@aikdna/kdna-core 0.12.3 → 0.12.4

package/README.md

@@ -52,27 +52,35 @@ const compact = loadAuthorized('./asset.kdna', {
 ## Supported Runtime Flow
 
 ```text
-v1 source directory
-→ buildChecksumsV1
-→ pack
+.kdna file
 → validate
 → planLoad
 → loadAuthorized
 → agent/runtime context
 ```
 
-## v1 Source Directory
+For authoring and test fixtures, `pack()` can turn a local working folder into
+a `.kdna` file before validation:
+
+```text
+local working folder
+→ pack
+→ .kdna file
+→ validate
+→ planLoad
+→ loadAuthorized
+```
+
+## v1 Container
 
-A v1 source directory contains:
+A v1 `.kdna` container contains:
 
 - `mimetype`
 - `kdna.json`
 - `payload.kdnab`
 - `checksums.json`
 
-## v1 Container
-
-A v1 `.kdna` container is a zip package of the same files. `validate()` checks:
+`validate()` checks:
 
 - format
 - manifest schema

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aikdna/kdna-core",
-  "version": "0.12.3",
+  "version": "0.12.4",
   "description": "KDNA Core library for validating, planning, and loading local .kdna judgment assets.",
   "type": "commonjs",
   "main": "src/index.js",

package/schema/checksums.schema.json

@@ -6,6 +6,16 @@
   "type": "object",
   "required": ["algorithm"],
   "additionalProperties": true,
+  "$defs": {
+    "sha256Digest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "sha256Value": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    }
+  },
   "properties": {
     "algorithm": {
       "type": "string",
@@ -13,19 +23,16 @@
       "enum": ["sha256", "sha512", "blake2b-256"]
     },
     "manifest_digest": {
-      "type": "string",
       "description": "Digest of the kdna.json entry.",
-      "pattern": "^[a-z0-9-]+:.+$"
+      "$ref": "#/$defs/sha256Digest"
     },
     "payload_digest": {
-      "type": "string",
       "description": "Digest of the payload.kdnab entry.",
-      "pattern": "^[a-z0-9-]+:.+$"
+      "$ref": "#/$defs/sha256Digest"
     },
     "asset_digest": {
-      "type": "string",
       "description": "Digest of the whole container (per-entry digests combined deterministically).",
-      "pattern": "^[a-z0-9-]+:.+$"
+      "$ref": "#/$defs/sha256Digest"
     },
     "entries": {
       "type": "object",
@@ -34,8 +41,8 @@
         "type": "object",
         "required": ["algorithm", "value"],
         "properties": {
-          "algorithm": { "type": "string" },
-          "value": { "type": "string" }
+          "algorithm": { "const": "sha256" },
+          "value": { "$ref": "#/$defs/sha256Value" }
         }
       }
     }

package/schema/load-plan.schema.json

@@ -14,6 +14,7 @@
     "required_action",
     "can_load_now",
     "projection_policy",
+    "input_fingerprint",
     "checks",
     "issues",
     "source"
@@ -73,6 +74,10 @@
       "type": "string",
       "enum": ["minimal", "remote", "none"]
     },
+    "input_fingerprint": {
+      "type": ["string", "null"],
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
     "checks": {
       "type": "object",
       "required": [

package/src/types.d.ts

@@ -549,6 +549,7 @@ export interface KDNAV1LoadPlan {
     | string;
   can_load_now: boolean;
   projection_policy: 'minimal' | 'remote' | 'none' | string;
+  input_fingerprint: string | null;
   checks: Record<string, boolean>;
   issues: KDNAV1LoadPlanIssue[];
   source: {

package/src/v1/index.js

@@ -747,6 +747,7 @@ function verifyDigests(checksums, map, problems, result) {
     manifest_digest: 'kdna.json',
     payload_digest: 'payload.kdnab',
   };
+  const entryDigests = {};
   let stillValid = true;
   for (const [digestKey, entryName] of Object.entries(entryMap)) {
     const declared = checksums[digestKey];
@@ -758,12 +759,33 @@ function verifyDigests(checksums, map, problems, result) {
     }
     const entryBytes = map[entryName];
     const actual = crypto.createHash('sha256').update(entryBytes).digest('hex');
+    entryDigests[entryName] = actual;
     const expected = declared.replace(/^sha256:/, '');
     if (actual !== expected) {
       problems.push(`checksums: ${digestKey} mismatch (declared ${expected.slice(0, 8)}..., actual ${actual.slice(0, 8)}...)`);
       stillValid = false;
     }
   }
+  if (checksums.asset_digest) {
+    const expectedAssetDigest = checksums.asset_digest.replace(/^sha256:/, '');
+    const missingAssetInputs = ['kdna.json', 'payload.kdnab'].filter((entryName) => !entryDigests[entryName]);
+    if (missingAssetInputs.length) {
+      problems.push(`checksums: asset_digest cannot be verified without ${missingAssetInputs.join(', ')}`);
+      stillValid = false;
+    } else {
+      const combined = Object.keys(entryDigests)
+        .sort()
+        .map((name) => `${name}:${entryDigests[name]}`)
+        .join('\n');
+      const actualAssetDigest = crypto.createHash('sha256').update(combined).digest('hex');
+      if (actualAssetDigest !== expectedAssetDigest) {
+        problems.push(
+          `checksums: asset_digest mismatch (declared ${expectedAssetDigest.slice(0, 8)}..., actual ${actualAssetDigest.slice(0, 8)}...)`,
+        );
+        stillValid = false;
+      }
+    }
+  }
   if (!stillValid) result.checksums_valid = false;
   return stillValid;
 }
@@ -986,6 +1008,25 @@ function finalizeLoadPlan(plan) {
   return plan;
 }
 
+function inputFingerprint(inputPath, v1) {
+  const absPath = path.resolve(inputPath);
+  if (v1.kind === 'file') {
+    return `sha256:${crypto.createHash('sha256').update(fs.readFileSync(absPath)).digest('hex')}`;
+  }
+
+  const hash = crypto.createHash('sha256');
+  for (const name of Object.keys(v1.map).sort()) {
+    const bytes = v1.map[name];
+    hash.update(name);
+    hash.update('\0');
+    hash.update(String(bytes.length));
+    hash.update('\0');
+    hash.update(bytes);
+    hash.update('\0');
+  }
+  return `sha256:${hash.digest('hex')}`;
+}
+
 function baseLoadPlan(inputPath, v1, validation) {
   const manifest = v1.manifest;
   const accessInfo = normalizeAccess(manifest.access);
@@ -1008,6 +1049,7 @@ function baseLoadPlan(inputPath, v1, validation) {
     required_action: 'block',
     can_load_now: false,
     projection_policy: 'none',
+    input_fingerprint: inputFingerprint(inputPath, v1),
     checks: {
       format_valid: validation.format_valid,
       schema_valid: validation.schema_valid,
@@ -1060,6 +1102,7 @@ function planLoad(inputPath, opts = {}) {
       required_action: 'block',
       can_load_now: false,
       projection_policy: 'none',
+      input_fingerprint: null,
       checks: {
         format_valid: false,
         schema_valid: false,