@zanii/blackbox 0.2.0 → 0.4.0

package/dist/index.d.ts

@@ -1,46 +1,75 @@
+export { A2A_STREAMING, type AgentCardReport, a2aMethod, a2aRequestMeta, a2aResponseMeta, a2aRestMethod, a2aRestRequestMeta, a2aRestResponseMeta, agentCardDigest, agentCardPayload, gatewayCardKey, rewriteAgentCard, verifyAgentCard, } from "./a2a/index.ts";
 export { causality, memoryXray } from "./agents/index.ts";
 export { type DetectorOptions, detectors, fingerprint } from "./analysis/detectors.ts";
 export { FAULTS, type Fault, faultOf } from "./analysis/faults.ts";
-export { type AnalyzeOptions, analyze, type ClaimVerdict, type CriterionResult, checkFlightPlan, checkpointReplay, dualWitness, eventsOf, type Finding as AnalysisFinding, findingKey, type Landing, landing, OUTCOMES, type Outcome, type OutcomeRollup, rollup, type Severity, type WasteReason, type WasteReport, waste, } from "./analysis/index.ts";
-export { type ApprovalFinding, approvalFindings } from "./approvals/index.ts";
+export { type Accuracy, type AnalyzeOptions, type AnswerClaims, analyze, answerClaims, answerCredential, answerRisk, answersOf, answerText, type ClaimEntry, type ClaimVerdict, type CriterionResult, canonicalNumber, checkAgainstPacks, checkFlightPlan, checkpointReplay, detectorAccuracy, dualWitness, Evidence, eventsOf, type Fact, type Finding as AnalysisFinding, factsIn, findingKey, type GroundedClaim, groundingFindings, groundingRequest, HOLD_TRIGGERS, identifiersIn, judgeFindings, judgeRequest, type Label as AccuracyLabel, type Landing, landing, loadReferencePacks, modelGroundingFindings, normaliseValue, OUTCOMES, type Outcome, type OutcomeRollup, packsFor, parseGroundingAnswer, parseJudgeAnswer, type ReferenceFact, type ReferencePack, type ReferenceVerdict, referenceContext, rollup, type Severity, schemaProblem, toolHallucinations, verifyAnswerCredential, type WasteReason, type WasteReport, waste, wilsonLow, } from "./analysis/index.ts";
+export { MITRE_ATLAS, OWASP_ASI, TAXONOMY, type Taxonomy, taxonomyOf, } from "./analysis/taxonomy.ts";
+export { type ApprovalFinding, approvalConfirmation, approvalFindings, argsHash, verifyConfirmation, } from "./approvals/index.ts";
 export { textWarnings } from "./approvals/warnings.ts";
+export { type ArchiveFile, type ArchiveManifest, type ArchiveReport, archiveDigest, archiveEntry, archiveManifest, verifyArchive, } from "./archive/index.ts";
+export { archiveParquet } from "./archive/parquet.ts";
 export { type Attestation, attest, isReadOnly, normalise, parseCommand } from "./attest/index.ts";
 export { type AuthorityFinding, authorityAt, authorityTimeline, automationSurprise, type Mode as AuthorityMode, type Span as AuthoritySpan, } from "./authority/index.ts";
+export { badgeSvg, RECORD_STATES, type RecordState, recordBadge, recordState, } from "./badge/index.ts";
 export { type Invoice, type InvoiceLine, invoice, loadPlans, type Plan, type Plans, renderTaxInvoice, stripeSignatureOk, type TaxInvoice, type TaxInvoiceInput, taxInvoice, } from "./billing/index.ts";
+export { type AgentIdentity, checkAgent, sessionBom } from "./bom/index.ts";
 export { BlackboxApiError, type Client, type ClientOptions, client, type SessionQuery, } from "./client/index.ts";
-export { complianceFacts, complianceReport, type Facts, type Framework, type Report as ComplianceReport, renderReport, } from "./compliance/index.ts";
+export { ART12_MIN_RETENTION_DAYS, type Art12Check, type Art12Report, art12Check, } from "./compliance/art12.ts";
+export { accuracyFact, complianceFacts, complianceReport, controlsFact, type Facts, type Framework, hallucinationFacts, type Report as ComplianceReport, renderReport, } from "./compliance/index.ts";
+export { renderZaniiCompliance, type ZaniiComplianceReport, zaniiCompliance, } from "./compliance/zanii.ts";
+export { type Constitution, type ConstitutionRule, constitutionHash, createConstitution, evaluateConstitution, governanceOf, verifyConstitution, } from "./constitution/index.ts";
