@actuarial-ts/compliance 0.6.1 → 0.7.1

package/dist/diagnosticRunEvidence.js

@@ -0,0 +1,195 @@
+import { ComplianceError } from "./errors.js";
+export const token = (value, path) => {
+    if (value.length === 0 ||
+        /^[\t-\r ]|[\t-\r ]$/.test(value) ||
+        value.includes("\0"))
+        throw new ComplianceError("BAD_DIAGNOSTIC_RUN", `${path} must be a nonempty token`, path);
+    for (let index = 0; index < value.length; index++) {
+        const unit = value.charCodeAt(index);
+        if (unit >= 0xd800 && unit <= 0xdbff) {
+            const next = value.charCodeAt(index + 1);
+            if (!(next >= 0xdc00 && next <= 0xdfff))
+                throw new ComplianceError("BAD_DIAGNOSTIC_RUN", `${path} contains malformed Unicode`, path);
+            index++;
+        }
+        else if (unit >= 0xdc00 && unit <= 0xdfff)
+            throw new ComplianceError("BAD_DIAGNOSTIC_RUN", `${path} contains malformed Unicode`, path);
+    }
+};
+export function plain(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+export function exactKeys(value, allowed, path) {
+    for (const key of Object.keys(value))
+        if (!allowed.includes(key))
+            throw new ComplianceError("BAD_DIAGNOSTIC_RUN", `Unknown field ${key}`, `${path}.${key}`);
+}
+export function snapshotLineage(lineage) {
+    if (!Array.isArray(lineage))
+        throw new ComplianceError("BAD_DIAGNOSTIC_RUN", "$.preparationLineage must be an array", "$.preparationLineage");
+    return lineage
+        .map((raw, index) => {
+        const path = `$.preparationLineage[${index}]`;
+        if (!plain(raw))
+            throw new ComplianceError("BAD_DIAGNOSTIC_RUN", "Lineage edge must be a plain object", path);
+        exactKeys(raw, ["outputArtifactId", "inputArtifactIds", "transformationArtifactIds"], path);
+        if (typeof raw.outputArtifactId !== "string")
+            throw new ComplianceError("BAD_DIAGNOSTIC_RUN", "Lineage output must be a string", `${path}.outputArtifactId`);
+        token(raw.outputArtifactId, `${path}.outputArtifactId`);
+        const readIds = (value, key) => {
+            if (!Array.isArray(value))
+                throw new ComplianceError("BAD_DIAGNOSTIC_RUN", `Lineage ${key} must be an array`, `${path}.${key}`);
+            const result = value.map((id, inputIndex) => {
+                if (typeof id !== "string")
+                    throw new ComplianceError("BAD_DIAGNOSTIC_RUN", "Lineage artifact id must be a string", `${path}.${key}[${inputIndex}]`);
+                token(id, `${path}.${key}[${inputIndex}]`);
+                return id;
+            });
+            if (new Set(result).size !== result.length)
+                throw new ComplianceError("BAD_DIAGNOSTIC_RUN", `Lineage ${key} must be unique`, `${path}.${key}`);
+            return [...result].sort();
+        };
+        const inputs = readIds(raw.inputArtifactIds, "inputArtifactIds"), transformations = readIds(raw.transformationArtifactIds, "transformationArtifactIds");
+        if (inputs.length + transformations.length === 0)
+            throw new ComplianceError("BAD_DIAGNOSTIC_RUN", "Lineage edge must have at least one upstream artifact", path);
+        return {
+            outputArtifactId: raw.outputArtifactId,
+            inputArtifactIds: inputs,
+            transformationArtifactIds: transformations,
+        };
+    })
+        .sort((a, b) => a.outputArtifactId < b.outputArtifactId
+        ? -1
+        : a.outputArtifactId > b.outputArtifactId
+            ? 1
+            : 0);
+}
+export function validateArtifactGraph(run, inputArtifacts, preparationArtifacts, lineage) {
+    const byId = new Map();
+    for (const [index, item] of [
+        ...inputArtifacts,
+        ...preparationArtifacts,
+    ].entries()) {
+        if (byId.has(item.id))
+            throw new ComplianceError("BAD_DIAGNOSTIC_RUN", `Duplicate artifact ID ${item.id}`, `$.${index < inputArtifacts.length ? "inputArtifacts" : "preparationArtifacts"}[${index < inputArtifacts.length ? index : index - inputArtifacts.length}].id`);
+        byId.set(item.id, item);
+    }
+    const referenced = new Set();
+    const requireArtifact = (id, scope, path) => {
+        const artifact = byId.get(id);
+        if (!artifact)
+            throw new ComplianceError("BAD_DIAGNOSTIC_RUN", `Artifact reference ${id} is unresolved`, path);
+        if (artifact.scope !== scope)
+            throw new ComplianceError("BAD_DIAGNOSTIC_RUN", `Artifact ${id} must have ${scope} scope`, path);
+        referenced.add(id);
+    };
+    let unsourced = false;
+    for (const [index, item] of run.prepared.inputAudit.entries()) {
+        const source = item.record.source;
+        if (source)
+            requireArtifact(source.artifactId, "input", `$.completedRun.prepared.inputAudit[${index}].record.source.artifactId`);
+        else
+            unsourced = true;
+    }
+    const evidence = run.review.evidence;
+    if (evidence) {
+        for (const [index, item] of evidence.groupingAssignments.entries()) {
+            if (item.source)
+                requireArtifact(item.source.artifactId, "input", `$.completedRun.review.evidence.groupingAssignments[${index}].source.artifactId`);
+            else
+                unsourced = true;
+        }
+        for (const [index, item] of evidence.cachedFormulas.entries()) {
+            if (item.source)
+                requireArtifact(item.source.artifactId, "input", `$.completedRun.review.evidence.cachedFormulas[${index}].source.artifactId`);
