@kashscript/hudhud 0.1.0

package/dist/anchor/index.js

@@ -0,0 +1,97 @@
+// ============================================================================
+// @kashscript/hudhud/anchor — external chain-tip anchoring + receipt store
+// ----------------------------------------------------------------------------
+// Periodic out-of-band publication of session chain tips: an attacker who
+// rewrites the whole ledger consistently still can't rewrite an anchor
+// published OUTSIDE the DB, so the auditor cross-checks the DB chain's latest
+// hash against the anchor. Ships the interface + a merkle-root helper + an
+// in-memory anchor and receipt store; the public witness (Rekor/OTS) is
+// attest's `witness`, and the node-fs FileChainAnchor is a deployment adapter
+// (kept out to keep hudhud edge-safe). Ported from the oreoasis-core-host engine.
+// ============================================================================
+import { sha256Hex } from "@kashscript/attest";
+/** Deterministic SHA-256-over-sorted-tip-triples root. Simpler than a binary
+ *  Merkle tree — the anchor's job is just to be unrewritable; the cross-check
+ *  against the per-session chain hash is what proves tamper. */
+export async function computeAnchorMerkleRoot(tips) {
+    const sorted = [...tips].sort((a, b) => (a.sessionId < b.sessionId ? -1 : 1));
+    const enc = new TextEncoder();
+    let acc = new Uint8Array(0);
+    // ⚠️ audit r1 F1 (KNOWN, deferred, wire-compatible with attest's witness anchor):
+    // this newline join is not injective. The injective fix is a wire-format change
+    // that would invalidate anchors a venture has already witnessed, so it lands
+    // behind a coordinated anchor-format v2 at the venture swap — see
+    // specs/hudhud-audit-r1.md. Kept byte-identical to attest for now.
+    for (const t of sorted) {
+        const segment = enc.encode(`${t.sessionId}\n${t.latestHash}\n${t.latestStepIndex}\n`);
+        const next = new Uint8Array(acc.length + segment.length);
+        next.set(acc);
+        next.set(segment, acc.length);
+        acc = next;
+    }
+    return sha256Hex(acc);
+}
+function frozenRecord(tips, merkleRoot, publishedAt) {
+    return Object.freeze({
+        publishedAt,
+        merkleRoot,
+        tipCount: tips.length,
+        tips: Object.freeze(tips.map((t) => Object.freeze({ ...t }))),
+    });
+}
+/** In-memory anchor — records publications for inspection. A legitimate
+ *  dev/test backend (the anchor is then witnessed for the process lifetime). */
+export class NullChainAnchor {
+    records = [];
+    async publish(tips) {
+        const record = frozenRecord(tips, await computeAnchorMerkleRoot(tips), new Date().toISOString());
+        this.records.push(record);
+        return record;
+    }
+    async history() {
+        return [...this.records];
+    }
+    async latest() {
+        return this.records.length === 0 ? null : this.records[this.records.length - 1];
+    }
+}
+let lastIdMicros = 0;
+function newReceiptId() {
+    let micros = Date.now() * 1000;
+    if (micros <= lastIdMicros)
+        micros = lastIdMicros + 1;
+    lastIdMicros = micros;
+    const rand = crypto.getRandomValues(new Uint8Array(6));
+    let hex = "";
+    for (const b of rand)
+        hex += b.toString(16).padStart(2, "0");
+    return `anchor_${micros.toString(36)}_${hex}`;
+}
+/** In-memory receipt store — the no-DB / test profile. */
+export class InMemoryAnchorReceiptStore {
+    rows = [];
+    async append(record) {
+        const stored = Object.freeze({
+            ...record,
+            tips: Object.freeze(record.tips.map((t) => Object.freeze({ ...t }))),
+            id: newReceiptId(),
+            createdAt: new Date().toISOString(),
+        });
+        this.rows.push(stored);
+        return stored;
+    }
+    async latest() {
+        return this.rows.length === 0 ? null : this.rows[this.rows.length - 1];
+    }
+    async history() {
+        return [...this.rows];
+    }
+    async latestForRoot(merkleRoot) {
+        for (let i = this.rows.length - 1; i >= 0; i--) {
+            if (this.rows[i].merkleRoot === merkleRoot)
+                return this.rows[i];
+        }
+        return null;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/anchor/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/anchor/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,2EAA2E;AAC3E,+EAA+E;AAC/E,0EAA0E;AAC1E,uEAAuE;AACvE,8EAA8E;AAC9E,2EAA2E;AAC3E,wEAAwE;AACxE,8EAA8E;AAC9E,kFAAkF;AAClF,+EAA+E;AAE/E,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AA+B/C;;gEAEgE;AAChE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAA6B;IACzE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;IAC9B,IAAI,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,kFAAkF;IAClF,gFAAgF;IAChF,6EAA6E;IAC7E,kEAAkE;IAClE,mEAAmE;IACnE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,GAAG,GAAG,IAAI,CAAC;IACb,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,YAAY,CAAC,IAA6B,EAAE,UAAkB,EAAE,WAAmB;IAC1F,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW;QACX,UAAU;QACV,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;KAC9D,CAAC,CAAC;AACL,CAAC;AAED;gFACgF;AAChF,MAAM,OAAO,eAAe;IACT,OAAO,GAAmB,EAAE,CAAC;IAE9C,KAAK,CAAC,OAAO,CAAC,IAA6B;QACzC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,uBAAuB,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACnF,CAAC;CACF;AAgBD,IAAI,YAAY,GAAG,CAAC,CAAC;AACrB,SAAS,YAAY;IACnB,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAC/B,IAAI,MAAM,IAAI,YAAY;QAAE,MAAM,GAAG,YAAY,GAAG,CAAC,CAAC;IACtD,YAAY,GAAG,MAAM,CAAC;IACtB,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7D,OAAO,UAAU,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC;AAChD,CAAC;AAED,0DAA0D;AAC1D,MAAM,OAAO,0BAA0B;IACpB,IAAI,GAA0B,EAAE,CAAC;IAElD,KAAK,CAAC,MAAM,CAAC,MAAoB;QAC/B,MAAM,MAAM,GAAwB,MAAM,CAAC,MAAM,CAAC;YAChD,GAAG,MAAM;YACT,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACpE,EAAE,EAAE,YAAY,EAAE;YAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,OAAO;QACX,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,UAAkB;QACpC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/C,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,UAAU,KAAK,UAAU;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/certificate/certificate.d.ts

