@actuarial-ts/compliance 0.6.1 → 0.7.1

package/README.md

@@ -3,14 +3,14 @@
 Documentation, judgment, provenance, and reproducibility primitives for actuarial-ts. The package is designed to support compliance work under applicable ASOPs; it neither determines compliance nor replaces the actuary’s review.
 
 ```bash
-npm install @actuarial-ts/compliance@0.6.1 @actuarial-ts/core@0.6.1 @actuarial-ts/data@0.6.1 @actuarial-ts/interchange@0.6.1
+npm install @actuarial-ts/compliance@0.7.1 @actuarial-ts/core@0.7.1 @actuarial-ts/data@0.7.1 @actuarial-ts/interchange@0.7.1
 ```
 
 Node 20+, ESM.
 
 ## Diagnostic provenance
 
-`createDiagnosticRunIdentity` accepts only an owner-authenticated, completed data-package run. It does not accept caller-restated formulas, filters, review status, or result identities.
+The example below uses eager provenance. `createDiagnosticRunIdentity` accepts only an owner-authenticated, completed eager data-package run. It does not accept caller-restated formulas, filters, review status, or result identities. Compact runs use the separate workflow below.
 
 ```ts
 import { createBundle, createDiagnosticRunIdentity } from "@actuarial-ts/compliance";
@@ -59,7 +59,48 @@ Material host judgments worth recording in the assumption ledger include amount
 
 The package also provides estimate metadata, assumption ledgers, ASOP No. 41 draft disclosure generation, ASOP No. 56 model cards, actual-versus-expected roll-forward, and canonical reproducibility bundles.
 
-See the [formula catalog](https://github.com/yerromnitsuj/actng/blob/v0.6.1/docs/reference/diagnostic-formulas.md) and [migration guide](https://github.com/yerromnitsuj/actng/blob/v0.6.1/docs/migrations/0.6-generalized-diagnostics.md).
+See the [formula catalog](https://github.com/yerromnitsuj/actng/blob/v0.7.1/docs/reference/diagnostic-formulas.md) and [migration guide](https://github.com/yerromnitsuj/actng/blob/v0.7.1/docs/migrations/0.6-generalized-diagnostics.md).
+
+## Compact provenance and replay streams
+
+Introduced in 0.7.0, this separate path retains complete audit evidence without
+requiring expanded manifest/result objects or one archive-sized identity string.
+It does not certify dataset capacity or total application memory use. Existing
+eager provenance and interchange `BundleDoc` APIs remain available.
+
+| Step | Public API and host responsibility |
+|---|---|
+| Produce a genuine completed run | Use the compact validated gateway in `@actuarial-ts/data`; handle both review and metric blocks. |
+| Hash actual artifact bytes | `digestDiagnosticArtifactChunks` returns an authenticated computed digest. Keep a repeatable byte source; hashes without retained original bytes must remain caller-declared. |
+| Bind run and artifact evidence | `createCompactDiagnosticRunIdentity` accepts the completed compact run, genuine computed receipts or explicitly declared evidence, and complete preparation lineage. |
+| Write complete replay evidence | Consume `writeDiagnosticReplayStream` into a temporary host destination and publish it only after successful completion. `openArtifact` must reopen the bytes matching each computed digest. |
+| Independently verify | `verifyDiagnosticReplayStream` requires explicit host resource limits, reruns the recorded input, and compares complete canonical evidence before issuing a receipt. Success requires the trailer and EOF. |
+
+The host owns file/network I/O, pending-I/O cancellation, retention, and access
+control. Supply the same abort signal to host I/O and the SDK. Cancellation is
+cooperative between chunks/phases, not interruption of synchronous calculation.
+Use summaries/pages for routine views; materializing all findings or identity
+documents afterward can erase the representation's memory benefit.
+
+`VerifiedCompactDiagnosticRunProvenance` is a distinct owner-authenticated
+object, not an eager `VerifiedDiagnosticRunProvenance` or a serializable
+authorization token. It cannot be cast into `createBundle`, the eager verifier,
+or the current diagnostic agent executor. The stream format is
+`diagnostic-replay/1`, separate from interchange wire `1.1.0`; it is not a
+single JSON document or a `BundleDoc`.
