@actuarial-ts/compliance 0.1.0 → 0.3.0

package/README.md

@@ -65,7 +65,7 @@ const markdown = generateDisclosure({
     { methodId: "mack", basisLabel: "paid", resultSummary: { standardError: mack.totals.standardError } },
   ],
   ledger,
-  sdkVersion: "0.1.0",
+  sdkVersion: "0.3.0",
   generatedAt: "2026-01-05T10:15:00Z",
 });
 ```
@@ -75,7 +75,7 @@ const markdown = generateDisclosure({
 The ASB does not approve, certify, or endorse software, and no software can
 be "ASOP-compliant" on its own — compliance is a property of a credentialed
 actuary's work in context. This package is **designed to support the
-actuary's compliance** with ASOP Nos. 41, 43, 23, 56, and 21 by generating
+actuary's compliance** with ASOP Nos. 41, 43, 23, 56, 21, and 20 by generating
 the disclosures, documentation, and audit artifacts those standards call
 for. The generated documents are draft support material for the responsible
 actuary to review, edit, and adopt.

package/dist/bundle.d.ts

@@ -3,63 +3,81 @@
  * hash, so an analysis can state "these results came from exactly these
  * inputs, parameters, and SDK versions" and a re-run can be byte-verified.
  *
- * Ground truth:
- * - `canonicalJson` is the package's single equality oracle: object keys are
- *   sorted recursively, arrays keep their order, numbers render via
- *   `String(n)` except -0 which normalizes to "0" (so 0 and -0 never differ),
- *   and anything JSON cannot faithfully represent (undefined, functions,
- *   NaN/Infinity, bigint, symbol, non-plain objects such as Date/Map/Set,
- *   circular references) THROWS with the offending path instead of being
- *   silently dropped or coerced the way JSON.stringify would.
- * - `fnv1a64` is an integrity aid, NOT a security control (see its doc block).
+ * `canonicalJson` and `fnv1a64` LIVE IN @actuarial-ts/core (src/canonical.ts)
+ * since 0.2.0 so the interchange layer can share them without a package
+ * cycle; this module re-exports both, unchanged. One deliberate behavior
+ * change rode along: invalid canonicalization input now throws core's
+ * ReservingError("UNSUPPORTED_VALUE") instead of ComplianceError - same
+ * code, same message shape, different class (CHANGELOG 0.2.0).
+ *
+ * Ground truth (unchanged):
  * - Timestamps are caller-supplied ISO strings; this module never reads a
  *   clock, so identical inputs yield byte-identical bundles.
- * - Browser-safe: no node builtins (TextEncoder is a web-standard global).
+ * - fnv1a64 is an integrity aid, NOT a security control (see its doc block
+ *   in core).
+ * - Browser-safe: no node builtins.
  *
  * Error style for the whole package: `ComplianceError` with a registered
- * machine code, mirroring core's `ReservingError` idiom. It lives here (not
- * in its own module) because bundle.ts is the package's dependency-root
- * module — ledger.ts already imports `canonicalJson` from it. Core's
- * `RESERVING_ERROR_CODES` registry is a closed contract enforced against
- * core's own source, and compliance failures (missing rationale, unsupported
- * bundle values) are not reserving-input errors, so this package does not
- * reuse `ReservingError`.
+ * machine code, mirroring core's `ReservingError` idiom (bundle.ts is the
+ * package's dependency-root module, so the class lives here).
  *
  * These utilities are designed to support the actuary's compliance with
  * ASOP No. 41 (documentation and reproducibility of the analysis);
  * responsibility for compliance remains with the credentialed actuary.
  */
+import { canonicalJson, fnv1a64 } from "@actuarial-ts/core";
+import type { BundleDoc, MethodResultDoc, SelectionDoc, StochasticResultDoc, TriangleDoc } from "@actuarial-ts/interchange";
+export { canonicalJson, fnv1a64 };
+/**
+ * The wrapped reproducibility bundle: the interchange BundleDoc (spec 3.2),
+ * re-exported under a compliance-side name so it cannot be confused with the
+ * inner ReproducibilityBundle record. The dependency on
+ * `@actuarial-ts/interchange` is TYPE-ONLY (interchange must not import
+ * compliance, and it does not; the outer tag is computed here with core's
+ * canonicalJson/fnv1a64, matching interchange's semanticBodyOf for
+ * kind "bundle" exactly — the wrapped round-trip test parses the emitted doc
+ * with the real interchange parser so any drift fails loudly).