@@ -0,0 +1,115 @@
+import type { DsseEnvelope, DsseSigner } from "@kashscript/attest";
+import type { AnchorRecord } from "../anchor";
+import type { ExceptionClassificationRecord, FailureClass } from "../exception";
+export declare const WORK_CERTIFICATE_FORMAT_VERSION: "kash-work-certificate/1";
+export declare const WORK_CERTIFICATE_PAYLOAD_TYPE: "application/vnd.kash.work-certificate+json";
+/** The AIUC-1 standard's canonical reference (web-verified). */
+export declare const AIUC1_SOURCE: "https://www.aiuc-1.com/";
+export interface Aiuc1Domain {
+    readonly code: "A" | "B" | "C" | "D" | "E" | "F";
+    readonly name: string;
+    readonly covers: string;
+}
+export declare const AIUC1_DOMAINS: ReadonlyArray<Aiuc1Domain>;
+export type WorkOutcomeStatus = "delivered_autonomous" | "delivered_with_signoff" | "declined";
+export interface CertifiedWorkRecord {
+    readonly workItemId: string;
+    readonly sessionId: string;
+    readonly workflowId: string;
+    readonly workflowLabel?: string;
+    readonly status: WorkOutcomeStatus;
+    readonly slaDeadlineIso: string;
+    readonly completedAtIso: string;
+    readonly slaMet: boolean;
+    readonly ledgerRowCount: number;
+    readonly ledgerTipHash: string;
+    readonly signoff: {
+        readonly operatorDid: string;
+        readonly ledgerStepIndex: number;
+    } | null;
+    readonly classification: ExceptionClassificationRecord | null;
+    readonly anchor: AnchorRecord | null;
+}
+export interface WorkCertificatePeriod {
+    readonly clientDid: string;
+    readonly clientName: string;
+    readonly month: string;
+    readonly fromIso: string;
+    readonly toIso: string;
+}
+export interface BuildWorkCertificateInput {
+    readonly period: WorkCertificatePeriod;
+    readonly issuerDid: string;
+    readonly records: ReadonlyArray<CertifiedWorkRecord>;
+    readonly slaTargetPct?: number;
+}
+export interface WorkCertificateSummary {
+    readonly workVolumeDelivered: number;
+    readonly workVolumeDeclined: number;
+    readonly automationRatePct: number;
+    readonly exceptionCount: number;
+    readonly exceptionsByClass: Record<FailureClass, number>;
+    readonly humanSignoffCount: number;
+    readonly slaAdherencePct: number;
+    readonly slaTargetPct: number | null;
+    readonly anchoredCount: number;
+}
+export interface Aiuc1DomainCoverage extends Aiuc1Domain {
+    readonly evidence: ReadonlyArray<string>;
+    readonly status: "evidenced" | "partial";
+}
+export interface CertifiedOutcome {
+    readonly workItemId: string;
+    readonly workflowId: string;
+    readonly status: WorkOutcomeStatus;
+    readonly slaMet: boolean;
+    readonly completedAtIso: string;
+    readonly ledgerTipHash: string;
+    readonly signoffLedgerStepIndex: number | null;
+    readonly classificationId: string | null;
+    readonly failureClass: FailureClass | null;
+    readonly anchorMerkleRoot: string | null;
+    readonly anchorWitnessBackend: string | null;
+}
+export interface WorkCertificateAnchorRef {
+    readonly merkleRoot: string;
+    readonly witnessBackend: string;
+    readonly witnessedAtIso: string | null;
+    readonly verifyWith: string;
+}
+export interface WorkCertificateBody {
+    readonly formatVersion: string;
+    readonly standard: {
+        readonly name: "AIUC-1";
+        readonly source: string;
+    };
+    readonly period: WorkCertificatePeriod;
+    readonly issuerDid: string;
+    readonly issuedAtIso: string;
+    readonly summary: WorkCertificateSummary;
+    readonly aiuc1Coverage: ReadonlyArray<Aiuc1DomainCoverage>;
+    readonly outcomes: ReadonlyArray<CertifiedOutcome>;
+    readonly anchors: ReadonlyArray<WorkCertificateAnchorRef>;
+    readonly verification: {
+        readonly instructions: string;
+    };
+}
+export interface WorkCertificate {
+    readonly body: WorkCertificateBody;
+    readonly envelope: DsseEnvelope;
+}
+/** Build + DSSE-sign a Work Certificate from a period's ledger-derived records. */
+export declare function buildWorkCertificate(input: BuildWorkCertificateInput, issuer: DsseSigner, issuedAtIso?: string): Promise<WorkCertificate>;
+export interface WorkCertificateVerifyReport {
+    readonly ok: boolean;
+    readonly signatureOk: boolean;
+    readonly countsRecomputeOk: boolean;
+    readonly mismatches: ReadonlyArray<string>;
+    readonly body: WorkCertificateBody | null;
+}
+/** Verify a Work Certificate: the DSSE signature is by the DECLARED issuer, the
+ *  payload type matches, and every summary count re-derives from the enumerated
+ *  outcomes. audit r1 F2: a valid signature from the wrong key, a different
+ *  document type, or a malformed body must all fail — not slip through or throw. */
+export declare function verifyWorkCertificate(envelope: DsseEnvelope, resolveIssuerKey: (keyid: string) => Uint8Array | null): Promise<WorkCertificateVerifyReport>;
+//# sourceMappingURL=certificate.d.ts.map

