@zanii/sla 0.1.0

package/LICENSE

@@ -0,0 +1,159 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or agreed
+      to in writing, Licensor provides the Work (and each Contributor
+      provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES
+      OR CONDITIONS OF ANY KIND, either express or implied, including,
+      without limitation, any warranties or conditions of TITLE,
+      NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Zanii
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,53 @@
+# @zanii/sla
+
+Machine-verifiable service agreements between agents. Provider and client co-sign
+terms — what service (a target scope), over what window, how much (`min`/`max`
+actions), how continuously (`max_gap_ms`, an uptime proxy) — and then **compliance is
+computed from receipts, not argued about**. Same terms + same receipts → same verdict
+for everyone, and every breach cites its evidence. Pair with `@zanii/escrow`: a breach
+verdict is refund evidence.
+
+```sh
+npm install @zanii/sla @zanii/core @zanii/payments
+```
+
+```ts
+import { buildSlaBody, signSla, assembleSla, assessCompliance } from '@zanii/sla';
+
+const body = buildSlaBody({
+  provider: worker.did, client: buyer.did, scope: 'feed.*',
+  window: { start, end },
+  commitments: { min_actions: 100, max_gap_ms: 15 * 60_000 },
+  price: { amount: '499.00', currency: 'USD' },   // informational — ties to an escrow
+  createdAt: now,
+});
+const sla = assembleSla(body, [signSla(body, worker.did, workerKey), signSla(body, buyer.did, buyerKey)]);
+
+// hand in the provider's CONSECUTIVE chain segment covering the window:
+const report = assessCompliance(sla, receipts, { asOf: now }); // asOf: fair mid-window checks
+report.ok;        // no breaches
+report.breaches;  // [{ kind, detail, receipt? }] — each cites the evidence
+report.metrics;   // { actions, max_gap_ms }
+```
+
+Python: `from zanii.sla import build_sla_body, assess_compliance, ...` — byte-identical
+JCS objects and hashes.
+
+## The property that makes the metrics honest
+
+Counting receipts is worthless if the provider can omit the bad hour. Zanii receipts
+form a **per-agent hash chain** (`prev` links), so completeness is *provable*:
+`assessCompliance` verifies the slice is consecutive in the provider's chain — a
+broken link is an **`INCOMPLETE_RECORD`** breach, not a silently wrong count. Trimming
+the ends doesn't help either: it shows as fewer actions and bigger edge gaps (gaps are
+measured to the window boundaries, not just between receipts).
+
+Breach kinds: `INVALID_RECEIPT` · `INCOMPLETE_RECORD` · `TOO_FEW_ACTIONS` ·
+`TOO_MANY_ACTIONS` · `MAX_GAP_EXCEEDED`.
+
+## The limit, stated up front
+
+Receipts prove what was *recorded* — an action taken entirely off the rails is the
+credential-custody problem, not an SLA one. A gap breach proves **silence on the
+ledger**, which the SLA defines as breach; that definition is the parties' agreement,
+not a law of nature.

package/dist/index.d.ts

@@ -0,0 +1,92 @@
+import { type Receipt } from '@zanii/core';
+import { type Money } from '@zanii/payments';
+export interface SlaCommitments {
+    /** Fewest matching receipts the window must contain. */
+    min_actions?: number;
+    /** Most matching receipts the window may contain. */
+    max_actions?: number;
+    /** Max silence between matching receipts (and to the window edges) — an uptime proxy. */
+    max_gap_ms?: number;
+}
+export interface SlaBody {
+    v: 1;
+    type: 'sla';
+    provider: string;
+    client: string;
+    /** Scope pattern the service's receipts must match, e.g. `feed.sync` or `api.*`. */
+    scope: string;
+    window: {
+        start: string;
+        end: string;
+    };
+    commitments: SlaCommitments;
+    /** Informational price — ties to an escrow; not used by compliance math. */
+    price?: Money;
+    created_at: string;
+    ref?: string;
+}
+export interface SlaSignature {
+    did: string;
+    /** `ed25519:<hex>` over the canonical (JCS) bytes of the body. */
+    sig: string;
+}
+export interface Sla {
+    body: SlaBody;
+    signatures: SlaSignature[];
+}
+export interface SlaInput {
+    provider: string;
+    client: string;
+    scope: string;
+    window: {
+        start: string;
+        end: string;
+    };
+    commitments: SlaCommitments;
+    price?: {
+        amount: string;
+        currency: string;
+    };
+    createdAt: string;
+    ref?: string;
