"""CONTROLLED REFERENCE IMPLEMENTATION — NOT EXTERNAL. Specification is authoritative."""
import base64, hashlib, json, sys, unicodedata
from datetime import datetime, timezone
def norm(v):
if isinstance(v, str): return unicodedata.normalize("NFC", v)
if isinstance(v, list): return [norm(x) for x in v]
if isinstance(v, dict): return {unicodedata.normalize("NFC", k): norm(v[k]) for k in sorted(v)}
if v is None or isinstance(v, (bool, int, float)): return 0 if isinstance(v, float) and v == 0 else v
raise TypeError(type(v))
def canonical(v): return json.dumps(norm(v), ensure_ascii=False, separators=(",", ":")).encode()
def seal_hash(d):
body=dict(d); body.pop("seal",None)
return hashlib.sha256(canonical(body)).hexdigest()
def carrier(d):
raw=canonical(d); ext="udr" if d["state"]=="UDR" else "uds"
payload=base64.b64encode(raw).decode()
return f'''Hello UDHello UD
Download exact original UD'''.encode()
stamp="2026-08-29T12:00:00.000Z"
udr={"ud_version":"0.1.0","state":"UDR","metadata":{"id":"00000000-0000-4000-8000-000000000016","title":"Python Hello UD","created_at":stamp,"updated_at":stamp,"created_by":"Controlled Python reference","revoked":False},"manifest":{"base_language":"en","language_manifest":[{"code":"en","label":"English","direction":"ltr"}],"clarity_layer_manifest":[],"permissions":{"allow_copy":True,"allow_print":True,"allow_export":True,"require_auth":False}},"blocks":[{"id":"paragraph-1","type":"paragraph","base_content":{"text":"Hello from an independently implementable format."}}]}
target=sys.argv[1] if len(sys.argv)>1 else "."
open(target+"/python-hello.udr","wb").write(canonical(udr));open(target+"/python-hello.udr.html","wb").write(carrier(udr))
uds=dict(udr);uds["state"]="UDS";uds["metadata"]=dict(udr["metadata"]);uds["seal"]={"sealed_at":stamp,"sealed_by":"CONTROLLED TEST ONLY","hash":seal_hash(uds),"chain_of_custody":[{"event":"sealed","actor":"CONTROLLED TEST ONLY","timestamp":stamp}]}
open(target+"/python-hello.uds","wb").write(canonical(uds));print("Created controlled UDR, BrowserCarrier, and unsigned-integrity test UDS")