+ */
+export type WrappedBundleDoc = BundleDoc;
 /**
  * Every machine-readable code a ComplianceError can carry, across all modules
  * of this package. Add the code here when introducing a new throw.
+ * (UNSUPPORTED_VALUE moved to core's registry with canonicalJson in 0.2.0.)
  */
-export declare const COMPLIANCE_ERROR_CODES: readonly ["BAD_BUNDLE", "BAD_CDF", "MISSING_RATIONALE", "UNSUPPORTED_VALUE"];
+export declare const COMPLIANCE_ERROR_CODES: readonly ["BAD_BUNDLE", "BAD_CDF", "MISSING_RATIONALE"];
 export type ComplianceErrorCode = (typeof COMPLIANCE_ERROR_CODES)[number];
-/** Thrown for invalid compliance input (unrepresentable bundle payloads, judgment without rationale, non-positive CDFs). */
+/** Thrown for invalid compliance input (bad bundles, judgment without rationale, non-positive CDFs). */
 export declare class ComplianceError extends Error {
     readonly code: ComplianceErrorCode;
     constructor(code: ComplianceErrorCode, message: string);
 }
 /**
- * Deterministic JSON serialization: sorted object keys (recursively), arrays
- * in order, no whitespace, -0 normalized to "0". Two structurally equal
- * values always produce the same string regardless of key insertion order.
- * Throws ComplianceError("UNSUPPORTED_VALUE") — with the offending path, e.g.
- * "$.rows[2].ultimate" — for any value JSON cannot faithfully represent.
+ * The interchange version the wrapped form is written under. Kept in literal
+ * sync with `@actuarial-ts/interchange`'s INTERCHANGE_SPEC_VERSION (the dep
+ * is type-only, so the constant cannot be imported); the wrapped round-trip
+ * test parses the emitted doc with the real interchange parser, which
+ * refuses a wrong-major version — drift fails loudly.
  */
-export declare function canonicalJson(value: unknown): string;
+export declare const WRAPPED_BUNDLE_INTERCHANGE_VERSION = "1.0.0";
 /**
- * FNV-1a 64-bit hash over the UTF-8 bytes of `text`, returned as a 16-hex-char
- * string.
- *
- * This is an INTEGRITY AID for detecting accidental divergence between a
- * bundle and a re-run. It is NOT a security control: FNV-1a is not collision
- * resistant and offers no protection against deliberate tampering. Anyone
- * needing tamper evidence must sign or cryptographically hash the payload
- * (which is exactly why the full canonical payload — not just the hash — is
- * stored on the bundle).
+ * This package's version, stamped into a wrapped bundle's `generator`
+ * envelope field. A sync test asserts it matches package.json so it cannot
+ * silently drift (mirroring interchange's INTERCHANGE_PACKAGE_VERSION
+ * discipline).
  */
-export declare function fnv1a64(text: string): string;
+export declare const COMPLIANCE_PACKAGE_VERSION = "0.3.0";
+/**
+ * The interchange mirror for a wrapped bundle (spec 3.2): the triangles the
+ * analysis consumed, the selections it applied, and the results it produced,
+ * each as an interchange document. Results are INCLUDED so a non-TS consumer
+ * (`load_bundle`) can honor its contract without ever parsing the TS-native
+ * canonical payload.
+ */
+export interface BundleWrapInput {
+    triangles: TriangleDoc[];
+    selections: SelectionDoc[];
+    results: (MethodResultDoc | StochasticResultDoc)[];
+}
 export interface CreateBundleInput {
     /** The data the analysis consumed (triangles, claims, exposures — anything canonicalizable). */
     inputs: unknown;
@@ -73,6 +91,28 @@ export interface CreateBundleInput {
     seeds?: unknown;
     /** Caller-supplied ISO timestamp (purity: no clock reads). */
     createdAt: string;
+    /**
+     * Optional interchange mirror (spec 3.2). When provided, the bundle is
+     * ALSO emitted as a wrapped BundleDoc whose OUTER integrity tag is defined
+     * over `{ bundle, interchange }`. Never enters the inner payload: the
+     * unwrapped bundle is byte-identical with or without `wrap`.
+     */
+    wrap?: BundleWrapInput;
+    /**
+     * Overrides the wrapped document's `generator` stamp. Defaults to this
+     * package at its current version, which is what a real analysis wants.
+     *
+     * Exists for authoring FROZEN corpora (the cross-engine conformance
+     * fixtures), where every byte must reproduce forever and so a stamp that
+     * tracks the live build cannot be used — the same reason `createdAt` is
+     * caller-supplied rather than read from the clock. Matches the
+     * `generator?` option the interchange document builders already accept.