+}
+export declare function buildSlaBody(input: SlaInput): SlaBody;
+/** One party signs the terms. Collect one from the provider and one from the client. */
+export declare function signSla(body: SlaBody, did: string, privateKey: Uint8Array): SlaSignature;
+export declare function assembleSla(body: SlaBody, signatures: SlaSignature[]): Sla;
+export declare function slaHash(sla: Sla): string;
+export interface SlaCheck {
+    ok: boolean;
+    reasons: string[];
+}
+/** Verify the agreement: structure sane, BOTH provider and client signed these exact terms. */
+export declare function verifySla(sla: Sla | undefined): SlaCheck;
+export type BreachKind = 'INVALID_RECEIPT' | 'INCOMPLETE_RECORD' | 'TOO_FEW_ACTIONS' | 'TOO_MANY_ACTIONS' | 'MAX_GAP_EXCEEDED';
+export interface Breach {
+    kind: BreachKind;
+    detail: string;
+    /** JCS hash of the receipt at/after which the breach sits, when applicable. */
+    receipt?: string;
+}
+export interface ComplianceReport {
+    ok: boolean;
+    breaches: Breach[];
+    metrics: {
+        /** In-window, in-scope receipts. */
+        actions: number;
+        /** Largest observed silence (ms), window edges included. null when nothing matched. */
+        max_gap_ms: number | null;
+    };
+}
+/**
+ * The compliance verdict — pure computation. Pass the provider's **consecutive chain
+ * segment** covering the window (its export slice): every receipt is signature-checked,
+ * the `prev` links are verified so nothing recorded can be hidden between the endpoints
+ * (`INCOMPLETE_RECORD` otherwise), then the commitments are measured on the in-window,
+ * in-scope receipts. `asOf` (default: window end) caps the trailing-gap check so a
+ * mid-window assessment doesn't count the not-yet-elapsed silence as breach.
+ */
+export declare function assessCompliance(sla: Sla, receipts: Receipt[], opts?: {
+    asOf?: string;
+}): ComplianceReport;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA8BA,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAc,KAAK,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAEzD,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,OAAO;IACtB,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,KAAK,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,WAAW,EAAE,cAAc,CAAC;IAC5B,4EAA4E;IAC5E,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,YAAY,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,WAAW,EAAE,cAAc,CAAC;IAC5B,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAgCrD;AAgBD,wFAAwF;AACxF,wBAAgB,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,YAAY,CAExF;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,GAAG,CAE1E;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAExC;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,+FAA+F;AAC/F,wBAAgB,SAAS,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,GAAG,QAAQ,CAsBxD;AAED,MAAM,MAAM,UAAU,GAClB,iBAAiB,GACjB,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,GAClB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE;QACP,oCAAoC;QACpC,OAAO,EAAE,MAAM,CAAC;QAChB,uFAAuF;QACvF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,CAAC;CACH;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,gBAAgB,CAmE9G"}

package/dist/index.js

@@ -0,0 +1,205 @@
+/**
+ * @zanii/sla — machine-verifiable service agreements between agents.
+ *
+ * Two parties co-sign terms — what service (a target scope), over what window, how
+ * much (min/max actions), how continuously (`max_gap_ms`, an uptime proxy) — and then
+ * **compliance is computed from receipts, not argued about**. `assessCompliance` is
+ * pure: same terms + same receipts → same verdict for everyone, and every breach cites
+ * the evidence. Pair with `@zanii/escrow`: a breach verdict is refund evidence.
+ *
+ * ## The property that makes the metrics honest
+ *
+ * Counting receipts is worthless if the provider can omit the bad hour. Zanii receipts
+ * form a **per-agent hash chain** (`prev` links), so completeness is *provable*:
+ * `assessCompliance` verifies the provided slice is consecutive in the provider's
+ * chain — a broken link is an `INCOMPLETE_RECORD` breach, not a silently wrong count.
+ * The provider hands over its chain segment covering the window; it cannot cherry-pick
+ * from the middle without the seam showing. (Chopping the *ends* off shortens the
+ * record visibly — fewer actions and bigger edge gaps — so trimming hurts, not helps.)