+            else
+                unsourced = true;
+        }
+    }
+    if (unsourced) {
+        if (run.datasetArtifactId === null)
+            throw new ComplianceError("BAD_DIAGNOSTIC_RUN", "Unsourced diagnostic input requires datasetArtifactId", "$.completedRun.datasetArtifactId");
+        const fallback = byId.get(run.datasetArtifactId);
+        if (!fallback ||
+            fallback.scope !== "input" ||
+            fallback.assurance !== "sdk-computed")
+            throw new ComplianceError("BAD_DIAGNOSTIC_RUN", "datasetArtifactId must resolve to SDK-computed input evidence", "$.completedRun.datasetArtifactId");
+        referenced.add(run.datasetArtifactId);
+    }
+    else if (run.datasetArtifactId !== null) {
+        requireArtifact(run.datasetArtifactId, "input", "$.completedRun.datasetArtifactId");
+        if (byId.get(run.datasetArtifactId).assurance !== "sdk-computed")
+            throw new ComplianceError("BAD_DIAGNOSTIC_RUN", "datasetArtifactId must resolve to SDK-computed input evidence", "$.completedRun.datasetArtifactId");
+    }
+    for (const [basisIndex, basis,] of run.prepared.definition.definition.amountBases.entries())
+        for (const [componentIndex, component] of basis.components.entries())
+            if (component.limitation.kind !== "unlimited" &&
+                component.limitation.kind !== "unknown" &&
+                component.limitation.derivation.kind === "external")
+                requireArtifact(component.limitation.derivation.transformationRef, "preparation", `$.definition.amountBases[${basisIndex}].components[${componentIndex}].limitation.derivation.transformationRef`);
+    for (const [ruleIndex, rule,] of run.prepared.definition.definition.reviewRules.entries())
+        if (rule.kind === "layer-order" &&
+            rule.comparability.kind === "caller-asserted")
+            requireArtifact(rule.comparability.rationaleArtifactId, "preparation", `$.definition.reviewRules[${ruleIndex}].comparability.rationaleArtifactId`);
+    if (run.gate.rationaleRef !== null)
+        requireArtifact(run.gate.rationaleRef, "preparation", "$.completedRun.gate.rationaleRef");
+    const edges = new Map();
+    for (const [index, edge] of lineage.entries()) {
+        const path = `$.preparationLineage[${index}]`;
+        if (edges.has(edge.outputArtifactId))
+            throw new ComplianceError("BAD_DIAGNOSTIC_RUN", "An artifact may have only one producing lineage edge", `${path}.outputArtifactId`);
+        const downstream = byId.get(edge.outputArtifactId);
+        if (!downstream)
+            throw new ComplianceError("BAD_DIAGNOSTIC_RUN", `Lineage artifact ${edge.outputArtifactId} is unresolved`, `${path}.outputArtifactId`);
+        if (downstream.scope !== "input")
+            throw new ComplianceError("BAD_DIAGNOSTIC_RUN", "Lineage output artifact must have input scope", `${path}.outputArtifactId`);
+        for (const [inputIndex, id] of edge.inputArtifactIds.entries()) {
+            if (id === edge.outputArtifactId)
+                throw new ComplianceError("BAD_DIAGNOSTIC_RUN", "Lineage may not reference itself", `${path}.inputArtifactIds[${inputIndex}]`);
+            const artifact = byId.get(id);
+            if (!artifact || artifact.scope !== "input")
+                throw new ComplianceError("BAD_DIAGNOSTIC_RUN", `Lineage input ${id} must resolve to input evidence`, `${path}.inputArtifactIds[${inputIndex}]`);
+        }
+        for (const [transformIndex, id,] of edge.transformationArtifactIds.entries()) {
+            const artifact = byId.get(id);
+            if (!artifact || artifact.scope !== "preparation")
+                throw new ComplianceError("BAD_DIAGNOSTIC_RUN", `Lineage transformation ${id} must resolve to preparation evidence`, `${path}.transformationArtifactIds[${transformIndex}]`);
+        }
+        edges.set(edge.outputArtifactId, [
+            ...edge.inputArtifactIds,
+            ...edge.transformationArtifactIds,
+        ]);
+    }
+    const visiting = new Set(), visited = new Set();
+    for (const root of [...referenced]) {
+        const stack = [{ id: root, exit: false }];
+        while (stack.length > 0) {
+            const { id, exit } = stack.pop();
+            if (exit) {
+                visiting.delete(id);
+                visited.add(id);
+                continue;
+            }
+            if (visiting.has(id))
+                throw new ComplianceError("BAD_DIAGNOSTIC_RUN", "Artifact lineage contains a cycle", "$.preparationLineage");
+            if (visited.has(id))
+                continue;
+            visiting.add(id);
+            stack.push({ id, exit: true });
+            for (const upstream of [...(edges.get(id) ?? [])].reverse()) {
+                referenced.add(upstream);
+                stack.push({ id: upstream, exit: false });
+            }
+        }
+    }
+    for (const [index, artifact] of inputArtifacts.entries())
+        if (!referenced.has(artifact.id))
+            throw new ComplianceError("BAD_DIAGNOSTIC_RUN", `Artifact ${artifact.id} is orphaned`, `$.inputArtifacts[${index}].id`);
+    for (const [index, artifact] of preparationArtifacts.entries())
+        if (!referenced.has(artifact.id))
+            throw new ComplianceError("BAD_DIAGNOSTIC_RUN", `Artifact ${artifact.id} is orphaned`, `$.preparationArtifacts[${index}].id`);
+}
+//# sourceMappingURL=diagnosticRunEvidence.js.map

