that need to:
- *  - Verify document signing certificates before granting access
- *  - Cache CRL/OCSP responses to meet response time SLAs
- *
- * Prerequisites:
- *   npm install @certysign/sdk
- *   export CERTYSIGN_PUBLIC_KEY="cs_pk_..."
- *   export CERTYSIGN_SECRET_KEY="cs_sk_..."
- */
-
-'use strict';
-
-const fs   = require('fs');
-const path = require('path');
-const { CertySignClient, CertySignError } = require('@certysign/sdk');
-
-const client = new CertySignClient({
-  publicKey:   process.env.CERTYSIGN_PUBLIC_KEY,
-  secretKey:   process.env.CERTYSIGN_SECRET_KEY,
-  environment: 'production'
-});
-
-async function runCertificateFlow() {
-  console.log('\n[PKI] CertySign Certificate Lifecycle Demo');
-  console.log('─'.repeat(60));
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // 1. Issue a certificate
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[PKI] 1. Issuing X.509 certificate...');
-
-  const issueResult = await client.certificates.issue({
-    commonName:   'HIE Integration Node — KNH',
-    organisation: 'Kenyatta National Hospital',
-    country:      'KE',
-    state:        'Nairobi',
-    locality:     'Nairobi',
-    email:        'pki@knh.or.ke',
-    validityDays: 365,
-    metadata:     { system: 'HIE-NODE-KNH-PROD', issuedAt: new Date().toISOString() }
-  });
-
-  const cert = issueResult.data;
-  console.log(`  serialNumber : ${cert.serialNumber}`);
-  console.log(`  fingerprint  : ${cert.fingerprint}`);
-  console.log(`  validFrom    : ${cert.validFrom}`);
-  console.log(`  validUntil   : ${cert.validUntil}`);
-  console.log(`  Subject CN   : ${cert.subject?.cn}`);
-
-  // Store private key securely (shown ONCE — CertySign does not retain it)
-  const keyPath = path.join(__dirname, 'hie-node-knh.key.pem');
-  fs.writeFileSync(keyPath, cert.privateKey, { mode: 0o600 });
-  console.log(`  privateKey   → ${keyPath}  (mode 600)`);
-
-  const certPath = path.join(__dirname, 'hie-node-knh.crt.pem');
-  fs.writeFileSync(certPath, cert.pemCertificate);
-  console.log(`  certificate  → ${certPath}`);
-
-  const { serialNumber } = cert;
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // 2. Real-time status check (should be 'good')
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[PKI] 2. Certificate status check...');
-  const statusResult = await client.certificates.status(serialNumber);
-  const status = statusResult.data;
-  console.log(`  status         : ${status.status}`);
-  if (status.status === 'revoked') {
-    console.log(`  revocationDate : ${status.revocationDate}`);
-    console.log(`  reason         : ${status.revocationReason}`);
-  }
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // 3. Full certificate verification (chain + revocation)
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[PKI] 3. Full certificate verification...');
-  const verifyResult = await client.certificates.verify(serialNumber);
-  const verification = verifyResult.data;
-  console.log(`  valid              : ${verification.valid}`);
-  console.log(`  chainVerified      : ${verification.chainVerified}`);
-  console.log(`  revocationChecked  : ${verification.revocationChecked}`);
-  console.log(`  certStatus         : ${verification.certStatus}`);
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // 4. Download CA chain and install in local trust store
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[PKI] 4. Downloading CA chain...');
-  const chainPem = await client.pki.chain();
-  const chainPath = path.join(__dirname, 'certysign-chain.pem');
-  fs.writeFileSync(chainPath, chainPem);
-  console.log(`  CA chain → ${chainPath}`);
-  console.log(`  (${chainPem.split('-----BEGIN CERTIFICATE-----').length - 1} cert(s) in bundle)`);
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // 5. Point-in-time verification
-  //    Used by HIE to check if a cert was valid at the time a document was signed
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[PKI] 5. Point-in-time verification...');
-  const signingTime = new Date(Date.now() - 5 * 60 * 1000);   // 5 minutes ago
