@aikdna/kdna-core 0.36.0-rc.r2.7 → 0.37.0

package/src/public-contract/key-grant-issuer-node.d.ts

@@ -10,7 +10,7 @@ export type IssuerIssuedObservation = { readonly "status": "issued"; readonly "g
 export type IssuerCoreRejectedObservation = { readonly "status": "core_rejected"; readonly "core": { readonly "status": "rejected"; readonly "reason": ReadDiagnosticCode; }; readonly "stage": "asset"; };
 export type IssuerFailedObservation = ({ readonly "status": "issuer_failed"; readonly "code": "ISSUER_INPUT_INVALID"; readonly "stage": "input"; } | { readonly "status": "issuer_failed"; readonly "code": "ISSUER_ASSET_PROFILE_UNSUPPORTED"; readonly "stage": "asset"; } | { readonly "status": "issuer_failed"; readonly "code": "ISSUER_ASSET_AUTHENTICATION_FAILED"; readonly "stage": "asset" | "integrity"; } | { readonly "status": "issuer_failed"; readonly "code": "ISSUER_KEY_INVALID"; readonly "stage": "issuer_key"; } | { readonly "status": "issuer_failed"; readonly "code": "ISSUER_GRANT_OPTIONS_INVALID"; readonly "stage": "input" | "grant"; } | { readonly "status": "issuer_failed"; readonly "code": "ISSUER_OUTPUT_INVALID"; readonly "stage": "input" | "asset" | "integrity" | "issuer_key" | "grant"; });
 export type IssuerResultObservation = (IssuerIssuedObservation | IssuerCoreRejectedObservation | IssuerFailedObservation);
-export type IssuerDescriptor = { readonly "id": "kdna.external-grant-issuer/1"; readonly "version": "1.0.0"; readonly "definition_digest": Digest; readonly "implementation": { readonly "package": "@aikdna/kdna-core"; readonly "version": "0.36.0-rc.r2.7"; }; readonly "exports": readonly ["getExternalGrantIssuerContract", "issueExternalKeyGrantForAsset"]; readonly "limits": { readonly "container_bytes": 26214400; readonly "grant_bytes": 1048576; readonly "timeout_ms_max": 60000; readonly "max_concurrent": 4; }; };
+export type IssuerDescriptor = { readonly "id": "kdna.external-grant-issuer/1"; readonly "version": "1.0.0"; readonly "definition_digest": Digest; readonly "implementation": { readonly "package": "@aikdna/kdna-core"; readonly "version": "0.37.0"; }; readonly "exports": readonly ["getExternalGrantIssuerContract", "issueExternalKeyGrantForAsset"]; readonly "limits": { readonly "container_bytes": 26214400; readonly "grant_bytes": 1048576; readonly "timeout_ms_max": 60000; readonly "max_concurrent": 4; }; };
 export type IssuerSecrets = { readonly issuerRootKey: Uint8Array; readonly issuerSigningPrivateKeyPkcs8: Uint8Array; readonly signaturePolicy: IssuerSignaturePolicy };
 export type IssuanceResult = (IssuerIssuedObservation & { readonly grantBytes: Uint8Array }) | IssuerCoreRejectedObservation | IssuerFailedObservation;
 export declare function getExternalGrantIssuerContract(): IssuerDescriptor;

package/src/public-contract/package-set-contract.generated.json

@@ -11,8 +11,8 @@
       "inspectAdmittedPackageSet",
       "verifyPackageSetHandoff"
     ],
-    "core_version": "0.36.0-rc.r2.7",
-    "definition_digest": "sha256:3b64c648ed8d2f10076ed6311f45917700df15dbc17590c1e820d64b73d83e66",
+    "core_version": "0.37.0",
+    "definition_digest": "sha256:86ceacb30be63d3b25e6cac17889ebd650fdc5cdff43340ad7d517423d2740fd",
     "limits": {
       "maxMembers": 10000,
       "maxTotalSourceBytes": 104857600
@@ -39,7 +39,7 @@
       "sealPackageSetHandoff",
       "admitPackageSetHandoff"
     ],
-    "read_version": "0.11.0-rc.r2.7"
+    "read_version": "0.11.1"
   },
   "key_sets": {
     "HandoffMember": {
@@ -739,7 +739,7 @@
           "type": "array"
         },
         "core_version": {
-          "const": "0.36.0-rc.r2.7",
+          "const": "0.37.0",
           "type": "string"
         },
         "definition_digest": {
@@ -769,7 +769,7 @@
           "type": "array"
         },
         "read_version": {
-          "const": "0.11.0-rc.r2.7",
+          "const": "0.11.1",
           "type": "string"
         }
       },