+     * Wrapped-mode only; the inner payload never carries it.
+     */
+    generator?: {
+        name: string;
+        version: string;
+    };
 }
 export interface ReproducibilityBundle {
     /** Canonical JSON of the full bundle body; the reproducibility record itself. */
@@ -80,13 +120,37 @@ export interface ReproducibilityBundle {
     /** fnv1a64(payload) — integrity aid, not a security control. */
     hash: string;
 }
+/** A ReproducibilityBundle plus its wrapped interchange form (spec 3.2). */
+export interface WrappedBundleResult extends ReproducibilityBundle {
+    /**
+     * The wrapped BundleDoc: `{ bundle: { payload, hash }, interchange }` under
+     * an interchange envelope, with the OUTER integrity tag over the two-field
+     * semantic body `{ bundle, interchange }`.
+     */
+    wrapped: WrappedBundleDoc;
+}
 /**
  * Packages an analysis run into a reproducibility bundle. The payload is
  * canonical, so two runs with structurally equal inputs produce byte-identical
  * payloads (and therefore identical hashes) regardless of key insertion order.
  * `seeds` is included only when provided (undefined would be unrepresentable).
+ *
+ * With `wrap` (the interchange mirror, spec 3.2) the same inner bundle is
+ * ALSO returned as a wrapped BundleDoc; the unwrapped `{ payload, hash }` is
+ * byte-identical either way (the v0.1.x compat fixture pins this).
  */
+export declare function createBundle(input: CreateBundleInput & {
+    wrap: BundleWrapInput;
+}): WrappedBundleResult;
 export declare function createBundle(input: CreateBundleInput): ReproducibilityBundle;
+/** Outer-tag verification detail (wrapped mode only; spec 3.2). */
+export interface OuterIntegrityCheck {
+    ok: boolean;
+    /** The tag recomputed from the `{ bundle, interchange }` semantic body. */
+    expected: string;
+    /** The tag the wrapped document claims. */
+    actual: string | null;
+}
 export interface VerifyBundleResult {
     reproduced: boolean;
     /**
@@ -94,19 +158,31 @@ export interface VerifyBundleResult {
      * sorted order), e.g. "$.rows[1].ultimate". Present only when not
      * reproduced. A missing/extra object key reports the key's path; an array
      * length mismatch reports the first index past the shared prefix; a type
-     * mismatch reports the node itself.
+     * mismatch reports the node itself. In wrapped mode, an outer-tag failure
+     * reports "$.integrity" (the divergent tag itself; see `outerIntegrity`
+     * for the expected/actual values).
      */
     mismatchPath?: string;
+    /** Present in wrapped mode only: the outer-tag check (spec 3.2). */
+    outerIntegrity?: OuterIntegrityCheck;
 }
 /**
  * Verifies a re-run against a bundle: canonicalizes `rerunResults` and
  * byte-compares it with the bundle's stored `results` segment. On mismatch,
  * reports the FIRST differing path (see VerifyBundleResult.mismatchPath).
  *
+ * Wrapped mode (a BundleDoc with `kind: "bundle"`, spec 3.2): additionally
+ * recomputes the OUTER integrity tag over `{ bundle, interchange }` and
+ * refuses on divergence BEFORE the inner check — a drifted interchange
+ * mirror fails verification with mismatchPath "$.integrity" and the
+ * expected/actual tags in `outerIntegrity`, even when the inner bundle is
+ * untouched. When the outer tag holds, the inner bundle is verified exactly
+ * as in unwrapped mode.
+ *
  * Throws ComplianceError("BAD_BUNDLE") when the payload is not a valid bundle
- * body, and propagates ComplianceError("UNSUPPORTED_VALUE") when
+ * body, and propagates ReservingError("UNSUPPORTED_VALUE") when
  * `rerunResults` itself is not canonicalizable — a result that cannot be
  * serialized cannot be verified.