package/dist/certificate/certificate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.d.ts","sourceRoot":"","sources":["../../src/certificate/certificate.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,KAAK,EAAE,6BAA6B,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEhF,eAAO,MAAM,+BAA+B,EAAG,yBAAkC,CAAC;AAClF,eAAO,MAAM,6BAA6B,EAAG,4CAAqD,CAAC;AAEnG,gEAAgE;AAChE,eAAO,MAAM,YAAY,EAAG,yBAAkC,CAAC;AAE/D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,eAAO,MAAM,aAAa,EAAE,aAAa,CAAC,WAAW,CAOpD,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,sBAAsB,GAAG,wBAAwB,GAAG,UAAU,CAAC;AAE/F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5F,QAAQ,CAAC,cAAc,EAAE,6BAA6B,GAAG,IAAI,CAAC;IAC9D,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IACrD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACzD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAC;CAC1C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IAC3D,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACnD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,wBAAwB,CAAC,CAAC;IAC1D,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;CACjC;AA+GD,mFAAmF;AACnF,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,EAChC,MAAM,EAAE,UAAU,EAClB,WAAW,GAAE,MAAiC,GAC7C,OAAO,CAAC,eAAe,CAAC,CAgB1B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAC3C;AA6CD;;;oFAGoF;AACpF,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,YAAY,EACtB,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,GACrD,OAAO,CAAC,2BAA2B,CAAC,CAmBtC"}

package/dist/certificate/certificate.js

@@ -0,0 +1,221 @@
+// ============================================================================
+// @kashscript/hudhud/certificate — the Work Certificate (AIUC-1, DSSE-signed)
+// ----------------------------------------------------------------------------
+// A monthly, per-client, SIGNED document rendered from the signed ledger — the
+// billing unit (it enumerates the warranted outcomes) and the retention
+// artifact. Everything DERIVES from the ledger: each CertifiedWorkRecord carries
+// its evidence (chain-tip hash, sign-off row, exception classification, anchor);
+// the certificate aggregates the counts and a third party RE-DERIVES them
+// (verifyWorkCertificate). Sections map onto the six AIUC-1 control domains
+// (web-verified, not invented). DSSE via `@kashscript/attest`. Ported from the
+// oreoasis-core-host engine (M5); format/payload identifiers neutralized.
+// ============================================================================
+import { signEnvelope, verifyEnvelope } from "@kashscript/attest";
+import { FAILURE_CLASSES } from "../exception";
+export const WORK_CERTIFICATE_FORMAT_VERSION = "kash-work-certificate/1";
+export const WORK_CERTIFICATE_PAYLOAD_TYPE = "application/vnd.kash.work-certificate+json";
+/** The AIUC-1 standard's canonical reference (web-verified). */
+export const AIUC1_SOURCE = "https://www.aiuc-1.com/";
+export const AIUC1_DOMAINS = [
+    { code: "A", name: "Data & Privacy", covers: "Customer-data policy, access controls, and safeguards against data leakage / PII exposure / IP infringement / unauthorized training." },
+    { code: "B", name: "Security", covers: "Adversarial-robustness testing, input filtering, access-privilege enforcement, deployment security, and output-exposure limits." },
+    { code: "C", name: "Safety", covers: "Risk-taxonomy definition, harmful/out-of-scope output prevention, human-review flagging, and third-party testing." },
+    { code: "D", name: "Reliability", covers: "Preventing hallucinated outputs and unsafe tool calls." },
+    { code: "E", name: "Accountability", covers: "Failure-response plans, access monitoring, regulatory compliance, quality management, activity logging, and transparency." },
+    { code: "F", name: "Society", covers: "Preventing AI cyber-misuse and catastrophic-misuse scenarios." },
+];
+function round1(n) {
+    return Math.round(n * 10) / 10;
+}
+function emptyClassMix() {
+    const mix = {};
+    for (const c of FAILURE_CLASSES)
+        mix[c] = 0;
+    return mix;
+}
+function summarize(records, slaTargetPct) {
+    let autonomous = 0;
+    let withSignoff = 0;
+    let declined = 0;
+    let slaMet = 0;
+    let anchored = 0;
+    const exceptionsByClass = emptyClassMix();
+    for (const r of records) {
+        if (r.status === "delivered_autonomous")
+            autonomous += 1;
+        else if (r.status === "delivered_with_signoff")
+            withSignoff += 1;
+        else
+            declined += 1;
+        if (r.slaMet)
+            slaMet += 1;
+        if (r.anchor !== null)
+            anchored += 1;
+        if (r.classification !== null)
+            exceptionsByClass[r.classification.failureClass] += 1;
+    }
+    const delivered = autonomous + withSignoff;
+    const total = records.length;
+    return {
+        workVolumeDelivered: delivered,
+        workVolumeDeclined: declined,
+        automationRatePct: delivered === 0 ? 0 : round1((autonomous / delivered) * 100),
+        exceptionCount: records.filter((r) => r.classification !== null).length,
+        exceptionsByClass,
+        humanSignoffCount: records.filter((r) => r.signoff !== null).length,
+        slaAdherencePct: total === 0 ? 0 : round1((slaMet / total) * 100),
+        slaTargetPct: slaTargetPct ?? null,
+        anchoredCount: anchored,
+    };
+}
+function mapAiuc1Coverage(records, summary) {
+    const anchoredEvidence = summary.anchoredCount > 0
+        ? `${summary.anchoredCount} of ${records.length} chain tips anchored to a public transparency log (Rekor / OpenTimestamps) — existence provable to a third party.`
+        : "Ledger is tamper-evident and independently exportable; public-witness anchoring available (none attached this period).";
+    return AIUC1_DOMAINS.map((d) => {
+        switch (d.code) {
+            case "A":
+                return { ...d, status: "evidenced", evidence: ["PII/secret redaction runs before every model call (privacy interceptor); category tags — never raw values — enter the signed ledger."] };
+            case "B":
+                return { ...d, status: "evidenced", evidence: [`Every action Ed25519-signed into an append-only, hash-chained ledger (${records.reduce((n, r) => n + r.ledgerRowCount, 0)} signed rows this period).`, anchoredEvidence] };