-  const ptResult = await client.certificates.verify(serialNumber, signingTime);
-  console.log(`  valid at ${signingTime.toISOString()} : ${ptResult.data.valid}`);
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // 6. Fetch and cache CRL (JSON format for application-level checks)
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[PKI] 6. Fetching CRL (JSON)...');
-  const crlJson = await client.pki.crl('json');
-  const crl = crlJson.data;
-  console.log(`  issuer        : ${crl.issuer}`);
-  console.log(`  thisUpdate    : ${crl.thisUpdate}`);
-  console.log(`  nextUpdate    : ${crl.nextUpdate}`);
-  console.log(`  revokedCount  : ${crl.revokedCount}`);
-
-  // Build a Set of revoked serial numbers for fast in-process lookups
-  const revokedSet = new Set((crl.crl || []).map(e => e.serialNumber));
-  console.log(`  Revoked set   : ${revokedSet.size} entries loaded`);
-
-  // Cache on disk until nextUpdate
-  fs.writeFileSync(
-    path.join(__dirname, 'crl-cache.json'),
-    JSON.stringify({ ...crl, cachedAt: new Date().toISOString() }, null, 2)
-  );
-
-  // Also download DER CRL for systems that need binary format
-  console.log('\n[PKI] 6b. Downloading DER CRL...');
-  const crlDer = await client.pki.crl('der');
-  fs.writeFileSync(path.join(__dirname, 'certysign-intermediate.crl'), crlDer);
-  console.log(`  certysign-intermediate.crl — ${crlDer.length} bytes`);
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // 7. In-process revocation check using cached CRL
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[PKI] 7. Local CRL check...');
-  const isRevoked = revokedSet.has(serialNumber);
-  console.log(`  Serial ${serialNumber.slice(0, 12)}... : ${isRevoked ? 'REVOKED' : 'not in CRL'}`);
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // 8. OCSP query — freshest revocation status
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[PKI] 8. OCSP query...');
-  const ocspResult = await client.pki.ocsp(serialNumber, 'json');
-  const ocsp = ocspResult.data;
-  console.log(`  status         : ${ocsp.status}`);
-  console.log(`  producedAt     : ${ocsp.producedAt}`);
-  console.log(`  responderId    : ${ocsp.responderId}`);
-  console.log(`  nextUpdate     : ${ocsp.nextUpdate}`);
-  console.log(`  signatureAlgo  : ${ocsp.signatureAlgorithm}`);
-  if (ocsp.certIdHash) {
-    console.log(`  CertID algo    : ${ocsp.certIdHash.algorithm}`);
-    console.log(`  issuerNameHash : ${ocsp.certIdHash.issuerNameHash?.slice(0, 16)}...`);
-  }
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // 9. CA Info — inspect the trust hierarchy
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[PKI] 9. CA hierarchy info...');
-  const info = await client.pki.info();
-  const caInfo = info.data;
-  console.log(`  Root CA        : ${caInfo.rootCA?.subject?.commonName}`);
-  console.log(`  Root CA expiry : ${caInfo.rootCA?.validity?.notAfter}`);
-  console.log(`  Inter CA       : ${caInfo.intermediateCA?.subject?.commonName}`);
-  console.log(`  Inter CA expiry: ${caInfo.intermediateCA?.validity?.notAfter}`);
-  console.log(`  CRL URL        : ${caInfo.intermediateCA?.crlUrl}`);
-  console.log(`  OCSP URL       : ${caInfo.intermediateCA?.ocspUrl}`);
-  console.log(`  Initialised    : ${caInfo.status?.initialized}`);
-
-  console.log('\n[PKI] ✓ Certificate lifecycle demo complete');
-  console.log('─'.repeat(60));
-}
-
-// ── Run ───────────────────────────────────────────────────────────────────────
-
-(async () => {
-  try {
-    await runCertificateFlow();
-  } catch (err) {
-    if (err instanceof CertySignError) {
-      console.error(`\n[PKI] API Error (${err.statusCode}): ${err.message}`);
-      if (err.details) console.error('[PKI] Details:', JSON.stringify(err.details, null, 2));
-    } else {
-      console.error('\n[PKI] Error:', err.message);
-    }
-    process.exit(1);
-  }
-})();

package/examples/dha-integration.js

@@ -1,208 +0,0 @@
-/**
- * DHA Kenya — Health Claims Quick-Sign Integration
- *
- * This example demonstrates the standard integration pattern for the
- * Department of Health Affairs (DHA) Kenya claims processing system.