  */
-export declare function verifyBundle(bundle: ReproducibilityBundle, rerunResults: unknown): VerifyBundleResult;
+export declare function verifyBundle(bundle: ReproducibilityBundle | WrappedBundleDoc, rerunResults: unknown): VerifyBundleResult;
 //# sourceMappingURL=bundle.d.ts.map

package/dist/bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;GAGG;AACH,eAAO,MAAM,sBAAsB,8EAKzB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,4HAA4H;AAC5H,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;gBACvB,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM;CAKvD;AA6DD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQ5C;AAED,MAAM,WAAW,iBAAiB;IAChC,gGAAgG;IAChG,MAAM,EAAE,OAAO,CAAC;IAChB,wFAAwF;IACxF,UAAU,EAAE,OAAO,CAAC;IACpB,qFAAqF;IACrF,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,gFAAgF;IAChF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,qBAAqB,CAW5E;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAyBD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,qBAAqB,EAAE,YAAY,EAAE,OAAO,GAAG,kBAAkB,CAerG"}
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EACV,SAAS,EACT,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,WAAW,EACZ,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AAElC;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAEzC;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,yDAIzB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,wGAAwG;AACxG,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;gBACvB,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM;CAKvD;AAID;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,UAAU,CAAC;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,UAAU,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,WAAW,EAAE,CAAC;IACzB,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,OAAO,EAAE,CAAC,eAAe,GAAG,mBAAmB,CAAC,EAAE,CAAC;CACpD;AAED,MAAM,WAAW,iBAAiB;IAChC,gGAAgG;IAChG,MAAM,EAAE,OAAO,CAAC;IAChB,wFAAwF;IACxF,UAAU,EAAE,OAAO,CAAC;IACpB,qFAAqF;IACrF,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,gFAAgF;IAChF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAED,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;CACd;AAED,4EAA4E;AAC5E,MAAM,WAAW,mBAAoB,SAAQ,qBAAqB;IAChE;;;;OAIG;IACH,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GAAG,mBAAmB,CAAC;AACxG,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,qBAAqB,CAAC;AAqC9E,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC;AAyFD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,qBAAqB,GAAG,gBAAgB,EAChD,YAAY,EAAE,OAAO,GACpB,kBAAkB,CAEpB"}

package/dist/bundle.js

@@ -3,43 +3,41 @@
  * hash, so an analysis can state "these results came from exactly these
  * inputs, parameters, and SDK versions" and a re-run can be byte-verified.
  *
- * Ground truth:
- * - `canonicalJson` is the package's single equality oracle: object keys are
- *   sorted recursively, arrays keep their order, numbers render via
- *   `String(n)` except -0 which normalizes to "0" (so 0 and -0 never differ),
- *   and anything JSON cannot faithfully represent (undefined, functions,
- *   NaN/Infinity, bigint, symbol, non-plain objects such as Date/Map/Set,
- *   circular references) THROWS with the offending path instead of being
- *   silently dropped or coerced the way JSON.stringify would.
- * - `fnv1a64` is an integrity aid, NOT a security control (see its doc block).
+ * `canonicalJson` and `fnv1a64` LIVE IN @actuarial-ts/core (src/canonical.ts)
+ * since 0.2.0 so the interchange layer can share them without a package
+ * cycle; this module re-exports both, unchanged. One deliberate behavior
+ * change rode along: invalid canonicalization input now throws core's
+ * ReservingError("UNSUPPORTED_VALUE") instead of ComplianceError - same
+ * code, same message shape, different class (CHANGELOG 0.2.0).
+ *
+ * Ground truth (unchanged):
  * - Timestamps are caller-supplied ISO strings; this module never reads a
  *   clock, so identical inputs yield byte-identical bundles.
- * - Browser-safe: no node builtins (TextEncoder is a web-standard global).
+ * - fnv1a64 is an integrity aid, NOT a security control (see its doc block
+ *   in core).
+ * - Browser-safe: no node builtins.
  *
  * Error style for the whole package: `ComplianceError` with a registered
- * machine code, mirroring core's `ReservingError` idiom. It lives here (not
- * in its own module) because bundle.ts is the package's dependency-root
- * module — ledger.ts already imports `canonicalJson` from it. Core's
- * `RESERVING_ERROR_CODES` registry is a closed contract enforced against
- * core's own source, and compliance failures (missing rationale, unsupported
- * bundle values) are not reserving-input errors, so this package does not
- * reuse `ReservingError`.
+ * machine code, mirroring core's `ReservingError` idiom (bundle.ts is the
+ * package's dependency-root module, so the class lives here).
  *
  * These utilities are designed to support the actuary's compliance with
  * ASOP No. 41 (documentation and reproducibility of the analysis);
  * responsibility for compliance remains with the credentialed actuary.
  */
+import { canonicalJson, fnv1a64 } from "@actuarial-ts/core";
+export { canonicalJson, fnv1a64 };
 /**
  * Every machine-readable code a ComplianceError can carry, across all modules
  * of this package. Add the code here when introducing a new throw.
