@aikdna/kdna-core 0.20.0 → 0.22.0

package/src/types.d.ts

@@ -240,7 +240,6 @@ export interface KDNAManifest {
     [key: string]: any;
   };
   content_digest?: string;
-  signature?: string;
   [key: string]: any;
 }
 
@@ -292,7 +291,6 @@ export interface KdnaAssetVerifyResult {
   manifest: KDNAManifest | null;
   asset_digest: string;
   content_digest: string;
-  signature_valid: boolean | null;
 }
 
 export interface KdnaAssetIndexProfile {
@@ -338,7 +336,6 @@ export interface KdnaAssetReader {
     options?: {
       asset_digest?: string;
       content_digest?: string;
-      requireSignature?: boolean;
       requireDecryption?: boolean;
     } & KdnaDecryptOptions,
   ): KdnaAssetVerifyResult;
@@ -347,7 +344,6 @@ export interface KdnaAssetReader {
     options?: {
       asset_digest?: string;
       content_digest?: string;
-      requireSignature?: boolean;
       requireDecryption?: boolean;
     } & KdnaDecryptOptions,
   ): Promise<KdnaAssetVerifyResult>;
@@ -736,7 +732,6 @@ export interface KDNAInspectResult {
   entries: string[];
   asset_digest: string;
   content_digest: string;
-  signature_valid: boolean | null;
   ok: boolean | null;
   errors: string[];
   warnings: string[];
@@ -748,6 +743,12 @@ export interface KDNAValidationReport {
   schema_valid: boolean;
   payload_valid: boolean;
   checksums_valid: boolean;
+  signature_valid: boolean;
+  signature_state: 'absent' | 'verified' | 'invalid';
+  signature_evidence: (KDNASignatureEvidenceVerified & {
+    algorithm: 'ed25519';
+    public_key: string;
+  }) | null;
   load_contract_valid: boolean;
   loader_version: string;
   min_loader_version: string | null;
@@ -788,6 +789,22 @@ export interface KDNADigestEvidence {
   runtime_entry_set: KDNADigestValue;
 }
 
+export interface KDNASignatureEvidenceAbsent {
+  state: 'absent';
+}
+
+export interface KDNASignatureEvidenceVerified {
+  state: 'verified';
+  profile: 'kdsig.ed25519';
+  profile_version: '0.1.0';
+  key_fingerprint: string;
+  content_digest: string;
+}
+
+export type KDNASignatureEvidence =
+  | KDNASignatureEvidenceAbsent
+  | KDNASignatureEvidenceVerified;
+
 export interface KDNARuntimeCapsule {
   type: 'kdna.runtime-capsule';
   contract_version: '0.1.0';
@@ -798,7 +815,7 @@ export interface KDNARuntimeCapsule {
     judgment_version: string;
   };
   digests: KDNADigestEvidence;
-  signature: { state: 'verified' | 'not_checked' | 'absent'; issuer?: string };
+  signature: KDNASignatureEvidence;
   access: 'public' | 'licensed' | 'remote';
   profile: 'index' | 'compact' | 'scenario' | 'full';
   context: Record<string, any>;
@@ -809,8 +826,13 @@ export interface KDNARuntimeCapsule {
     input_kind: 'packaged_file' | 'packaged_bytes';
     runtime_eligible: true;
     schema_valid: true;
-    signature_state: 'verified' | 'not_checked' | 'absent';
+    signature_state: 'absent' | 'verified';
     profile: 'index' | 'compact' | 'scenario' | 'full';
+    projection_report?: {
+      status: 'complete' | 'partial';
+      omitted: Array<{ path: string; count: number }>;
+      omitted_total: number;
+    };
   };
 }
 