+
+Replay identities include the producing SDK's engine versions. Preserve those
+exact package versions with stored evidence and use a matching runtime for
+verification. Stream version 1 does not guarantee cross-SDK-version replay;
+in particular, a patch upgrade must not be assumed to verify an older stream.
+Successful replay establishes internal reproducibility, not source authenticity,
+a digital signature, correct claim-level capping, or actuarial correctness.
+
+The runnable [compact adoption guide](https://github.com/yerromnitsuj/actng/blob/v0.7.1/docs/migrations/0.7-compact-diagnostics.md)
+and complete [replay reference](https://github.com/yerromnitsuj/actng/blob/v0.7.1/docs/reference/diagnostic-replay-stream.md)
+document ownership, artifact bytes, paging, framing, resource limits, and
+assurance boundaries. These repository guides are linked here for npm users;
+the guide files themselves are not shipped inside the package.
 
 ## License
 

package/dist/diagnosticArtifactStream.d.ts

@@ -0,0 +1,30 @@
+import type { DiagnosticArtifactDigest } from "./diagnosticRun.js";
+export interface DiagnosticArtifactStreamMetadata {
+    readonly id: string;
+    readonly scope: "input" | "preparation";
+    /** Optional completeness check; no digest handle is issued on truncation. */
+    readonly expectedByteLength?: number;
+    /** Caller-selected resource ceiling, at most Number.MAX_SAFE_INTEGER. */
+    readonly maximumByteLength?: number;
+}
+declare const computedArtifactDigestBrand: unique symbol;
+export type ComputedDiagnosticArtifactDigest = Extract<DiagnosticArtifactDigest, {
+    assurance: "sdk-computed";
+}> & {
+    readonly [computedArtifactDigestBrand]: true;
+};
+/**
+ * Hash the bytes actually received, retaining only a bounded chunk copy.
+ * The producer owns I/O. A completed handle means SDK-computed content digest,
+ * not source authenticity, a signature, or validation of an actuarial run.
+ * Shared buffers are refused; bytes are consumed before requesting the next
+ * chunk. A changing producer must be checked again against this digest on replay.
+ * Cancellation is cooperative between received chunks; the producer should use
+ * the same signal to cancel pending I/O. One synchronous chunk is not interrupted.
+ */
+export declare function digestDiagnosticArtifactChunks(metadata: DiagnosticArtifactStreamMetadata, chunks: AsyncIterable<Uint8Array> | Iterable<Uint8Array>, options?: {
+    readonly signal?: AbortSignal;
+}): Promise<ComputedDiagnosticArtifactDigest>;
+export declare function assertComputedDiagnosticArtifactDigest(value: unknown): asserts value is ComputedDiagnosticArtifactDigest;
+export {};
+//# sourceMappingURL=diagnosticArtifactStream.d.ts.map

package/dist/diagnosticArtifactStream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnosticArtifactStream.d.ts","sourceRoot":"","sources":["../src/diagnosticArtifactStream.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAKnE,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAAC;IACxC,6EAA6E;IAC7E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,yEAAyE;IACzE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AACD,OAAO,CAAC,MAAM,2BAA2B,EAAE,OAAO,MAAM,CAAC;AACzD,MAAM,MAAM,gCAAgC,GAAG,OAAO,CACpD,wBAAwB,EACxB;IAAE,SAAS,EAAE,cAAc,CAAA;CAAE,CAC9B,GAAG;IAAE,QAAQ,CAAC,CAAC,2BAA2B,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAiErD;;;;;;;;GAQG;AACH,wBAAsB,8BAA8B,CAClD,QAAQ,EAAE,gCAAgC,EAC1C,MAAM,EAAE,aAAa,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,EACxD,OAAO,GAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GAC9C,OAAO,CAAC,gCAAgC,CAAC,CAuC3C;AAED,wBAAgB,sCAAsC,CACpD,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,KAAK,IAAI,gCAAgC,CAGnD"}

package/dist/diagnosticArtifactStream.js

@@ -0,0 +1,128 @@
+import { diagnosticJsonPreflight, isDiagnosticPlainRecord, isDiagnosticToken, } from "@actuarial-ts/core";
+import { ComplianceError } from "./errors.js";
+import { createSha256 } from "./sha256Stream.js";
+import { diagnosticByteView } from "./diagnosticByteView.js";
+import { consumeDiagnosticByteSource } from "./diagnosticByteSource.js";
+const computed = new WeakSet();
+const signalAborted = Object.getOwnPropertyDescriptor(AbortSignal.prototype, "aborted").get;
+const throwIfAborted = AbortSignal.prototype.throwIfAborted;
+const COPY_SIZE = 65_536;
+function invalid(message, path = "$") {
+    throw new ComplianceError("BAD_DIAGNOSTIC_RUN", message, path);
+}
+function ownedMetadata(value) {
+    // Read descriptors once. A Proxy must not pass validation with one property
+    // value and supply a different value when the final digest is assembled.