- *
- * Workflow:
- *  1. Load a health claim PDF
- *  2. Sign it using quickSign() — creates envelope, uploads, signs in one call
- *  3. Issue a per-document X.509 certificate bound to the claim
- *  4. Store the envelopeId and certificate serial number in the claims DB
- *  5. Optionally verify the certificate via OCSP before archiving
- *
- * Prerequisites:
- *   npm install @certysign/sdk
- *   export CERTYSIGN_PUBLIC_KEY="cs_pk_..."
- *   export CERTYSIGN_SECRET_KEY="cs_sk_..."
- */
-
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const { CertySignClient } = require('@certysign/sdk');
-
-// ── Initialise client ────────────────────────────────────────────────────────
-
-const client = new CertySignClient({
-  publicKey:   process.env.CERTYSIGN_PUBLIC_KEY,
-  secretKey:   process.env.CERTYSIGN_SECRET_KEY,
-  environment: 'production'                         // 'staging' for UAT
-});
-
-// ── Simulated DHA claim record ───────────────────────────────────────────────
-
-const claim = {
-  id:          'CLM-2026-003421',
-  patientName: 'John Kamau Njoroge',
-  facility:    'Kenyatta National Hospital',
-  approvedBy:  'Dr. Amina Okonkwo',
-  approverEmail: 'amina.okonkwo@dha.go.ke',
-  department:  'Primary Health Outreach',
-  amount:      45_000            // KES
-};
-
-// ── Main integration function ────────────────────────────────────────────────
-
-async function processClaim(claim) {
-  console.log(`\n[DHA] Processing claim ${claim.id} — ${claim.facility}`);
-  console.log('─'.repeat(60));
-
-  // Step 1: Load the generated claim PDF (your system produces this)
-  const pdfPath = path.join(__dirname, 'sample-claim.pdf');
-  let pdfBuffer;
-  try {
-    pdfBuffer = fs.readFileSync(pdfPath);
-  } catch {
-    // Create a minimal placeholder for demo purposes
-    pdfBuffer = Buffer.from('%PDF-1.4 sample claim document');
-    console.warn('[DHA] Using placeholder PDF — replace with real claim PDF in production');
-  }
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // Step 2: Sign the claim document
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[DHA] Signing claim document...');
-
-  const signResult = await client.sign.quickSign({
-    document:    pdfBuffer,
-    filename:    `claim-${claim.id}.pdf`,
-    signerName:  claim.approvedBy,
-    signerEmail: claim.approverEmail,
-    reason:      `Health claim approval — DHA Kenya (${claim.id})`,
-    location:    'Nairobi, Kenya',
-    metadata: {
-      claimId:    claim.id,
-      patientName: claim.patientName,
-      facility:   claim.facility,
-      department: claim.department,
-      amount:     claim.amount,
-      currency:   'KES',
-      system:     'DHA-CLAIMS-PROD'
-    }
-  });
-
-  const { envelopeId, certificate: sigCert } = signResult.data;
-  console.log(`[DHA] ✓ Document signed`);
-  console.log(`      envelopeId : ${envelopeId}`);
-  console.log(`      sigCert SN : ${sigCert?.serialNumber || '(embedded in PDF)'}`);
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // Step 3: Issue a per-document X.509 certificate for the claim
-  // This cert is used by the HIE system to grant document access
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[DHA] Issuing per-document X.509 certificate...');
-
-  const certResult = await client.certificates.issue({
-    commonName:   `DHA-${claim.id}`,
-    organisation: 'Department of Health Affairs Kenya',
-    country:      'KE',
-    state:        'Nairobi',
-    locality:     'Nairobi',
-    email:        claim.approverEmail,
-    validityDays: 365,
-    metadata: {
-      claimId:    claim.id,
-      envelopeId,
-      facility:   claim.facility,
-      issuedAt:   new Date().toISOString()
-    }
-  });
-
-  const cert = certResult.data;
-  console.log(`[DHA] ✓ Certificate issued`);
-  console.log(`      serialNumber : ${cert.serialNumber}`);
