@aikdna/kdna-core 0.17.0 → 0.18.0

package/schema/load-plan.schema.json

@@ -126,8 +126,8 @@
       "required": ["kind", "path"],
       "additionalProperties": false,
       "properties": {
-        "kind": { "type": ["string", "null"], "enum": ["dir", "file", null] },
-        "path": { "type": "string" }
+        "kind": { "type": ["string", "null"], "enum": ["dir", "file", "memory", null] },
+        "path": { "type": ["string", "null"] }
       }
     }
   }

package/schema/runtime-capsule-1.schema.json

@@ -0,0 +1,68 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/aikdna/kdna/specs/runtime-capsule-1.schema.json",
+  "title": "KDNA Runtime Capsule 1",
+  "description": "Frozen compatibility schema. The historical asset_digest member means E (kdna-runtime-entry-set-v1), never the final container digest A.",
+  "type": "object",
+  "required": [
+    "type",
+    "version",
+    "domain",
+    "judgment_version",
+    "asset_digest",
+    "signature",
+    "access",
+    "risk_level",
+    "profile",
+    "context",
+    "trace"
+  ],
+  "additionalProperties": true,
+  "properties": {
+    "type": { "const": "kdna.context.capsule" },
+    "version": { "const": "1.0" },
+    "domain": { "type": ["string", "null"] },
+    "judgment_version": { "type": ["string", "null"] },
+    "asset_digest": {
+      "description": "Frozen Capsule 1 name for the runtime entry-set digest E.",
+      "oneOf": [{ "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, { "type": "null" }]
+    },
+    "signature": { "$ref": "#/$defs/signature" },
+    "access": { "type": "string" },
+    "risk_level": { "type": ["string", "null"] },
+    "profile": { "enum": ["index", "compact", "scenario", "full"] },
+    "context": { "type": "object" },
+    "trace": { "$ref": "#/$defs/trace" }
+  },
+  "$defs": {
+    "signature": {
+      "type": "object",
+      "required": ["state"],
+      "additionalProperties": false,
+      "properties": {
+        "state": { "enum": ["verified", "not_checked", "absent"] },
+        "issuer": { "type": "string", "minLength": 1 }
+      }
+    },
+    "trace": {
+      "type": "object",
+      "required": [
+        "payload_encoding",
+        "loaded_by",
+        "loaded_at",
+        "schema_valid",
+        "signature_state",
+        "profile"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "payload_encoding": { "const": "cbor" },
+        "loaded_by": { "const": "kdna-core" },
+        "loaded_at": { "type": "string", "format": "date-time" },
+        "schema_valid": { "type": "boolean" },
+        "signature_state": { "enum": ["verified", "not_checked", "absent"] },
+        "profile": { "enum": ["index", "compact", "scenario", "full"] }
+      }
+    }
+  }
+}