+            case "C":
+                return { ...d, status: "evidenced", evidence: [`${summary.exceptionCount} exception(s) flagged for human review and resolved this period; each classified under a fixed risk taxonomy (judgment / gap-filling / ambiguous).`, "Restricted actions suspend for human judgment rather than proceed autonomously."] };
+            case "D":
+                return { ...d, status: "evidenced", evidence: ["Tools restricted to a per-provider allowlist (scope-gating): an out-of-allowlist or restricted tool call cannot be dispatched by construction.", `Automation rate this period: ${summary.automationRatePct}% delivered without human intervention.`] };
+            case "E":
+                return { ...d, status: "evidenced", evidence: ["Complete signed activity log (the ledger) for every work item; a self-contained audit bundle is independently verifiable offline.", `${summary.humanSignoffCount} human sign-off(s), each a SECOND-key signed ledger row (the host cannot forge human judgment).`] };
+            case "F":
+                return { ...d, status: "partial", evidence: ["Money-moving / restricted tools require a two-key human sign-off; no autonomous execution of restricted actions in this period's ledger."] };
+        }
+    });
+}
+function toOutcome(r) {
+    return {
+        workItemId: r.workItemId,
+        workflowId: r.workflowId,
+        status: r.status,
+        slaMet: r.slaMet,
+        completedAtIso: r.completedAtIso,
+        ledgerTipHash: r.ledgerTipHash,
+        signoffLedgerStepIndex: r.signoff?.ledgerStepIndex ?? null,
+        classificationId: r.classification?.id ?? null,
+        failureClass: r.classification?.failureClass ?? null,
+        anchorMerkleRoot: r.anchor?.merkleRoot ?? null,
+        anchorWitnessBackend: r.anchor?.witness?.backend ?? null,
+    };
+}
+function collectAnchors(records) {
+    const seen = new Set();
+    const out = [];
+    for (const r of records) {
+        const a = r.anchor;
+        if (a === null || seen.has(a.merkleRoot))
+            continue;
+        seen.add(a.merkleRoot);
+        const backend = a.witness?.backend ?? "none";
+        out.push({
+            merkleRoot: a.merkleRoot,
+            witnessBackend: backend,
+            witnessedAtIso: a.witness?.witnessedAt ?? null,
+            verifyWith: backend === "rekor"
+                ? "rekor-cli get --uuid <uuid in the anchor receipt>"
+                : backend === "opentimestamps"
+                    ? "ots upgrade <proof>.ots && ots verify <proof>.ots"
+                    : "no public witness attached (locally tamper-evident only)",
+        });
+    }
+    return out;
+}
+const VERIFY_INSTRUCTIONS = "This certificate is a DSSE envelope signed by the issuer's Ed25519 key. " +
+    "To verify: (1) check the envelope signature against the issuer DID's published key; " +
+    "(2) re-derive every summary count from the `outcomes` array (they must match `summary`); " +
+    "(3) for each outcome, re-verify the underlying audit bundle (chain + signatures) with the shipped verifier, " +
+    "and confirm the anchor with public tooling per each entry in `anchors`. Counts derive from the signed ledger — " +
+    "there is no separate metering system to trust.";
+/** Build + DSSE-sign a Work Certificate from a period's ledger-derived records. */
+export async function buildWorkCertificate(input, issuer, issuedAtIso = new Date().toISOString()) {
+    const summary = summarize(input.records, input.slaTargetPct);
+    const body = {
+        formatVersion: WORK_CERTIFICATE_FORMAT_VERSION,
+        standard: { name: "AIUC-1", source: AIUC1_SOURCE },
+        period: input.period,
+        issuerDid: input.issuerDid,
+        issuedAtIso,
+        summary,
+        aiuc1Coverage: mapAiuc1Coverage(input.records, summary),
+        outcomes: input.records.map(toOutcome),
+        anchors: collectAnchors(input.records),
+        verification: { instructions: VERIFY_INSTRUCTIONS },
+    };
+    const envelope = await signEnvelope(body, WORK_CERTIFICATE_PAYLOAD_TYPE, issuer);
+    return { body, envelope };
+}
+function recomputeCountsMatch(body) {
+    const mismatches = [];
+    const o = body.outcomes;
+    const delivered = o.filter((x) => x.status !== "declined").length;
+    const declined = o.filter((x) => x.status === "declined").length;
+    const autonomous = o.filter((x) => x.status === "delivered_autonomous").length;
+    const slaMet = o.filter((x) => x.slaMet).length;
+    const exceptionCount = o.filter((x) => x.classificationId !== null).length;
+    const signoffCount = o.filter((x) => x.signoffLedgerStepIndex !== null).length;
+    const anchored = o.filter((x) => x.anchorMerkleRoot !== null).length;
+    const total = o.length;
+    const s = body.summary;
+    const check = (label, got, want) => {
+        if (got !== want)
+            mismatches.push(`${label}: outcomes=${got} vs summary=${want}`);
+    };
+    check("workVolumeDelivered", delivered, s.workVolumeDelivered);
+    check("workVolumeDeclined", declined, s.workVolumeDeclined);
+    check("exceptionCount", exceptionCount, s.exceptionCount);
+    check("humanSignoffCount", signoffCount, s.humanSignoffCount);
+    check("anchoredCount", anchored, s.anchoredCount);
+    const wantAutomation = delivered === 0 ? 0 : round1((autonomous / delivered) * 100);
+    if (wantAutomation !== s.automationRatePct)
+        mismatches.push(`automationRatePct: recomputed=${wantAutomation} vs summary=${s.automationRatePct}`);
+    const wantSla = total === 0 ? 0 : round1((slaMet / total) * 100);
+    if (wantSla !== s.slaAdherencePct)
+        mismatches.push(`slaAdherencePct: recomputed=${wantSla} vs summary=${s.slaAdherencePct}`);
+    const classMix = emptyClassMix();
