@aikdna/kdna-core 0.12.4 → 0.12.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aikdna/kdna-core",
-  "version": "0.12.4",
+  "version": "0.12.6",
   "description": "KDNA Core library for validating, planning, and loading local .kdna judgment assets.",
   "type": "commonjs",
   "main": "src/index.js",

package/schema/checksums.schema.json

@@ -20,7 +20,7 @@
     "algorithm": {
       "type": "string",
       "description": "Hash algorithm. Phase 1 uses sha256.",
-      "enum": ["sha256", "sha512", "blake2b-256"]
+      "const": "sha256"
     },
     "manifest_digest": {
       "description": "Digest of the kdna.json entry.",

package/src/v1/index.js

@@ -1008,7 +1008,7 @@ function finalizeLoadPlan(plan) {
   return plan;
 }
 
-function inputFingerprint(inputPath, v1) {
+function computeSourceFingerprint(inputPath, v1) {
   const absPath = path.resolve(inputPath);
   if (v1.kind === 'file') {
     return `sha256:${crypto.createHash('sha256').update(fs.readFileSync(absPath)).digest('hex')}`;
@@ -1027,7 +1027,20 @@ function inputFingerprint(inputPath, v1) {
   return `sha256:${hash.digest('hex')}`;
 }
 
-function baseLoadPlan(inputPath, v1, validation) {
+function inputFingerprint(inputPath, v1, opts = {}) {
+  const allowedEntitlement = new Set(['active', 'expired', 'revoked', 'offline_grace']);
+  const entitlementInput = (
+    opts.entitlement && allowedEntitlement.has(opts.entitlement.status)
+  ) ? opts.entitlement.status : null;
+
+  return {
+    has_password_input: opts.hasPassword === true,
+    entitlement_input: entitlementInput,
+    source_fingerprint: computeSourceFingerprint(inputPath, v1),
+  };
+}
+
+function baseLoadPlan(inputPath, v1, validation, opts = {}) {
   const manifest = v1.manifest;
   const accessInfo = normalizeAccess(manifest.access);
   const entitlementProfile = inferEntitlementProfile(manifest);
@@ -1049,7 +1062,7 @@ function baseLoadPlan(inputPath, v1, validation) {
     required_action: 'block',
     can_load_now: false,
     projection_policy: 'none',
-    input_fingerprint: inputFingerprint(inputPath, v1),
+    input_fingerprint: inputFingerprint(inputPath, v1, opts),
     checks: {
       format_valid: validation.format_valid,
       schema_valid: validation.schema_valid,
@@ -1122,7 +1135,7 @@ function planLoad(inputPath, opts = {}) {
   }
 
   const validation = runValidate(v1);
-  const plan = baseLoadPlan(inputPath, v1, validation);
+  const plan = baseLoadPlan(inputPath, v1, validation, opts);
 
   if (!validation.overall_valid) {
     plan.state = 'invalid';
@@ -1253,8 +1266,8 @@ function planLoad(inputPath, opts = {}) {
     }
 
     if (opts.entitlement && opts.entitlement.status === 'expired') {
-      plan.state = 'expired';
-      plan.required_action = 'sync';
+      plan.state = 'expired_grace';
+      plan.required_action = 'renew_entitlement';
       plan.can_load_now = false;
       plan.projection_policy = 'none';
       plan.issues.push(buildLoadPlanIssue(
@@ -1266,8 +1279,8 @@ function planLoad(inputPath, opts = {}) {
     }
 
     if (opts.entitlement && opts.entitlement.status === 'revoked') {
-      plan.state = 'revoked';
-      plan.required_action = 'block';
+      plan.state = 'denied';
+      plan.required_action = 'contact_issuer';
       plan.can_load_now = false;
       plan.projection_policy = 'none';
       plan.issues.push(buildLoadPlanIssue(
@@ -1316,6 +1329,66 @@ function planLoad(inputPath, opts = {}) {
     return finalizeLoadPlan(plan);
   }
 
+  if (opts.entitlement && opts.entitlement.status === 'expired') {
+    plan.state = 'expired_grace';
+    plan.required_action = 'renew_entitlement';
+    plan.can_load_now = false;
+    plan.projection_policy = 'none';
+    plan.issues.push(buildLoadPlanIssue(
+      'KDNA_AUTH_EXPIRED',
+      'blocking',
+      'The entitlement is expired.',
+    ));
+    return finalizeLoadPlan(plan);
+  }
+
+  if (opts.entitlement && opts.entitlement.status === 'revoked') {
+    plan.state = 'denied';
+    plan.required_action = 'contact_issuer';
+    plan.can_load_now = false;
+    plan.projection_policy = 'none';
+    plan.issues.push(buildLoadPlanIssue(
+      'KDNA_AUTH_REVOKED',
+      'blocking',
+      'The entitlement has been revoked.',
+    ));
+    return finalizeLoadPlan(plan);
+  }
+
+  if (opts.entitlement && opts.entitlement.status === 'offline_grace') {
+    plan.state = 'offline_grace';
+    plan.required_action = 'sync';
+    plan.can_load_now = true;
+    plan.projection_policy = 'minimal';
+    plan.issues.push(buildLoadPlanIssue(
+      'KDNA_AUTH_OFFLINE_GRACE_ACTIVE',
+      'warning',
+      'The entitlement can load during offline grace but must sync before grace expires.',
+    ));
+    return finalizeLoadPlan(plan);
+  }
+
+  if (opts.entitlement && opts.entitlement.status === 'active') {
+    plan.state = 'ready';
+    plan.required_action = 'load';
+    plan.can_load_now = true;
+    plan.projection_policy = 'minimal';
+    plan.issues.push(buildLoadPlanIssue(
+      'KDNA_AUTH_ACTIVE_DIAGNOSTIC',
+      'info',
+      'Entitlement active diagnostic signal acknowledged.',
+    ));
+    return finalizeLoadPlan(plan);
+  }
+
+  if (opts.hasPassword === true && !opts.password) {
+    plan.issues.push(buildLoadPlanIssue(
+      'KDNA_AUTH_PASSWORD_DIAGNOSTIC',
+      'info',
+      'hasPassword is a diagnostic credential-presence signal only; it does not verify the password.',
+    ));
+  }
+
   plan.state = 'ready';
   plan.required_action = 'load';
   plan.can_load_now = true;