package/dist/diagnosticRunEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnosticRunEvidence.js","sourceRoot":"","sources":["../src/diagnosticRunEvidence.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAa9C,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,EAAE;IACnD,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QACjC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAEpB,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,GAAG,IAAI,2BAA2B,EAClC,IAAI,CACL,CAAC;IACJ,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC;gBACrC,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,GAAG,IAAI,6BAA6B,EACpC,IAAI,CACL,CAAC;YACJ,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM;YACzC,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,GAAG,IAAI,6BAA6B,EACpC,IAAI,CACL,CAAC;IACN,CAAC;AACH,CAAC,CAAC;AACF,MAAM,UAAU,KAAK,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAC9D,CAAC;AACD,MAAM,UAAU,SAAS,CACvB,KAA8B,EAC9B,OAA0B,EAC1B,IAAY;IAEZ,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YACxB,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,iBAAiB,GAAG,EAAE,EACtB,GAAG,IAAI,IAAI,GAAG,EAAE,CACjB,CAAC;AACR,CAAC;AACD,MAAM,UAAU,eAAe,CAC7B,OAAgB;IAEhB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACzB,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,uCAAuC,EACvC,sBAAsB,CACvB,CAAC;IACJ,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAClB,MAAM,IAAI,GAAG,wBAAwB,KAAK,GAAG,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YACb,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,qCAAqC,EACrC,IAAI,CACL,CAAC;QACJ,SAAS,CACP,GAAG,EACH,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,2BAA2B,CAAC,EACrE,IAAI,CACL,CAAC;QACF,IAAI,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ;YAC1C,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,iCAAiC,EACjC,GAAG,IAAI,mBAAmB,CAC3B,CAAC;QACJ,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,IAAI,mBAAmB,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,GAAW,EAAE,EAAE;YAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACvB,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,WAAW,GAAG,mBAAmB,EACjC,GAAG,IAAI,IAAI,GAAG,EAAE,CACjB,CAAC;YACJ,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE;gBAC1C,IAAI,OAAO,EAAE,KAAK,QAAQ;oBACxB,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,sCAAsC,EACtC,GAAG,IAAI,IAAI,GAAG,IAAI,UAAU,GAAG,CAChC,CAAC;gBACJ,KAAK,CAAC,EAAE,EAAE,GAAG,IAAI,IAAI,GAAG,IAAI,UAAU,GAAG,CAAC,CAAC;gBAC3C,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM;gBACxC,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,WAAW,GAAG,iBAAiB,EAC/B,GAAG,IAAI,IAAI,GAAG,EAAE,CACjB,CAAC;YACJ,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,EAC9D,eAAe,GAAG,OAAO,CACvB,GAAG,CAAC,yBAAyB,EAC7B,2BAA2B,CAC5B,CAAC;QACJ,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,KAAK,CAAC;YAC9C,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,uDAAuD,EACvD,IAAI,CACL,CAAC;QACJ,OAAO;YACL,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,gBAAgB,EAAE,MAAM;YACxB,yBAAyB,EAAE,eAAe;SAC3C,CAAC;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACb,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,gBAAgB;QACrC,CAAC,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,gBAAgB;YACvC,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,CAAC,CACR,CAAC;AACN,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,GAAmC,EACnC,cAGG,EACH,oBAGG,EACH,OAAgD;IAEhD,MAAM,IAAI,GAAG,IAAI,GAAG,EAGjB,CAAC;IACJ,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI;QAC1B,GAAG,cAAc;QACjB,GAAG,oBAAoB;KACxB,CAAC,OAAO,EAAE,EAAE,CAAC;QACZ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,yBAAyB,IAAI,CAAC,EAAE,EAAE,EAClC,KAAK,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,IAAI,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,cAAc,CAAC,MAAM,MAAM,CAC9J,CAAC;QACJ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,eAAe,GAAG,CACtB,EAAU,EACV,KAA8B,EAC9B,IAAY,EACZ,EAAE;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,sBAAsB,EAAE,gBAAgB,EACxC,IAAI,CACL,CAAC;QACJ,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK;YAC1B,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,YAAY,EAAE,cAAc,KAAK,QAAQ,EACzC,IAAI,CACL,CAAC;QACJ,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC,CAAC;IACF,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAClC,IAAI,MAAM;YACR,eAAe,CACb,MAAM,CAAC,UAAU,EACjB,OAAO,EACP,sCAAsC,KAAK,4BAA4B,CACxE,CAAC;