+    if (!isDiagnosticPlainRecord(value))
+        invalid("Artifact metadata must be a plain object");
+    const snapshot = Object.create(null);
+    for (const key of Reflect.ownKeys(value)) {
+        if (typeof key !== "string")
+            invalid("Artifact metadata cannot have symbol keys");
+        const field = Object.getOwnPropertyDescriptor(value, key);
+        if (!field || !("value" in field) || !field.enumerable)
+            invalid("Artifact metadata must contain enumerable data properties", `$.${key}`);
+        snapshot[key] = field.value;
+    }
+    value = snapshot;
+    const issues = diagnosticJsonPreflight(value, "input");
+    if (issues.length)
+        invalid(issues[0].message, issues[0].path);
+    if (!isDiagnosticPlainRecord(value))
+        invalid("Artifact metadata must be a plain object");
+    for (const key of Object.keys(value))
+        if (!["id", "scope", "expectedByteLength", "maximumByteLength"].includes(key))
+            invalid("Unknown artifact metadata key", `$.${key}`);
+    if (!isDiagnosticToken(value.id))
+        invalid("Artifact ID must be a valid token", "$.id");
+    if (value.scope !== "input" && value.scope !== "preparation")
+        invalid("Artifact scope must be input or preparation", "$.scope");
+    for (const key of ["expectedByteLength", "maximumByteLength"])
+        if (value[key] !== undefined && (!Number.isSafeInteger(value[key]) || value[key] < 0))
+            invalid("Byte length must be a nonnegative safe integer", `$.${key}`);
+    const maximumByteLength = value.maximumByteLength ?? Number.MAX_SAFE_INTEGER;
+    if (value.expectedByteLength !== undefined && value.expectedByteLength > maximumByteLength)
+        invalid("Expected byte length exceeds the resource ceiling", "$.expectedByteLength");
+    return {
+        id: value.id,
+        scope: value.scope,
+        expectedByteLength: value.expectedByteLength,
+        maximumByteLength,
+    };
+}
+function cancellation(options) {
+    if (!isDiagnosticPlainRecord(options))
+        invalid("Artifact stream options must be a plain object");
+    for (const key of Reflect.ownKeys(options))
+        if (key !== "signal")
+            invalid("Unknown artifact stream option");
+    const field = Object.getOwnPropertyDescriptor(options, "signal");
+    if (field && (!("value" in field) || !field.enumerable))
+        invalid("Artifact signal must be supplied as a data property");
+    const signal = field?.value;
+    if (signal === undefined)
+        return () => { };
+    try {
+        signalAborted.call(signal);
+    }
+    catch {
+        invalid("Artifact signal must be an AbortSignal");
+    }
+    // Capture the genuine signal and intrinsic method before any producer await.
+    return () => throwIfAborted.call(signal);
+}
+/**
+ * Hash the bytes actually received, retaining only a bounded chunk copy.
+ * The producer owns I/O. A completed handle means SDK-computed content digest,
+ * not source authenticity, a signature, or validation of an actuarial run.
+ * Shared buffers are refused; bytes are consumed before requesting the next
+ * chunk. A changing producer must be checked again against this digest on replay.