+ *
+ * ## The limit, stated up front
+ *
+ * Receipts prove what was *recorded*, with recording enforced by the rails — an action
+ * taken entirely off the rails is the credential-custody problem, not an SLA one. The
+ * chain check proves no *recorded* action was hidden between the endpooints you were
+ * given between the endpoints; it cannot conjure receipts that were never created. And a gap breach proves
+ * silence on the ledger, which the SLA defines as breach — that definition is the
+ * parties' agreement, not a law of nature.
+ */
+import { ed25519 } from '@noble/curves/ed25519';
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils';
+import { canonicalBytes, jcsHash, publicKeyFromDid, receiptHash, scopeCovers, verifyReceipt, } from '@zanii/core';
+import { parseMoney } from '@zanii/payments';
+export function buildSlaBody(input) {
+    if (!input.provider || !input.client)
+        throw new Error('provider and client are required');
+    if (input.provider === input.client)
+        throw new Error('provider and client must differ');
+    if (!input.scope)
+        throw new Error('scope is required (the target pattern the service receipts match)');
+    const start = Date.parse(input.window?.start ?? '');
+    const end = Date.parse(input.window?.end ?? '');
+    if (Number.isNaN(start) || Number.isNaN(end))
+        throw new Error('window start/end must be ISO timestamps');
+    if (start >= end)
+        throw new Error('window start must be before end');
+    if (Number.isNaN(Date.parse(input.createdAt)))
+        throw new Error('createdAt must be an ISO timestamp');
+    const c = input.commitments ?? {};
+    for (const [k, v] of Object.entries(c)) {
+        if (v !== undefined && (!Number.isInteger(v) || v < 0))
+            throw new Error(`commitment ${k} must be a non-negative integer`);
+    }
+    if (c.min_actions === undefined && c.max_actions === undefined && c.max_gap_ms === undefined) {
+        throw new Error('an SLA with no commitments commits to nothing');
+    }
+    if (c.min_actions !== undefined && c.max_actions !== undefined && c.min_actions > c.max_actions) {
+        throw new Error('min_actions must not exceed max_actions');
+    }
+    const body = {
+        v: 1,
+        type: 'sla',
+        provider: input.provider,
+        client: input.client,
+        scope: input.scope,
+        window: input.window,
+        commitments: c,
+        created_at: input.createdAt,
+    };
+    if (input.price)
+        body.price = parseMoney(input.price.amount, input.price.currency);
+    if (input.ref !== undefined)
+        body.ref = input.ref;
+    return body;
+}
+const sign = (obj, priv) => `ed25519:${bytesToHex(ed25519.sign(canonicalBytes(obj), priv))}`;
+const sigValid = (obj, did, sig) => {
+    const pub = publicKeyFromDid(did);
+    const hex = typeof sig === 'string' && sig.startsWith('ed25519:') ? sig.slice(8) : '';
+    if (!pub || !/^[0-9a-f]{128}$/.test(hex))
+        return false;
+    try {
+        return ed25519.verify(hexToBytes(hex), canonicalBytes(obj), pub);
+    }
+    catch {
+        return false;
+    }
+};
+/** One party signs the terms. Collect one from the provider and one from the client. */
+export function signSla(body, did, privateKey) {
+    return { did, sig: sign(body, privateKey) };
+}
+export function assembleSla(body, signatures) {
+    return { body, signatures };
+}
+export function slaHash(sla) {
+    return jcsHash(sla);
+}
+/** Verify the agreement: structure sane, BOTH provider and client signed these exact terms. */
+export function verifySla(sla) {
+    const reasons = [];
+    const e = sla ?? {};
+    const b = e.body ?? {};
+    if (b.v !== 1 || b.type !== 'sla')
+        reasons.push('not an sla (v1)');
+    if (!b.provider || !b.client || b.provider === b.client)
+        reasons.push('missing/invalid parties');
+    if (!b.scope)
+        reasons.push('missing scope');
+    const start = Date.parse(b.window?.start ?? '');
+    const end = Date.parse(b.window?.end ?? '');
+    if (Number.isNaN(start) || Number.isNaN(end) || start >= end)
+        reasons.push('invalid window');
+    const c = b.commitments ?? {};
+    if (c.min_actions === undefined && c.max_actions === undefined && c.max_gap_ms === undefined) {
+        reasons.push('no commitments');
+    }
+    if (reasons.length === 0) {
+        for (const [party, role] of [[b.provider, 'provider'], [b.client, 'client']]) {
+            const s = (e.signatures ?? []).find((x) => x.did === party);
+            if (!s)
+                reasons.push(`missing signature from ${role}`);
+            else if (!sigValid(b, s.did, s.sig))
+                reasons.push(`invalid signature from ${role}`);
+        }
+    }
+    return { ok: reasons.length === 0, reasons };
+}
+/**
+ * The compliance verdict — pure computation. Pass the provider's **consecutive chain
+ * segment** covering the window (its export slice): every receipt is signature-checked,
+ * the `prev` links are verified so nothing recorded can be hidden between the endpoints
+ * (`INCOMPLETE_RECORD` otherwise), then the commitments are measured on the in-window,
+ * in-scope receipts. `asOf` (default: window end) caps the trailing-gap check so a
+ * mid-window assessment doesn't count the not-yet-elapsed silence as breach.