 export { type CallCost, type CostReport, callMicroUsd, effectivePrice, formatAed, type LoadedPrices, loadPrices, type ModelPrice, type PriceTable, priceCall, priceFor, promptTokens, requestsOf, sessionCost, type Tokens, toAedFils, tokensOf, } from "./cost/index.ts";
+export { agentCv, buildCv, cvHash, verifyCv } from "./cv/index.ts";
 export { type AuditRow, CORE_EVIDENCE, CORE_IDENTIFIERS, type Connector as AuditConnector, canaryIdentifier, checkAuditConnector, type DataFinding, type DataRules, dataClasses, dataFindings, dataFingerprint, dataMeta, dataScan, dataTopology, hasEvidence, type Identifier, type Lineage, lineage, luhn, normalizeValue, parseAuditLog, parseCsv, reconcileSystem, type SystemReport, type Topology, toolWitness, unevidenced, verifyToolWitness, witnessOf, } from "./data/index.ts";
 export { type Directive, type DirectiveItem, type DirectiveOptions, directives, fleetDirectives, } from "./directives/index.ts";
+export { argumentLeaves, type Disclosure, type DisclosureEnvelope, discloseFields, disclosureEnvelope, verifyDisclosure, verifyEventDisclosure, } from "./disclosure/index.ts";
 export { checkDrill, drillReport, type Fault as DrillFault } from "./drills/index.ts";
 export { checkDuty, type DutyFinding, type DutyLimits, dutyFindings } from "./duty/index.ts";
+export { openSegments, type SealedSegment } from "./encryption/index.ts";
+export { type EvidencePack, type EvidencePackOptions, evidencePack, renderEvidencePack, } from "./evidence/index.ts";
+export { buildEquivocationProof, compareViews, cosignLedgerSth, verifyEquivocationProof, verifyLedgerCosignature, } from "./federation/index.ts";
+export { buildOwnerAttestation, buildPayment, CURRENCIES, FTA_WALL_ID, financeFindings, formatMoney, ftaPayload, parseMoney, paymentsOf, screenCounterparty, screeningPayload, verifyOwnerAttestation, verifyOwnerBinding, } from "./finance/index.ts";
 export { aggregateFindings, airworthiness, type Collision, collisions, didFromSeed, type FindingGroup, incidentReport, logbook, type Summary, sessionSummary, signatureOf, signatures, signCertificate, verifyCertificate, } from "./fleet/index.ts";
+export { type AppealItem, type AppealPack, appealPack, decisionPayload, GOV_DECISION_KINDS, renderAppealPack, ruleConsistency, signSubjectClaim, subjectTag, verifyDecision, verifyFactors, verifySubjectClaim, } from "./gov/index.ts";
+export { accessPayload, breakGlass, checkEpisodeTag, clinicianConfirmation, type EpisodeItem, episodeSeed, episodesPack, episodeTag, healthFindings, protocolTrail, recommendationHash, recommendationPayload, verifyCommitment, verifyHealthSignature, } from "./health/index.ts";
 export { attachBlackbox, BlackboxAgentHooks, BlackboxCallbackHandler, type BlackboxCallbacks, blackboxAgentHooks, blackboxCallbacks, blackboxMiddleware, type EventSink, llmIds, llmIdsOf, trackMemory, wrapAnthropic, wrapBedrock, wrapGemini, wrapOpenAI, } from "./hooks/index.ts";
 export { type AgentSink, BlackboxStoppedError, blackboxAgentMiddleware, blackboxHitl, type HitlRequest, } from "./hooks/langchain-agent.ts";
 export { blackboxCheckpointer } from "./hooks/langgraph-checkpoint.ts";
 export { MANAGED_END, MANAGED_START, managedBlock, protectedEdit } from "./hooks/protect.ts";
 export { type Investigation, investigation, renderInvestigation, } from "./investigate/index.ts";
 export { type McpWrapOptions, mcpWrap } from "./mcp-wrap/index.ts";
+export { commitContent, memoryChain, memoryEntry, verifyMemoryContent, verifyMemoryEntry, } from "./memory/index.ts";
 export { type AmountUnit, anthropicStatement, type Baseline, baselines, type Connector, checkConnector, checkStatement, csvStatement, customStatement, decimalToMicroUsd, fuel, modelSpend, openaiStatement, pageParams, parseXml, reconcileBilling, requestFor, resolvePath, type Statement, } from "./money/index.ts";
-export { filingPack, type OccurrenceFacts, type OccurrenceFramework, type OccurrenceReport, occurrenceFacts, occurrenceReport, renderOccurrence, } from "./occurrence/index.ts";
+export { deadlinesDue, filingPack, type OccurrenceFacts, type OccurrenceFramework, type OccurrenceReport, occurrenceFacts, occurrenceReport, renderOccurrence, } from "./occurrence/index.ts";