+ * (UNSUPPORTED_VALUE moved to core's registry with canonicalJson in 0.2.0.)
  */
 export const COMPLIANCE_ERROR_CODES = [
     "BAD_BUNDLE",
     "BAD_CDF",
     "MISSING_RATIONALE",
-    "UNSUPPORTED_VALUE",
 ];
-/** Thrown for invalid compliance input (unrepresentable bundle payloads, judgment without rationale, non-positive CDFs). */
+/** Thrown for invalid compliance input (bad bundles, judgment without rationale, non-positive CDFs). */
 export class ComplianceError extends Error {
     code;
     constructor(code, message) {
@@ -48,103 +46,21 @@ export class ComplianceError extends Error {
         this.code = code;
     }
 }
-function isPlainObject(value) {
-    if (value === null || typeof value !== "object" || Array.isArray(value))
-        return false;
-    const proto = Object.getPrototypeOf(value);
-    return proto === Object.prototype || proto === null;
-}
-function canonicalize(value, path, seen) {
-    if (value === null)
-        return "null";
-    switch (typeof value) {
-        case "string":
-            return JSON.stringify(value);
-        case "boolean":
-            return value ? "true" : "false";
-        case "number": {
-            if (!Number.isFinite(value)) {
-                throw new ComplianceError("UNSUPPORTED_VALUE", `non-finite number (${String(value)}) at ${path}`);
-            }
-            return Object.is(value, -0) ? "0" : String(value);
-        }
-        case "undefined":
-            throw new ComplianceError("UNSUPPORTED_VALUE", `undefined at ${path}`);
-        case "function":
-            throw new ComplianceError("UNSUPPORTED_VALUE", `function at ${path}`);
-        case "bigint":
-        case "symbol":
-            throw new ComplianceError("UNSUPPORTED_VALUE", `${typeof value} at ${path}`);
-        case "object":
-            break;
-    }
-    const obj = value;
-    if (seen.has(obj)) {
-        throw new ComplianceError("UNSUPPORTED_VALUE", `circular reference at ${path}`);
-    }
-    seen.add(obj);
-    let out;
-    if (Array.isArray(obj)) {
-        const parts = [];
-        for (let i = 0; i < obj.length; i++) {
-            parts.push(canonicalize(obj[i], `${path}[${i}]`, seen));
-        }
-        out = `[${parts.join(",")}]`;
-    }
-    else if (isPlainObject(obj)) {
-        const keys = Object.keys(obj).sort();
-        const parts = [];
-        for (const key of keys) {
-            parts.push(`${JSON.stringify(key)}:${canonicalize(obj[key], `${path}.${key}`, seen)}`);
-        }
-        out = `{${parts.join(",")}}`;
-    }
-    else {
-        const name = obj.constructor?.name ?? "unknown";
-        throw new ComplianceError("UNSUPPORTED_VALUE", `non-plain object (${name}) at ${path}; only plain objects, arrays, and JSON primitives are canonicalizable`);
-    }
-    seen.delete(obj);
-    return out;
-}
-/**
- * Deterministic JSON serialization: sorted object keys (recursively), arrays
- * in order, no whitespace, -0 normalized to "0". Two structurally equal
- * values always produce the same string regardless of key insertion order.
- * Throws ComplianceError("UNSUPPORTED_VALUE") — with the offending path, e.g.
- * "$.rows[2].ultimate" — for any value JSON cannot faithfully represent.
- */
-export function canonicalJson(value) {
-    return canonicalize(value, "$", new Set());
-}
-const FNV_OFFSET_BASIS = 0xcbf29ce484222325n;
-const FNV_PRIME = 0x100000001b3n;
-const MASK_64 = 0xffffffffffffffffn;
 /**
- * FNV-1a 64-bit hash over the UTF-8 bytes of `text`, returned as a 16-hex-char
- * string.
- *
- * This is an INTEGRITY AID for detecting accidental divergence between a
- * bundle and a re-run. It is NOT a security control: FNV-1a is not collision
- * resistant and offers no protection against deliberate tampering. Anyone
- * needing tamper evidence must sign or cryptographically hash the payload
- * (which is exactly why the full canonical payload — not just the hash — is
- * stored on the bundle).
+ * The interchange version the wrapped form is written under. Kept in literal
+ * sync with `@actuarial-ts/interchange`'s INTERCHANGE_SPEC_VERSION (the dep
+ * is type-only, so the constant cannot be imported); the wrapped round-trip
+ * test parses the emitted doc with the real interchange parser, which
+ * refuses a wrong-major version — drift fails loudly.