-  console.log(`      fingerprint  : ${cert.fingerprint}`);
-  console.log(`      validUntil   : ${cert.validUntil}`);
-  console.log(`      privateKey   : [SHOW ONCE — store securely]`);
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // Step 4: Verify the certificate is good via OCSP
-  // (optional but recommended before archiving)
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[DHA] Verifying certificate via OCSP...');
-
-  const ocspResult = await client.pki.ocsp(cert.serialNumber, 'json');
-  const ocspStatus = ocspResult.data;
-
-  console.log(`[DHA] OCSP status  : ${ocspStatus.status}`);
-  console.log(`      responderId  : ${ocspStatus.responderId}`);
-  console.log(`      nextUpdate   : ${ocspStatus.nextUpdate}`);
-
-  if (ocspStatus.status !== 'good') {
-    throw new Error(`[DHA] Unexpected OCSP status: ${ocspStatus.status}`);
-  }
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // Step 5: Store claim record with signing proof
-  // ─────────────────────────────────────────────────────────────────────────
-  const claimRecord = {
-    claimId:           claim.id,
-    envelopeId,
-    certificateSerial: cert.serialNumber,
-    certificateExpiry: cert.validUntil,
-    signedAt:          new Date().toISOString(),
-    status:            'SIGNED',
-    // Store PEM cert for offline verification (NOT the private key in production DB)
-    pemCertificate:    cert.pemCertificate
-  };
-
-  console.log('\n[DHA] ✓ Claim processed successfully');
-  console.log('─'.repeat(60));
-  console.log('[DHA] Claim record:', JSON.stringify(claimRecord, null, 2));
-
-  return claimRecord;
-}
-
-// ── Retrieve and verify an archived claim ────────────────────────────────────
-
-async function verifyClaim(claimRecord) {
-  console.log(`\n[DHA] Verifying archived claim ${claimRecord.claimId}`);
-  console.log('─'.repeat(60));
-
-  // Check signing envelope still has valid signatures
-  const envelopeResult = await client.sign.verifyById(claimRecord.envelopeId);
-  const env = envelopeResult.data;
-
-  console.log(`[DHA] Envelope status   : ${env.status}`);
-  console.log(`[DHA] Signature valid   : ${env.valid}`);
-  console.log(`[DHA] Signed by         : ${env.signerName}`);
-  console.log(`[DHA] Signed at         : ${env.signedAt}`);
-
-  // Check certificate status
-  const certStatus = await client.certificates.status(claimRecord.certificateSerial);
-  console.log(`[DHA] Certificate status: ${certStatus.data.status}`);
-
-  // Point-in-time verification — was cert valid when signing happened?
-  const certAtTime = await client.certificates.verify(
-    claimRecord.certificateSerial,
-    claimRecord.signedAt
-  );
-  console.log(`[DHA] Cert valid-at-signing: ${certAtTime.data.valid}`);
-
-  return {
-    envelopeValid:    env.valid,
-    certificateStatus: certStatus.data.status,
-    certValidAtSigning: certAtTime.data.valid
-  };
-}
-
-// ── Run example ──────────────────────────────────────────────────────────────
-
-(async () => {
-  try {
-    const record = await processClaim(claim);
-    await verifyClaim(record);
-  } catch (err) {
-    if (err.code === 'INVALID_API_KEY') {
-      console.error('\n[DHA] Authentication failed — check CERTYSIGN_PUBLIC_KEY / CERTYSIGN_SECRET_KEY');
-    } else if (err.code === 'RATE_LIMIT_EXCEEDED') {
-      console.error('\n[DHA] Rate limit reached — implement request throttling');
-    } else {
-      console.error('\n[DHA] Error:', err.message);
-      if (err.details) console.error('[DHA] Details:', JSON.stringify(err.details, null, 2));
-    }
-    process.exit(1);
-  }
-})();

package/examples/nhif-batch-sign.js

@@ -1,216 +0,0 @@
-/**
- * NHIF Kenya — Batch Invoice Signing Integration
- *
- * This example shows how NHIF's automated invoicing system uses batchSign()
- * to sign hundreds of provider reimbursement invoices in a single API call
- * during the nightly batch run.