 export { ingestOcsf, type OcsfEvent, type OcsfVersion, ocsfLine, toOcsf } from "./ocsf/index.ts";
 export { toOtlp } from "./otlp/index.ts";
 export { checkIdentifier, checkPack, corePack, type PackEntry, packData, packFrameworks, } from "./packs/index.ts";
 export { type PolicyChange, type PolicyDelta, policyDelta } from "./policy/delta.ts";
 export { type Draft, type DraftGroup, policyDrafts } from "./policy/drafts.ts";
-export { audited, type CompiledPolicy, compilePolicy, type Decision, decide, loadPolicy, type Policy, policyFindings, type Rule, } from "./policy/index.ts";
+export { audited, type CompiledPolicy, compilePolicy, type Decision, decide, ENVIRONMENT, environmentOf, loadPolicy, mcpToolHints, type Policy, policyFindings, type Rule, type ToolHints, toolDefinitionHash, } from "./policy/index.ts";
+export { fromZaniiPolicy, toZaniiPolicy } from "./policy/zanii.ts";
+export { bindPqKey, PQ_ALG, pqAvailable, pqPublicKey, pqSeedOf, pqTransitionPayload, verifyPqBinding, } from "./pq/index.ts";
 export { calibration, FEATURES, features, MIN_EACH, type PrecogModel, precogFindings, precogReport, predict, prefixOf, splitOf, TARGET, train, } from "./precog/index.ts";
 export { type InterventionEvidence, interventionEvidence, interventionGain, } from "./precog/intervention.ts";
 export { activities, buildNormal, type NormalModel, type NormalScore, normalScore, normalThreshold, } from "./precog/normal.ts";
 export { type PreflightFinding, preflightFindings } from "./preflight/index.ts";
 export { type Rating, type TypeUnratedFinding, typeRatings, typeUnrated, } from "./ratings/index.ts";
 export { type Finding, type FindingCode, type Harness, loadLocal, type ReconcileOptions, RecordNotVerified, type Report, reconcile, } from "./reconcile/index.ts";
+/** Canonical JSON (keys sorted, no whitespace, JavaScript number formatting), as hashed. */
+export { canonical } from "./reconcile/shared.ts";
 export { cassette, requestKey, type Take } from "./replay/index.ts";
 export { ORPHAN_TEXT, repairToolCalls } from "./replay/repair.ts";
+export { checkSearch, type SearchMatch, type SearchQuery, searchEvents } from "./search/index.ts";
 export { type DrainResult, drainSpools } from "./session/drain.ts";
 export { BlackboxSession, checkEgress, type EgressCheck, type FlightPlan, type LlmCallIds, type SessionError, type SessionOptions, type SessionState, type SessionStats, session, stableEventId, } from "./session/index.ts";
+export { assembleSla, assessCompliance, buildSlaBody, signSla, slaHash, verifySla, } from "./sla/index.ts";
+export { assembleSuccession, buildSuccessionBody, type Succession, type SuccessionBody, type SuccessionReason, signSuccession, successionHash, verifyLineage, verifySuccession, } from "./succession/index.ts";
+export { type TimestampReport, timestampRequest, verifyTimestamp, } from "./timestamp/index.ts";
+export { resolveToken, resolveTokens, tokenFor } from "./tokens/index.ts";
+export { addCheckpointBody, type Cbor, cborDecode, cborEncode, checkpointText, consistencyProof, cosign, cosignMldsa, ed25519PublicKey, inclusionProof, keyRotationNote, leafHash, logKid, makeReceipt, merkleRoot, mldsaAvailable, mldsaPublicKey, noteVkey, parseAddCheckpoint, parseCheckpoint, parseVkey, RECEIPT_SUB, SESSION_CONTENT_TYPE, sessionStatement, signNote, signStatement, splitNote, statementEntry, subtreeMessage, transparentStatement, verifyConsistency, verifyCoseSign1, verifyCosignature, verifyInclusion, verifyKeyRotation, verifyNote, verifyReceipt, verifyTransparency, } from "./transparency/index.ts";
 export { type Compensation, checkCompensations, runUndo, type UndoFinding, type UndoStatus, type UndoStep, undoFindings, undoPlan, } from "./undo/index.ts";
 export * from "./verify/index.ts";
 export { VERSION } from "./version.ts";
+export { checkOutput, WALLS, type Wall, wallFindings, wallManifestHash, } from "./walls/index.ts";
 export { type Conditions, type Sample, weather } from "./weather/index.ts";
 export { postReceipt, receiptFor, type Tree, workspaceTree } from "./workspace-receipt/index.ts";