+ * Cancellation is cooperative between received chunks; the producer should use
+ * the same signal to cancel pending I/O. One synchronous chunk is not interrupted.
+ */
+export async function digestDiagnosticArtifactChunks(metadata, chunks, options = {}) {
+    const owned = ownedMetadata(metadata);
+    const checkCancellation = cancellation(options);
+    checkCancellation();
+    const hash = createSha256();
+    const copy = new Uint8Array(COPY_SIZE);
+    let byteLength = 0;
+    try {
+        for await (const chunk of consumeDiagnosticByteSource(chunks, checkCancellation)) {
+            checkCancellation();
+            const view = diagnosticByteView(chunk);
+            const size = view.byteLength;
+            if (!Number.isSafeInteger(byteLength + size) || byteLength + size > owned.maximumByteLength)
+                invalid("Artifact byte length exceeds the resource ceiling", "$.chunks");
+            if (owned.expectedByteLength !== undefined && byteLength + size > owned.expectedByteLength)
+                invalid("Artifact has more bytes than declared", "$.chunks");
+            for (let start = 0; start < size; start += COPY_SIZE) {
+                const length = Math.min(COPY_SIZE, size - start);
+                copy.set(new Uint8Array(view.buffer, view.byteOffset + start, length));
+                hash.update(copy.subarray(0, length));
+            }
+            byteLength += size;
+        }
+        checkCancellation();
+        if (owned.expectedByteLength !== undefined && byteLength !== owned.expectedByteLength)
+            invalid("Artifact ended before its declared byte length", "$.chunks");
+        const digest = Object.freeze({
+            id: owned.id,
+            scope: owned.scope,
+            assurance: "sdk-computed",
+            algorithm: "sha256",
+            value: hash.digest(),
+            byteLength,
+        });
+        computed.add(digest);
+        return digest;
+    }
+    finally {
+        copy.fill(0);
+    }
+}
+export function assertComputedDiagnosticArtifactDigest(value) {
+    if (value === null || typeof value !== "object" || !computed.has(value))
+        invalid("Value is not an authentic SDK-computed streamed artifact digest");
+}
+//# sourceMappingURL=diagnosticArtifactStream.js.map

package/dist/diagnosticArtifactStream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnosticArtifactStream.js","sourceRoot":"","sources":["../src/diagnosticArtifactStream.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAgBxE,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAU,CAAC;AACvC,MAAM,aAAa,GAAG,MAAM,CAAC,wBAAwB,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,CAAE,CAAC,GAAI,CAAC;AAC9F,MAAM,cAAc,GAAG,WAAW,CAAC,SAAS,CAAC,cAAc,CAAC;AAC5D,MAAM,SAAS,GAAG,MAAM,CAAC;AAEzB,SAAS,OAAO,CAAC,OAAe,EAAE,IAAI,GAAG,GAAG;IAC1C,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,aAAa,CAAC,KAAuC;IAC5D,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,0CAA0C,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA4B,CAAC;IAChE,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,CAAC,2CAA2C,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU;YACpD,OAAO,CAAC,2DAA2D,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;QACnF,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IAC9B,CAAC;IACD,KAAK,GAAG,QAAuD,CAAC;IAChE,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,0CAA0C,CAAC,CAAC;IACzF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC3E,OAAO,CAAC,+BAA+B,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,OAAO,CAAC,mCAAmC,EAAE,MAAM,CAAC,CAAC;IACvF,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK,KAAK,aAAa;QAC1D,OAAO,CAAC,6CAA6C,EAAE,SAAS,CAAC,CAAC;IACpE,KAAK,MAAM,GAAG,IAAI,CAAC,oBAAoB,EAAE,mBAAmB,CAAU;QACpE,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAE,GAAG,CAAC,CAAC;YACpF,OAAO,CAAC,gDAAgD,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,IAAI,MAAM,CAAC,gBAAgB,CAAC;IAC7E,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,IAAI,KAAK,CAAC,kBAAkB,GAAG,iBAAiB;QACxF,OAAO,CAAC,mDAAmD,EAAE,sBAAsB,CAAC,CAAC;IACvF,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAA0C;IAC9D,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,gDAAgD,CAAC,CAAC;IACjG,