@@ -852,11 +874,72 @@ export function buildRuntimeCapsule(input: {
   projection: Record<string, any>;
   manifest: KDNAManifest;
   digests: KDNADigestEvidence;
-  signature: { state: 'verified' | 'not_checked' | 'absent'; issuer?: string };
+  signature?: KDNASignatureEvidence;
   inputKind: 'packaged_file' | 'packaged_bytes';
   loadedAt?: string;
   schemaValid?: boolean;
 }): KDNARuntimeCapsule;
+
+export const KDSIG_PROFILE: 'kdsig.ed25519';
+export const KDSIG_PROFILE_VERSION: '0.1.0';
+export const KDSIG_ALGORITHM: 'ed25519';
+export const SIGNATURE_ENTRY_NAME: 'signature.kdsig';
+
+export interface KDNASignatureBundle {
+  algorithm: 'ed25519';
+  content_digest: string;
+  profile: 'kdsig.ed25519';
+  profile_version: '0.1.0';
+  public_key: string;
+  signature: string;
+}
+
+export function buildSigningPayload(contentDigest: string): Uint8Array;
+export function generateSigningKeyPair(): {
+  algorithm: 'ed25519';
+  private_key: string;
+  public_key: string;
+};
+export function keyFingerprint(publicKeyHex: string): string;
+export function parseSignatureBundle(bytes: Uint8Array | string): KDNASignatureBundle;
+export function serializeSignatureBundle(bundle: KDNASignatureBundle): Uint8Array;
+export function signContentDigest(
+  contentDigest: string,
+  privateKeySeedHex: string,
+): KDNASignatureBundle;
+export function verifySignatureBundle(
+  bundle: Uint8Array | string,
+  contentDigest: string,
+  options?: { expectedPublicKey?: string },
+): KDNASignatureEvidenceVerified & { algorithm: 'ed25519'; public_key: string };
+export function signKDNA(
+  input: string | Uint8Array,
+  privateKey: string,
+  options?: { outputPath?: string },
+): Promise<{
+  containerBytes: Uint8Array;
+  bundle: KDNASignatureBundle;
+  bundleBytes: Uint8Array;
+  content_digest: string;
+}>;
+export function signKDNASync(
+  input: string | Uint8Array,
+  privateKey: string,
+  options?: { outputPath?: string },
+): {
+  containerBytes: Uint8Array;
+  bundle: KDNASignatureBundle;
+  bundleBytes: Uint8Array;
+  content_digest: string;
+};
+export function verifyKDNASignature(
+  input: string | Uint8Array,
+  options?: { required?: boolean; expectedPublicKey?: string },
+): Promise<KDNASignatureEvidence>;
+export function verifyKDNASignatureSync(
+  input: string | Uint8Array,
+  options?: { required?: boolean; expectedPublicKey?: string },
+): KDNASignatureEvidence;
 export function loadRuntimeCapsule(
   input: string | Uint8Array,
   options?: {
@@ -1296,7 +1379,6 @@ export function verifyAsset(
   options?: {
     asset_digest?: string;
     content_digest?: string;
-    requireSignature?: boolean;
     requireDecryption?: boolean;
   } & KdnaDecryptOptions,
 ): Promise<KdnaAssetVerifyResult>;
@@ -1305,7 +1387,6 @@ export function verifyAssetSync(
   options?: {
     asset_digest?: string;
     content_digest?: string;
-    requireSignature?: boolean;
     requireDecryption?: boolean;
   } & KdnaDecryptOptions,
 ): KdnaAssetVerifyResult;
@@ -1319,14 +1400,6 @@ export function verifyDigestSync(
   expectedDigest: string,
   options?: KdnaDecryptOptions,
 ): KdnaAssetVerifyResult;
-export function verifySignature(
-  input: KDNAAssetInput,
-  options?: KdnaDecryptOptions,
-): Promise<KdnaAssetVerifyResult>;
-export function verifySignatureSync(
-  input: KDNAAssetInput,
-  options?: KdnaDecryptOptions,
-): KdnaAssetVerifyResult;
 export function matchDomain(
   input: string,
   candidates: Array<KDNAAssetInput | KDNAInspectResult>,
@@ -1370,6 +1443,11 @@ export interface KDNALayout {
 }
 
 export function readLayout(inputPath: string): KDNALayout;
+export function readLayoutBytes(input: Uint8Array): KDNALayout;
+export function fullEntryBufferMap(layout: KDNALayout): Record<string, Uint8Array>;
+export function contentDigestFromEntryBuffers(
+  buffers: Map<string, Uint8Array> | Record<string, Uint8Array>,
+): string;
 
 export interface KDNAChecksumEntry {
   algorithm: 'sha256';
@@ -1393,7 +1471,7 @@ export function inspect(
   input: string | Uint8Array,
   options?: Record<string, any>,
 ): Record<string, any>;
-export const KDNA_LOADER_VERSION: '0.20.0';
+export const KDNA_LOADER_VERSION: '0.22.0';
 export const STRICT_LOADER_VERSION: RegExp;
 export function parseLoaderVersion(version: unknown): readonly [string, string, string] | null;
 export function compareLoaderVersions(left: string, right: string): -1 | 0 | 1;
@@ -1454,6 +1532,7 @@ export interface KDNALoadPlan {
     source_fingerprint: string;
   } | null;
   checks: Record<string, boolean>;
+  signature_state: 'absent' | 'verified' | 'invalid';
   issues: KDNALoadPlanIssue[];
   source: {
     kind: 'dir' | 'file' | 'memory' | string | null;
@@ -1470,6 +1549,17 @@ export function planLoad(
 ): KDNALoadPlan;
 export function buildChecksums(sourceDir: string): KDNAChecksums;
 export function pack(sourceDir: string, outputPath: string): void;
+export function packEntryMap(map: Record<string, Uint8Array>): Uint8Array;
+export function signContainerBytes(
+  input: Uint8Array,
+  privateKey: string,
+  options?: Record<string, any>,
+): {
+  containerBytes: Uint8Array;
+  bundle: KDNASignatureBundle;
+  bundleBytes: Uint8Array;
+  content_digest: string;
+};
 export function unpack(inputPath: string, outputDir: string): void;
 export function loadAuthorized(
   input: string | Uint8Array,