shieldcortex 0.1.1__tar.gz → 0.3.0__tar.gz

shieldcortex-0.3.0/CHANGELOG.md

@@ -0,0 +1,57 @@
+# Changelog
+
+## 0.2.0 — 2026-08-11
+
+SDK lockstep release: the Python SDK now covers the full customer surface
+documented in the SDK lockstep contract, in lockstep with the TypeScript SDK.
+
+### Added
+
+- **Verification** — `submit_verification()`, `list_verifications()`,
+  `get_verification()`, `get_verification_stats()`, `delete_verification()`
+- **Skills** — `ingest_skill_scans()`, `list_skill_scans()`
+- **Threats** — `report_threat()` (OpenClaw realtime compat shim)
+- **Incidents** — `replay_incidents()`
+- **Recall** — `explain_recall()`
+- **Sync** — `get_sync_health()`, `push_memories()`, `list_synced_memories()`,
+  `push_memory_graph()`. Note: `list_synced_memories()` omits the
+  `include_deleted` param unless truthy — the server Boolean-coerces any
+  present value (even `"false"`) as enabling it. Every other boolean query
+  param was audited for the same coercion trap; none affected.
+- **Licence** — `get_license()`, `regenerate_license()`
+- **Audit** — `ingest_audit_events()`, `get_iron_dome_stats()`,
+  `get_iron_dome_events()`, and the export-manifest surface
+  (`list_audit_exports()`, `get_audit_export_manifest()`,
+  `verify_audit_export()`, `list_audit_export_verifications()`)
+- Cross-SDK endpoint parity manifest and drift guard
+  (`tests/endpoint_manifest.py`, kept in lockstep with the TS SDK's
+  `tests/endpoint-manifest.ts`), including a sync/async surface parity test
+- Shared request builders (`_payloads.py`) so the sync and async clients
+  construct identical wire payloads and cannot drift
+
+### Changed
+
+- **BREAKING:** `export_audit_logs()` (both clients) now returns
+  `AuditExportResult` — the raw file body in `.content` plus the parsed
+  `X-ShieldCortex-Export-*` integrity headers in `.headers` — instead of a
+  bare `str`. Previously the integrity headers were discarded, so exports
+  structurally could not be verified. An absent `sha256`/`signature` header
+  is `None` (never `""`): the export is unverifiable. Migration:
+  `client.export_audit_logs(...)` → `client.export_audit_logs(...).content`.
+
+### Deprecated
+
+- `create_checkout_session()` / `create_portal_session()` now emit
+  `DeprecationWarning`: self-serve plans were retired 2026-07 (Free +
+  Enterprise model); the endpoints remain for grandfathered licence holders.
+
+## 0.1.1 — 2026-03-12
+
+- Added Iron Dome patterns/policies client support; fixed the default-policy
+  verb (PUT).
+
+## 0.1.0 — 2026-02-15
+
+- Initial release: scanning, audit, quarantine, keys, teams, invites,
+  billing, devices, alerts, webhooks, firewall rules; sync + async clients;
+  CrewAI and LangChain integrations; Python 3.9+ compatibility fixes.

{shieldcortex-0.1.1 → shieldcortex-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: shieldcortex
-Version: 0.1.1
+Version: 0.3.0
 Summary: Official Python SDK for the ShieldCortex API — AI memory security scanning
 Project-URL: Homepage, https://shieldcortex.ai
 Project-URL: Documentation, https://shieldcortex.ai/docs
@@ -166,8 +166,10 @@ logs = client.get_audit_logs(AuditQuery(level="BLOCK", limit=10))
 for entry in client.iter_audit_logs():
     print(entry.id, entry.firewall_result)
 
-# Export as CSV
-csv = client.export_audit_logs(format="csv")
+# Export as CSV — returns the raw body plus integrity headers
+export = client.export_audit_logs(format="csv")
+print(export.content)
+print(export.headers.sha256)  # None ⇒ export unverifiable
 ```
 
 ## Error Handling
@@ -185,24 +187,60 @@ except ValidationError:
     print("Invalid request")
 ```
 