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;QACxC,IAAI,GAAG,KAAK,QAAQ;YAAE,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QACrD,OAAO,CAAC,qDAAqD,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,KAAK,EAAE,KAAK,CAAC;IAC5B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,wCAAwC,CAAC,CAAC;IACpD,CAAC;IACD,6EAA6E;IAC7E,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,QAA0C,EAC1C,MAAwD,EACxD,UAA6C,EAAE;IAE/C,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,iBAAiB,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAChD,iBAAiB,EAAE,CAAC;IACpB,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,2BAA2B,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;YACjF,iBAAiB,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,UAAU,GAAG,IAAI,GAAG,KAAK,CAAC,iBAAiB;gBACzF,OAAO,CAAC,mDAAmD,EAAE,UAAU,CAAC,CAAC;YAC3E,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,IAAI,UAAU,GAAG,IAAI,GAAG,KAAK,CAAC,kBAAkB;gBACxF,OAAO,CAAC,uCAAuC,EAAE,UAAU,CAAC,CAAC;YAC/D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,SAAS,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,GAAG,KAAK,CAAC,CAAC;gBACjD,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;gBACvE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACxC,CAAC;YACD,UAAU,IAAI,IAAI,CAAC;QACrB,CAAC;QACD,iBAAiB,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,IAAI,UAAU,KAAK,KAAK,CAAC,kBAAkB;YACnF,OAAO,CAAC,gDAAgD,EAAE,UAAU,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC3B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,cAAuB;YAClC,SAAS,EAAE,QAAiB;YAC5B,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;YACpB,UAAU;SACX,CAAqC,CAAC;QACvC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,KAAc;IAEd,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;QACrE,OAAO,CAAC,iEAAiE,CAAC,CAAC;AAC/E,CAAC"}

package/dist/diagnosticByteSource.d.ts

@@ -0,0 +1,10 @@
+type DiagnosticByteSource = Iterable<Uint8Array> | AsyncIterable<Uint8Array>;
+/**
+ * Own one producer iterator through completion, cancellation or read failure.
+ * Unlike a bare for-await loop, a rejected next() also closes the producer.
+ * A cleanup failure never replaces the error that caused cleanup. Hosts should
+ * pass the same cancellation signal to pending I/O; checks cannot interrupt it.
+ */
+export declare function consumeDiagnosticByteSource(source: DiagnosticByteSource, checkCancellation?: () => void): AsyncGenerator<Uint8Array>;
+export {};
+//# sourceMappingURL=diagnosticByteSource.d.ts.map

package/dist/diagnosticByteSource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnosticByteSource.d.ts","sourceRoot":"","sources":["../src/diagnosticByteSource.ts"],"names":[],"mappings":"AAAA,KAAK,oBAAoB,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;AAQ7E;;;;;GAKG;AACH,wBAAuB,2BAA2B,CAChD,MAAM,EAAE,oBAAoB,EAC5B,iBAAiB,GAAE,MAAM,IAAe,GACvC,cAAc,CAAC,UAAU,CAAC,CAgE5B"}

package/dist/diagnosticByteSource.js

@@ -0,0 +1,70 @@
+function isObject(value) {
+    return (value !== null && (typeof value === "object" || typeof value === "function"));
+}
+/**
+ * Own one producer iterator through completion, cancellation or read failure.
+ * Unlike a bare for-await loop, a rejected next() also closes the producer.
+ * A cleanup failure never replaces the error that caused cleanup. Hosts should
+ * pass the same cancellation signal to pending I/O; checks cannot interrupt it.
+ */
+export async function* consumeDiagnosticByteSource(source, checkCancellation = () => { }) {
+    if (!isObject(source))
+        throw new TypeError("Diagnostic byte source must be iterable");
+    const iterable = source;
+    const asynchronous = iterable[Symbol.asyncIterator];
+    const method = asynchronous ?? iterable[Symbol.iterator];
+    if (typeof method !== "function")
+        throw new TypeError("Diagnostic byte source must provide an iterator method");
+    const iterator = Reflect.apply(method, source, []);
+    if (!isObject(iterator))
+        throw new TypeError("Diagnostic byte iterator must be an object");
+    const protocol = iterator;
+    let completed = false;
+    let failed = false;
+    try {
+        // Capture next once, as the iterator protocol does; never use a producer's
+        // potentially overwritten Function.call property.