;YACC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;IACrC,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,mBAAmB,CAAC,OAAO,EAAE,EAAE,CAAC;YACnE,IAAI,IAAI,CAAC,MAAM;gBACb,eAAe,CACb,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,OAAO,EACP,sDAAsD,KAAK,qBAAqB,CACjF,CAAC;;gBACC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;QACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9D,IAAI,IAAI,CAAC,MAAM;gBACb,eAAe,CACb,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,OAAO,EACP,iDAAiD,KAAK,qBAAqB,CAC5E,CAAC;;gBACC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,GAAG,CAAC,iBAAiB,KAAK,IAAI;YAChC,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,uDAAuD,EACvD,kCAAkC,CACnC,CAAC;QACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACjD,IACE,CAAC,QAAQ;YACT,QAAQ,CAAC,KAAK,KAAK,OAAO;YAC1B,QAAQ,CAAC,SAAS,KAAK,cAAc;YAErC,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,+DAA+D,EAC/D,kCAAkC,CACnC,CAAC;QACJ,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACxC,CAAC;SAAM,IAAI,GAAG,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC1C,eAAe,CACb,GAAG,CAAC,iBAAiB,EACrB,OAAO,EACP,kCAAkC,CACnC,CAAC;QACF,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAE,CAAC,SAAS,KAAK,cAAc;YAC/D,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,+DAA+D,EAC/D,kCAAkC,CACnC,CAAC;IACN,CAAC;IACD,KAAK,MAAM,CACT,UAAU,EACV,KAAK,EACN,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,OAAO,EAAE;QAC3D,KAAK,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE;YAClE,IACE,SAAS,CAAC,UAAU,CAAC,IAAI,KAAK,WAAW;gBACzC,SAAS,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS;gBACvC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,UAAU;gBAEnD,eAAe,CACb,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,iBAAiB,EACjD,aAAa,EACb,4BAA4B,UAAU,gBAAgB,cAAc,2CAA2C,CAChH,CAAC;IACR,KAAK,MAAM,CACT,SAAS,EACT,IAAI,EACL,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,OAAO,EAAE;QAC3D,IACE,IAAI,CAAC,IAAI,KAAK,aAAa;YAC3B,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,iBAAiB;YAE7C,eAAe,CACb,IAAI,CAAC,aAAa,CAAC,mBAAmB,EACtC,aAAa,EACb,4BAA4B,SAAS,qCAAqC,CAC3E,CAAC;IACN,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,IAAI;QAChC,eAAe,CACb,GAAG,CAAC,IAAI,CAAC,YAAY,EACrB,aAAa,EACb,kCAAkC,CACnC,CAAC;IACJ,MAAM,KAAK,GAAG,IAAI,GAAG,EAA6B,CAAC;IACnD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,wBAAwB,KAAK,GAAG,CAAC;QAC9C,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAClC,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,sDAAsD,EACtD,GAAG,IAAI,mBAAmB,CAC3B,CAAC;QACJ,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU;YACb,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,oBAAoB,IAAI,CAAC,gBAAgB,gBAAgB,EACzD,GAAG,IAAI,mBAAmB,CAC3B,CAAC;QACJ,IAAI,UAAU,CAAC,KAAK,KAAK,OAAO;YAC9B,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,+CAA+C,EAC/C,GAAG,IAAI,mBAAmB,CAC3B,CAAC;QACJ,KAAK,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/D,IAAI,EAAE,KAAK,IAAI,CAAC,gBAAgB;gBAC9B,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,kCAAkC,EAClC,GAAG,IAAI,qBAAqB,UAAU,GAAG,CAC1C,CAAC;YACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO;gBACzC,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,iBAAiB,EAAE,iCAAiC,EACpD,GAAG,IAAI,qBAAqB,UAAU,GAAG,CAC1C,CAAC;QACN,CAAC;QACD,KAAK,MAAM,CACT,cAAc,EACd,EAAE,EACH,IAAI,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,aAAa;gBAC/C,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,0BAA0B,EAAE,uCAAuC,EACnE,GAAG,IAAI,8BAA8B,cAAc,GAAG,CACvD,CAAC;QACN,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE;YAC/B,GAAG,IAAI,CAAC,gBAAgB;YACxB,GAAG,IAAI,CAAC,yBAAyB;SAClC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,EAChC,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;YAClC,IAAI,IAAI,EAAE,CAAC;gBACT,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACpB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,mCAAmC,EACnC,sBAAsB,CACvB,CAAC;YACJ,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/B,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC5D,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE;QACtD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,YAAY,QAAQ,CAAC,EAAE,cAAc,EACrC,oBAAoB,KAAK,MAAM,CAChC,CAAC;IACN,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,oBAAoB,CAAC,OAAO,EAAE;QAC5D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,YAAY,QAAQ,CAAC,EAAE,cAAc,EACrC,0BAA0B,KAAK,MAAM,CACtC,CAAC;AACR,CAAC"}