-## Full API Coverage
+## API Coverage
 
-The SDK covers all ShieldCortex API endpoints:
+The SDK covers the full customer surface documented in the SDK lockstep contract:
 
 | Category | Methods |
 |----------|---------|
 | **Scanning** | `scan()`, `scan_batch()`, `scan_skill()` |
-| **Audit** | `get_audit_logs()`, `get_audit_entry()`, `get_audit_stats()`, `get_audit_trends()`, `export_audit_logs()`, `iter_audit_logs()` |
+| **Audit** | `get_audit_logs()`, `get_audit_entry()`, `get_audit_stats()`, `get_audit_trends()`, `export_audit_logs()`, `iter_audit_logs()`, `ingest_audit_events()`, `get_iron_dome_stats()`, `get_iron_dome_events()` |
+| **Audit Export Manifests** | `list_audit_exports()`, `get_audit_export_manifest()`, `verify_audit_export()`, `list_audit_export_verifications()` |
 | **Quarantine** | `get_quarantine()`, `get_quarantine_item()`, `review_quarantine_item()` |
 | **API Keys** | `create_api_key()`, `list_api_keys()`, `revoke_api_key()` |
 | **Teams** | `get_team()`, `update_team()`, `get_team_members()`, `get_usage()` |
 | **Invites** | `create_invite()`, `list_invites()`, `delete_invite()`, `resend_invite()` |
-| **Billing** | `create_checkout_session()`, `create_portal_session()` |
+| **Billing** (deprecated) | `create_checkout_session()`, `create_portal_session()` — self-serve plans retired 2026-07; retained for grandfathered licence holders |
 | **Devices** | `get_devices()`, `register_device()`, `update_device()`, `device_heartbeat()` |
 | **Alerts** | `get_alerts()`, `create_alert()`, `update_alert()`, `delete_alert()` |
 | **Webhooks** | `get_webhooks()`, `create_webhook()`, `update_webhook()`, `delete_webhook()`, `test_webhook()`, `get_webhook_deliveries()` |
 | **Firewall Rules** | `get_firewall_rules()`, `get_active_firewall_rules()`, `create_firewall_rule()`, `update_firewall_rule()`, `delete_firewall_rule()` |
 | **Iron Dome** | `get_injection_patterns()`, `get_injection_patterns_sync()`, `create_injection_pattern()`, `update_injection_pattern()`, `test_injection_pattern()`, `delete_injection_pattern()`, `get_iron_dome_policies()`, `get_iron_dome_policy_sync()`, `create_iron_dome_policy()`, `update_iron_dome_policy()`, `set_default_iron_dome_policy()`, `delete_iron_dome_policy()` |
+| **Verification** | `submit_verification()`, `list_verifications()`, `get_verification()`, `get_verification_stats()`, `delete_verification()` |
+| **Skills** | `ingest_skill_scans()`, `list_skill_scans()` |
+| **Threats** | `report_threat()` |
+| **Incidents** | `replay_incidents()` |
+| **Recall** | `explain_recall()` |
+| **Sync** | `get_sync_health()`, `push_memories()`, `list_synced_memories()`, `push_memory_graph()` |
+| **Licence** | `get_license()`, `regenerate_license()` |
+
+### Deferred endpoints
+
+The audit **verification-export download chain** (`GET .../verifications/export`,
+`GET .../verification-exports`, `GET .../verification-exports/{id}` and its
+`/download`) is deliberately deferred — it serves CLI tooling rather than SDK
+consumers. See `tests/endpoint_manifest.py` for the canonical list.
+
+### Out of scope
+
+- `/v1/platform/*` — platform-owner operations
+- `/v1/auth/*` — magic-link login flows (browser/dashboard, not API-key auth)
+- `/v1/customizer/*` — retired 2026-07
+
+Additional dashboard/session-scoped `/v1` routes exist server-side; they sit
+outside the SDK's API-key surface.
+
+### Cross-SDK policy notes
+
+The Python and TypeScript SDKs cover the same endpoint manifest, with two
+deliberate differences:
+
+1. **Deletes** — the TypeScript SDK returns `void` from every delete method;
+   the Python SDK returns the typed response body where the server sends one
+   (per-language internal consistency).
+2. **Audit export** — both SDKs return the raw file content together with the
+   parsed `X-ShieldCortex-Export-*` integrity headers. An absent `sha256` or
+   `signature` header means the export is unverifiable.
 