+        const next = protocol.next;
+        if (typeof next !== "function")
+            throw new TypeError("Diagnostic byte iterator must provide next()");
+        for (;;) {
+            checkCancellation();
+            const result = await Reflect.apply(next, iterator, []);
+            if (!isObject(result))
+                throw new TypeError("Diagnostic byte read must return an iterator result");
+            const item = result;
+            completed = Boolean(item.done);
+            checkCancellation();
+            if (completed)
+                return;
+            // An async generator also observes a rejected value from a synchronous
+            // iterator here, so that failure follows the same cleanup path.
+            yield item.value;
+        }
+    }
+    catch (error) {
+        failed = true;
+        throw error;
+    }
+    finally {
+        if (!completed) {
+            try {
+                // Read return only when closing, once, following normal iterator
+                // semantics. The generator's finally executes at most once.
+                const close = protocol.return;
+                if (close !== undefined && close !== null) {
+                    if (typeof close !== "function")
+                        throw new TypeError("Diagnostic byte iterator return must be a function");
+                    const result = await Reflect.apply(close, iterator, []);
+                    if (!isObject(result))
+                        throw new TypeError("Diagnostic byte iterator return must return an iterator result");
+                }
+            }
+            catch (cleanupError) {
+                if (!failed)
+                    throw cleanupError;
+            }
+        }
+    }
+}
+//# sourceMappingURL=diagnosticByteSource.js.map

package/dist/diagnosticByteSource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnosticByteSource.js","sourceRoot":"","sources":["../src/diagnosticByteSource.ts"],"names":[],"mappings":"AAEA,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,CACL,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,UAAU,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,2BAA2B,CAChD,MAA4B,EAC5B,oBAAgC,GAAG,EAAE,GAAE,CAAC;IAExC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnB,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,MAEhB,CAAC;IACF,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,OAAO,MAAM,KAAK,UAAU;QAC9B,MAAM,IAAI,SAAS,CACjB,wDAAwD,CACzD,CAAC;IACJ,MAAM,QAAQ,GAAY,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACrB,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,QAAgD,CAAC;IAClE,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,2EAA2E;QAC3E,kDAAkD;QAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC3B,IAAI,OAAO,IAAI,KAAK,UAAU;YAC5B,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;QACtE,SAAS,CAAC;YACR,iBAAiB,EAAE,CAAC;YACpB,MAAM,MAAM,GAAY,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACnB,MAAM,IAAI,SAAS,CACjB,qDAAqD,CACtD,CAAC;YACJ,MAAM,IAAI,GAAG,MAAoC,CAAC;YAClD,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,iBAAiB,EAAE,CAAC;YACpB,IAAI,SAAS;gBAAE,OAAO;YACtB,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,IAAI,CAAC,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,iEAAiE;gBACjE,4DAA4D;gBAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC;gBAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBAC1C,IAAI,OAAO,KAAK,KAAK,UAAU;wBAC7B,MAAM,IAAI,SAAS,CACjB,oDAAoD,CACrD,CAAC;oBACJ,MAAM,MAAM,GAAY,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;oBACjE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;wBACnB,MAAM,IAAI,SAAS,CACjB,gEAAgE,CACjE,CAAC;gBACN,CAAC;YACH,CAAC;YAAC,OAAO,YAAY,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM;oBAAE,MAAM,YAAY,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/diagnosticByteView.d.ts

@@ -0,0 +1,3 @@
+/** Borrow a synchronous intrinsic-only view; callers copy before yielding. */
+export declare function diagnosticByteView(chunk: unknown): Uint8Array<ArrayBuffer>;
+//# sourceMappingURL=diagnosticByteView.d.ts.map