package/dist/index.d.ts

@@ -5,6 +5,10 @@ export * from "./ledger.js";
 export * from "./modelCards.js";
 export * from "./disclosure.js";
 export * from "./diagnosticRun.js";
+export * from "./diagnosticArtifactStream.js";
+export { createCompactDiagnosticRunIdentity, assertVerifiedCompactDiagnosticRunProvenance, type CompactDiagnosticArtifactEvidence, type CreateCompactDiagnosticRunIdentityInput, type VerifiedCompactDiagnosticRunProvenance, } from "./diagnosticCompactRun.js";
+export * from "./diagnosticReplayWriter.js";
+export * from "./diagnosticReplayReader.js";
 export * from "./bundle.js";
 export * from "./ave.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,OAAO,EACL,kCAAkC,EAClC,4CAA4C,EAC5C,KAAK,iCAAiC,EACtC,KAAK,uCAAuC,EAC5C,KAAK,sCAAsC,GAC5C,MAAM,2BAA2B,CAAC;AACnC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC"}

package/dist/index.js

@@ -5,6 +5,10 @@ export * from "./ledger.js";
 export * from "./modelCards.js";
 export * from "./disclosure.js";
 export * from "./diagnosticRun.js";
+export * from "./diagnosticArtifactStream.js";
+export { createCompactDiagnosticRunIdentity, assertVerifiedCompactDiagnosticRunProvenance, } from "./diagnosticCompactRun.js";
+export * from "./diagnosticReplayWriter.js";
+export * from "./diagnosticReplayReader.js";
 export * from "./bundle.js";
 export * from "./ave.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,OAAO,EACL,kCAAkC,EAClC,4CAA4C,GAI7C,MAAM,2BAA2B,CAAC;AACnC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC"}

package/dist/sha256Stream.d.ts

@@ -0,0 +1,6 @@
+/** Internal state never escapes; update consumes bytes synchronously. */
+export declare function createSha256(): {
+    update(bytes: Uint8Array): void;
+    digest(): string;
+};
+//# sourceMappingURL=sha256Stream.d.ts.map

package/dist/sha256Stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sha256Stream.d.ts","sourceRoot":"","sources":["../src/sha256Stream.ts"],"names":[],"mappings":"AAkBA,yEAAyE;AACzE,wBAAgB,YAAY;kBAkDV,UAAU,GAAG,IAAI;cAiBrB,MAAM;EAqBnB"}

package/dist/sha256Stream.js

@@ -0,0 +1,103 @@
+/**
+ * Private incremental SHA-256, following FIPS 180-4 sections 4.1.2, 4.2.2,
+ * 5.1.1, 5.3.3 and 6.2.2. No I/O, dependencies or whole-message buffering.
+ * https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf
+ * This implementation is not a NIST/FIPS-validated cryptographic module.
+ */
+const ROUND = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+const rotate = (value, count) => (value >>> count) | (value << (32 - count));
+/** Internal state never escapes; update consumes bytes synchronously. */
+export function createSha256() {
+    const state = new Uint32Array([
+        0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+    ]);
+    const block = new Uint8Array(64);
+    const words = new Uint32Array(64);
+    let buffered = 0;
+    let byteLength = 0;
+    let finalized = false;
+    function compress() {
+        const view = new DataView(block.buffer);
+        for (let index = 0; index < 16; index++)
+            words[index] = view.getUint32(index * 4, false);
+        for (let index = 16; index < 64; index++) {
+            const a = words[index - 15];
+            const b = words[index - 2];
+            const small0 = rotate(a, 7) ^ rotate(a, 18) ^ (a >>> 3);
+            const small1 = rotate(b, 17) ^ rotate(b, 19) ^ (b >>> 10);
+            words[index] = (words[index - 16] + small0 + words[index - 7] + small1) >>> 0;
+        }
+        let a = state[0], b = state[1], c = state[2], d = state[3];
+        let e = state[4], f = state[5], g = state[6], h = state[7];
+        for (let index = 0; index < 64; index++) {
+            const large1 = rotate(e, 6) ^ rotate(e, 11) ^ rotate(e, 25);
+            const choose = (e & f) ^ (~e & g);
+            const t1 = (h + large1 + choose + ROUND[index] + words[index]) >>> 0;
+            const large0 = rotate(a, 2) ^ rotate(a, 13) ^ rotate(a, 22);
+            const majority = (a & b) ^ (a & c) ^ (b & c);
+            const t2 = (large0 + majority) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = (d + t1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) >>> 0;
+        }
+        const completed = [a, b, c, d, e, f, g, h];
+        for (let index = 0; index < 8; index++)
+            state[index] = (state[index] + completed[index]) >>> 0;
+    }
+    return {
+        update(bytes) {
+            if (finalized)
+                throw new Error("SHA-256 state is finalized");
+            if (!Number.isSafeInteger(byteLength + bytes.byteLength))
+                throw new RangeError("SHA-256 byte length exceeds the safe integer range");
+            byteLength += bytes.byteLength;
+            let offset = 0;
+            while (offset < bytes.byteLength) {
+                const count = Math.min(64 - buffered, bytes.byteLength - offset);
+                block.set(bytes.subarray(offset, offset + count), buffered);
+                buffered += count;
+                offset += count;
+                if (buffered === 64) {
+                    compress();
+                    buffered = 0;
+                }
+            }
+        },
+        digest() {
+            if (finalized)
+                throw new Error("SHA-256 state is finalized");
+            finalized = true;
+            block[buffered++] = 0x80;
+            block.fill(0, buffered);
+            if (buffered > 56) {
+                compress();
+                block.fill(0);
+            }
+            const view = new DataView(block.buffer);
+            // Split the bit length before multiplying: exact for every safe byte length.
+            view.setUint32(56, Math.floor(byteLength / 0x20000000), false);
+            view.setUint32(60, (byteLength % 0x20000000) * 8, false);
+            compress();
+            const hex = Array.from(state, (word) => word.toString(16).padStart(8, "0")).join("");
+            block.fill(0);
+            words.fill(0);
+            state.fill(0);
+            return hex;
+        },
+    };
+}
+//# sourceMappingURL=sha256Stream.js.map

