@aikdna/kdna-core 0.15.6 → 0.15.8

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## v0.15.8 (2026-06-28)
+
+Story 11 — RAG namespace isolation (RFC #148 v2.x Phase 3).
+
+- **`rag_namespace`** field added to each entry in `resolved_dependencies`.
+  Format: `name@version` (or bare `name` when version is absent). Provides a
+  stable scoped identifier for per-component namespace isolation.
+- **`rag_isolation_policy`** object added to load output when
+  `resolved_dependencies` is non-empty:
+  `{ default: "fenced", cross_namespace_blocked: true, namespaces: [...] }`.
+  Consumers MUST NOT mix content across namespaces without explicit permission.
+- **`--as=prompt` namespace header**: each component section in multi-asset
+  prompt output is now prefixed with `[NAMESPACE: name@version]` so RAG
+  systems can attribute and isolate content per source component (per SPEC
+  §13.8 source attribution).
+- No breaking changes to existing single-asset load output or to
+  `resolved_dependencies` shape (fields are additive only).
+
+## v0.15.7 (2026-06-28)
+
+Story 6 — dependencies runtime. Supports semver-matching local/registry dependency resolution and topological sort-based loading order.
+
+- **Dependencies manifest schema support**: Explicitly declared `"dependencies"` as a first-class manifest property.
+- **Topological Sorting Resolver**: Added a robust, pure post-order DFS topological sorter with circular cycle, missing dependency, and version range mismatch checks.
+- **Topological Prompt Composition**: Enabled recursive, multi-domain prompt composition and flat topological JSON return inside `loadAuthorized`.
+
+
 ## v0.15.6 (2026-06-28)
 
 Story 5 — Bundle payload type. Bumps KDNA manifest format schema to v2, introduces bundle-profile-v1 payload profile, and starts KDNA v1 format deprecation window.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aikdna/kdna-core",
-  "version": "0.15.6",
+  "version": "0.15.8",
   "description": "KDNA Core library for validating, planning, and loading local .kdna judgment assets.",
   "engines": {
     "node": ">=18.0.0"

package/schema/manifest.schema.json

@@ -195,6 +195,12 @@
         }
       }
     },
+    "dependencies": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "string"
+      }
+    },
     "encryption": { "type": "object" },
     "load_contract": { "$ref": "load-contract.schema.json" },
     "scope": { "type": "object" },

package/src/v1/index.js

@@ -1241,6 +1241,46 @@ function planLoad(inputPath, opts = {}) {
   }
 
   const manifest = v1.manifest;
+
+  // Resolve dependencies if declared (Story 6)
+  const resolvedDeps = [];
+  if (manifest.dependencies && typeof manifest.dependencies === 'object' && Object.keys(manifest.dependencies).length > 0) {
+    if (typeof opts.resolveAsset === 'function') {
+      try {
+        const resolved = resolveDependencies(manifest, opts.resolveAsset);
+        resolvedDeps.push(...resolved);
+      } catch (err) {
+        plan.state = 'invalid';
+        plan.required_action = 'block';
+        plan.can_load_now = false;
+        plan.issues.push(buildLoadPlanIssue(
+          'KDNA_DEPENDENCY_RESOLUTION_FAILED',
+          'blocking',
+          err.message
+        ));
+        return finalizeLoadPlan(plan);
+      }
+    } else {
+      plan.state = 'invalid';
+      plan.required_action = 'block';
+      plan.can_load_now = false;
+      plan.issues.push(buildLoadPlanIssue(
+        'KDNA_DEPENDENCY_RESOLVER_MISSING',
+        'blocking',
+        'Asset has dependencies but no dependency resolver callback was provided.'
+      ));
+      return finalizeLoadPlan(plan);
+    }
+  }
+
+  if (resolvedDeps.length > 0) {
+    plan.resolved_dependencies = resolvedDeps.map(dep => ({
+      name: dep.name,
+      version: dep.version,
+      path: dep.path
+    }));
+  }
+
   const payloadDeclaredEncrypted =
     manifest.payload && manifest.payload.encrypted === true;
   const encryptedEntries = Array.isArray(manifest.encryption && manifest.encryption.encrypted_entries)
@@ -1622,7 +1662,8 @@ function loadAuthorized(inputPath, opts = {}) {
     err.plan = plan;
     throw err;
   }
-  return loadV1Unsafe(inputPath, opts);
+  const mergedOpts = { ...opts, resolvedDependencies: plan.resolved_dependencies };
+  return loadV1Unsafe(inputPath, mergedOpts);
 }
 