package/src/public-contract/package-set-node.d.ts

@@ -6,7 +6,7 @@ export type PackageSetMemberObservationRequest = { readonly "set_id": Identifier
 export type PackageSetMemberObservationRow = { readonly "member_id": Identifier; readonly "asset_id": Identifier; readonly "asset_version": VersionLabel; readonly "A": Digest; readonly "decision": "allow" | "deny"; readonly "decision_id": Identifier; readonly "host_id": Identifier; readonly "host_epoch": Identifier; readonly "issued_at": UInt; readonly "expires_at": UInt; readonly "current_ms": UInt; };
 export type PackageSetMemberObservation = { readonly "decisions": ReadonlyArray<PackageSetMemberObservationRow>; };
 export type PackageSetReadObservation = { readonly "context": HostReadContextData; readonly "current_ms": UInt; };
-export type PackageSetNodeDescriptor = { readonly "contract": "kdna.package-set-node/0.2.1"; readonly "module_version": "0.2.0"; readonly "core_version": "0.36.0-rc.r2.7"; readonly "read_version": "0.11.0-rc.r2.7"; readonly "limits": PackageSetLimits; readonly "local_failures": ReadonlyArray<PackageSetLocalFailure>; readonly "core_callables": ReadonlyArray<Identifier>; readonly "read_callables": ReadonlyArray<Identifier>; readonly "claims": "claims_not_authenticated"; readonly "definition_digest": Digest; };
+export type PackageSetNodeDescriptor = { readonly "contract": "kdna.package-set-node/0.2.1"; readonly "module_version": "0.2.0"; readonly "core_version": "0.37.0"; readonly "read_version": "0.11.1"; readonly "limits": PackageSetLimits; readonly "local_failures": ReadonlyArray<PackageSetLocalFailure>; readonly "core_callables": ReadonlyArray<Identifier>; readonly "read_callables": ReadonlyArray<Identifier>; readonly "claims": "claims_not_authenticated"; readonly "definition_digest": Digest; };
 export type PackageSetNodeSurface = (PackageSet | PackageSetHandoff | PackageSetMemberObservationRequest | PackageSetMemberObservation | PackageSetReadObservation | PackageSetNodeDescriptor);
 export type PackageSetOperation = "isolated_read" | "semantic_merge" | "cross_asset_reference";
 export type PackageSetMemberSource = { readonly "member_id": string; readonly "bytes": Uint8Array };

package/src/public-contract/package-set-validators.generated.js

@@ -2324,7 +2324,7 @@ return errors === 0;
 }
 validate41.evaluated = {"props":true,"dynamicProps":false,"dynamicItems":false};
 