package/dist/diagnosticByteView.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnosticByteView.d.ts","sourceRoot":"","sources":["../src/diagnosticByteView.ts"],"names":[],"mappings":"AAUA,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,CAe1E"}

package/dist/diagnosticByteView.js

@@ -0,0 +1,27 @@
+import { ComplianceError } from "./errors.js";
+const typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype);
+const byteLength = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteLength").get;
+const byteOffset = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteOffset").get;
+const bufferOf = Object.getOwnPropertyDescriptor(typedArrayPrototype, "buffer").get;
+const arrayBufferLength = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "byteLength")
+    .get;
+const resizable = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "resizable")?.get;
+/** Borrow a synchronous intrinsic-only view; callers copy before yielding. */
+export function diagnosticByteView(chunk) {
+    const fail = (message) => {
+        throw new ComplianceError("BAD_DIAGNOSTIC_RUN", message, "$.chunks");
+    };
+    if (!(chunk instanceof Uint8Array) || !ArrayBuffer.isView(chunk))
+        fail("Artifact chunks must be Uint8Array values");
+    const buffer = bufferOf.call(chunk);
+    try {
+        arrayBufferLength.call(buffer);
+    }
+    catch {
+        fail("Shared artifact buffers cannot provide a stable byte snapshot");
+    }
+    if (resizable?.call(buffer))
+        fail("Resizable artifact buffers cannot provide a stable byte snapshot");
+    return new Uint8Array(buffer, byteOffset.call(chunk), byteLength.call(chunk));
+}
+//# sourceMappingURL=diagnosticByteView.js.map

package/dist/diagnosticByteView.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnosticByteView.js","sourceRoot":"","sources":["../src/diagnosticByteView.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,mBAAmB,GAAG,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AACxE,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,mBAAmB,EAAE,YAAY,CAAE,CAAC,GAAI,CAAC;AAC5F,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,mBAAmB,EAAE,YAAY,CAAE,CAAC,GAAI,CAAC;AAC5F,MAAM,QAAQ,GAAG,MAAM,CAAC,wBAAwB,CAAC,mBAAmB,EAAE,QAAQ,CAAE,CAAC,GAAI,CAAC;AACtF,MAAM,iBAAiB,GAAG,MAAM,CAAC,wBAAwB,CAAC,WAAW,CAAC,SAAS,EAAE,YAAY,CAAE;KAC5F,GAAI,CAAC;AACR,MAAM,SAAS,GAAG,MAAM,CAAC,wBAAwB,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,GAAG,CAAC;AAE3F,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,MAAM,IAAI,GAAG,CAAC,OAAe,EAAS,EAAE;QACtC,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IACvE,CAAC,CAAC;IACF,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9D,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAgB,CAAC;IACnD,IAAI,CAAC;QACH,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,+DAA+D,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC;QACzB,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAC3E,OAAO,IAAI,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC"}

package/dist/diagnosticCompactRun.d.ts

@@ -0,0 +1,43 @@
+import { type DiagnosticIdentityDocument } from "@actuarial-ts/core";
+import { type CompletedCompactMetricDiagnosticsRun } from "@actuarial-ts/data";
+import { type ComputedDiagnosticArtifactDigest } from "./diagnosticArtifactStream.js";
+import type { DiagnosticArtifactDigest, DiagnosticPreparationLineage, DiagnosticRunIdentity, DiagnosticRunProvenance } from "./diagnosticRun.js";
+/** Computed digests must be authentic completed byte-stream receipts, not JSON copies. */
+export type CompactDiagnosticArtifactEvidence = ComputedDiagnosticArtifactDigest | Extract<DiagnosticArtifactDigest, {
+    assurance: "caller-declared";
+}>;
+export interface CreateCompactDiagnosticRunIdentityInput {
+    readonly completedRun: CompletedCompactMetricDiagnosticsRun;
+    readonly inputArtifacts: readonly CompactDiagnosticArtifactEvidence[];
+    readonly preparationArtifacts: readonly CompactDiagnosticArtifactEvidence[];
+    readonly preparationLineage: readonly DiagnosticPreparationLineage[];
+}
+declare const verifiedCompactDiagnosticRunProvenanceBrand: unique symbol;
+/**
+ * Verified compact evidence, not a legacy provenance DTO or BundleDoc.