package/schema/runtime-capsule-2.schema.json

@@ -0,0 +1,140 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/aikdna/kdna/specs/runtime-capsule-2.schema.json",
+  "title": "KDNA Runtime Capsule 2",
+  "description": "Opt-in Runtime Capsule carrying explicit A/C/E digest evidence. P is external delivery metadata and is never embedded here.",
+  "type": "object",
+  "required": [
+    "type",
+    "version",
+    "asset",
+    "digests",
+    "signature",
+    "access",
+    "risk_level",
+    "profile",
+    "context",
+    "trace"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "type": { "const": "kdna.context.capsule" },
+    "version": { "const": "2.0" },
+    "asset": { "$ref": "#/$defs/asset" },
+    "digests": {
+      "allOf": [
+        {
+          "$ref": "https://github.com/aikdna/kdna/specs/digest-evidence.schema.json"
+        },
+        {
+          "properties": {
+            "asset": { "$ref": "#/$defs/successfulDigest" },
+            "content": { "$ref": "#/$defs/successfulDigest" },
+            "runtime_entry_set": { "$ref": "#/$defs/successfulDigest" }
+          }
+        }
+      ]
+    },
+    "signature": { "$ref": "#/$defs/signature" },
+    "access": { "enum": ["public", "licensed", "remote"] },
+    "risk_level": { "type": ["string", "null"] },
+    "profile": { "enum": ["index", "compact", "scenario", "full"] },
+    "context": { "type": "object" },
+    "trace": { "$ref": "#/$defs/trace" },
+    "compatibility": { "$ref": "#/$defs/compatibility" }
+  },
+  "$defs": {
+    "sha256": {
+      "type": "string",
+      "pattern": "^sha256:[0-9a-f]{64}$"
+    },
+    "asset": {
+      "type": "object",
+      "required": ["asset_id", "asset_uid", "version", "judgment_version"],
+      "additionalProperties": false,
+      "properties": {
+        "asset_id": {
+          "type": "string",
+          "pattern": "^[a-zA-Z][a-zA-Z0-9_-]*(:[a-zA-Z0-9_.-]+)+$"
+        },
+        "asset_uid": { "type": "string", "format": "uri" },
+        "version": {
+          "type": "string",
+          "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+([+-].+)?$"
+        },
+        "judgment_version": {
+          "type": "string",
+          "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+([+-].+)?$"
+        }
+      }
+    },
+    "successfulDigest": {
+      "type": "object",
+      "properties": {
+        "value": { "$ref": "#/$defs/sha256" },
+        "comparison": {
+          "type": "object",
+          "properties": {
+            "state": { "enum": ["matched", "not_compared"] }
+          }
+        }
+      }
+    },
+    "signature": {
+      "type": "object",
+      "required": ["state"],
+      "additionalProperties": false,
+      "properties": {
+        "state": { "enum": ["verified", "not_checked", "absent"] },
+        "issuer": { "type": "string", "minLength": 1 }
+      }
+    },
+    "trace": {
+      "type": "object",
+      "required": [
+        "payload_encoding",
+        "loaded_by",
+        "loaded_at",
+        "input_kind",
+        "runtime_eligible",
+        "schema_valid",
+        "signature_state",
+        "profile"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "payload_encoding": { "const": "cbor" },
+        "loaded_by": { "const": "kdna-core" },
+        "loaded_at": { "type": "string", "format": "date-time" },
+        "input_kind": { "enum": ["packaged_file", "packaged_bytes"] },
+        "runtime_eligible": { "const": true },
+        "schema_valid": { "const": true },
+        "signature_state": { "enum": ["verified", "not_checked", "absent"] },
+        "profile": { "enum": ["index", "compact", "scenario", "full"] }
+      }
+    },
+    "compatibility": {
+      "description": "Adapter-only values with no Capsule 2 identity or routing authority.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": false,
+      "properties": {
+        "capsule_1_domain": { "type": "string", "minLength": 1 },
+        "capsule_1_access": { "enum": ["open", "protected", "runtime"] },
+        "capsule_1_extensions": { "$ref": "#/$defs/capsule1Extensions" }
+      }
+    },
+    "capsule1Extensions": {
+      "description": "Frozen Capsule 1 extension values carried only for exact one-way adapter parity.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": false,
+      "properties": {
+        "extends_chain": { "type": "array" },
+        "inheritance_applied": { "type": "boolean" },
+        "resolved_dependencies": { "type": "array" },
+        "rag_isolation_policy": { "type": "object" }
+      }
+    }
+  }
+}

package/src/asset-reader.js

@@ -6,15 +6,13 @@ const fs = require('fs');
 const crypto = require('crypto');
 const zlib = require('zlib');
 const cbor = require('cbor-x');
-const { loadDomainFromFiles, formatContext } = require('./loader');
 
 const KDNA_MEDIA_TYPE = 'application/vnd.kdna.asset';
+const ASSET_SOURCE_BYTES = Symbol.for('@aikdna/kdna-core.asset-source-bytes');
 