package/dist/index.js

@@ -1,48 +1,77 @@
 // Public API of @zanii/blackbox. Everything customers can import is re-exported here.
 // Keep this file in step with sdks/python/src/zanii_blackbox/__init__.py (the SDKs mirror each other).
+export { A2A_STREAMING, a2aMethod, a2aRequestMeta, a2aResponseMeta, a2aRestMethod, a2aRestRequestMeta, a2aRestResponseMeta, agentCardDigest, agentCardPayload, gatewayCardKey, rewriteAgentCard, verifyAgentCard, } from "./a2a/index.js";
 export { causality, memoryXray } from "./agents/index.js";
 export { detectors, fingerprint } from "./analysis/detectors.js";
 export { FAULTS, faultOf } from "./analysis/faults.js";
-export { analyze, checkFlightPlan, checkpointReplay, dualWitness, eventsOf, findingKey, landing, OUTCOMES, rollup, waste, } from "./analysis/index.js";
-export { approvalFindings } from "./approvals/index.js";
+export { analyze, answerClaims, answerCredential, answerRisk, answersOf, answerText, canonicalNumber, checkAgainstPacks, checkFlightPlan, checkpointReplay, detectorAccuracy, dualWitness, Evidence, eventsOf, factsIn, findingKey, groundingFindings, groundingRequest, HOLD_TRIGGERS, identifiersIn, judgeFindings, judgeRequest, landing, loadReferencePacks, modelGroundingFindings, normaliseValue, OUTCOMES, packsFor, parseGroundingAnswer, parseJudgeAnswer, referenceContext, rollup, schemaProblem, toolHallucinations, verifyAnswerCredential, waste, wilsonLow, } from "./analysis/index.js";
+export { MITRE_ATLAS, OWASP_ASI, TAXONOMY, taxonomyOf, } from "./analysis/taxonomy.js";
+export { approvalConfirmation, approvalFindings, argsHash, verifyConfirmation, } from "./approvals/index.js";
 export { textWarnings } from "./approvals/warnings.js";
+export { archiveDigest, archiveEntry, archiveManifest, verifyArchive, } from "./archive/index.js";
+export { archiveParquet } from "./archive/parquet.js";
 export { attest, isReadOnly, normalise, parseCommand } from "./attest/index.js";
 export { authorityAt, authorityTimeline, automationSurprise, } from "./authority/index.js";
+export { badgeSvg, RECORD_STATES, recordBadge, recordState, } from "./badge/index.js";
 export { invoice, loadPlans, renderTaxInvoice, stripeSignatureOk, taxInvoice, } from "./billing/index.js";
+export { checkAgent, sessionBom } from "./bom/index.js";
 export { BlackboxApiError, client, } from "./client/index.js";
-export { complianceFacts, complianceReport, renderReport, } from "./compliance/index.js";
+export { ART12_MIN_RETENTION_DAYS, art12Check, } from "./compliance/art12.js";
+export { accuracyFact, complianceFacts, complianceReport, controlsFact, hallucinationFacts, renderReport, } from "./compliance/index.js";
+export { renderZaniiCompliance, zaniiCompliance, } from "./compliance/zanii.js";
+export { constitutionHash, createConstitution, evaluateConstitution, governanceOf, verifyConstitution, } from "./constitution/index.js";
 export { callMicroUsd, effectivePrice, formatAed, loadPrices, priceCall, priceFor, promptTokens, requestsOf, sessionCost, toAedFils, tokensOf, } from "./cost/index.js";
+export { agentCv, buildCv, cvHash, verifyCv } from "./cv/index.js";
 export { CORE_EVIDENCE, CORE_IDENTIFIERS, canaryIdentifier, checkAuditConnector, dataClasses, dataFindings, dataFingerprint, dataMeta, dataScan, dataTopology, hasEvidence, lineage, luhn, normalizeValue, parseAuditLog, parseCsv, reconcileSystem, toolWitness, unevidenced, verifyToolWitness, witnessOf, } from "./data/index.js";
 export { directives, fleetDirectives, } from "./directives/index.js";
+export { argumentLeaves, discloseFields, disclosureEnvelope, verifyDisclosure, verifyEventDisclosure, } from "./disclosure/index.js";
 export { checkDrill, drillReport } from "./drills/index.js";
 export { checkDuty, dutyFindings } from "./duty/index.js";
+export { openSegments } from "./encryption/index.js";
+export { evidencePack, renderEvidencePack, } from "./evidence/index.js";
+export { buildEquivocationProof, compareViews, cosignLedgerSth, verifyEquivocationProof, verifyLedgerCosignature, } from "./federation/index.js";
+export { buildOwnerAttestation, buildPayment, CURRENCIES, FTA_WALL_ID, financeFindings, formatMoney, ftaPayload, parseMoney, paymentsOf, screenCounterparty, screeningPayload, verifyOwnerAttestation, verifyOwnerBinding, } from "./finance/index.js";
 export { aggregateFindings, airworthiness, collisions, didFromSeed, incidentReport, logbook, sessionSummary, signatureOf, signatures, signCertificate, verifyCertificate, } from "./fleet/index.js";
+export { appealPack, decisionPayload, GOV_DECISION_KINDS, renderAppealPack, ruleConsistency, signSubjectClaim, subjectTag, verifyDecision, verifyFactors, verifySubjectClaim, } from "./gov/index.js";