package/dist/sha256Stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sha256Stream.js","sourceRoot":"","sources":["../src/sha256Stream.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC;IAC5B,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IAC9F,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IAC9F,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IAC9F,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IAC9F,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IAC9F,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IAC9F,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IAC9F,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;CAC/F,CAAC,CAAC;AACH,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;AAE7F,yEAAyE;AACzE,MAAM,UAAU,YAAY;IAC1B,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC;QAC5B,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;KAC/F,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,SAAS,QAAQ;QACf,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE;YAAE,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QACzF,KAAK,IAAI,KAAK,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,EAAE,CAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC1D,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAE,GAAG,MAAM,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,EACf,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,EACb,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,EACb,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAChB,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,EACf,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,EACb,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,EACb,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAChB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAClC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,KAAK,CAAE,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5D,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7C,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE;YACpC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAE,GAAG,SAAS,CAAC,KAAK,CAAE,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,MAAM,CAAC,KAAiB;YACtB,IAAI,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;gBACtD,MAAM,IAAI,UAAU,CAAC,oDAAoD,CAAC,CAAC;YAC7E,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC;YAC/B,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,OAAO,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC;gBACjE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;gBAC5D,QAAQ,IAAI,KAAK,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC;gBAChB,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;oBACpB,QAAQ,EAAE,CAAC;oBACX,QAAQ,GAAG,CAAC,CAAC;gBACf,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM;YACJ,IAAI,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC7D,SAAS,GAAG,IAAI,CAAC;YACjB,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YACxB,IAAI,QAAQ,GAAG,EAAE,EAAE,CAAC;gBAClB,QAAQ,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACxC,6EAA6E;YAC7E,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;YAC/D,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YACzD,QAAQ,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACd,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const COMPLIANCE_PACKAGE_VERSION = "0.6.1";
+export declare const COMPLIANCE_PACKAGE_VERSION = "0.7.1";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const COMPLIANCE_PACKAGE_VERSION = "0.6.1";
+export const COMPLIANCE_PACKAGE_VERSION = "0.7.1";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actuarial-ts/compliance",
-  "version": "0.6.1",
+  "version": "0.7.1",
   "description": "ASOP-compliance-support layer for the actuarial-ts SDK: estimate metadata, assumption ledger, disclosures, model cards, diagnostics provenance, reproducibility bundles, and actual-vs-expected roll-forward. Responsibility for compliance remains with the credentialed actuary.",
   "license": "Apache-2.0",
   "type": "module",
@@ -47,9 +47,9 @@
     "prepublishOnly": "node ../../tools/release/verify-release-attestation.mjs @actuarial-ts/compliance"
   },
   "dependencies": {
-    "@actuarial-ts/core": "^0.6.1",
-    "@actuarial-ts/data": "^0.6.1",
-    "@actuarial-ts/interchange": "^0.6.1"
+    "@actuarial-ts/core": "^0.7.1",
+    "@actuarial-ts/data": "^0.7.1",
+    "@actuarial-ts/interchange": "^0.7.1"
   },
   "devDependencies": {
     "@types/node": "^22.10.5",