+    for (const x of o)
+        if (x.failureClass !== null)
+            classMix[x.failureClass] += 1;
+    for (const c of FAILURE_CLASSES) {
+        if (classMix[c] !== s.exceptionsByClass[c])
+            mismatches.push(`exceptionsByClass.${c}: outcomes=${classMix[c]} vs summary=${s.exceptionsByClass[c]}`);
+    }
+    return mismatches;
+}
+function isWorkCertificateBody(x) {
+    if (x === null || typeof x !== "object")
+        return false;
+    const b = x;
+    return (typeof b.issuerDid === "string" &&
+        Array.isArray(b.outcomes) &&
+        b.summary !== null &&
+        typeof b.summary === "object");
+}
+/** Verify a Work Certificate: the DSSE signature is by the DECLARED issuer, the
+ *  payload type matches, and every summary count re-derives from the enumerated
+ *  outcomes. audit r1 F2: a valid signature from the wrong key, a different
+ *  document type, or a malformed body must all fail — not slip through or throw. */
+export async function verifyWorkCertificate(envelope, resolveIssuerKey) {
+    const dsse = await verifyEnvelope(envelope, resolveIssuerKey);
+    if (dsse.payloadType !== WORK_CERTIFICATE_PAYLOAD_TYPE) {
+        return { ok: false, signatureOk: dsse.ok, countsRecomputeOk: false, mismatches: [`payloadType is "${dsse.payloadType}", expected "${WORK_CERTIFICATE_PAYLOAD_TYPE}"`], body: null };
+    }
+    const body = isWorkCertificateBody(dsse.payloadJson) ? dsse.payloadJson : null;
+    if (!dsse.ok || body === null) {
+        return { ok: false, signatureOk: dsse.ok, countsRecomputeOk: false, mismatches: body === null ? ["malformed work-certificate body"] : [], body };
+    }
+    // The signer must be the issuer the certificate NAMES. A valid signature from
+    // any OTHER resolvable key is not a valid certificate from `issuerDid`.
+    if (!dsse.verifiedKeyids.includes(body.issuerDid)) {
+        return { ok: false, signatureOk: true, countsRecomputeOk: false, mismatches: [`signer ${JSON.stringify(dsse.verifiedKeyids)} is not the declared issuer "${body.issuerDid}"`], body };
+    }
+    const mismatches = recomputeCountsMatch(body);
+    const countsRecomputeOk = mismatches.length === 0;
+    return { ok: countsRecomputeOk, signatureOk: true, countsRecomputeOk, mismatches, body };
+}
+//# sourceMappingURL=certificate.js.map

package/dist/certificate/certificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.js","sourceRoot":"","sources":["../../src/certificate/certificate.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,wEAAwE;AACxE,iFAAiF;AACjF,iFAAiF;AACjF,0EAA0E;AAC1E,4EAA4E;AAC5E,+EAA+E;AAC/E,0EAA0E;AAC1E,+EAA+E;AAE/E,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAIlE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAG/C,MAAM,CAAC,MAAM,+BAA+B,GAAG,yBAAkC,CAAC;AAClF,MAAM,CAAC,MAAM,6BAA6B,GAAG,4CAAqD,CAAC;AAEnG,gEAAgE;AAChE,MAAM,CAAC,MAAM,YAAY,GAAG,yBAAkC,CAAC;AAQ/D,MAAM,CAAC,MAAM,aAAa,GAA+B;IACvD,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,sIAAsI,EAAE;IACrL,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,iIAAiI,EAAE;IAC1K,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,mHAAmH,EAAE;IAC1J,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,wDAAwD,EAAE;IACpG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,2HAA2H,EAAE;IAC1K,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,+DAA+D,EAAE;CACxG,CAAC;AA2FF,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;AACjC,CAAC;AACD,SAAS,aAAa;IACpB,MAAM,GAAG,GAAG,EAAkC,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,eAAe;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,OAA2C,EAAE,YAAgC;IAC9F,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,iBAAiB,GAAG,aAAa,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,KAAK,sBAAsB;YAAE,UAAU,IAAI,CAAC,CAAC;aACpD,IAAI,CAAC,CAAC,MAAM,KAAK,wBAAwB;YAAE,WAAW,IAAI,CAAC,CAAC;;YAC5D,QAAQ,IAAI,CAAC,CAAC;QACnB,IAAI,CAAC,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;YAAE,QAAQ,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI;YAAE,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC;IAC7B,OAAO;QACL,mBAAmB,EAAE,SAAS;QAC9B,kBAAkB,EAAE,QAAQ;QAC5B,iBAAiB,EAAE,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,GAAG,SAAS,CAAC,GAAG,GAAG,CAAC;QAC/E,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,MAAM;QACvE,iBAAiB;QACjB,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,MAAM;QACnE,eAAe,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC;QACjE,YAAY,EAAE,YAAY,IAAI,IAAI;QAClC,aAAa,EAAE,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA2C,EAAE,OAA+B;IACpG,MAAM,gBAAgB,GACpB,OAAO,CAAC,aAAa,GAAG,CAAC;QACvB,CAAC,CAAC,GAAG,OAAO,CAAC,aAAa,OAAO,OAAO,CAAC,MAAM,mHAAmH;QAClK,CAAC,CAAC,wHAAwH,CAAC;IAC/H,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAuB,EAAE;QAClD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,GAAG;gBACN,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,sIAAsI,CAAC,EAAE,CAAC;YAC3L,KAAK,GAAG;gBACN,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,yEAAyE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,4BAA4B,EAAE,gBAAgB,CAAC,EAAE,CAAC;YAC7N,KAAK,GAAG;gBACN,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,oJAAoJ,EAAE,iFAAiF,CAAC,EAAE,CAAC;YACrT,KAAK,GAAG;gBACN,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,gJAAgJ,EAAE,gCAAgC,OAAO,CAAC,iBAAiB,yCAAyC,CAAC,EAAE,CAAC;YACzS,KAAK,GAAG;gBACN,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,mIAAmI,EAAE,GAAG,OAAO,CAAC,iBAAiB,iGAAiG,CAAC,EAAE,CAAC;YACvT,KAAK,GAAG;gBACN,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,0IAA0I,CAAC,EAAE,CAAC;QAC/L,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,CAAsB;IACvC,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,eAAe,IAAI,IAAI;QAC1D,gBAAgB,EAAE,CAAC,CAAC,cAAc,EAAE,EAAE,IAAI,IAAI;QAC9C,YAAY,EAAE,CAAC,CAAC,cAAc,EAAE,YAAY,IAAI,IAAI;QACpD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,IAAI,IAAI;QAC9C,