+ */
+export function assessCompliance(sla, receipts, opts = {}) {
+    const agreement = verifySla(sla);
+    if (!agreement.ok) {
+        return { ok: false, breaches: agreement.reasons.map((r) => ({ kind: 'INVALID_RECEIPT', detail: `sla: ${r}` })), metrics: { actions: 0, max_gap_ms: null } };
+    }
+    const b = sla.body;
+    const breaches = [];
+    const winStart = Date.parse(b.window.start);
+    const winEnd = Date.parse(b.window.end);
+    if (opts.asOf !== undefined && Number.isNaN(Date.parse(opts.asOf)))
+        throw new Error('asOf must be an ISO timestamp');
+    const asOf = Math.min(opts.asOf !== undefined ? Date.parse(opts.asOf) : winEnd, winEnd);
+    // 1. Every receipt must be valid and the provider's.
+    const sorted = [...receipts].sort((x, y) => Date.parse(x.ts) - Date.parse(y.ts));
+    for (const r of sorted) {
+        const check = verifyReceipt(r);
+        if (!check.ok)
+            breaches.push({ kind: 'INVALID_RECEIPT', detail: check.error ?? 'invalid receipt', receipt: receiptHash(r) });
+        else if (r.agent_id !== b.provider)
+            breaches.push({ kind: 'INVALID_RECEIPT', detail: `receipt by ${r.agent_id}, not the provider`, receipt: receiptHash(r) });
+    }
+    // 2. The slice must be consecutive in the provider's hash chain — omission shows as a seam.
+    for (let i = 1; i < sorted.length; i++) {
+        if (sorted[i].prev !== receiptHash(sorted[i - 1])) {
+            breaches.push({
+                kind: 'INCOMPLETE_RECORD',
+                detail: `chain break between receipts #${i - 1} and #${i} — the slice is not the provider's consecutive record`,
+                receipt: receiptHash(sorted[i]),
+            });
+        }
+    }
+    // 3. Measure commitments on the in-window, in-scope receipts.
+    const matching = sorted.filter((r) => {
+        const t = Date.parse(r.ts);
+        return t >= winStart && t <= winEnd && scopeCovers(b.scope, r.target);
+    });
+    const c = b.commitments;
+    if (c.min_actions !== undefined && matching.length < c.min_actions) {
+        breaches.push({ kind: 'TOO_FEW_ACTIONS', detail: `${matching.length} matching actions < committed minimum ${c.min_actions}` });
+    }
+    if (c.max_actions !== undefined && matching.length > c.max_actions) {
+        breaches.push({ kind: 'TOO_MANY_ACTIONS', detail: `${matching.length} matching actions > committed maximum ${c.max_actions}` });
+    }
+    let maxGap = null;
+    if (matching.length > 0) {
+        const times = matching.map((r) => Date.parse(r.ts));
+        const gaps = [{ ms: times[0] - winStart }];
+        for (let i = 1; i < times.length; i++)
+            gaps.push({ ms: times[i] - times[i - 1], after: matching[i - 1] });
+        if (asOf > times[times.length - 1])
+            gaps.push({ ms: asOf - times[times.length - 1], after: matching[matching.length - 1] });
+        maxGap = Math.max(...gaps.map((g) => g.ms));
+        if (c.max_gap_ms !== undefined) {
+            for (const g of gaps) {
+                if (g.ms > c.max_gap_ms) {
+                    breaches.push({
+                        kind: 'MAX_GAP_EXCEEDED',
+                        detail: `${g.ms}ms of silence > committed max ${c.max_gap_ms}ms`,
+                        ...(g.after ? { receipt: receiptHash(g.after) } : {}),
+                    });
+                }
+            }
+        }
+    }
+    else if (c.max_gap_ms !== undefined && asOf - winStart > c.max_gap_ms) {
+        breaches.push({ kind: 'MAX_GAP_EXCEEDED', detail: `no matching actions for ${asOf - winStart}ms > committed max ${c.max_gap_ms}ms` });
+    }
+    return { ok: breaches.length === 0, breaches, metrics: { actions: matching.length, max_gap_ms: maxGap } };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,cAAc,EACd,OAAO,EACP,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,GAEd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AAgDzD,MAAM,UAAU,YAAY,CAAC,KAAe;IAC1C,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC1F,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACxF,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACzG,IAAI,KAAK,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACrG,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,iCAAiC,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7F,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,GAAY;QACpB,CAAC,EAAE,CAAC;QACJ,