-const schema87 = {"additionalProperties":false,"properties":{"claims":{"const":"claims_not_authenticated","type":"string"},"contract":{"const":"kdna.package-set-node/0.2.1","type":"string"},"core_callables":{"items":{"$ref":"#/$defs/Identifier"},"maxItems":7,"minItems":7,"type":"array"},"core_version":{"const":"0.36.0-rc.r2.7","type":"string"},"definition_digest":{"$ref":"#/$defs/Digest"},"limits":{"$ref":"#/$defs/PackageSetLimits"},"local_failures":{"items":{"$ref":"#/$defs/PackageSetLocalFailure"},"maxItems":12,"minItems":12,"type":"array"},"module_version":{"const":"0.2.0","type":"string"},"read_callables":{"items":{"$ref":"#/$defs/Identifier"},"maxItems":5,"minItems":5,"type":"array"},"read_version":{"const":"0.11.0-rc.r2.7","type":"string"}},"required":["contract","module_version","core_version","read_version","limits","local_failures","core_callables","read_callables","claims","definition_digest"],"type":"object"};
+const schema87 = {"additionalProperties":false,"properties":{"claims":{"const":"claims_not_authenticated","type":"string"},"contract":{"const":"kdna.package-set-node/0.2.1","type":"string"},"core_callables":{"items":{"$ref":"#/$defs/Identifier"},"maxItems":7,"minItems":7,"type":"array"},"core_version":{"const":"0.37.0","type":"string"},"definition_digest":{"$ref":"#/$defs/Digest"},"limits":{"$ref":"#/$defs/PackageSetLimits"},"local_failures":{"items":{"$ref":"#/$defs/PackageSetLocalFailure"},"maxItems":12,"minItems":12,"type":"array"},"module_version":{"const":"0.2.0","type":"string"},"read_callables":{"items":{"$ref":"#/$defs/Identifier"},"maxItems":5,"minItems":5,"type":"array"},"read_version":{"const":"0.11.1","type":"string"}},"required":["contract","module_version","core_version","read_version","limits","local_failures","core_callables","read_callables","claims","definition_digest"],"type":"object"};
 const schema90 = {"additionalProperties":false,"properties":{"maxMembers":{"const":10000,"type":"integer"},"maxTotalSourceBytes":{"const":104857600,"type":"integer"}},"required":["maxMembers","maxTotalSourceBytes"],"type":"object"};
 const schema91 = {"enum":["invalid_limits","member_limit_exceeded","source_bytes_limit_exceeded","invalid_member_source","invalid_read_request","provider_invalid","provider_failed","provider_observation_invalid","cancelled","core_unavailable","delivery_unconfirmed","handoff_invalid"],"type":"string"};
 
@@ -2460,8 +2460,8 @@ if(typeof data4 !== "string"){
 validate45.errors = [{instancePath:instancePath+"/core_version",schemaPath:"#/properties/core_version/type",keyword:"type",params:{type: "string"},message:"must be string"}];
 return false;
 }
-if("0.36.0-rc.r2.7" !== data4){
-validate45.errors = [{instancePath:instancePath+"/core_version",schemaPath:"#/properties/core_version/const",keyword:"const",params:{allowedValue: "0.36.0-rc.r2.7"},message:"must be equal to constant"}];
+if("0.37.0" !== data4){
+validate45.errors = [{instancePath:instancePath+"/core_version",schemaPath:"#/properties/core_version/const",keyword:"const",params:{allowedValue: "0.37.0"},message:"must be equal to constant"}];
 return false;
 }
 var valid0 = _errs11 === errors;
@@ -2696,8 +2696,8 @@ if(typeof data14 !== "string"){
 validate45.errors = [{instancePath:instancePath+"/read_version",schemaPath:"#/properties/read_version/type",keyword:"type",params:{type: "string"},message:"must be string"}];
 return false;
 }
-if("0.11.0-rc.r2.7" !== data14){
-validate45.errors = [{instancePath:instancePath+"/read_version",schemaPath:"#/properties/read_version/const",keyword:"const",params:{allowedValue: "0.11.0-rc.r2.7"},message:"must be equal to constant"}];
+if("0.11.1" !== data14){
+validate45.errors = [{instancePath:instancePath+"/read_version",schemaPath:"#/properties/read_version/const",keyword:"const",params:{allowedValue: "0.11.1"},message:"must be equal to constant"}];
 return false;
 }
 var valid0 = _errs36 === errors;
@@ -2973,8 +2973,8 @@ if(typeof data4 !== "string"){
 validate55.errors = [{instancePath:instancePath+"/core_version",schemaPath:"#/properties/core_version/type",keyword:"type",params:{type: "string"},message:"must be string"}];
 return false;
 }
-if("0.36.0-rc.r2.7" !== data4){
-validate55.errors = [{instancePath:instancePath+"/core_version",schemaPath:"#/properties/core_version/const",keyword:"const",params:{allowedValue: "0.36.0-rc.r2.7"},message:"must be equal to constant"}];
+if("0.37.0" !== data4){
+validate55.errors = [{instancePath:instancePath+"/core_version",schemaPath:"#/properties/core_version/const",keyword:"const",params:{allowedValue: "0.37.0"},message:"must be equal to constant"}];
 return false;
 }
 var valid0 = _errs11 === errors;
@@ -3209,8 +3209,8 @@ if(typeof data14 !== "string"){
 validate55.errors = [{instancePath:instancePath+"/read_version",schemaPath:"#/properties/read_version/type",keyword:"type",params:{type: "string"},message:"must be string"}];
 return false;
 }
-if("0.11.0-rc.r2.7" !== data14){
-validate55.errors = [{instancePath:instancePath+"/read_version",schemaPath:"#/properties/read_version/const",keyword:"const",params:{allowedValue: "0.11.0-rc.r2.7"},message:"must be equal to constant"}];
+if("0.11.1" !== data14){
+validate55.errors = [{instancePath:instancePath+"/read_version",schemaPath:"#/properties/read_version/const",keyword:"const",params:{allowedValue: "0.11.1"},message:"must be equal to constant"}];
 return false;
 }
 var valid0 = _errs36 === errors;