+export { accessPayload, breakGlass, checkEpisodeTag, clinicianConfirmation, episodeSeed, episodesPack, episodeTag, healthFindings, protocolTrail, recommendationHash, recommendationPayload, verifyCommitment, verifyHealthSignature, } from "./health/index.js";
 export { attachBlackbox, BlackboxAgentHooks, BlackboxCallbackHandler, blackboxAgentHooks, blackboxCallbacks, blackboxMiddleware, llmIds, llmIdsOf, trackMemory, wrapAnthropic, wrapBedrock, wrapGemini, wrapOpenAI, } from "./hooks/index.js";
 export { BlackboxStoppedError, blackboxAgentMiddleware, blackboxHitl, } from "./hooks/langchain-agent.js";
 export { blackboxCheckpointer } from "./hooks/langgraph-checkpoint.js";
 export { MANAGED_END, MANAGED_START, managedBlock, protectedEdit } from "./hooks/protect.js";
 export { investigation, renderInvestigation, } from "./investigate/index.js";
 export { mcpWrap } from "./mcp-wrap/index.js";
+export { commitContent, memoryChain, memoryEntry, verifyMemoryContent, verifyMemoryEntry, } from "./memory/index.js";
 export { anthropicStatement, baselines, checkConnector, checkStatement, csvStatement, customStatement, decimalToMicroUsd, fuel, modelSpend, openaiStatement, pageParams, parseXml, reconcileBilling, requestFor, resolvePath, } from "./money/index.js";
-export { filingPack, occurrenceFacts, occurrenceReport, renderOccurrence, } from "./occurrence/index.js";
+export { deadlinesDue, filingPack, occurrenceFacts, occurrenceReport, renderOccurrence, } from "./occurrence/index.js";
 export { ingestOcsf, ocsfLine, toOcsf } from "./ocsf/index.js";
 export { toOtlp } from "./otlp/index.js";
 export { checkIdentifier, checkPack, corePack, packData, packFrameworks, } from "./packs/index.js";
 export { policyDelta } from "./policy/delta.js";
 export { policyDrafts } from "./policy/drafts.js";
-export { audited, compilePolicy, decide, loadPolicy, policyFindings, } from "./policy/index.js";
+export { audited, compilePolicy, decide, ENVIRONMENT, environmentOf, loadPolicy, mcpToolHints, policyFindings, toolDefinitionHash, } from "./policy/index.js";
+export { fromZaniiPolicy, toZaniiPolicy } from "./policy/zanii.js";
+export { bindPqKey, PQ_ALG, pqAvailable, pqPublicKey, pqSeedOf, pqTransitionPayload, verifyPqBinding, } from "./pq/index.js";
 export { calibration, FEATURES, features, MIN_EACH, precogFindings, precogReport, predict, prefixOf, splitOf, TARGET, train, } from "./precog/index.js";
 export { interventionEvidence, interventionGain, } from "./precog/intervention.js";
 export { activities, buildNormal, normalScore, normalThreshold, } from "./precog/normal.js";
 export { preflightFindings } from "./preflight/index.js";
 export { typeRatings, typeUnrated, } from "./ratings/index.js";
 export { loadLocal, RecordNotVerified, reconcile, } from "./reconcile/index.js";
+/** Canonical JSON (keys sorted, no whitespace, JavaScript number formatting), as hashed. */
+export { canonical } from "./reconcile/shared.js";
 export { cassette, requestKey } from "./replay/index.js";
 export { ORPHAN_TEXT, repairToolCalls } from "./replay/repair.js";
+export { checkSearch, searchEvents } from "./search/index.js";
 export { drainSpools } from "./session/drain.js";
 export { BlackboxSession, checkEgress, session, stableEventId, } from "./session/index.js";
+export { assembleSla, assessCompliance, buildSlaBody, signSla, slaHash, verifySla, } from "./sla/index.js";
+export { assembleSuccession, buildSuccessionBody, signSuccession, successionHash, verifyLineage, verifySuccession, } from "./succession/index.js";
+export { timestampRequest, verifyTimestamp, } from "./timestamp/index.js";
+export { resolveToken, resolveTokens, tokenFor } from "./tokens/index.js";
+export { addCheckpointBody, cborDecode, cborEncode, checkpointText, consistencyProof, cosign, cosignMldsa, ed25519PublicKey, inclusionProof, keyRotationNote, leafHash, logKid, makeReceipt, merkleRoot, mldsaAvailable, mldsaPublicKey, noteVkey, parseAddCheckpoint, parseCheckpoint, parseVkey, RECEIPT_SUB, SESSION_CONTENT_TYPE, sessionStatement, signNote, signStatement, splitNote, statementEntry, subtreeMessage, transparentStatement, verifyConsistency, verifyCoseSign1, verifyCosignature, verifyInclusion, verifyKeyRotation, verifyNote, verifyReceipt, verifyTransparency, } from "./transparency/index.js";
 export { checkCompensations, runUndo, undoFindings, undoPlan, } from "./undo/index.js";
 export * from "./verify/index.js";
 export { VERSION } from "./version.js";
+export { checkOutput, WALLS, wallFindings, wallManifestHash, } from "./walls/index.js";
 export { weather } from "./weather/index.js";
 export { postReceipt, receiptFor, workspaceTree } from "./workspace-receipt/index.js";