-// Standard KDNA domain data entries — kept in lockstep with loader.FILE_MAP.
-// Asset reader pre-loads these so callers don't have to enumerate entry names.
-// NOTE: kdna.json / manifest.json are read separately via readManifest(); do not
-// add them here. KDNA_Cluster is intentionally omitted — its schema exists but
-// is not yet wired into the loader contract.
+// Deprecated legacy authoring source entry names. Current Runtime assets carry
+// judgment only in payload.kdnab and never expose these as distribution entries.
+// Kept for source-migration callers; loadProfile does not use this list.
 const STANDARD_ENTRIES = Object.freeze([
   'KDNA_Core.json',
   'KDNA_Patterns.json',
@@ -43,6 +41,14 @@ function stableStringify(value) {
   return JSON.stringify(value);
 }
 
+function compareEntryNamesByUtf8(left, right) {
+  return Buffer.compare(Buffer.from(left, 'utf8'), Buffer.from(right, 'utf8'));
+}
+
+function sortedEntryNames(entries) {
+  return [...entries.keys()].sort(compareEntryNamesByUtf8);
+}
+
 function parseJson(buf, entryName) {
   try {
     return JSON.parse(Buffer.isBuffer(buf) ? buf.toString('utf8') : String(buf));
@@ -51,6 +57,17 @@ function parseJson(buf, entryName) {
   }
 }
 
+function validateDecodedEntry(buf, entryName) {
+  if (entryName === 'payload.kdnab') {
+    try {
+      return cbor.decode(buf);
+    } catch (e) {
+      throw new Error(`${entryName}: invalid CBOR: ${e.message}`, { cause: e });
+    }
+  }
+  return parseJson(buf, entryName);
+}
+
 function encryptedEntries(manifest) {
   const entries = manifest?.encryption?.encrypted_entries;
   return Array.isArray(entries) ? entries : [];
@@ -188,7 +205,7 @@ function manifestForDigest(manifest) {
 function buildContentDigest(asset) {
   const parts = [];
   const excluded = new Set(['.DS_Store', 'signature.json', 'build-receipt.json']);
-  for (const entryName of [...asset.entries.keys()].sort()) {
+  for (const entryName of sortedEntryNames(asset.entries)) {
     if (excluded.has(entryName)) continue;
     if (entryName.startsWith('reports/')) continue;
     const entryBuf = asset.readEntry(entryName);
@@ -243,7 +260,7 @@ function buildSigningPayload(asset, options = {}) {
   // byte strings and the signature would fail to verify. The fix
   // mirrors `buildContentDigest`'s exclusion set exactly.
   const parts = [];
-  for (const entryName of [...asset.entries.keys()].sort()) {
+  for (const entryName of sortedEntryNames(asset.entries)) {
     if (entryName === '.DS_Store' || entryName === 'signature.json') continue;
     if (entryName === 'build-receipt.json') continue;
     if (entryName.startsWith('reports/')) continue;
@@ -324,7 +341,9 @@ function verifyHumanLockSignatures(coreData, manifest, errors, warnings) {
     ['stances', 'stance'],
   ];
 
-  let verified = 0, missing = 0, invalid = 0;
+  let verified = 0,
+    missing = 0,
+    invalid = 0;
   for (const [arrayName] of CORE_CARD_ARRAYS) {
     const cards = coreData?.[arrayName];
     if (!Array.isArray(cards) || cards.length === 0) continue;
@@ -342,8 +361,11 @@ function verifyHumanLockSignatures(coreData, manifest, errors, warnings) {
         const sig = Buffer.from(String(hl.signature).replace(/^ed25519:/, ''), 'hex');
         const key = crypto.createPublicKey(publicKeyPEM);
         const ok = crypto.verify(null, Buffer.from(payload), key, sig);
-        if (ok) { verified++; }
-        else { invalid++; }
+        if (ok) {
+          verified++;
+        } else {
+          invalid++;
+        }
       } catch {
         invalid++;
       }
@@ -351,7 +373,9 @@ function verifyHumanLockSignatures(coreData, manifest, errors, warnings) {
   }
 