package/src/public-contract/packageset06/contract.json

@@ -2,8 +2,8 @@
   "candidate_only": true,
   "source": {
     "path": "specs/public-semantic-source.json",
-    "bytes": 1435436,
-    "sha256": "4b39c37c7a6f18ade567fb6248e6488af94737c0f4a08f25ef4751399e5315ec"
+    "bytes": 1438087,
+    "sha256": "5ae686be4e7a7d7abcc88967ac3fc67cbbcc7e5f60d8379cc109edd7a581598a"
   },
   "historical_original_source": {
     "scope": "historical_original_contract_source_identity_not_current_generator_input",

package/src/public-contract/packageset06/generation-manifest.json

@@ -3,35 +3,35 @@
   "candidate_only": true,
   "source": {
     "path": "specs/public-semantic-source.json",
-    "bytes": 1435436,
-    "sha256": "4b39c37c7a6f18ade567fb6248e6488af94737c0f4a08f25ef4751399e5315ec"
+    "bytes": 1438087,
+    "sha256": "5ae686be4e7a7d7abcc88967ac3fc67cbbcc7e5f60d8379cc109edd7a581598a"
   },
   "producer": {
     "recipe": {
       "path": "scripts/public-contract/native-output-recipe.json",
-      "bytes": 155955,
-      "sha256": "b0cbd0e1f84ff66a777ec355b3247a7291db5464f315dc816a490161ff041ff0"
+      "bytes": 155707,
+      "sha256": "2cf31e27fdd1d8264b41fc7355a5c767c4a28f5cec01a7930f5c8a6851c36c29"
     },
     "scripts": [
       {
         "path": "scripts/public-contract/generate-native.mjs",
-        "bytes": 6022,
-        "sha256": "43795046b00966c27a2db591d0792c370bc956bf7f2268b9d8646f7a2b3715f3"
+        "bytes": 6966,
+        "sha256": "2385330076357ac83182d77e0a1f7bf683003aaae276103919862811db36da3d"
       },
       {
         "path": "scripts/public-contract/native-renderer.mjs",
-        "bytes": 15777,
-        "sha256": "0c5a8a5d10e96d9842325a9180b8112e4c9c760bae49979f67e4691df4b5c5cf"
+        "bytes": 19534,
+        "sha256": "05a359837c3c61d18ecc3fe109387ade921daf25eb12a8530e7a5b7550dfe1c7"
       },
       {
         "path": "scripts/public-contract/generation-writer.mjs",
-        "bytes": 4940,
-        "sha256": "2ec51fda7f38c4d35d915ef0bf4e75d34a33c65ca7cc8ad6648b062d065d4bdc"
+        "bytes": 5909,
+        "sha256": "5f2b95585cfb99084af9ad03a2e95926d7a445c12f25ed29ede05aa6d17bac98"
       },
       {
         "path": "scripts/public-contract/generate.mjs",
-        "bytes": 72318,
-        "sha256": "cd1914a7fd684fc033f635bd331bb5491446222352097fec72dc05982e0e4661"
+        "bytes": 73563,
+        "sha256": "9ed819f22c943fcda69a8df10ea1d49439255fee0fb72f81a8e5a6d5c1a4dd26"
       }
     ]
   },
@@ -586,7 +586,7 @@
     {
       "path": "packages/kdna-core/src/public-contract/packageset06/contract.json",
       "bytes": 307339,
-      "sha256": "51100a21485fb629b4f6a642c61e8bd2710f37a5062e7d106d79e15e5392a389"
+      "sha256": "bd01b6f179b096cb0e0e65ebe3ff42322401e9920ef78220347dc0d8662a48fd"
     },
     {
       "path": "packages/kdna-core/src/public-contract/packageset06/api.d.ts",