- *
- * Workflow:
- *  1. Collect pending invoices from the DB (up to 25 per API call)
- *  2. Sign all documents in one batchSign() call
- *  3. For each signed invoice: store envelopeId, certificate serial
- *  4. Retrieve audit trails for compliance archiving
- *  5. Download signed PDFs from the envelopes
- *
- * Rate limits:
- *  The SDK automatically handles 429 responses with exponential back-off.
- *  For very large batches, use the BATCH_SIZE constant to chunk requests.
- *
- * Prerequisites:
- *   npm install @certysign/sdk
- *   export CERTYSIGN_PUBLIC_KEY="cs_pk_..."
- *   export CERTYSIGN_SECRET_KEY="cs_sk_..."
- */
-
-'use strict';
-
-const fs   = require('fs');
-const path = require('path');
-const { CertySignClient, CertySignError } = require('@certysign/sdk');
-
-// ── Config ───────────────────────────────────────────────────────────────────
-
-const BATCH_SIZE = 10;          // Sign up to 10 invoices per API call (max 25)
-const SIGNER_NAME  = 'NHIF Finance System';
-const SIGNER_EMAIL = 'invoicing-batch@nhif.or.ke';
-
-const client = new CertySignClient({
-  publicKey:   process.env.CERTYSIGN_PUBLIC_KEY,
-  secretKey:   process.env.CERTYSIGN_SECRET_KEY,
-  environment: 'production'
-});
-
-// ── Simulated pending invoices ────────────────────────────────────────────────
-
-function getPendingInvoices() {
-  // In production: fetch from your DB
-  return [
-    { id: 'INV-2026-0441', provider: 'Aga Khan University Hospital', amount: 1_250_000 },
-    { id: 'INV-2026-0442', provider: 'Nairobi Hospital',             amount:   875_000 },
-    { id: 'INV-2026-0443', provider: 'Karen Hospital',               amount:   430_000 },
-    { id: 'INV-2026-0444', provider: 'MP Shah Hospital',             amount:   995_000 },
-    { id: 'INV-2026-0445', provider: 'Mater Hospital',               amount:   660_000 }
-  ];
-}
-
-function loadInvoicePdf(invoice) {
-  // In production: load from document store / generate from template
-  const filePath = path.join(__dirname, `invoice-${invoice.id}.pdf`);
-  if (fs.existsSync(filePath)) return fs.readFileSync(filePath);
-  // Placeholder for demo
-  return Buffer.from(`%PDF-1.4 NHIF Invoice ${invoice.id} — ${invoice.provider}`);
-}
-
-// ── Chunk array helper ────────────────────────────────────────────────────────
-
-function* chunks(arr, size) {
-  for (let i = 0; i < arr.length; i += size) {
-    yield arr.slice(i, i + size);
-  }
-}
-
-// ── Batch signing ─────────────────────────────────────────────────────────────
-
-async function runNightlyBatch() {
-  console.log('\n[NHIF] Starting nightly invoice signing batch');
-  console.log(`[NHIF] Timestamp: ${new Date().toISOString()}`);
-  console.log('─'.repeat(60));
-
-  const invoices = getPendingInvoices();
-  console.log(`[NHIF] ${invoices.length} invoices pending signature`);
-
-  const signedRecords = [];
-  const failedInvoices = [];
-  let batchNumber = 0;
-
-  for (const batch of chunks(invoices, BATCH_SIZE)) {
-    batchNumber++;
-    console.log(`\n[NHIF] Batch ${batchNumber} — signing ${batch.length} invoices...`);
-
-    // Build document list for this batch
-    const documents = batch.map(invoice => ({
-      data:     loadInvoicePdf(invoice),
-      filename: `nhif-invoice-${invoice.id}.pdf`
-    }));
-
-    try {
-      const result = await client.sign.batchSign({
-        documents,
-        signerName:  SIGNER_NAME,
-        signerEmail: SIGNER_EMAIL,
-        reason:      `NHIF provider reimbursement batch — ${new Date().toISOString().slice(0, 10)}`,
-        location:    'Nairobi, Kenya',
-        metadata: {
-          batchNumber:  batchNumber,
-          invoiceCount: batch.length,
-          system:       'NHIF-FINANCE-BATCH'
-        }
-      });
-
-      // Map results back to invoice records
-      const results = result.data.results;  // Array, one per document
-      for (let i = 0; i < batch.length; i++) {