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,CAAC;QACd,UAAU,EAAE,KAAK,CAAC,SAAS;KAC5B,CAAC;IACF,IAAI,KAAK,CAAC,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnF,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,GAA4B,EAAE,IAAgB,EAAU,EAAE,CACtE,WAAW,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;AAEnE,MAAM,QAAQ,GAAG,CAAC,GAA4B,EAAE,GAAW,EAAE,GAAY,EAAW,EAAE;IACpF,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,wFAAwF;AACxF,MAAM,UAAU,OAAO,CAAC,IAAa,EAAE,GAAW,EAAE,UAAsB;IACxE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAA0C,EAAE,UAAU,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAa,EAAE,UAA0B;IACnE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAQ;IAC9B,OAAO,OAAO,CAAC,GAAyC,CAAC,CAAC;AAC5D,CAAC;AAOD,+FAA+F;AAC/F,MAAM,UAAU,SAAS,CAAC,GAAoB;IAC5C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,CAAC,GAAG,GAAG,IAAK,EAAU,CAAC;IAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,IAAK,EAAc,CAAC;IACpC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACnE,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACjG,IAAI,CAAC,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7F,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAU,EAAE,CAAC;YACtF,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;YAC5D,IAAI,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;iBAClD,IAAI,CAAC,QAAQ,CAAC,CAAuC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;QAC5H,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AA2BD;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAQ,EAAE,QAAmB,EAAE,OAA0B,EAAE;IAC1F,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,iBAA0B,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;IACvK,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;IACnB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACrH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExF,qDAAqD;IACrD,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,IAAI,iBAAiB,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aACxH,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,QAAQ,oBAAoB,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChK,CAAC;IAED,4FAA4F;IAC5F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,mBAAmB;gBACzB,MAAM,EAAE,iCAAiC,CAAC,GAAG,CAAC,SAAS,CAAC,uDAAuD;gBAC/G,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3B,OAAO,CAAC,IAAI,QAAQ,IAAI,CAAC,IAAI,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC;IACxB,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,yCAAyC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,yCAAyC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAClI,CAAC;IAED,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,MAAM,IAAI,GAA2C,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QACpF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5G,IAAI,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9H,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC;oBACxB,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,kBAAkB;wBACxB,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,iCAAiC,CAAC,CAAC,UAAU,IAAI;wBAChE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACtD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,GAAG,QAAQ,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,2BAA2B,IAAI,GAAG,QAAQ,sBAAsB,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACxI,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC;AAC5G,CAAC"}

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@zanii/sla",
+  "version": "0.1.0",
+  "description": "Machine-verifiable service agreements between agents - co-signed terms (scope, window, volume, max-gap uptime proxy) with compliance computed deterministically from receipts. The per-agent hash chain closes the omission hole: a broken prev-link is an INCOMPLETE_RECORD breach, so a provider cannot hide the bad hour. Disputes become arithmetic, and breaches cite receipts.",
+  "license": "Apache-2.0",
+  "homepage": "https://ledger.zanii.agency",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.0",
+    "typescript": "^5.8.2",
+    "vitest": "^3.0.9"
+  },
+  "dependencies": {
+    "@noble/curves": "^1.8.1",
+    "@noble/hashes": "^1.7.1",
+    "@zanii/core": "0.4.0",
+    "@zanii/payments": "0.1.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  }
+}

package/src/index.ts

@@ -0,0 +1,279 @@
+/**
+ * @zanii/sla — machine-verifiable service agreements between agents.