package/src/public-contract/protected-browser.d.ts

@@ -0,0 +1,17 @@
+// Generated protected-browser definitions; schema validity is not authority.
+import type { CanonicalReadSnapshot, CoreAdmissionCatalogOnly, CoreAdmissionRejected } from './types.js';
+import type { ProtectionDiagnostic, ProtectionRuntimeDescriptor, ProtectedSignaturePolicy, TrustedProtectionProvider } from './protection-node.js';
+export type ConsumerUnlockSelection = { readonly "slotIndex": number; readonly "slot": string; readonly "kdf_profile": "scrypt-sha256" | "argon2id"; };
+export type ConsumerUnlockObservation = { readonly "kind": "consumer_unlock_observation"; readonly "proof": "observation_not_authority"; readonly "checked_at_ms": number; readonly "selection": ConsumerUnlockSelection; };
+export type ProtectedBrowserInput = { readonly "bytes": Uint8Array; readonly "plaintextPayload": Uint8Array; readonly "observation": ConsumerUnlockObservation; readonly "signaturePolicy"?: ProtectedSignaturePolicy; };
+export type ProtectedBrowserDisclosure = { readonly "slot_selection": ConsumerUnlockSelection; readonly "observation_not_authority": true; readonly "provenance": "host_supplied_triple"; };
+export type ProtectedBrowserAccepted = { readonly "status": "accepted"; readonly "snapshot": CanonicalReadSnapshot; readonly "disclosure": ProtectedBrowserDisclosure; };
+export type ProtectedBrowserCatalogOnly = { readonly "status": "catalog_only"; readonly "catalog": CoreAdmissionCatalogOnly; readonly "disclosure": ProtectedBrowserDisclosure; };
+export type ProtectedBrowserCoreRejected = { readonly "status": "core_rejected"; readonly "stage": "container" | "manifest" | "payload" | "interpretation"; readonly "core": CoreAdmissionRejected; };
+export type ProtectedBrowserFailed = { readonly "status": "protection_failed"; readonly "diagnostic": ProtectedBrowserDiagnostic; };
+// The observation-phase codes are the reviewed family extension settled under
+// D-CBPA-IMPL-3 (2026-10-06); the shared node codes keep their stages.
+export type ProtectedBrowserDiagnostic = (ProtectionDiagnostic | { readonly "code": "PROTECTION_OBSERVATION_INVALID"; readonly "stage": "observation"; } | { readonly "code": "PROTECTION_OBSERVATION_BINDING_INVALID"; readonly "stage": "binding"; } | { readonly "code": "PROTECTION_NOT_DECLARED"; readonly "stage": "declaration"; });
+export type ProtectedBrowserAdmissionResult = (ProtectedBrowserAccepted | ProtectedBrowserCatalogOnly | ProtectedBrowserCoreRejected | ProtectedBrowserFailed);
+export declare function getProtectionContract(): ProtectionRuntimeDescriptor;
+export declare function admitProtectedBrowser(input: ProtectedBrowserInput, provider: TrustedProtectionProvider): Promise<ProtectedBrowserAdmissionResult>;

package/src/public-contract/protected-browser.js

@@ -0,0 +1,4 @@
+'use strict';
+const { getProtectionContract } = require('./protection-declaration.js');
+const { admitProtectedBrowser } = require('./protection-admission-browser.js');
+module.exports = { getProtectionContract, admitProtectedBrowser };