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,OAA2C;IACjE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAA+B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACnB,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;YAAE,SAAS;QACnD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACvB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,IAAI,MAAM,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC;YACP,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,cAAc,EAAE,OAAO;YACvB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,WAAW,IAAI,IAAI;YAC9C,UAAU,EACR,OAAO,KAAK,OAAO;gBACjB,CAAC,CAAC,mDAAmD;gBACrD,CAAC,CAAC,OAAO,KAAK,gBAAgB;oBAC5B,CAAC,CAAC,mDAAmD;oBACrD,CAAC,CAAC,0DAA0D;SACnE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,mBAAmB,GACvB,0EAA0E;IAC1E,sFAAsF;IACtF,2FAA2F;IAC3F,8GAA8G;IAC9G,iHAAiH;IACjH,gDAAgD,CAAC;AAEnD,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAgC,EAChC,MAAkB,EAClB,cAAsB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAE9C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAwB;QAChC,aAAa,EAAE,+BAA+B;QAC9C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE;QAClD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW;QACX,OAAO;QACP,aAAa,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;QACvD,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QACtC,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;QACtC,YAAY,EAAE,EAAE,YAAY,EAAE,mBAAmB,EAAE;KACpD,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,6BAA6B,EAAE,MAAM,CAAC,CAAC;IACjF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAUD,SAAS,oBAAoB,CAAC,IAAyB;IACrD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IACxB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IAClE,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IACjE,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,sBAAsB,CAAC,CAAC,MAAM,CAAC;IAC/E,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAChD,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IAC3E,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IAC/E,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IACrE,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;IACvB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;IACvB,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,IAAY,EAAQ,EAAE;QAC/D,IAAI,GAAG,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,cAAc,GAAG,eAAe,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC;IACF,KAAK,CAAC,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC,mBAAmB,CAAC,CAAC;IAC/D,KAAK,CAAC,oBAAoB,EAAE,QAAQ,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC5D,KAAK,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;IAC1D,KAAK,CAAC,mBAAmB,EAAE,YAAY,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC9D,KAAK,CAAC,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,GAAG,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC;IACpF,IAAI,cAAc,KAAK,CAAC,CAAC,iBAAiB;QAAE,UAAU,CAAC,IAAI,CAAC,iCAAiC,cAAc,eAAe,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACjJ,MAAM,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;IACjE,IAAI,OAAO,KAAK,CAAC,CAAC,eAAe;QAAE,UAAU,CAAC,IAAI,CAAC,+BAA+B,OAAO,eAAe,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7H,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI;YAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,qBAAqB,CAAC,cAAc,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAU;IACvC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzB,CAAC,CAAC,OAAO,KAAK,IAAI;QAClB,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAC9B,CAAC;AACJ,CAAC;AAED;;;oFAGoF;AACpF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAsB,EACtB,gBAAsD;IAEtD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAE9D,IAAI,IAAI,CAAC,WAAW,KAAK,6BAA6B,EAAE,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,mBAAmB,IAAI,CAAC,WAAW,gBAAgB,6BAA6B,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtL,CAAC;IACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;IACnJ,CAAC;IACD,8EAA8E;IAC9E,wEAAwE;IACxE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,gCAAgC,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;IACxL,CAAC;IAED,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;IAClD,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,WAAW,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAC3F,CAAC"}

package/dist/certificate/html.d.ts

@@ -0,0 +1,10 @@
+import type { WorkCertificateBody } from "./certificate";
+export interface WorkCertificateBrand {
+    readonly accentColor?: string;
+    readonly logoText?: string;
+    /** Footer attribution line (default neutral). */
+    readonly footerText?: string;
+}
+/** Render a self-contained, print-to-PDF-ready HTML certificate. */
+export declare function renderWorkCertificateHtml(body: WorkCertificateBody, brand?: WorkCertificateBrand): string;
+//# sourceMappingURL=html.d.ts.map

package/dist/certificate/html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../src/certificate/html.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAyC,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEhG,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AA6CD,oEAAoE;AACpE,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,GAAE,oBAAyB,GAAG,MAAM,CA6F7G"}

package/dist/certificate/html.js

@@ -0,0 +1,141 @@
+// ============================================================================
+// @kashscript/hudhud/certificate — the human-readable Work Certificate (HTML)
+// ----------------------------------------------------------------------------
+// A self-contained, client-branded HTML document a CFO can read and a browser
+// can "Print → Save as PDF" (no headless-browser dependency). Renders a
+// WorkCertificateBody; all styling inline so the file is portable. Ported from
+// the oreoasis-core-host engine (M5); the footer is neutralized/brandable.