+ *
+ * Two parties co-sign terms — what service (a target scope), over what window, how
+ * much (min/max actions), how continuously (`max_gap_ms`, an uptime proxy) — and then
+ * **compliance is computed from receipts, not argued about**. `assessCompliance` is
+ * pure: same terms + same receipts → same verdict for everyone, and every breach cites
+ * the evidence. Pair with `@zanii/escrow`: a breach verdict is refund evidence.
+ *
+ * ## The property that makes the metrics honest
+ *
+ * Counting receipts is worthless if the provider can omit the bad hour. Zanii receipts
+ * form a **per-agent hash chain** (`prev` links), so completeness is *provable*:
+ * `assessCompliance` verifies the provided slice is consecutive in the provider's
+ * chain — a broken link is an `INCOMPLETE_RECORD` breach, not a silently wrong count.
+ * The provider hands over its chain segment covering the window; it cannot cherry-pick
+ * from the middle without the seam showing. (Chopping the *ends* off shortens the
+ * record visibly — fewer actions and bigger edge gaps — so trimming hurts, not helps.)
+ *
+ * ## The limit, stated up front
+ *
+ * Receipts prove what was *recorded*, with recording enforced by the rails — an action
+ * taken entirely off the rails is the credential-custody problem, not an SLA one. The
+ * chain check proves no *recorded* action was hidden between the endpooints you were
+ * given between the endpoints; it cannot conjure receipts that were never created. And a gap breach proves
+ * silence on the ledger, which the SLA defines as breach — that definition is the
+ * parties' agreement, not a law of nature.
+ */
+import { ed25519 } from '@noble/curves/ed25519';
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils';
+import {
+  canonicalBytes,
+  jcsHash,
+  publicKeyFromDid,
+  receiptHash,
+  scopeCovers,
+  verifyReceipt,
+  type Receipt,
+} from '@zanii/core';
+import { parseMoney, type Money } from '@zanii/payments';
+
+export interface SlaCommitments {
+  /** Fewest matching receipts the window must contain. */
+  min_actions?: number;
+  /** Most matching receipts the window may contain. */
+  max_actions?: number;
+  /** Max silence between matching receipts (and to the window edges) — an uptime proxy. */
+  max_gap_ms?: number;
+}
+
+export interface SlaBody {
+  v: 1;
+  type: 'sla';
+  provider: string;
+  client: string;
+  /** Scope pattern the service's receipts must match, e.g. `feed.sync` or `api.*`. */
+  scope: string;
+  window: { start: string; end: string };
+  commitments: SlaCommitments;
+  /** Informational price — ties to an escrow; not used by compliance math. */
+  price?: Money;
+  created_at: string;
+  ref?: string;
+}
+
+export interface SlaSignature {
+  did: string;
+  /** `ed25519:<hex>` over the canonical (JCS) bytes of the body. */
+  sig: string;
+}
+
+export interface Sla {
+  body: SlaBody;
+  signatures: SlaSignature[];
+}
+
+export interface SlaInput {
+  provider: string;
+  client: string;
+  scope: string;
+  window: { start: string; end: string };
+  commitments: SlaCommitments;
+  price?: { amount: string; currency: string };
+  createdAt: string;
+  ref?: string;
+}
+
+export function buildSlaBody(input: SlaInput): SlaBody {
+  if (!input.provider || !input.client) throw new Error('provider and client are required');
+  if (input.provider === input.client) throw new Error('provider and client must differ');
+  if (!input.scope) throw new Error('scope is required (the target pattern the service receipts match)');
+  const start = Date.parse(input.window?.start ?? '');
+  const end = Date.parse(input.window?.end ?? '');
+  if (Number.isNaN(start) || Number.isNaN(end)) throw new Error('window start/end must be ISO timestamps');
+  if (start >= end) throw new Error('window start must be before end');
+  if (Number.isNaN(Date.parse(input.createdAt))) throw new Error('createdAt must be an ISO timestamp');
+  const c = input.commitments ?? {};
+  for (const [k, v] of Object.entries(c)) {
+    if (v !== undefined && (!Number.isInteger(v) || v < 0)) throw new Error(`commitment ${k} must be a non-negative integer`);
+  }
+  if (c.min_actions === undefined && c.max_actions === undefined && c.max_gap_ms === undefined) {