package/src/public-contract/protected-browser.mjs

@@ -0,0 +1,2 @@
+import api from './protected-browser.js';
+export const { getProtectionContract, admitProtectedBrowser } = api;

package/src/public-contract/protected-source-contract.generated.json

@@ -1,6 +1,6 @@
 {
   "api_typescript": "export type ProtectedSourceContractIdentity = { readonly id: 'kdna.protected-source/1'; readonly version: '1.0.0'; readonly definition_digest: import('./types.js').Digest };\nexport type ProtectedSourceRuntimeDescriptor = { readonly contract: ProtectedSourceContractIdentity; readonly implementation: { readonly package: '@aikdna/kdna-core'; readonly version: string }; readonly profiles: ReadonlyArray<'kdna.envelope.aead/0.1.0' | 'kdna.envelope.external-grant/0.1.0'>; readonly callables: ReadonlyArray<'getProtectedSourceContract' | 'createTrustedProtectedSourceHost' | 'withProtectedSourceNode' | 'commitProtectedSourceTransport' | 'previewProtectedSourceRevision' | 'produceProtectedSourceRevision'>; readonly limits: { readonly container_bytes: 26214400; readonly entries: 128; readonly entry_bytes: 8388608; readonly total_uncompressed_bytes: 12582912; readonly delivered_plaintext_bytes: 8388608; readonly documented_raw_byte_bound: 20971520; readonly timeout_ms_max: 60000 }; readonly proof_limits: ReadonlyArray<string> };\nexport type SourceHostObservationContext = { readonly context_id: string | null; readonly epoch: string | null; readonly asset_digest: string; readonly scope: 'complete_source'; readonly purpose: string; readonly requested_at_ms: number };\nexport type ProtectedSourceMember = { readonly name: string; readonly type: 'file'; readonly mode: number; readonly bytes: Uint8Array };\nexport type ProtectedSourceInventoryEntry = { readonly name: string; readonly type: 'file'; readonly mode: number; readonly size: number; readonly sha256: string };\nexport type ProtectedSourceBundle = { readonly identity: { readonly A: string; readonly C: string; readonly E: string }; readonly manifest: unknown; readonly payload: unknown; readonly original_members: ReadonlyArray<ProtectedSourceMember>; readonly original_inventory: ReadonlyArray<ProtectedSourceInventoryEntry>; readonly plaintext_payload: { readonly entry: 'payload.kdnab'; readonly bytes: Uint8Array; readonly sha256: string }; readonly prior_snapshot: unknown; readonly host_observation: unknown; readonly proof_limits: ReadonlyArray<string> };\nexport type ProtectedSourceRevisionContext = { readonly [brand: symbol]: true };\nexport type ProtectedSourcePreparedDelivery = { readonly [brand: symbol]: true };\nexport type ProtectedSourceHostCallbacks = { readonly observe: (context: SourceHostObservationContext) => SourceHostObservation | Promise<SourceHostObservation>; readonly deliver: (bundle: ProtectedSourceBundle, prepared: ProtectedSourcePreparedDelivery, context: ProtectedSourceRevisionContext) => boolean | Promise<boolean> };\nexport type TrustedProtectedSourceHost = { readonly [brand: symbol]: true };\nexport type ProtectedSourceRevisionOptions = { readonly admission: import('./protection-node.js').ProtectedAdmissionOptions; readonly expected_A: string; readonly timeout_ms: number };\nexport type TrustedProtectedSourceTransport = { readonly observeScope: () => SourceHostObservation | Promise<SourceHostObservation>; readonly commit: (bundle: ProtectedSourceBundle | null) => boolean };\nexport type ProtectedSourceCommitResult = { readonly status: 'source_committed'; readonly disclosure: import('./protection-node.js').ProtectionDisclosure; readonly body: null; readonly body_bytes: 0 } | SourceFailed;\nexport type ProtectedSourcePolicy = ({ readonly kind: 'password'; readonly asset_uid: string; readonly entitlement: { readonly profile: 'password'; readonly offline?: boolean; readonly revocable?: boolean }; readonly slots: ReadonlyArray<{ readonly slot: string; readonly kdf_profile: 'scrypt-sha256' | 'argon2id' }> } | { readonly kind: 'external-grant'; readonly asset_uid: string; readonly entitlement: { readonly profile: 'account' | 'org'; readonly offline?: boolean; readonly revocable?: boolean }; readonly key_ref: string; readonly issuer_key_id: string }) & { readonly checksums: boolean; readonly signature: 'none' | 'ed25519' };\nexport type ProtectedSourceEdits = { readonly manifest?: unknown; readonly payload?: unknown };\nexport type ProtectedSourceProviderRequest = { readonly source_A: string; readonly edits_digest: string; readonly policy_digest: string; readonly kind: 'password' | 'external-grant'; readonly signature: 'none' | 'ed25519' };\nexport type ProtectedSourceOutputSecrets = { readonly passwords?: ReadonlyArray<{ readonly slot: string; readonly password: Uint8Array }>; readonly signingSeed?: Uint8Array; readonly issuerRootKey?: Uint8Array };\nexport type SourceRevisionEvidence = { readonly contract: ProtectedSourceContractIdentity; readonly implementation: { readonly package: '@aikdna/kdna-core'; readonly version: string }; readonly source_A: string; readonly output: { readonly A: string; readonly C: string; readonly E: string }; readonly profile: { readonly id: string; readonly version: string }; readonly entry: 'payload.kdnab'; readonly member_actions: { readonly [name: string]: 'added' | 'replaced' | 'removed' }; readonly integrity: unknown; readonly payload_source: 'explicit_edit' | 'original_decrypted_cbor'; readonly proof: 'producer_observation_not_consumer_admission'; readonly output_delivery: 'not_published' | 'trusted_host'; readonly output_A: string | null };\nexport type ProtectedSourceRevisionResult = { readonly status: 'revision_produced'; readonly bytes: Uint8Array; readonly evidence: SourceRevisionEvidence; readonly body_bytes: number } | { readonly status: 'revision_rejected'; readonly diagnostic: SourceDiagnostic; readonly body: null; readonly body_bytes: 0 };\nexport declare function getProtectedSourceContract(): ProtectedSourceRuntimeDescriptor;\nexport declare function createTrustedProtectedSourceHost(callbacks: ProtectedSourceHostCallbacks): TrustedProtectedSourceHost;\nexport declare function withProtectedSourceNode(input: string | Uint8Array, options: ProtectedSourceRevisionOptions, protectionProvider: import('./protection-node.js').TrustedProtectionProvider, sourceHost: TrustedProtectedSourceHost): Promise<ProtectedSourceObservation>;\nexport declare function commitProtectedSourceTransport(prepared: ProtectedSourcePreparedDelivery, transport: TrustedProtectedSourceTransport): Promise<ProtectedSourceCommitResult>;\nexport declare function previewProtectedSourceRevision(context: ProtectedSourceRevisionContext, edits: ProtectedSourceEdits, policy: ProtectedSourcePolicy): Promise<ProtectedSourceRevisionPreviewResult>;\nexport declare function produceProtectedSourceRevision(context: ProtectedSourceRevisionContext, edits: ProtectedSourceEdits, policy: ProtectedSourcePolicy, outputSecretProvider: (request: ProtectedSourceProviderRequest) => ProtectedSourceOutputSecrets | Promise<ProtectedSourceOutputSecrets>): Promise<ProtectedSourceRevisionResult>;\n",
-  "definition_digest": "sha256:848d4afbb80130e12217c0d86ef5d6a21e5e032687d47c3837dc8341f25981fe",
+  "definition_digest": "sha256:612b285c79566eb308ff613fbc4fd1599ee35076efaf5c1214c271ebfa3334ab",
   "id": "kdna.protected-source/1",
   "limits": {
     "container_bytes": 26214400,
@@ -29,8 +29,8 @@
   ],
   "schema_binding": {
     "package_versions": {
-      "@aikdna/kdna-core": "0.36.0-rc.r2.7",
-      "@aikdna/kdna-read": "0.11.0-rc.r2.7"
+      "@aikdna/kdna-core": "0.37.0",
+      "@aikdna/kdna-read": "0.11.1"
     },
     "version_tuple": {
       "container": "0.5.0",
@@ -9260,7 +9260,7 @@
               "type": "string"
             },
             "version": {
-              "const": "0.36.0-rc.r2.7",
+              "const": "0.37.0",
               "type": "string"
             }
           },
@@ -10632,7 +10632,7 @@
               "type": "string"
             },
             "version": {
-              "const": "0.36.0-rc.r2.7",
+              "const": "0.37.0",
               "type": "string"
             }
           },
@@ -13783,7 +13783,7 @@
               "type": "string"
             },
             "version": {
-              "const": "0.36.0-rc.r2.7",
+              "const": "0.37.0",
               "type": "string"
             }
           },