 ## Documentation
 

{shieldcortex-0.1.1 → shieldcortex-0.3.0}/README.md

@@ -127,8 +127,10 @@ logs = client.get_audit_logs(AuditQuery(level="BLOCK", limit=10))
 for entry in client.iter_audit_logs():
     print(entry.id, entry.firewall_result)
 
-# Export as CSV
-csv = client.export_audit_logs(format="csv")
+# Export as CSV — returns the raw body plus integrity headers
+export = client.export_audit_logs(format="csv")
+print(export.content)
+print(export.headers.sha256)  # None ⇒ export unverifiable
 ```
 
 ## Error Handling
@@ -146,24 +148,60 @@ except ValidationError:
     print("Invalid request")
 ```
 
-## Full API Coverage
+## API Coverage
 
-The SDK covers all ShieldCortex API endpoints:
+The SDK covers the full customer surface documented in the SDK lockstep contract:
 
 | Category | Methods |
 |----------|---------|
 | **Scanning** | `scan()`, `scan_batch()`, `scan_skill()` |
-| **Audit** | `get_audit_logs()`, `get_audit_entry()`, `get_audit_stats()`, `get_audit_trends()`, `export_audit_logs()`, `iter_audit_logs()` |
+| **Audit** | `get_audit_logs()`, `get_audit_entry()`, `get_audit_stats()`, `get_audit_trends()`, `export_audit_logs()`, `iter_audit_logs()`, `ingest_audit_events()`, `get_iron_dome_stats()`, `get_iron_dome_events()` |
+| **Audit Export Manifests** | `list_audit_exports()`, `get_audit_export_manifest()`, `verify_audit_export()`, `list_audit_export_verifications()` |
 | **Quarantine** | `get_quarantine()`, `get_quarantine_item()`, `review_quarantine_item()` |
 | **API Keys** | `create_api_key()`, `list_api_keys()`, `revoke_api_key()` |
 | **Teams** | `get_team()`, `update_team()`, `get_team_members()`, `get_usage()` |
 | **Invites** | `create_invite()`, `list_invites()`, `delete_invite()`, `resend_invite()` |
-| **Billing** | `create_checkout_session()`, `create_portal_session()` |
+| **Billing** (deprecated) | `create_checkout_session()`, `create_portal_session()` — self-serve plans retired 2026-07; retained for grandfathered licence holders |
 | **Devices** | `get_devices()`, `register_device()`, `update_device()`, `device_heartbeat()` |
 | **Alerts** | `get_alerts()`, `create_alert()`, `update_alert()`, `delete_alert()` |
 | **Webhooks** | `get_webhooks()`, `create_webhook()`, `update_webhook()`, `delete_webhook()`, `test_webhook()`, `get_webhook_deliveries()` |
 | **Firewall Rules** | `get_firewall_rules()`, `get_active_firewall_rules()`, `create_firewall_rule()`, `update_firewall_rule()`, `delete_firewall_rule()` |
 | **Iron Dome** | `get_injection_patterns()`, `get_injection_patterns_sync()`, `create_injection_pattern()`, `update_injection_pattern()`, `test_injection_pattern()`, `delete_injection_pattern()`, `get_iron_dome_policies()`, `get_iron_dome_policy_sync()`, `create_iron_dome_policy()`, `update_iron_dome_policy()`, `set_default_iron_dome_policy()`, `delete_iron_dome_policy()` |
+| **Verification** | `submit_verification()`, `list_verifications()`, `get_verification()`, `get_verification_stats()`, `delete_verification()` |
+| **Skills** | `ingest_skill_scans()`, `list_skill_scans()` |
+| **Threats** | `report_threat()` |
+| **Incidents** | `replay_incidents()` |
+| **Recall** | `explain_recall()` |
+| **Sync** | `get_sync_health()`, `push_memories()`, `list_synced_memories()`, `push_memory_graph()` |
+| **Licence** | `get_license()`, `regenerate_license()` |
+
+### Deferred endpoints
+
+The audit **verification-export download chain** (`GET .../verifications/export`,
+`GET .../verification-exports`, `GET .../verification-exports/{id}` and its
+`/download`) is deliberately deferred — it serves CLI tooling rather than SDK
+consumers. See `tests/endpoint_manifest.py` for the canonical list.
+
+### Out of scope
+
+- `/v1/platform/*` — platform-owner operations
+- `/v1/auth/*` — magic-link login flows (browser/dashboard, not API-key auth)
+- `/v1/customizer/*` — retired 2026-07
+
+Additional dashboard/session-scoped `/v1` routes exist server-side; they sit
+outside the SDK's API-key surface.
+
+### Cross-SDK policy notes
+
+The Python and TypeScript SDKs cover the same endpoint manifest, with two
+deliberate differences:
+
+1. **Deletes** — the TypeScript SDK returns `void` from every delete method;
+   the Python SDK returns the typed response body where the server sends one
+   (per-language internal consistency).
+2. **Audit export** — both SDKs return the raw file content together with the
+   parsed `X-ShieldCortex-Export-*` integrity headers. An absent `sha256` or
+   `signature` header means the export is unverifiable.
 