   if (invalid > 0) {
-    errors.push(`${invalid} Human Lock signature(s) failed verification — judgment may have been altered`);
+    errors.push(
+      `${invalid} Human Lock signature(s) failed verification — judgment may have been altered`,
+    );
   }
   if (missing > 0) {
     warnings.push(`${missing} locked card(s) have no Human Lock signature`);
@@ -361,29 +385,10 @@ function verifyHumanLockSignatures(coreData, manifest, errors, warnings) {
   }
 }
 
-function validateManifestIdentity(manifest, errors, _warnings) {
-  if (manifest.kdna_spec) {
-    errors.push('kdna.json: kdna_spec is not allowed. Use kdna_version.');
-  }
-  if (manifest.format && manifest.format !== 'kdna') {
-    errors.push(`kdna.json.format: invalid value "${manifest.format}". Expected "kdna".`);
-  }
-  if (!manifest.kdna_version) {
-    errors.push('kdna.json: missing required field "kdna_version"');
-  } else if (manifest.kdna_version !== '1.0') {
-    errors.push(
-      `kdna.json.kdna_version: invalid value "${manifest.kdna_version}". Expected "1.0".`,
-    );
-  }
-  if (manifest.language) {
-    errors.push('kdna.json: language is not allowed. Use default_language and languages.');
-  }
-}
-
 function openAsset(input) {
   const { buffer, path } = normalizeInput(input);
   const entries = parseZipEntries(buffer);
-  return {
+  const asset = {
     path,
     size: buffer.length,
     asset_digest: `sha256:${sha256Hex(buffer)}`,
@@ -394,6 +399,29 @@ function openAsset(input) {
       return readZipEntry(buffer, entry);
     },
   };
+  Object.defineProperty(asset, ASSET_SOURCE_BYTES, {
+    value: buffer,
+    enumerable: false,
+    writable: false,
+  });
+  return asset;
+}
+
+function validateCurrentContainer(asset) {
+  const bytes = asset[ASSET_SOURCE_BYTES];
+  if (!Buffer.isBuffer(bytes)) {
+    throw new Error('Current KDNA validation requires the original .kdna container bytes');
+  }
+  return require('./v1').validate(bytes);
+}
+
+function appendCurrentValidationErrors(asset, errors) {
+  try {
+    const validation = validateCurrentContainer(asset);
+    if (!validation.overall_valid) errors.push(...validation.problems);
+  } catch (e) {
+    errors.push(e.message);
+  }
 }
 
 function listEntries(asset) {
@@ -409,30 +437,18 @@ function readManifest(asset) {
   return parseJson(asset.readEntry('kdna.json'), 'kdna.json');
 }
 
-function readDataMapSync(asset, options = {}) {
-  const dataMap = {};
-  const manifest = readManifest(asset);
-
+function readDataMapSync(asset, _options = {}) {
   if (asset.entries.has('payload.kdnab')) {
-    const payloadBuf = asset.readEntry('payload.kdnab');
-    const payload = cbor.decode(payloadBuf);
-    if (payload && payload.judgment) {
-      if (payload.judgment.core) dataMap['KDNA_Core.json'] = payload.judgment.core;
-      if (payload.judgment.patterns) dataMap['KDNA_Patterns.json'] = payload.judgment.patterns;
-      if (payload.judgment.scenarios) dataMap['KDNA_Scenarios.json'] = payload.judgment.scenarios;
-      if (payload.judgment.cases) dataMap['KDNA_Cases.json'] = payload.judgment.cases;
-      if (payload.judgment.reasoning) dataMap['KDNA_Reasoning.json'] = payload.judgment.reasoning;
-      if (payload.judgment.evolution) dataMap['KDNA_Evolution.json'] = payload.judgment.evolution;
-    }
-
-    const encrypted = encryptedEntries(manifest);
-    if (encrypted.length && typeof options.decryptEntry !== 'function') {
-      throw new Error(`encrypted entries require decryptEntry hook: ${encrypted.join(', ')}`);
-    }
-    return dataMap;
+    const error = new Error(
+      'readDataMap is a legacy source-tree API and does not project current payload.kdnab into KDNA_Core.json/KDNA_Patterns.json. Use loadProfile or loadAuthorized.',
+    );
+    error.code = 'KDNA_LEGACY_DATA_MAP_UNSUPPORTED';
+    throw error;
   }
 