package/dist/memory/index.d.ts

@@ -0,0 +1,36 @@
+type Obj = Record<string, unknown>;
+/** Zanii's salted commitment to memory content. */
+export declare function commitContent(content: string, salt?: string): {
+    commitment: string;
+    salt: string;
+};
+/** The entry was about `content`, given the salt kept at write time. */
+export declare const verifyMemoryContent: (content: string, salt: string, commitment: string) => boolean;
+/** Zanii's memory.write payload, after `prev` (the previous entry; null starts a chain). Keep the salt. */
+export declare function memoryEntry(input: {
+    content: string;
+    ts: string;
+    kind?: string;
+    prev?: Obj | null;
+    salt?: string;
+    agent?: string;
+    tags?: string[];
+}): {
+    payload: Obj;
+    salt: string;
+};
+/** Zanii's check of one entry: well formed, and its entry_hash matches. */
+export declare function verifyMemoryEntry(payload: unknown): {
+    ok: boolean;
+    reasons: string[];
+};
+/** Walks entries in order: each checks, links to the one before and counts up by one. The first may continue a chain from elsewhere. */
+export declare function memoryChain(entries: readonly unknown[]): {
+    ok: boolean;
+    length: number;
+    broken: {
+        index: number;
+        reason: string;
+    }[];
+};
+export {};