package/src/diagnosticArtifactStream.ts

@@ -0,0 +1,148 @@
+import {
+  diagnosticJsonPreflight,
+  isDiagnosticPlainRecord,
+  isDiagnosticToken,
+} from "@actuarial-ts/core";
+import { ComplianceError } from "./errors.js";
+import type { DiagnosticArtifactDigest } from "./diagnosticRun.js";
+import { createSha256 } from "./sha256Stream.js";
+import { diagnosticByteView } from "./diagnosticByteView.js";
+import { consumeDiagnosticByteSource } from "./diagnosticByteSource.js";
+
+export interface DiagnosticArtifactStreamMetadata {
+  readonly id: string;
+  readonly scope: "input" | "preparation";
+  /** Optional completeness check; no digest handle is issued on truncation. */
+  readonly expectedByteLength?: number;
+  /** Caller-selected resource ceiling, at most Number.MAX_SAFE_INTEGER. */
+  readonly maximumByteLength?: number;
+}
+declare const computedArtifactDigestBrand: unique symbol;
+export type ComputedDiagnosticArtifactDigest = Extract<
+  DiagnosticArtifactDigest,
+  { assurance: "sdk-computed" }
+> & { readonly [computedArtifactDigestBrand]: true };
+
+const computed = new WeakSet<object>();
+const signalAborted = Object.getOwnPropertyDescriptor(AbortSignal.prototype, "aborted")!.get!;
+const throwIfAborted = AbortSignal.prototype.throwIfAborted;
+const COPY_SIZE = 65_536;
+
+function invalid(message: string, path = "$"): never {
+  throw new ComplianceError("BAD_DIAGNOSTIC_RUN", message, path);
+}
+
+function ownedMetadata(value: DiagnosticArtifactStreamMetadata) {
+  // Read descriptors once. A Proxy must not pass validation with one property
+  // value and supply a different value when the final digest is assembled.
+  if (!isDiagnosticPlainRecord(value)) invalid("Artifact metadata must be a plain object");
+  const snapshot = Object.create(null) as Record<string, unknown>;
+  for (const key of Reflect.ownKeys(value)) {
+    if (typeof key !== "string") invalid("Artifact metadata cannot have symbol keys");
+    const field = Object.getOwnPropertyDescriptor(value, key);
+    if (!field || !("value" in field) || !field.enumerable)
+      invalid("Artifact metadata must contain enumerable data properties", `$.${key}`);
+    snapshot[key] = field.value;
+  }
+  value = snapshot as unknown as DiagnosticArtifactStreamMetadata;
+  const issues = diagnosticJsonPreflight(value, "input");
+  if (issues.length) invalid(issues[0]!.message, issues[0]!.path);
+  if (!isDiagnosticPlainRecord(value)) invalid("Artifact metadata must be a plain object");
+  for (const key of Object.keys(value))
+    if (!["id", "scope", "expectedByteLength", "maximumByteLength"].includes(key))
+      invalid("Unknown artifact metadata key", `$.${key}`);
+  if (!isDiagnosticToken(value.id)) invalid("Artifact ID must be a valid token", "$.id");
+  if (value.scope !== "input" && value.scope !== "preparation")
+    invalid("Artifact scope must be input or preparation", "$.scope");
+  for (const key of ["expectedByteLength", "maximumByteLength"] as const)
+    if (value[key] !== undefined && (!Number.isSafeInteger(value[key]) || value[key]! < 0))
+      invalid("Byte length must be a nonnegative safe integer", `$.${key}`);
+  const maximumByteLength = value.maximumByteLength ?? Number.MAX_SAFE_INTEGER;
+  if (value.expectedByteLength !== undefined && value.expectedByteLength > maximumByteLength)
+    invalid("Expected byte length exceeds the resource ceiling", "$.expectedByteLength");
+  return {
+    id: value.id,
+    scope: value.scope,
+    expectedByteLength: value.expectedByteLength,
+    maximumByteLength,
+  };
+}
+
+function cancellation(options: { readonly signal?: AbortSignal }): () => void {
+  if (!isDiagnosticPlainRecord(options)) invalid("Artifact stream options must be a plain object");
+  for (const key of Reflect.ownKeys(options))
+    if (key !== "signal") invalid("Unknown artifact stream option");
+  const field = Object.getOwnPropertyDescriptor(options, "signal");
+  if (field && (!("value" in field) || !field.enumerable))
+    invalid("Artifact signal must be supplied as a data property");
+  const signal = field?.value;
+  if (signal === undefined) return () => {};
+  try {
+    signalAborted.call(signal);
+  } catch {
+    invalid("Artifact signal must be an AbortSignal");
+  }
+  // Capture the genuine signal and intrinsic method before any producer await.
+  return () => throwIfAborted.call(signal);
+}
+
+/**
+ * Hash the bytes actually received, retaining only a bounded chunk copy.
+ * The producer owns I/O. A completed handle means SDK-computed content digest,
+ * not source authenticity, a signature, or validation of an actuarial run.
+ * Shared buffers are refused; bytes are consumed before requesting the next
+ * chunk. A changing producer must be checked again against this digest on replay.
+ * Cancellation is cooperative between received chunks; the producer should use
+ * the same signal to cancel pending I/O. One synchronous chunk is not interrupted.
+ */
+export async function digestDiagnosticArtifactChunks(
+  metadata: DiagnosticArtifactStreamMetadata,
+  chunks: AsyncIterable<Uint8Array> | Iterable<Uint8Array>,
+  options: { readonly signal?: AbortSignal } = {},
+): Promise<ComputedDiagnosticArtifactDigest> {
+  const owned = ownedMetadata(metadata);
+  const checkCancellation = cancellation(options);
+  checkCancellation();
+  const hash = createSha256();
+  const copy = new Uint8Array(COPY_SIZE);
+  let byteLength = 0;
+  try {
+    for await (const chunk of consumeDiagnosticByteSource(chunks, checkCancellation)) {
+      checkCancellation();
+      const view = diagnosticByteView(chunk);
+      const size = view.byteLength;
+      if (!Number.isSafeInteger(byteLength + size) || byteLength + size > owned.maximumByteLength)
+        invalid("Artifact byte length exceeds the resource ceiling", "$.chunks");
+      if (owned.expectedByteLength !== undefined && byteLength + size > owned.expectedByteLength)
+        invalid("Artifact has more bytes than declared", "$.chunks");
+      for (let start = 0; start < size; start += COPY_SIZE) {
+        const length = Math.min(COPY_SIZE, size - start);
+        copy.set(new Uint8Array(view.buffer, view.byteOffset + start, length));
+        hash.update(copy.subarray(0, length));
+      }
+      byteLength += size;
+    }
+    checkCancellation();
+    if (owned.expectedByteLength !== undefined && byteLength !== owned.expectedByteLength)
+      invalid("Artifact ended before its declared byte length", "$.chunks");
+    const digest = Object.freeze({
+      id: owned.id,
+      scope: owned.scope,
+      assurance: "sdk-computed" as const,
+      algorithm: "sha256" as const,
+      value: hash.digest(),
+      byteLength,
+    }) as ComputedDiagnosticArtifactDigest;
+    computed.add(digest);
+    return digest;
+  } finally {
+    copy.fill(0);
+  }
+}
+
+export function assertComputedDiagnosticArtifactDigest(
+  value: unknown,
+): asserts value is ComputedDiagnosticArtifactDigest {
+  if (value === null || typeof value !== "object" || !computed.has(value))
+    invalid("Value is not an authentic SDK-computed streamed artifact digest");
+}