  */
-export function fnv1a64(text) {
-    const bytes = new TextEncoder().encode(text);
-    let hash = FNV_OFFSET_BASIS;
-    for (const byte of bytes) {
-        hash ^= BigInt(byte);
-        hash = (hash * FNV_PRIME) & MASK_64;
-    }
-    return hash.toString(16).padStart(16, "0");
-}
+export const WRAPPED_BUNDLE_INTERCHANGE_VERSION = "1.0.0";
 /**
- * Packages an analysis run into a reproducibility bundle. The payload is
- * canonical, so two runs with structurally equal inputs produce byte-identical
- * payloads (and therefore identical hashes) regardless of key insertion order.
- * `seeds` is included only when provided (undefined would be unrepresentable).
+ * This package's version, stamped into a wrapped bundle's `generator`
+ * envelope field. A sync test asserts it matches package.json so it cannot
+ * silently drift (mirroring interchange's INTERCHANGE_PACKAGE_VERSION
+ * discipline).
  */
+export const COMPLIANCE_PACKAGE_VERSION = "0.3.0";
 export function createBundle(input) {
     const body = {
         createdAt: input.createdAt,
@@ -156,7 +72,36 @@ export function createBundle(input) {
     if (input.seeds !== undefined)
         body["seeds"] = input.seeds;
     const payload = canonicalJson(body);
-    return { payload, hash: fnv1a64(payload) };
+    const inner = { payload, hash: fnv1a64(payload) };
+    if (input.wrap === undefined)
+        return inner;
+    // The inner record is carried opaquely as the `bundle` segment; the outer
+    // tag is fnv1a64(canonicalJson({ bundle, interchange })) — exactly
+    // interchange's semanticBodyOf for kind "bundle" (spec 3.2).
+    const bundleSegment = { hash: inner.hash, payload: inner.payload };
+    const interchange = {
+        triangles: [...input.wrap.triangles],
+        selections: [...input.wrap.selections],
+        results: [...input.wrap.results],
+    };
+    const wrapped = {
+        interchangeVersion: WRAPPED_BUNDLE_INTERCHANGE_VERSION,
+        kind: "bundle",
+        generator: input.generator
+            ? { ...input.generator }
+            : { name: "@actuarial-ts/compliance", version: COMPLIANCE_PACKAGE_VERSION },
+        createdAt: input.createdAt,
+        bundle: bundleSegment,
+        interchange,
+        integrity: fnv1a64(canonicalJson({ bundle: bundleSegment, interchange })),
+    };
+    return { ...inner, wrapped };
+}
+function isPlainObject(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
 }
 /** First differing path between two canonicalizable structures, or null when equal. */
 function firstDifference(stored, rerun, path) {
@@ -183,17 +128,16 @@ function firstDifference(stored, rerun, path) {
     }
     return canonicalJson(stored) === canonicalJson(rerun) ? null : path;
 }
-/**
- * Verifies a re-run against a bundle: canonicalizes `rerunResults` and
- * byte-compares it with the bundle's stored `results` segment. On mismatch,
- * reports the FIRST differing path (see VerifyBundleResult.mismatchPath).
- *
- * Throws ComplianceError("BAD_BUNDLE") when the payload is not a valid bundle
- * body, and propagates ComplianceError("UNSUPPORTED_VALUE") when
- * `rerunResults` itself is not canonicalizable — a result that cannot be
- * serialized cannot be verified.
- */
-export function verifyBundle(bundle, rerunResults) {
+/** Inner verification — the pre-wrapped behavior, unchanged byte for byte. */
+function verifyUnwrapped(bundle, rerunResults) {
+    // The bundle's own hash first. Without this, the attestation ("these results
+    // came from exactly these inputs, parameters, and SDK versions") checked the
+    // results segment only — a bundle with rewritten inputs and hash "deadbeef"
+    // verified. The wrapped path always recomputed its tag; the unwrapped one
+    // must too.