-        const invoice = batch[i];
-        const res     = results[i];
-
-        if (res.success) {
-          signedRecords.push({
-            invoiceId:         invoice.id,
-            provider:          invoice.provider,
-            amount:            invoice.amount,
-            envelopeId:        res.envelopeId,
-            certificateSerial: res.certificate?.serialNumber,
-            signedAt:          new Date().toISOString(),
-            status:            'SIGNED'
-          });
-
-          console.log(`  ✓ ${invoice.id} → env: ${res.envelopeId}`);
-        } else {
-          failedInvoices.push({ invoice, reason: res.error });
-          console.warn(`  ✗ ${invoice.id} → ${res.error}`);
-        }
-      }
-
-    } catch (err) {
-      if (err instanceof CertySignError) {
-        console.error(`[NHIF] Batch ${batchNumber} API error (${err.statusCode}): ${err.message}`);
-        if (err.statusCode === 429) {
-          // Rate limited — wait and log (SDK already retried 3 times)
-          console.error('[NHIF] Rate limit exhausted — will retry this batch in next run');
-        }
-        batch.forEach(inv => failedInvoices.push({ invoice: inv, reason: err.message }));
-      } else {
-        throw err;
-      }
-    }
-  }
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // Step 2: Retrieve audit trails for compliance
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log(`\n[NHIF] Retrieving audit trails for ${signedRecords.length} signed invoices...`);
-
-  for (const record of signedRecords.slice(0, 3)) {  // Demo: first 3 only
-    try {
-      const auditResult = await client.envelopes.getAuditTrail(record.envelopeId);
-      const { auditTrail, chainIntegrity } = auditResult.data;
-
-      record.auditEntries    = auditTrail.length;
-      record.auditChainValid = chainIntegrity?.valid;
-
-      console.log(`  ✓ ${record.invoiceId}: ${auditTrail.length} events, chain=${chainIntegrity?.valid}`);
-    } catch (err) {
-      console.warn(`  ✗ Audit trail for ${record.invoiceId}: ${err.message}`);
-    }
-  }
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // Step 3: Download first signed PDF as a demo
-  // ─────────────────────────────────────────────────────────────────────────
-  if (signedRecords.length > 0) {
-    const sample = signedRecords[0];
-    try {
-      console.log(`\n[NHIF] Downloading signed PDF for ${sample.invoiceId}...`);
-      // First get the envelope to find the document ID
-      const env = await client.envelopes.get(sample.envelopeId);
-      const docId = env.data?.envelope?.documents?.[0]?._id;
-
-      if (docId) {
-        const pdfBuffer = await client.envelopes.getDocument(sample.envelopeId, docId);
-        const outPath = path.join(__dirname, `signed-${sample.invoiceId}.pdf`);
-        fs.writeFileSync(outPath, pdfBuffer);
-        console.log(`[NHIF] ✓ Saved signed PDF to ${outPath} (${pdfBuffer.length} bytes)`);
-      }
-    } catch (err) {
-      console.warn(`[NHIF] Could not download signed PDF: ${err.message}`);
-    }
-  }
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // Summary
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n' + '─'.repeat(60));
-  console.log(`[NHIF] Batch complete`);
-  console.log(`       Signed   : ${signedRecords.length}`);
-  console.log(`       Failed   : ${failedInvoices.length}`);
-
-  if (failedInvoices.length) {
-    console.log('[NHIF] Failed invoices:');
-    failedInvoices.forEach(({ invoice, reason }) => {
-      console.log(`  - ${invoice.id}: ${reason}`);
-    });
-  }
-
-  return { signed: signedRecords, failed: failedInvoices };
-}
-
-// ── Run ───────────────────────────────────────────────────────────────────────
-
-(async () => {
-  try {
-    await runNightlyBatch();
-  } catch (err) {
-    console.error('\n[NHIF] Fatal error:', err.message);
-    process.exit(1);
-  }
-})();