package/dist/memory/index.js

@@ -0,0 +1,85 @@
+// Provable agent memory (spec/agents.md §4): Zanii's memory.write entries, a salted commitment to
+// what the agent remembered, hash-chained so an edit afterwards shows (@zanii/memory). Pure;
+// mirrors sdks/python/src/zanii_blackbox/memory.py; pinned by spec/vectors/memory.json.
+import { createHash, randomBytes } from "node:crypto";
+import { jcsHash } from "@zanii/core";
+/** Zanii's salted commitment to memory content. */
+export function commitContent(content, salt) {
+    const s = salt ?? randomBytes(16).toString("hex");
+    const h = createHash("sha256")
+        .update(Buffer.from(s, "hex"))
+        .update(content, "utf8")
+        .digest("hex");
+    return { commitment: `sha256:${h}`, salt: s };
+}
+/** The entry was about `content`, given the salt kept at write time. */
+export const verifyMemoryContent = (content, salt, commitment) => commitContent(content, salt).commitment === commitment;
+const validTs = (ts) => typeof ts === "string" && !Number.isNaN(Date.parse(ts));
+const entryHash = (commitment, kind, ts, prev, seq) => jcsHash({ v: 1, content_commitment: commitment, kind, ts, prev, seq });
+/** Zanii's memory.write payload, after `prev` (the previous entry; null starts a chain). Keep the salt. */
+export function memoryEntry(input) {
+    if (!validTs(input.ts))
+        throw new Error("ts must be an ISO timestamp");
+    const p = input.prev ?? null;
+    if (p && (typeof p.entry_hash !== "string" || !Number.isSafeInteger(p.seq)))
+        throw new Error("previous entry has no entry_hash or seq");
+    const kind = input.kind ?? "fact";
+    const c = commitContent(input.content, input.salt);
+    const seq = p ? p.seq + 1 : 0;
+    const prev = p ? p.entry_hash : null;
+    return {
+        payload: {
+            _zr_kind: "memory",
+            v: 1,
+            kind,
+            content_commitment: c.commitment,
+            prev,
+            seq,
+            entry_hash: entryHash(c.commitment, kind, input.ts, prev, seq),
+            agent: input.agent ?? null,
+            tags: input.tags ?? null,
+            ts: input.ts,
+        },
+        salt: c.salt,
+    };
+}
+/** Zanii's check of one entry: well formed, and its entry_hash matches. */
+export function verifyMemoryEntry(payload) {
+    const p = (payload ?? {});
+    const reasons = [];
+    if (p._zr_kind !== "memory" || p.v !== 1)
+        reasons.push("not a memory receipt (v1)");
+    const cc = p.content_commitment;
+    if (typeof cc !== "string" || !cc.startsWith("sha256:"))
+        reasons.push("missing/invalid content commitment");
+    if (!validTs(p.ts))
+        reasons.push("missing/invalid ts");
+    if (!Number.isSafeInteger(p.seq) || p.seq < 0)
+        reasons.push("missing/invalid seq");
+    if (p.prev !== null && p.prev !== undefined && typeof p.prev !== "string")
+        reasons.push("prev must be a hash string or null");
+    if (reasons.length === 0 &&
+        entryHash(cc, p.kind || "fact", p.ts, p.prev ?? null, p.seq) !== p.entry_hash)
+        reasons.push("entry_hash does not match its contents (tampered)");
+    return { ok: reasons.length === 0, reasons };
+}
+/** Walks entries in order: each checks, links to the one before and counts up by one. The first may continue a chain from elsewhere. */
+export function memoryChain(entries) {
+    const broken = [];
+    let prevHash = null;
+    let prevSeq = null;
+    entries.forEach((e, i) => {
+        const p = (e ?? {});
+        const single = verifyMemoryEntry(p);
+        if (!single.ok)
+            broken.push({ index: i, reason: single.reasons.join("; ") });
+        else if (i > 0 && (p.prev ?? null) !== prevHash)
+            broken.push({ index: i, reason: "broken link (prev is not the previous entry_hash)" });
+        if (single.ok && prevSeq !== null && p.seq !== prevSeq + 1)
+            broken.push({ index: i, reason: "seq is not previous + 1" });
+        // a bad entry is reported once: the next one is checked against what it claims
+        prevHash = p.entry_hash;
+        prevSeq = Number.isSafeInteger(p.seq) ? p.seq : null;
+    });
+    return { ok: broken.length === 0, length: entries.length, broken };
+}

package/dist/occurrence/index.d.ts

@@ -5,6 +5,8 @@ export interface OccurrenceFramework {
     title: string;
     authority: string;
     deadlines: string[];
+    /** spec/packs.md §1: each deadline's hours after awareness, or null. */
+    clock_hours?: Array<number | null>;
     sections: Array<{
         id: string;
         title: string;
@@ -68,6 +70,15 @@ export declare function occurrenceReport(id: string, framework: OccurrenceFramew
     }[];
 };
 export type OccurrenceReport = ReturnType<typeof occurrenceReport>;
+/**
+ * spec/occurrence.md §1a: each deadline's due time, counted from when the entity became aware
+ * (`awareAt`, ISO-8601 with a zone). A deadline without a clock (it runs from another event, like a
+ * corrective measure) is `null`. Whether and when the entity became aware is the entity's call.
+ */
+export declare function deadlinesDue(framework: OccurrenceFramework, awareAt: string, lang?: "en" | "ar"): Array<{
+    deadline: string;
+    due_at: string | null;
+}>;
 export declare function renderOccurrence(r: OccurrenceReport, notes: string): string;
 /** spec/occurrence.md "Filing": what a person needs to file the report in an authority's portal. */
 export declare function filingPack(r: OccurrenceReport, notes: string, pack: {

package/dist/occurrence/index.js

@@ -114,6 +114,24 @@ export function occurrenceReport(id, framework, facts, lang = "en") {
         })),
     };
 }
+/**
+ * spec/occurrence.md §1a: each deadline's due time, counted from when the entity became aware
+ * (`awareAt`, ISO-8601 with a zone). A deadline without a clock (it runs from another event, like a
+ * corrective measure) is `null`. Whether and when the entity became aware is the entity's call.
+ */
+export function deadlinesDue(framework, awareAt, lang = "en") {
+    const at = Date.parse(awareAt);
+    if (!/[zZ]|[+-]\d{2}:\d{2}$/.test(awareAt) || Number.isNaN(at))
+        throw new Error("aware_at must be an ISO-8601 time with a zone");
+    const texts = lang === "ar" && framework.ar ? framework.ar.deadlines : framework.deadlines;
+    return texts.map((deadline, i) => {
+        const h = framework.clock_hours?.[i];
+        return {
+            deadline,
+            due_at: typeof h === "number" ? new Date(at + h * 3_600_000).toISOString() : null,
+        };
+    });
+}
 const LABELS = {
     en: ["Session", "Record verifies", "yes", "NO", "Report to", "Generated", "Deadlines"],
     ar: ["الجلسة", "السجل موثّق", "نعم", "لا", "جهة الإبلاغ", "تاريخ الإنشاء", "المواعيد النهائية"],