 ## Documentation
 

shieldcortex-0.3.0/examples/audit_export.py

@@ -0,0 +1,48 @@
+"""Audit log querying and export example."""
+
+from shieldcortex import ShieldCortex, AuditQuery
+
+client = ShieldCortex(api_key="sc_live_YOUR_KEY_HERE")
+
+# Get summary stats
+stats = client.get_audit_stats(time_range="7d")
+print(f"Total operations: {stats.total_operations}")
+print(f"Allowed: {stats.allowed_count}")
+print(f"Blocked: {stats.blocked_count}")
+print(f"Quarantined: {stats.quarantined_count}")
+
+# Query blocked entries
+logs = client.get_audit_logs(AuditQuery(level="BLOCK", limit=5))
+print(f"\nRecent blocks ({logs.total} total):")
+for entry in logs.logs:
+    print(f"  [{entry.timestamp}] {entry.reason} (trust: {entry.trust_score})")
+
+# Auto-paginate through all entries
+print("\nAll audit entries:")
+for entry in client.iter_audit_logs(AuditQuery(level="BLOCK")):
+    print(f"  #{entry.id}: {entry.firewall_result}")
+
+# Export as CSV — returns the raw body plus X-ShieldCortex-Export-* integrity headers
+export = client.export_audit_logs(format="csv")
+with open("audit_export.csv", "w") as f:
+    f.write(export.content)
+print("\nExported to audit_export.csv")
+
+# Verify the export's integrity. sha256/signature/manifest_id are None when
+# the server did not send them — the export is unverifiable, never "".
+headers = export.headers
+if headers.sha256 is None or headers.signature is None:
+    print("Export is UNVERIFIABLE — integrity headers absent")
+else:
+    print(f"Entries: {headers.count}")
+    print(f"SHA-256: {headers.sha256}")
+    print(f"Signature ({headers.signature_algorithm}): {headers.signature}")
+    if headers.manifest_id is not None:
+        # Server-side check against the persisted, signed manifest
+        response = client.verify_audit_export(
+            headers.manifest_id, export_sha256=headers.sha256
+        )
+        result = response.verification
+        print(f"Manifest {headers.manifest_id}:")
+        print(f"  signature valid: {result.signature_valid}")
+        print(f"  sha256 matches:  {result.sha256_matches}")

{shieldcortex-0.1.1 → shieldcortex-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "shieldcortex"
-version = "0.1.1"
+version = "0.3.0"
 description = "Official Python SDK for the ShieldCortex API — AI memory security scanning"
 readme = "README.md"
 license = { text = "MIT" }