+    if (fnv1a64(bundle.payload) !== bundle.hash) {
+        return { reproduced: false, mismatchPath: "$.hash" };
+    }
     let stored;
     try {
         stored = JSON.parse(bundle.payload);
@@ -211,4 +155,50 @@ export function verifyBundle(bundle, rerunResults) {
         return { reproduced: true };
     return { reproduced: false, mismatchPath: firstDifference(storedResults, rerunResults, "$") ?? "$" };
 }
+function isWrappedBundleDoc(value) {
+    return value.kind === "bundle";
+}
+/** Wrapped mode: the outer tag (spec 3.2) AND the inner bundle exactly as today. */
+function verifyWrapped(doc, rerunResults) {
+    const innerRaw = doc.bundle;
+    if (!isPlainObject(innerRaw) ||
+        typeof innerRaw["payload"] !== "string" ||
+        typeof innerRaw["hash"] !== "string") {
+        throw new ComplianceError("BAD_BUNDLE", 'wrapped bundle\'s "bundle" segment must carry the inner { payload, hash } record');
+    }
+    if (doc.interchange === undefined || doc.interchange === null) {
+        throw new ComplianceError("BAD_BUNDLE", 'wrapped bundle is missing its "interchange" mirror');
+    }
+    // OUTER tag over the two-field semantic body { bundle, interchange } —
+    // exactly interchange's semanticBodyOf for kind "bundle" (spec 3.2).
+    const expected = fnv1a64(canonicalJson({ bundle: doc.bundle, interchange: doc.interchange }));
+    const actual = typeof doc.integrity === "string" ? doc.integrity : null;
+    const outerIntegrity = { ok: expected === actual, expected, actual };
+    if (!outerIntegrity.ok) {
+        return { reproduced: false, mismatchPath: "$.integrity", outerIntegrity };
+    }
+    const inner = { payload: innerRaw["payload"], hash: innerRaw["hash"] };
+    return { ...verifyUnwrapped(inner, rerunResults), outerIntegrity };
+}
+/**
+ * Verifies a re-run against a bundle: canonicalizes `rerunResults` and
+ * byte-compares it with the bundle's stored `results` segment. On mismatch,
+ * reports the FIRST differing path (see VerifyBundleResult.mismatchPath).
+ *
+ * Wrapped mode (a BundleDoc with `kind: "bundle"`, spec 3.2): additionally
+ * recomputes the OUTER integrity tag over `{ bundle, interchange }` and
+ * refuses on divergence BEFORE the inner check — a drifted interchange
+ * mirror fails verification with mismatchPath "$.integrity" and the
+ * expected/actual tags in `outerIntegrity`, even when the inner bundle is
+ * untouched. When the outer tag holds, the inner bundle is verified exactly
+ * as in unwrapped mode.
+ *
+ * Throws ComplianceError("BAD_BUNDLE") when the payload is not a valid bundle
+ * body, and propagates ReservingError("UNSUPPORTED_VALUE") when
+ * `rerunResults` itself is not canonicalizable — a result that cannot be
+ * serialized cannot be verified.
+ */
+export function verifyBundle(bundle, rerunResults) {
+    return isWrappedBundleDoc(bundle) ? verifyWrapped(bundle, rerunResults) : verifyUnwrapped(bundle, rerunResults);
+}
 //# sourceMappingURL=bundle.js.map

package/dist/bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,YAAY;IACZ,SAAS;IACT,mBAAmB;IACnB,mBAAmB;CACX,CAAC;AAIX,4HAA4H;AAC5H,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,CAAsB;IACnC,YAAY,IAAyB,EAAE,OAAe;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,KAAK,GAAY,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AACtD,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY,EAAE,IAAiB;IACnE,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAClC,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,sBAAsB,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,OAAO,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;QACD,KAAK,WAAW;YACd,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACzE,KAAK,UAAU;YACb,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;QACxE,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,GAAG,OAAO,KAAK,OAAO,IAAI,EAAE,CAAC,CAAC;QAC/E,KAAK,QAAQ;YACX,MAAM;IACV,CAAC;IACD,MAAM,GAAG,GAAG,KAAe,CAAC;IAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,yBAAyB,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,IAAI,GAAW,CAAC;IAChB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC/B,CAAC;SAAM,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAI,GAAG,CAAC,WAA6C,EAAE,IAAI,IAAI,SAAS,CAAC;QACnF,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,qBAAqB,IAAI,QAAQ,IAAI,uEAAuE,CAC7G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,SAAS,GAAG,cAAc,CAAC;AACjC,MAAM,OAAO,GAAG,mBAAmB,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,GAAG,gBAAgB,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAwBD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAwB;IACnD,MAAM,IAAI,GAA4B;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC;IACF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IAC3D,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;AAC7C,CAAC;AAcD,uFAAuF;AACvF,SAAS,eAAe,CAAC,MAAe,EAAE,KAAc,EAAE,IAAY;IACpE,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;YACxD,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;YAC/D,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;YACnE,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;QACjC,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,MAAM,GAAG,CAAC;IACtE,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,MAA6B,EAAE,YAAqB;IAC/E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,yCAAyC,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,cAAc,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,eAAe,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IACrD,IAAI,cAAc,KAAK,eAAe;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACpE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,eAAe,CAAC,aAAa,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;AACvG,CAAC"}