-  throw new Error('Not a KDNA asset: missing payload.kdnab');
+  const error = new Error('Not a current KDNA asset: missing payload.kdnab');
+  error.code = 'KDNA_FORMAT_INVALID';
+  throw error;
 }
 
 function verifySync(asset, options = {}) {
@@ -440,6 +456,12 @@ function verifySync(asset, options = {}) {
   const warnings = [];
   const entries = listEntries(asset);
 
+  // The current v1 implementation is the sole authority for container,
+  // manifest, CBOR payload, checksum, and load-contract validity. The reader
+  // adds transport identity and legacy signature hooks; it must not maintain a
+  // second manifest or payload dialect.
+  appendCurrentValidationErrors(asset, errors);
+
   if (!asset.entries.has('kdna.json')) errors.push('required entry missing: kdna.json');
   verifyMediaType(asset, errors);
   if (!asset.entries.has('payload.kdnab')) errors.push('required entry missing: payload.kdnab');
@@ -450,7 +472,9 @@ function verifySync(asset, options = {}) {
     errors.push(`asset digest mismatch: expected ${options.asset_digest}, got ${asset_digest}`);
   }
   if (options.content_digest && options.content_digest !== content_digest) {
-    errors.push(`content digest mismatch: expected ${options.content_digest}, got ${content_digest}`);
+    errors.push(
+      `content digest mismatch: expected ${options.content_digest}, got ${content_digest}`,
+    );
   }
 
   let manifest = null;
@@ -458,7 +482,6 @@ function verifySync(asset, options = {}) {
   if (asset.entries.has('kdna.json')) {
     try {
       manifest = readManifest(asset);
-      validateManifestIdentity(manifest, errors, warnings);
       const encrypted = encryptedEntries(manifest);
       if (encrypted.length) {
         warnings.push(`encrypted entries present: ${encrypted.join(', ')}`);
@@ -479,7 +502,7 @@ function verifySync(asset, options = {}) {
                 asset.readEntry(entryName),
                 options,
               );
-              parseJson(decrypted, entryName);
+              validateDecodedEntry(decrypted, entryName);
             } catch (e) {
               errors.push(e.message);
             }
@@ -516,29 +539,15 @@ function verifySync(asset, options = {}) {
 }
 
 function loadProfileSync(asset, profile = 'compact', options = {}) {
-  const manifest = readManifest(asset);
-  if (profile === 'index') {
-    return {
-      profile,
-      manifest,
-      asset_digest: asset.asset_digest,
-      content_digest: buildContentDigest(asset),
-      entries: listEntries(asset),
-      name: manifest.name || manifest.asset_id || null,
-      version: manifest.version || null,
-      judgment_version: manifest.judgment_version || null,
-      keywords: manifest.keywords || [],
-    };
-  }
-  const dataMap = readDataMapSync(asset, STANDARD_ENTRIES, options);
-  const mode = profile === 'full' ? 'all' : profile === 'scenario' ? 'auto' : 'minimum';
-  const domain = loadDomainFromFiles(dataMap, { mode, input: options.input || '' });
-  return {
+  const bytes = asset[ASSET_SOURCE_BYTES];
+  if (!Buffer.isBuffer(bytes)) {
+    throw new Error('loadProfile requires the original .kdna container bytes');
+  }
+  return require('./runtime-api').loadAuthorized(bytes, {
+    ...options,
     profile,
-    manifest,
-    domain,
-    context: options.context === false || !domain ? null : formatContext(domain),
-  };
+    as: options.as || 'json',
+  });
 }
 