package/dist/ocsf/index.d.ts

@@ -1,5 +1,5 @@
 import type { Json } from "../verify/index.ts";
-export type OcsfVersion = "1.8" | "1.3" | "1.1";
+export type OcsfVersion = "1.9" | "1.8" | "1.3" | "1.1";
 export type OcsfEvent = {
     [key: string]: Json;
 };

package/dist/ocsf/index.js

@@ -1,6 +1,7 @@
 // OCSF export (spec/ocsf.md, idea S1): a session's record as OCSF 1.8.0 events for a SIEM (Splunk,
 // AWS Security Lake, CrowdStrike, Elastic), with a lossy downgrade to 1.1 / 1.3 and a one-line text
 // form. Mirrors ocsf.py.
+import { taxonomyOf } from "../analysis/taxonomy.js";
 const SEVERITY = {
     advisory: [2, "Low"],
     caution: [3, "Medium"],
@@ -45,11 +46,16 @@ const FINDING = [2004, "Detection Finding", 2, "Findings"];
  * gets what the gateway saw. */
 export function toOcsf(lines, options = {}) {
     const pv = options.productVersion ?? "unknown";
+    let label;
+    let session = "";
     const requests = new Map();
     const out = [];
     for (const line of lines) {
         const e = JSON.parse(line);
         const m = e.meta;
+        session = e.session_id;
+        if (e.kind === "session.open" && typeof m.label === "string")
+            label = m.label;
         if (e.kind === "llm.request") {
             requests.set(e.seq, {
                 ...(typeof m.provider === "string" ? { provider: m.provider } : {}),
@@ -114,9 +120,36 @@ export function toOcsf(lines, options = {}) {
             out.push(ev);
         }
     }
-    return options.version && options.version !== "1.8"
-        ? out.map((ev) => downgrade(ev, options.version))
-        : out;
+    const version = options.version ?? "1.9";
+    if (version === "1.9")
+        return out.map((ev) => upgrade(ev, label, session));
+    return version === "1.8" ? out : out.map((ev) => downgrade(ev, version));
+}
+/** OCSF 1.9 (spec/ocsf.md §2): the agent (`ai_agent`) on model and tool events, and each finding's
+ * MITRE ATLAS techniques (`attacks`) and OWASP ASI ids (`metadata.tags`). */
+function upgrade(ev, label, session) {
+    const metadata = {
+        ...ev.metadata,
+        version: "1.9.0",
+    };
+    const out = { ...ev, metadata };
+    const ai = ev.ai_model !== undefined ||
+        ev.api?.operation === "tools/call";
+    if (ai) {
+        out.ai_agent = { name: label ?? "agent", instance_uid: session };
+        metadata.profiles = ["ai_operation"];
+    }
+    if (ev.class_uid === 2004) {
+        const t = taxonomyOf(String(ev.finding_info.title));
+        if (t.atlas.length)
+            out.attacks = t.atlas.map((a) => ({
+                technique: { uid: a.id, name: a.name },
+                version: "ATLAS v2026.09",
+            }));
+        if (t.owasp.length)
+            metadata.tags = t.owasp.map((o) => ({ name: "owasp_asi", value: o.id }));
+    }
+    return out;
 }
 /** Idea S1: for a SIEM on an older OCSF: drops what came later (`ai_model`), the `ai_operation`
  * profile, and says so in `unmapped.downgraded_from`. */

package/dist/otlp/index.d.ts

@@ -7,7 +7,14 @@ type Attr = {
     key: string;
     value: Value;
 };
-export declare function toOtlp(lines: readonly string[]): {
+/**
+ * spec/otlp.md: a session as OTLP/JSON. `semconv: 2` (the default) follows the GenAI semantic
+ * conventions as of v1.42 (`gen_ai.provider.name`, `invoke_agent`, MCP `tools/call`); `semconv: 1`
+ * is the first version's output, pinned by spec/vectors/otlp.json.
+ */
+export declare function toOtlp(lines: readonly string[], options?: {
+    semconv?: 1 | 2;
+}): {
     resourceSpans: {
         resource: {
             attributes: Attr[];