 function loadV1(inputPath, opts = {}) {
@@ -1803,6 +1844,38 @@ function loadV1Unsafe(inputPath, opts = {}) {
     throw new Error(`unknown load profile: ${profile}`);
   }
 
+   if (opts.resolvedDependencies && opts.resolvedDependencies.length > 0) {
+    result.resolved_dependencies = opts.resolvedDependencies.map(dep => {
+      const depLoaded = loadV1Unsafe(dep.path, { ...opts, resolvedDependencies: [] });
+      // RAG namespace (Story 11): scoped identifier for namespace isolation.
+      // Format: name@version (or just name when version is absent).
+      const ragNamespace = dep.name
+        ? (dep.version ? `${dep.name}@${dep.version}` : dep.name)
+        : null;
+      return {
+        name: dep.name,
+        version: dep.version,
+        path: dep.path,
+        rag_namespace: ragNamespace,
+        status: depLoaded.status,
+        profile: depLoaded.profile,
+        content: depLoaded.content
+      };
+    });
+
+    // RAG isolation policy (Story 11): consumers MUST NOT mix content
+    // across namespaces without explicit permission. cross_namespace_blocked
+    // is the default; a consumer may opt in to cross-namespace access by
+    // setting its own policy, but Core never does it silently.
+    result.rag_isolation_policy = {
+      default: 'fenced',
+      cross_namespace_blocked: true,
+      namespaces: result.resolved_dependencies
+        .map(d => d.rag_namespace)
+        .filter(Boolean),
+    };
+  }
+
   if (as === 'prompt') {
     const c = result.content;
     if (!c || (c.scenarios && c.scenarios.length === 0 && !c.highest_question && !(c.axioms && c.axioms.length) && !(c.boundaries && c.boundaries.length))) {
@@ -1826,8 +1899,141 @@ function loadV1Unsafe(inputPath, opts = {}) {
     if (c.failure_modes && c.failure_modes.length) text += 'Failure modes:\n' + c.failure_modes.map((f) => '- ' + renderPromptItem(f)).join('\n') + '\n';
     if (c.patterns && c.patterns.length) text += 'Patterns:\n' + c.patterns.map((p) => '- ' + renderPromptItem(p)).join('\n') + '\n';
     if (c.note) text += 'Note: ' + c.note + '\n';
-    return { status: result.status, profile: result.profile, text: text.trim() };
+    
+    let textOut = text.trim();
+    if (opts.resolvedDependencies && opts.resolvedDependencies.length > 0) {
+      for (const dep of opts.resolvedDependencies) {
+        const depLoaded = loadV1Unsafe(dep.path, { ...opts, resolvedDependencies: [] });
+        if (depLoaded.text) {
+          // Namespace header (Story 11): each component section is prefixed
+          // with [NAMESPACE: id] so consumers can isolate RAG content per source.
+          const ns = dep.name
+            ? (dep.version ? `${dep.name}@${dep.version}` : dep.name)
+            : null;
+          const nsHeader = ns ? `[NAMESPACE: ${ns}]\n` : '';
+          textOut += '\n\n---\n\n' + nsHeader + depLoaded.text;
+        }
+      }
+    }
+    return { status: result.status, profile: result.profile, text: textOut };
   }
 