+    throw new Error('an SLA with no commitments commits to nothing');
+  }
+  if (c.min_actions !== undefined && c.max_actions !== undefined && c.min_actions > c.max_actions) {
+    throw new Error('min_actions must not exceed max_actions');
+  }
+  const body: SlaBody = {
+    v: 1,
+    type: 'sla',
+    provider: input.provider,
+    client: input.client,
+    scope: input.scope,
+    window: input.window,
+    commitments: c,
+    created_at: input.createdAt,
+  };
+  if (input.price) body.price = parseMoney(input.price.amount, input.price.currency);
+  if (input.ref !== undefined) body.ref = input.ref;
+  return body;
+}
+
+const sign = (obj: Record<string, unknown>, priv: Uint8Array): string =>
+  `ed25519:${bytesToHex(ed25519.sign(canonicalBytes(obj), priv))}`;
+
+const sigValid = (obj: Record<string, unknown>, did: string, sig: unknown): boolean => {
+  const pub = publicKeyFromDid(did);
+  const hex = typeof sig === 'string' && sig.startsWith('ed25519:') ? sig.slice(8) : '';
+  if (!pub || !/^[0-9a-f]{128}$/.test(hex)) return false;
+  try {
+    return ed25519.verify(hexToBytes(hex), canonicalBytes(obj), pub);
+  } catch {
+    return false;
+  }
+};
+
+/** One party signs the terms. Collect one from the provider and one from the client. */
+export function signSla(body: SlaBody, did: string, privateKey: Uint8Array): SlaSignature {
+  return { did, sig: sign(body as unknown as Record<string, unknown>, privateKey) };
+}
+
+export function assembleSla(body: SlaBody, signatures: SlaSignature[]): Sla {
+  return { body, signatures };
+}
+
+export function slaHash(sla: Sla): string {
+  return jcsHash(sla as unknown as Record<string, unknown>);
+}
+
+export interface SlaCheck {
+  ok: boolean;
+  reasons: string[];
+}
+
+/** Verify the agreement: structure sane, BOTH provider and client signed these exact terms. */
+export function verifySla(sla: Sla | undefined): SlaCheck {
+  const reasons: string[] = [];
+  const e = sla ?? ({} as Sla);
+  const b = e.body ?? ({} as SlaBody);
+  if (b.v !== 1 || b.type !== 'sla') reasons.push('not an sla (v1)');
+  if (!b.provider || !b.client || b.provider === b.client) reasons.push('missing/invalid parties');
+  if (!b.scope) reasons.push('missing scope');
+  const start = Date.parse(b.window?.start ?? '');
+  const end = Date.parse(b.window?.end ?? '');
+  if (Number.isNaN(start) || Number.isNaN(end) || start >= end) reasons.push('invalid window');
+  const c = b.commitments ?? {};
+  if (c.min_actions === undefined && c.max_actions === undefined && c.max_gap_ms === undefined) {
+    reasons.push('no commitments');
+  }
+  if (reasons.length === 0) {
+    for (const [party, role] of [[b.provider, 'provider'], [b.client, 'client']] as const) {
+      const s = (e.signatures ?? []).find((x) => x.did === party);
+      if (!s) reasons.push(`missing signature from ${role}`);
+      else if (!sigValid(b as unknown as Record<string, unknown>, s.did, s.sig)) reasons.push(`invalid signature from ${role}`);
+    }
+  }
+  return { ok: reasons.length === 0, reasons };
+}
+
+export type BreachKind =
+  | 'INVALID_RECEIPT'
+  | 'INCOMPLETE_RECORD'
+  | 'TOO_FEW_ACTIONS'
+  | 'TOO_MANY_ACTIONS'
+  | 'MAX_GAP_EXCEEDED';
+
+export interface Breach {
+  kind: BreachKind;
+  detail: string;
+  /** JCS hash of the receipt at/after which the breach sits, when applicable. */
+  receipt?: string;
+}
+
+export interface ComplianceReport {
+  ok: boolean;
+  breaches: Breach[];
+  metrics: {
+    /** In-window, in-scope receipts. */
+    actions: number;
+    /** Largest observed silence (ms), window edges included. null when nothing matched. */
+    max_gap_ms: number | null;
+  };
+}
+
+/**
+ * The compliance verdict — pure computation. Pass the provider's **consecutive chain
+ * segment** covering the window (its export slice): every receipt is signature-checked,
+ * the `prev` links are verified so nothing recorded can be hidden between the endpoints
+ * (`INCOMPLETE_RECORD` otherwise), then the commitments are measured on the in-window,
+ * in-scope receipts. `asOf` (default: window end) caps the trailing-gap check so a
+ * mid-window assessment doesn't count the not-yet-elapsed silence as breach.