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAS5D,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AAclC;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,YAAY;IACZ,SAAS;IACT,mBAAmB;CACX,CAAC;AAIX,wGAAwG;AACxG,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,CAAsB;IACnC,YAAY,IAAyB,EAAE,OAAe;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAID;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,OAAO,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,OAAO,CAAC;AA8ElD,MAAM,UAAU,YAAY,CAAC,KAAwB;IACnD,MAAM,IAAI,GAA4B;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC;IACF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IAC3D,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAA0B,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IACzE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAE3C,0EAA0E;IAC1E,mEAAmE;IACnE,6DAA6D;IAC7D,MAAM,aAAa,GAA4B,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC5F,MAAM,WAAW,GAAG;QAClB,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;QACpC,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;QACtC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;KACjC,CAAC;IACF,MAAM,OAAO,GAAqB;QAChC,kBAAkB,EAAE,kCAAkC;QACtD,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK,CAAC,SAAS;YACxB,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE;YACxB,CAAC,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,0BAA0B,EAAE;QAC7E,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,aAAa;QACrB,WAAW;QACX,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;KAC1E,CAAC;IACF,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AA2BD,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,KAAK,GAAY,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AACtD,CAAC;AAED,uFAAuF;AACvF,SAAS,eAAe,CAAC,MAAe,EAAE,KAAc,EAAE,IAAY;IACpE,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;YACxD,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;YAC/D,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;YACnE,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;QACjC,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,MAAM,GAAG,CAAC;IACtE,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,8EAA8E;AAC9E,SAAS,eAAe,CAAC,MAA6B,EAAE,YAAqB;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,YAAY;IACZ,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,yCAAyC,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,cAAc,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,eAAe,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IACrD,IAAI,cAAc,KAAK,eAAe;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACpE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,eAAe,CAAC,aAAa,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;AACvG,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA+C;IACzE,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,CAAC;AACzD,CAAC;AAED,oFAAoF;AACpF,SAAS,aAAa,CAAC,GAAqB,EAAE,YAAqB;IACjE,MAAM,QAAQ,GAAY,GAAG,CAAC,MAAM,CAAC;IACrC,IACE,CAAC,aAAa,CAAC,QAAQ,CAAC;QACxB,OAAO,QAAQ,CAAC,SAAS,CAAC,KAAK,QAAQ;QACvC,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,QAAQ,EACpC,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,YAAY,EACZ,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC9D,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,oDAAoD,CAAC,CAAC;IAChG,CAAC;IACD,uEAAuE;IACvE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,cAAc,GAAwB,EAAE,EAAE,EAAE,QAAQ,KAAK,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC1F,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;QACvB,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAA0B,EAAE,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IAC9F,OAAO,EAAE,GAAG,eAAe,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAgD,EAChD,YAAqB;IAErB,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAClH,CAAC"}

package/dist/disclosure.d.ts

@@ -1,3 +1,4 @@
+import type { CrosscheckReportDoc } from "@actuarial-ts/interchange";
 import type { EstimateMetadata } from "./metadata.js";
 import type { AssumptionLedger, ChangedAssumptions } from "./ledger.js";
 import { type MethodId } from "./modelCards.js";
@@ -67,6 +68,13 @@ export interface DisclosureInput {
     priorComparison?: PriorComparison;
     reliances?: string[];
     limitations?: string[];
+    /**
+     * Cross-implementation referee reports (interchange spec 5), rendered as
+     * "## 4b. Cross-implementation verification" after Section 4. Omitted or
+     * empty = no Section 4b (the disclosure never claims a verification that
+     * was not performed).
+     */
+    crossImplementation?: CrosscheckReportDoc[];
     sdkVersion: string;
     /** Caller-supplied ISO timestamp (determinism: the generator never reads a clock). */
     generatedAt: string;

package/dist/disclosure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"disclosure.d.ts","sourceRoot":"","sources":["../src/disclosure.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAG7D;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,QAAQ,CAAC;IACnB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IACjF,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;CACrB;AAkDD,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CA+KjE"}
+{"version":3,"file":"disclosure.d.ts","sourceRoot":"","sources":["../src/disclosure.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAG7D;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,QAAQ,CAAC;IACnB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IACjF,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;CACrB;AA8GD,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CA0OjE"}