   return result;
 }
+
+// ─── Semver & Dependency Resolution (Story 6) ─────────────────────────
+
+function parseSemver(v) {
+  if (!v) return null;
+  const match = v.trim().match(/^v?([0-9]+)\.([0-9]+)\.([0-9]+)(?:-[a-zA-Z0-9.]+)?/);
+  if (!match) return null;
+  return {
+    major: parseInt(match[1], 10),
+    minor: parseInt(match[2], 10),
+    patch: parseInt(match[3], 10)
+  };
+}
+
+function compareSemver(v1, v2) {
+  const p1 = parseSemver(v1);
+  const p2 = parseSemver(v2);
+  if (!p1 || !p2) return 0;
+  if (p1.major !== p2.major) return p1.major - p2.major;
+  if (p1.minor !== p2.minor) return p1.minor - p2.minor;
+  return p1.patch - p2.patch;
+}
+
+function satisfies(version, range) {
+  if (!range || range === '*' || range.trim() === '') return true;
+  const r = range.trim();
+  
+  // Specific version comparison (e.g. "1.2.3")
+  if (/^[0-9]/.test(r)) {
+    return compareSemver(version, r) === 0;
+  }
+  
+  // ^ range comparison (e.g. "^1.2.3")
+  if (r.startsWith('^')) {
+    const min = r.slice(1);
+    const parsedMin = parseSemver(min);
+    if (!parsedMin) return false;
+    const parsedVer = parseSemver(version);
+    if (!parsedVer) return false;
+    // same major, and version >= min
+    if (parsedVer.major !== parsedMin.major) return false;
+    return compareSemver(version, min) >= 0;
+  }
+  
+  // ~ range comparison (e.g. "~1.2.3")
+  if (r.startsWith('~')) {
+    const min = r.slice(1);
+    const parsedMin = parseSemver(min);
+    if (!parsedMin) return false;
+    const parsedVer = parseSemver(version);
+    if (!parsedVer) return false;
+    // same major, same minor, and version >= min
+    if (parsedVer.major !== parsedMin.major || parsedVer.minor !== parsedMin.minor) return false;
+    return compareSemver(version, min) >= 0;
+  }
+  
+  // Custom ranges like ">=1.0.0 <2.0.0"
+  if (r.includes(' ')) {
+    const parts = r.split(/\s+/);
+    return parts.every(part => satisfies(version, part));
+  }
+  
+  if (r.startsWith('>=')) {
+    return compareSemver(version, r.slice(2)) >= 0;
+  }
+  if (r.startsWith('>')) {
+    return compareSemver(version, r.slice(1)) > 0;
+  }
+  if (r.startsWith('<=')) {
+    return compareSemver(version, r.slice(2)) <= 0;
+  }
+  if (r.startsWith('<')) {
+    return compareSemver(version, r.slice(1)) < 0;
+  }
+  
+  return false;
+}
+
+function resolveDependencies(manifest, resolveAssetCallback, seen = new Set(), stack = []) {
+  const resolved = [];
+  const deps = manifest.dependencies || {};
+  
+  for (const [name, range] of Object.entries(deps)) {
+    if (stack.includes(name)) {
+      throw new Error(`Circular dependency detected: ${stack.join(' -> ')} -> ${name}`);
+    }
+    
+    if (seen.has(name)) continue;
+    
+    // Resolve the dependency using the callback
+    const depAsset = resolveAssetCallback(name);
+    if (!depAsset) {
+      throw new Error(`Dependency not satisfied: "${name}" matching "${range}" is not installed.`);
+    }
+    
+    // Check if the resolved version satisfies the range
+    if (!satisfies(depAsset.version, range)) {
+      throw new Error(`Dependency mismatch: installed "${name}" version "${depAsset.version}" does not satisfy range "${range}".`);
+    }
+    
+    // Recurse
+    stack.push(name);
+    const subResolved = resolveDependencies(depAsset.manifest, resolveAssetCallback, seen, stack);
+    stack.pop();
+    
+    resolved.push(...subResolved);
+    resolved.push({
+      name,
+      version: depAsset.version,
+      path: depAsset.path,
+      manifest: depAsset.manifest
+    });
+    seen.add(name);
+  }
+  
+  return resolved;
+}