{shieldcortex-0.1.1 → shieldcortex-0.3.0}/src/shieldcortex/__init__.py

@@ -24,6 +24,10 @@ from shieldcortex.errors import (
 from shieldcortex.types import (
     AlertRule,
     AuditEntry,
+    AuditExportHeaders,
+    AuditExportResult,
+    AuditIngestEntry,
+    AuditIngestResponse,
     AuditQuery,
     AuditResponse,
     AuditStats,
@@ -32,19 +36,39 @@ from shieldcortex.types import (
     CheckoutResponse,
     CreateKeyResponse,
     CreateWebhookResponse,
+    DeleteVerificationResponse,
+    DetectedThreat,
     Device,
+    ExportManifest,
+    ExportManifestDetail,
+    ExportManifestListResponse,
+    ExportVerificationEvent,
+    ExportVerificationListResponse,
+    ExportVerifyExpected,
+    ExportVerifyResponse,
+    ExportVerifyResult,
     FirewallResult,
     FirewallRule,
     FragmentationResult,
+    IncidentCoverage,
+    IncidentEvent,
+    IncidentReplayResponse,
+    IncidentStreamSummary,
     InjectionPattern,
     InjectionPatternsResponse,
     Invite,
     InviteListResponse,
+    IronDomeEvent,
+    IronDomeEventsResponse,
     IronDomePoliciesResponse,
     IronDomePolicy,
+    IronDomeStats,
+    IronDomeTopDevice,
     KeyInfo,
     KeyListItem,
     KeyListResponse,
+    LicenseInfo,
+    ManifestVerification,
     MembersResponse,
     Pagination,
     PatternSyncItem,
@@ -55,24 +79,56 @@ from shieldcortex.types import (
     QuarantineItem,
     QuarantineQuery,
     QuarantineResponse,
+    RecallExplainResponse,
+    RecallLinkedEntity,
+    RecallMemory,
+    RecallResult,
+    RecallScoreBreakdown,
+    RegenerateLicenseResponse,
     ReviewResponse,
     ScanConfig,
     ScanResult,
     ScanSource,
     SensitivityResult,
+    SkillFinding,
+    SkillIngestResponse,
+    SkillScanFile,
+    SkillScanListResponse,
     SkillScanMetadata,
     SkillScanResult,
     SkillThreat,
     SourceCount,
+    SyncDeviceHealth,
+    SyncedMemoriesResponse,
+    SyncedMemory,
+    SyncedSkillScan,
+    SyncGraphEntity,
+    SyncGraphResponse,
+    SyncGraphTriple,
+    SyncHealth,
+    SyncHealthSummary,
+    SyncLatestDeviceSync,
+    SyncMemory,
+    SyncMemoryEntityLink,
+    SyncMemorySummary,
+    SyncPushResponse,
     TeamInfo,
     TeamMember,
     TestWebhookResponse,
+    ThreatReportResponse,
     TrendBucket,
     TrendResponse,
     TrustResult,
     UsageBreakdown,
     UsageInfo,
     UsageResponse,
+    VerificationDayStats,
+    VerificationDetail,
+    VerificationListItem,
+    VerificationListResponse,
+    VerificationQuota,
+    VerificationResult,
+    VerificationStats,
     Webhook,
     WebhookDelivery,
 )
@@ -111,6 +167,8 @@ __all__ = [
     "SourceCount",
     "TrendBucket",
     "TrendResponse",
+    "AuditExportHeaders",
+    "AuditExportResult",
     "Pagination",
     # Quarantine types
     "QuarantineQuery",
@@ -154,4 +212,66 @@ __all__ = [
     "IronDomePolicy",
     "IronDomePoliciesResponse",
     "PolicySyncResponse",
+    # Verification types
+    "DetectedThreat",
+    "VerificationResult",
+    "VerificationListItem",
+    "VerificationListResponse",
+    "VerificationDetail",
+    "VerificationDayStats",
+    "VerificationQuota",
+    "VerificationStats",
+    "DeleteVerificationResponse",
+    # Skill sync types
+    "SkillFinding",
+    "SkillScanFile",
+    "SkillIngestResponse",
+    "SyncedSkillScan",
+    "SkillScanListResponse",
+    # Threat types
+    "ThreatReportResponse",
+    # Incident types
+    "IncidentEvent",
+    "IncidentStreamSummary",
+    "IncidentCoverage",
+    "IncidentReplayResponse",
+    # Recall types
+    "RecallMemory",
+    "RecallLinkedEntity",
+    "RecallScoreBreakdown",
+    "RecallResult",
+    "RecallExplainResponse",
+    # Sync types
+    "SyncHealth",
+    "SyncMemory",
+    "SyncPushResponse",
+    "SyncedMemory",
+    "SyncLatestDeviceSync",
+    "SyncDeviceHealth",
+    "SyncHealthSummary",
+    "SyncMemorySummary",
+    "SyncedMemoriesResponse",
+    "SyncGraphEntity",
+    "SyncGraphTriple",
+    "SyncMemoryEntityLink",
+    "SyncGraphResponse",
+    # License types
+    "LicenseInfo",
+    "RegenerateLicenseResponse",
+    # Audit Iron Dome & export types
+    "IronDomeTopDevice",
+    "IronDomeStats",
+    "IronDomeEvent",
+    "IronDomeEventsResponse",
+    "AuditIngestEntry",
+    "AuditIngestResponse",
+    "ExportManifest",
+    "ExportManifestListResponse",
+    "ManifestVerification",
+    "ExportManifestDetail",
+    "ExportVerifyResult",
+    "ExportVerifyExpected",
+    "ExportVerifyResponse",
+    "ExportVerificationEvent",
+    "ExportVerificationListResponse",
 ]

{shieldcortex-0.1.1 → shieldcortex-0.3.0}/src/shieldcortex/_http.py

@@ -8,6 +8,7 @@ from __future__ import annotations
 
 import dataclasses
 import re
+from collections.abc import Callable
 from typing import Any, TypeVar, get_type_hints
 
 import httpx
@@ -21,6 +22,7 @@ from shieldcortex.errors import (
     ShieldCortexError,
     ValidationError,
 )
+from shieldcortex.types import AuditExportHeaders
 
 T = TypeVar("T")
 
@@ -54,12 +56,12 @@ _QUERY_ALIASES: dict[str, str] = {
 # ── Serialisation ─────────────────────────────────────────────────────────────
 
 
-def serialize(obj: Any) -> Any:
-    """Convert a dataclass (or primitive) to an API-compatible dict.
+def _serialize(obj: Any, key_of: Callable[[dataclasses.Field[Any]], str]) -> Any:
+    """Shared serialisation traversal.
 