 function createKdnaAssetReader() {
@@ -565,7 +574,13 @@ function createKdnaAssetReader() {
       if (!asset.entries.has(entryName)) return null;
       const manifest =
         entryName === 'kdna.json' ? null : parseJson(asset.readEntry('kdna.json'), 'kdna.json');
-      const buf = maybeDecryptEntrySync(asset, manifest, entryName, asset.readEntry(entryName), options);
+      const buf = maybeDecryptEntrySync(
+        asset,
+        manifest,
+        entryName,
+        asset.readEntry(entryName),
+        options,
+      );
       return parseJson(buf, entryName);
     },
 
@@ -591,21 +606,8 @@ function createKdnaAssetReader() {
 
     readDataMapSync,
 
-    async readDataMap(asset, entries = STANDARD_ENTRIES, options = {}) {
-      const dataMap = {};
-      const manifest = await this.readManifest(asset);
-      for (const entryName of entries) {
-        if (!asset.entries.has(entryName)) continue;
-        const buf = await maybeDecryptEntry(
-          asset,
-          manifest,
-          entryName,
-          asset.readEntry(entryName),
-          options,
-        );
-        dataMap[entryName] = parseJson(buf, entryName);
-      }
-      return dataMap;
+    async readDataMap(asset, _entries = STANDARD_ENTRIES, options = {}) {
+      return readDataMapSync(asset, options);
     },
 
     contentDigestSync: buildContentDigest,
@@ -621,6 +623,8 @@ function createKdnaAssetReader() {
       const warnings = [];
       const entries = [...asset.entries.keys()].sort();
 
+      appendCurrentValidationErrors(asset, errors);
+
       if (!asset.entries.has('kdna.json')) errors.push('required entry missing: kdna.json');
       verifyMediaType(asset, errors);
       if (!asset.entries.has('payload.kdnab')) errors.push('required entry missing: payload.kdnab');
@@ -641,7 +645,6 @@ function createKdnaAssetReader() {
       if (asset.entries.has('kdna.json')) {
         try {
           manifest = parseJson(asset.readEntry('kdna.json'), 'kdna.json');
-          validateManifestIdentity(manifest, errors, warnings);
           const encrypted = encryptedEntries(manifest);
           if (encrypted.length) {
             warnings.push(`encrypted entries present: ${encrypted.join(', ')}`);
@@ -662,7 +665,7 @@ function createKdnaAssetReader() {
                     asset.readEntry(entryName),
                     options,
                   );
-                  parseJson(decrypted, entryName);
+                  validateDecodedEntry(decrypted, entryName);
                 } catch (e) {
                   errors.push(e.message);
                 }
@@ -692,30 +695,7 @@ function createKdnaAssetReader() {
     loadProfileSync,
 
     async loadProfile(asset, profile = 'compact', options = {}) {
-      const manifest = await this.readManifest(asset);
-      if (profile === 'index') {
-        return {
-          profile,
-          manifest,
-          asset_digest: asset.asset_digest,
-          content_digest: buildContentDigest(asset),
-          entries: await this.listEntries(asset),
-          name: manifest.name || manifest.asset_id || null,
-          version: manifest.version || null,
-          judgment_version: manifest.judgment_version || null,
-          keywords: manifest.keywords || [],
-        };
-      }
-
-      const dataMap = await this.readDataMap(asset, STANDARD_ENTRIES, options);
-      const mode = profile === 'full' ? 'all' : profile === 'scenario' ? 'auto' : 'minimum';
-      const domain = loadDomainFromFiles(dataMap, { mode, input: options.input || '' });
-      return {
-        profile,
-        manifest,
-        domain,
-        context: options.context === false || !domain ? null : formatContext(domain),
-      };
+      return loadProfileSync(asset, profile, options);
     },
   };
 }