+ * Documents emit the complete legacy normalized manifest/result identity bytes.
+ * They retain immutable owners, not expanded identity arrays or source bytes.
+ * The provenance brand, not a structural document, establishes verification.
+ */
+export interface VerifiedCompactDiagnosticRunProvenance extends DiagnosticRunIdentity {
+    readonly [verifiedCompactDiagnosticRunProvenanceBrand]: true;
+    readonly definition: DiagnosticRunProvenance["definition"];
+    readonly inputArtifacts: readonly DiagnosticArtifactDigest[];
+    readonly preparationArtifacts: readonly DiagnosticArtifactDigest[];
+    readonly preparationLineage: readonly DiagnosticPreparationLineage[];
+    readonly preparationFingerprint: string;
+    readonly reviewFingerprint: string;
+    readonly manifestIdentityDocument: DiagnosticIdentityDocument;
+    readonly resultIdentityDocument: DiagnosticIdentityDocument;
+}
+/**
+ * Verify an authentic compact completed run and bind completed artifact digests.
+ * Synchronous: source bytes were consumed by digestDiagnosticArtifactChunks already.
+ * This deliberately replays review/math and compares every identity code unit.
+ */
+export declare function createCompactDiagnosticRunIdentity(input: CreateCompactDiagnosticRunIdentityInput): VerifiedCompactDiagnosticRunProvenance;
+export declare function assertVerifiedCompactDiagnosticRunProvenance(value: unknown): asserts value is VerifiedCompactDiagnosticRunProvenance;
+/** Internal transport plumbing; deliberately not exported from the package index. */
+export declare function getCompactDiagnosticRunOwner(provenance: VerifiedCompactDiagnosticRunProvenance): CompletedCompactMetricDiagnosticsRun;
+export {};
+//# sourceMappingURL=diagnosticCompactRun.d.ts.map

package/dist/diagnosticCompactRun.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnosticCompactRun.d.ts","sourceRoot":"","sources":["../src/diagnosticCompactRun.ts"],"names":[],"mappings":"AAAA,OAAO,EAYL,KAAK,0BAA0B,EAChC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAML,KAAK,oCAAoC,EAC1C,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,gCAAgC,EACtC,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,oBAAoB,CAAC;AAU5B,0FAA0F;AAC1F,MAAM,MAAM,iCAAiC,GACzC,gCAAgC,GAChC,OAAO,CAAC,wBAAwB,EAAE;IAAE,SAAS,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAAC;AAExE,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,YAAY,EAAE,oCAAoC,CAAC;IAC5D,QAAQ,CAAC,cAAc,EAAE,SAAS,iCAAiC,EAAE,CAAC;IACtE,QAAQ,CAAC,oBAAoB,EAAE,SAAS,iCAAiC,EAAE,CAAC;IAC5E,QAAQ,CAAC,kBAAkB,EAAE,SAAS,4BAA4B,EAAE,CAAC;CACtE;AAED,OAAO,CAAC,MAAM,2CAA2C,EAAE,OAAO,MAAM,CAAC;AACzE;;;;;GAKG;AACH,MAAM,WAAW,sCACf,SAAQ,qBAAqB;IAC7B,QAAQ,CAAC,CAAC,2CAA2C,CAAC,EAAE,IAAI,CAAC;IAC7D,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC,YAAY,CAAC,CAAC;IAC3D,QAAQ,CAAC,cAAc,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC7D,QAAQ,CAAC,oBAAoB,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACnE,QAAQ,CAAC,kBAAkB,EAAE,SAAS,4BAA4B,EAAE,CAAC;IACrE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,wBAAwB,EAAE,0BAA0B,CAAC;IAC9D,QAAQ,CAAC,sBAAsB,EAAE,0BAA0B,CAAC;CAC7D;AAuRD;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,uCAAuC,GAC7C,sCAAsC,CAyFxC;AAED,wBAAgB,4CAA4C,CAC1D,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,KAAK,IAAI,sCAAsC,CAGzD;AAED,qFAAqF;AACrF,wBAAgB,4BAA4B,CAC1C,UAAU,EAAE,sCAAsC,GACjD,oCAAoC,CAGtC"}