package/src/diagnosticByteSource.ts

@@ -0,0 +1,82 @@
+type DiagnosticByteSource = Iterable<Uint8Array> | AsyncIterable<Uint8Array>;
+
+function isObject(value: unknown): value is object {
+  return (
+    value !== null && (typeof value === "object" || typeof value === "function")
+  );
+}
+
+/**
+ * Own one producer iterator through completion, cancellation or read failure.
+ * Unlike a bare for-await loop, a rejected next() also closes the producer.
+ * A cleanup failure never replaces the error that caused cleanup. Hosts should
+ * pass the same cancellation signal to pending I/O; checks cannot interrupt it.
+ */
+export async function* consumeDiagnosticByteSource(
+  source: DiagnosticByteSource,
+  checkCancellation: () => void = () => {},
+): AsyncGenerator<Uint8Array> {
+  if (!isObject(source))
+    throw new TypeError("Diagnostic byte source must be iterable");
+  const iterable = source as Partial<
+    Iterable<Uint8Array> & AsyncIterable<Uint8Array>
+  >;
+  const asynchronous = iterable[Symbol.asyncIterator];
+  const method = asynchronous ?? iterable[Symbol.iterator];
+  if (typeof method !== "function")
+    throw new TypeError(
+      "Diagnostic byte source must provide an iterator method",
+    );
+  const iterator: unknown = Reflect.apply(method, source, []);
+  if (!isObject(iterator))
+    throw new TypeError("Diagnostic byte iterator must be an object");
+  const protocol = iterator as { next?: unknown; return?: unknown };
+  let completed = false;
+  let failed = false;
+  try {
+    // Capture next once, as the iterator protocol does; never use a producer's
+    // potentially overwritten Function.call property.
+    const next = protocol.next;
+    if (typeof next !== "function")
+      throw new TypeError("Diagnostic byte iterator must provide next()");
+    for (;;) {
+      checkCancellation();
+      const result: unknown = await Reflect.apply(next, iterator, []);
+      if (!isObject(result))
+        throw new TypeError(
+          "Diagnostic byte read must return an iterator result",
+        );
+      const item = result as IteratorResult<Uint8Array>;
+      completed = Boolean(item.done);
+      checkCancellation();
+      if (completed) return;
+      // An async generator also observes a rejected value from a synchronous
+      // iterator here, so that failure follows the same cleanup path.
+      yield item.value;
+    }
+  } catch (error) {
+    failed = true;
+    throw error;
+  } finally {
+    if (!completed) {
+      try {
+        // Read return only when closing, once, following normal iterator
+        // semantics. The generator's finally executes at most once.
+        const close = protocol.return;
+        if (close !== undefined && close !== null) {
+          if (typeof close !== "function")
+            throw new TypeError(
+              "Diagnostic byte iterator return must be a function",
+            );
+          const result: unknown = await Reflect.apply(close, iterator, []);
+          if (!isObject(result))
+            throw new TypeError(
+              "Diagnostic byte iterator return must return an iterator result",
+            );
+        }
+      } catch (cleanupError) {
+        if (!failed) throw cleanupError;
+      }
+    }
+  }
+}