+// ============================================================================
+function esc(s) {
+    return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+/** audit r1 F10: `accentColor` is interpolated into a CSS declaration (not an
+ *  HTML text node), where `esc()` is insufficient — a `;`/`{`/`}` would break out
+ *  of the rule and rewrite the document's styles (content-hiding / banner spoof).
+ *  Accept ONLY a CSS colour literal, else fall back to the default. */
+function safeAccent(s, fallback) {
+    if (s === undefined)
+        return fallback;
+    return /^(#[0-9a-fA-F]{3,8}|[a-z]{3,20}|rgb\(\s*\d{1,3}\s*,\s*\d{1,3}\s*,\s*\d{1,3}\s*\))$/.test(s) ? s : fallback;
+}
+/** audit r1 F10: the body can arrive from a signature-valid-but-untrusted
+ *  envelope, so only hyperlink an `http(s)` source (no `javascript:` URIs). */
+function safeUrl(s) {
+    return /^https?:\/\//i.test(s) ? s : "#";
+}
+function short(hash, n = 16) {
+    return hash.length > n ? `${hash.slice(0, n)}…` : hash;
+}
+const STATUS_LABEL = {
+    delivered_autonomous: "Delivered (autonomous)",
+    delivered_with_signoff: "Delivered (human sign-off)",
+    declined: "Declined at sign-off",
+};
+function metricCard(label, value, sub) {
+    return `<div class="card"><div class="card-v">${esc(value)}</div><div class="card-l">${esc(label)}</div><div class="card-s">${esc(sub)}</div></div>`;
+}
+function aiuc1Row(d) {
+    const badge = d.status === "evidenced" ? `<span class="pill pill-ok">Evidenced</span>` : `<span class="pill pill-part">Partial</span>`;
+    const items = d.evidence.map((e) => `<li>${esc(e)}</li>`).join("");
+    return `<tr><td class="dom"><span class="dom-code">${esc(d.code)}</span> ${esc(d.name)} ${badge}<div class="dom-covers">${esc(d.covers)}</div></td><td><ul class="ev">${items}</ul></td></tr>`;
+}
+function outcomeRow(o) {
+    const cls = o.failureClass ? esc(o.failureClass) : "—";
+    const anchor = o.anchorMerkleRoot ? `${esc(short(o.anchorMerkleRoot, 12))} <span class="mut">(${esc(o.anchorWitnessBackend ?? "none")})</span>` : "—";
+    const sla = o.slaMet ? `<span class="pill pill-ok">met</span>` : `<span class="pill pill-bad">missed</span>`;
+    return `<tr><td class="mono">${esc(o.workItemId)}</td><td>${esc(STATUS_LABEL[o.status])}</td><td>${sla}</td><td class="mono">${esc(short(o.ledgerTipHash, 12))}</td><td>${o.signoffLedgerStepIndex === null ? "—" : `#${o.signoffLedgerStepIndex}`}</td><td>${cls}</td><td class="mono">${anchor}</td></tr>`;
+}
+/** Render a self-contained, print-to-PDF-ready HTML certificate. */
+export function renderWorkCertificateHtml(body, brand = {}) {
+    const accent = safeAccent(brand.accentColor, "#0f2a4a");
+    const logo = brand.logoText ?? body.period.clientName;
+    const footer = brand.footerText ?? "Accountable AI workforce";
+    const s = body.summary;
+    const classMix = Object.entries(s.exceptionsByClass).map(([k, v]) => `${esc(k)}: <b>${v}</b>`).join(" &nbsp;·&nbsp; ");
+    const anchors = body.anchors.length === 0
+        ? `<p class="mut">No public-witness anchor attached to this period (ledger is tamper-evident and independently exportable).</p>`
+        : `<table class="tbl"><thead><tr><th>Merkle root</th><th>Witness</th><th>Witnessed</th><th>Verify with</th></tr></thead><tbody>${body.anchors
+            .map((a) => `<tr><td class="mono">${esc(short(a.merkleRoot, 20))}</td><td>${esc(a.witnessBackend)}</td><td>${esc(a.witnessedAtIso ?? "pending")}</td><td class="mono">${esc(a.verifyWith)}</td></tr>`)
+            .join("")}</tbody></table>`;
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Work Certificate — ${esc(body.period.clientName)} — ${esc(body.period.month)}</title>
+<style>
+  :root { --accent: ${esc(accent)}; }
+  * { box-sizing: border-box; }
+  body { font-family: -apple-system, "Segoe UI", Roboto, Helvetica, Arial, sans-serif; color: #1a1f26; margin: 0; background: #f4f6f8; }
+  .page { max-width: 900px; margin: 24px auto; background: #fff; box-shadow: 0 1px 6px rgba(0,0,0,.08); }
+  .band { background: var(--accent); color: #fff; padding: 28px 40px; }
+  .band .logo { font-size: 13px; letter-spacing: .18em; text-transform: uppercase; opacity: .85; }
+  .band h1 { margin: 6px 0 2px; font-size: 26px; font-weight: 650; }
+  .band .sub { opacity: .9; font-size: 14px; }
+  .band .verifiable { margin-top: 12px; display: inline-block; font-size: 12px; background: rgba(255,255,255,.16); padding: 4px 10px; border-radius: 3px; }
+  .body { padding: 28px 40px 40px; }
+  h2 { font-size: 15px; text-transform: uppercase; letter-spacing: .06em; color: var(--accent); border-bottom: 2px solid #eceff2; padding-bottom: 6px; margin: 30px 0 14px; }