-    - Dataclass fields are converted to camelCase
+    - Wire keys are derived per field by ``key_of``
     - None values are omitted
-    - Nested dataclasses are recursed
+    - Nested dataclasses, lists and dicts are recursed
     """
     if dataclasses.is_dataclass(obj) and not isinstance(obj, type):
         result: dict[str, Any] = {}
@@ -67,16 +69,44 @@ def serialize(obj: Any) -> Any:
             value = getattr(obj, f.name)
             if value is None:
                 continue
-            api_key = _to_camel(f.name)
-            result[api_key] = serialize(value)
+            result[key_of(f)] = _serialize(value, key_of)
         return result
     if isinstance(obj, list):
-        return [serialize(item) for item in obj]
+        return [_serialize(item, key_of) for item in obj]
     if isinstance(obj, dict):
-        return {k: serialize(v) for k, v in obj.items()}
+        return {k: _serialize(v, key_of) for k, v in obj.items()}
     return obj
 
 
+def _camel_key(f: dataclasses.Field[Any]) -> str:
+    return _to_camel(f.name)
+
+
+def _snake_wire_key(f: dataclasses.Field[Any]) -> str:
+    return str(f.metadata.get("wire", f.name))
+
+
+def serialize(obj: Any) -> Any:
+    """Convert a dataclass (or primitive) to an API-compatible dict.
+
+    - Dataclass fields are converted to camelCase
+    - None values are omitted
+    - Nested dataclasses are recursed
+    """
+    return _serialize(obj, _camel_key)
+
+
+def serialize_snake(obj: Any) -> Any:
+    """Convert a dataclass (or primitive) to a snake_case wire dict.
+
+    Unlike :func:`serialize`, field names are kept snake_case (the house wire
+    convention). Known camelCase warts (e.g. skills findings[].matchedText)
+    are declared per field via ``metadata={"wire": ...}`` in types.py.
+    None values are omitted; nested dataclasses are recursed.
+    """
+    return _serialize(obj, _snake_wire_key)
+
+
 def serialize_query(obj: Any) -> dict[str, str]:
     """Convert a dataclass to query parameter dict (string values, no Nones)."""
     if not dataclasses.is_dataclass(obj) or isinstance(obj, type):
@@ -223,6 +253,36 @@ def raise_for_status(response: httpx.Response) -> None:
         raise ShieldCortexError(f"API error: {status}", status, body)
 
 
+# ── Audit export integrity headers ────────────────────────────────────────────
+
+
+def parse_export_headers(headers: httpx.Headers) -> AuditExportHeaders:
+    """Parse the ``X-ShieldCortex-Export-*`` integrity headers.
+
+    Mirrors the TS SDK exactly: absent ``sha256``/``signature``/
+    ``manifest_id`` stay ``None`` (never ``""``) — the export is
+    unverifiable, and a ``""`` manifest_id would build a malformed
+    manifest URL; ``count`` is ``None`` when absent, empty, or
+    non-numeric; the remaining fields default to ``""`` / ``False``.
+    """
+    count_header = headers.get("X-ShieldCortex-Export-Count")
+    count: int | None = None
+    if count_header is not None:
+        try:
+            count = int(count_header)
+        except ValueError:
+            count = None
+    return AuditExportHeaders(
+        sha256=headers.get("X-ShieldCortex-Export-SHA256"),
+        count=count,
+        generated_at=headers.get("X-ShieldCortex-Export-Generated-At", ""),
+        manifest_id=headers.get("X-ShieldCortex-Export-Manifest-Id"),
+        signature=headers.get("X-ShieldCortex-Export-Signature"),
+        signature_algorithm=headers.get("X-ShieldCortex-Export-Signature-Alg", ""),
+        manifest_persisted=headers.get("X-ShieldCortex-Export-Manifest-Persisted") == "1",
+    )
+
+
 # ── Headers ───────────────────────────────────────────────────────────────────