+ */
+export function assessCompliance(sla: Sla, receipts: Receipt[], opts: { asOf?: string } = {}): ComplianceReport {
+  const agreement = verifySla(sla);
+  if (!agreement.ok) {
+    return { ok: false, breaches: agreement.reasons.map((r) => ({ kind: 'INVALID_RECEIPT' as const, detail: `sla: ${r}` })), metrics: { actions: 0, max_gap_ms: null } };
+  }
+  const b = sla.body;
+  const breaches: Breach[] = [];
+  const winStart = Date.parse(b.window.start);
+  const winEnd = Date.parse(b.window.end);
+  if (opts.asOf !== undefined && Number.isNaN(Date.parse(opts.asOf))) throw new Error('asOf must be an ISO timestamp');
+  const asOf = Math.min(opts.asOf !== undefined ? Date.parse(opts.asOf) : winEnd, winEnd);
+
+  // 1. Every receipt must be valid and the provider's.
+  const sorted = [...receipts].sort((x, y) => Date.parse(x.ts) - Date.parse(y.ts));
+  for (const r of sorted) {
+    const check = verifyReceipt(r);
+    if (!check.ok) breaches.push({ kind: 'INVALID_RECEIPT', detail: check.error ?? 'invalid receipt', receipt: receiptHash(r) });
+    else if (r.agent_id !== b.provider) breaches.push({ kind: 'INVALID_RECEIPT', detail: `receipt by ${r.agent_id}, not the provider`, receipt: receiptHash(r) });
+  }
+
+  // 2. The slice must be consecutive in the provider's hash chain — omission shows as a seam.
+  for (let i = 1; i < sorted.length; i++) {
+    if (sorted[i]!.prev !== receiptHash(sorted[i - 1]!)) {
+      breaches.push({
+        kind: 'INCOMPLETE_RECORD',
+        detail: `chain break between receipts #${i - 1} and #${i} — the slice is not the provider's consecutive record`,
+        receipt: receiptHash(sorted[i]!),
+      });
+    }
+  }
+
+  // 3. Measure commitments on the in-window, in-scope receipts.
+  const matching = sorted.filter((r) => {
+    const t = Date.parse(r.ts);
+    return t >= winStart && t <= winEnd && scopeCovers(b.scope, r.target);
+  });
+  const c = b.commitments;
+  if (c.min_actions !== undefined && matching.length < c.min_actions) {
+    breaches.push({ kind: 'TOO_FEW_ACTIONS', detail: `${matching.length} matching actions < committed minimum ${c.min_actions}` });
+  }
+  if (c.max_actions !== undefined && matching.length > c.max_actions) {
+    breaches.push({ kind: 'TOO_MANY_ACTIONS', detail: `${matching.length} matching actions > committed maximum ${c.max_actions}` });
+  }
+
+  let maxGap: number | null = null;
+  if (matching.length > 0) {
+    const times = matching.map((r) => Date.parse(r.ts));
+    const gaps: Array<{ ms: number; after?: Receipt }> = [{ ms: times[0]! - winStart }];
+    for (let i = 1; i < times.length; i++) gaps.push({ ms: times[i]! - times[i - 1]!, after: matching[i - 1] });
+    if (asOf > times[times.length - 1]!) gaps.push({ ms: asOf - times[times.length - 1]!, after: matching[matching.length - 1] });
+    maxGap = Math.max(...gaps.map((g) => g.ms));
+    if (c.max_gap_ms !== undefined) {
+      for (const g of gaps) {
+        if (g.ms > c.max_gap_ms) {
+          breaches.push({
+            kind: 'MAX_GAP_EXCEEDED',
+            detail: `${g.ms}ms of silence > committed max ${c.max_gap_ms}ms`,
+            ...(g.after ? { receipt: receiptHash(g.after) } : {}),
+          });
+        }
+      }
+    }
+  } else if (c.max_gap_ms !== undefined && asOf - winStart > c.max_gap_ms) {
+    breaches.push({ kind: 'MAX_GAP_EXCEEDED', detail: `no matching actions for ${asOf - winStart}ms > committed max ${c.max_gap_ms}ms` });
+  }
+
+  return { ok: breaches.length === 0, breaches, metrics: { actions: matching.length, max_gap_ms: maxGap } };
+}