+  .cards { display: grid; grid-template-columns: repeat(4, 1fr); gap: 12px; }
+  .card { border: 1px solid #e6eaee; border-radius: 5px; padding: 14px; }
+  .card-v { font-size: 24px; font-weight: 680; color: var(--accent); }
+  .card-l { font-size: 12px; font-weight: 600; margin-top: 2px; }
+  .card-s { font-size: 11px; color: #6b7683; margin-top: 2px; }
+  table { width: 100%; border-collapse: collapse; font-size: 12.5px; }
+  .aiuc td { border-top: 1px solid #eceff2; padding: 12px 8px; vertical-align: top; }
+  .aiuc .dom { width: 40%; }
+  .dom-code { display: inline-block; background: var(--accent); color: #fff; width: 20px; height: 20px; text-align: center; line-height: 20px; border-radius: 3px; font-size: 11px; font-weight: 700; margin-right: 4px; }
+  .dom-covers { color: #6b7683; font-size: 11.5px; margin-top: 4px; }
+  ul.ev { margin: 0; padding-left: 16px; } ul.ev li { margin: 3px 0; }
+  .tbl th { text-align: left; background: #f7f9fb; border-bottom: 1px solid #e6eaee; padding: 8px; font-size: 11px; text-transform: uppercase; letter-spacing: .04em; color: #6b7683; }
+  .tbl td { border-bottom: 1px solid #f0f2f5; padding: 8px; }
+  .mono { font-family: "SFMono-Regular", Consolas, "Liberation Mono", monospace; font-size: 11.5px; }
+  .mut { color: #94a0ac; }
+  .pill { font-size: 10.5px; padding: 1px 7px; border-radius: 10px; font-weight: 600; }
+  .pill-ok { background: #e3f5ea; color: #1a7a44; }
+  .pill-part { background: #fbf1dc; color: #8a6414; }
+  .pill-bad { background: #fbe4e4; color: #a52222; }
+  .verify { background: #f7f9fb; border: 1px solid #e6eaee; border-radius: 5px; padding: 14px 16px; font-size: 12.5px; }
+  .foot { color: #94a0ac; font-size: 11px; margin-top: 24px; border-top: 1px solid #eceff2; padding-top: 12px; }
+  a { color: var(--accent); }
+  @media print { body { background: #fff; } .page { box-shadow: none; margin: 0; max-width: none; } h2 { break-after: avoid; } tr { break-inside: avoid; } }
+</style></head>
+<body><div class="page">
+  <div class="band">
+    <div class="logo">${esc(logo)}</div>
+    <h1>Work Certificate</h1>
+    <div class="sub">${esc(body.period.clientName)} &nbsp;·&nbsp; ${esc(body.period.month)} &nbsp;·&nbsp; ${esc(body.period.fromIso.slice(0, 10))} → ${esc(body.period.toIso.slice(0, 10))}</div>
+    <div class="verifiable">🔒 Cryptographically signed &amp; independently verifiable — structured to AIUC-1</div>
+  </div>
+  <div class="body">
+    <h2>Delivered work this period</h2>
+    <div class="cards">
+      ${metricCard("Outcomes delivered", String(s.workVolumeDelivered), `${s.workVolumeDeclined} declined at sign-off`)}
+      ${metricCard("Automation rate", `${s.automationRatePct}%`, "delivered without human touch")}
+      ${metricCard("Exceptions", String(s.exceptionCount), `${s.humanSignoffCount} human sign-off(s)`)}
+      ${metricCard("SLA adherence", `${s.slaAdherencePct}%`, s.slaTargetPct === null ? "no target set" : `target ${s.slaTargetPct}%`)}
+    </div>
+    <p style="font-size:12.5px;color:#6b7683;margin-top:12px">Exception classification mix — ${classMix}. Every count on this certificate derives from the signed ledger; there is no separate metering system.</p>
+
+    <h2>AIUC-1 control coverage</h2>
+    <table class="aiuc"><tbody>
+      ${body.aiuc1Coverage.map(aiuc1Row).join("\n")}
+    </tbody></table>
+    <p class="mut" style="font-size:11px;margin-top:8px">Categories per the AIUC-1 standard (<a href="${esc(safeUrl(body.standard.source))}">${esc(body.standard.source)}</a>). Evidence statements are factual records from this period's signed ledger.</p>
+
+    <h2>Warranted outcomes (${body.outcomes.length})</h2>
+    <table class="tbl"><thead><tr><th>Work item</th><th>Outcome</th><th>SLA</th><th>Chain tip</th><th>Sign-off</th><th>Class</th><th>Anchor</th></tr></thead>
+      <tbody>${body.outcomes.map(outcomeRow).join("\n")}</tbody></table>
+
+    <h2>Public-witness anchors</h2>
+    ${anchors}
+
+    <h2>How to verify this certificate</h2>
+    <div class="verify">
+      <p style="margin:0 0 8px">${esc(body.verification.instructions)}</p>
+      <div class="mono">issuer: ${esc(body.issuerDid)}</div>
+      <div class="mono">format: ${esc(body.formatVersion)} &nbsp;·&nbsp; issued: ${esc(body.issuedAtIso)}</div>
+    </div>
+
+    <div class="foot">${esc(footer)}. This certificate enumerates the warranted outcomes it is the billing unit for. AIUC-1 categories: ${esc(body.standard.source)}.</div>
+  </div>
+</div></body></html>`;
+}
+//# sourceMappingURL=html.js.map