package/src/public-contract/protected-source-node.d.ts

@@ -10,7 +10,7 @@ export type ProtectedSourceCatalog = { readonly "status": "catalog_only"; readon
 export type SourceCoreRejected = { readonly "status": "core_rejected"; readonly "stage": "admission"; readonly "core": CoreAdmissionRejected; readonly "disclosure": ProtectionDisclosure; readonly "body": null; readonly "body_bytes": 0; };
 export type ProtectedSourceObservation = (ProtectedSourceDelivered | ProtectedSourceCatalog | SourceCoreRejected | SourceFailed);
 export type SourceHostObservation = { readonly "context_id": Identifier; readonly "epoch": Identifier; readonly "asset_digest": Digest; readonly "permission": "allowed" | "denied"; readonly "scope": "complete_source"; readonly "current_ms": UInt; readonly "expires_at_ms": UInt; readonly "revoked": boolean; };
-export type SourcePreviewValidation = { readonly "contract": ProtectionContractIdentity; readonly "implementation": { readonly "name": "@aikdna/kdna-core"; readonly "version": "0.36.0-rc.r2.7"; }; readonly "source_A": Digest; readonly "original_payload_digest": Digest; readonly "edits_digest": Digest; readonly "policy_digest": Digest; readonly "semantic_status": "valid"; readonly "proof": "semantic_validation_not_ciphertext_admission"; };
+export type SourcePreviewValidation = { readonly "contract": ProtectionContractIdentity; readonly "implementation": { readonly "name": "@aikdna/kdna-core"; readonly "version": "0.37.0"; }; readonly "source_A": Digest; readonly "original_payload_digest": Digest; readonly "edits_digest": Digest; readonly "policy_digest": Digest; readonly "semantic_status": "valid"; readonly "proof": "semantic_validation_not_ciphertext_admission"; };
 export type SourcePreviewValid = { readonly "status": "preview_valid"; readonly "validation": SourcePreviewValidation; readonly "body": null; readonly "body_bytes": 0; };
 export type SourcePreviewRejected = { readonly "status": "preview_rejected"; readonly "diagnostic": SourceDiagnostic; readonly "body": null; readonly "body_bytes": 0; };
 export type ProtectedSourceRevisionPreviewResult = (SourcePreviewValid | SourcePreviewRejected);

package/src/public-contract/protection-admission-browser.js

@@ -0,0 +1,114 @@
+'use strict';
+// Browser protected admission core (case A: an independent browser entry).
+//
+// The host supplies the container bytes, the payload plaintext bytes and the
+// unlock observation; nothing here decrypts, and the observation is never
+// authority (its provenance limit is named in the disclosure). The five-step
+// admission mirrors the retained node entry's structure and codes; the kdsig
+// face follows the browser family route (globalThis.crypto subtle, same
+// kdsig.ed25519:0.1.0 framing as the node helper), and the checksums document
+// is verified against a verbatim local port of protection-integrity.makeChecksums
+// (that module is node-bound by its kdsig helper import).
+const { parseJson, canonicalJson, freeze, uint, identifier } = require('./strict-input.js');
+const { parseContainer } = require('./container.js');
+const { inflate } = require('./browser-native/portable-inflate.js');
+const { utf8, fromHex } = require('./browser-native/bytes.js');
+const { digest, contentTreePreimage, runtimeEntryPreimage, runtimeEntryNames } = require('./digests.js');
+const { validate } = require('./validate.js');
+const { rejected } = require('./admit.js');
+const { decodeValidatedPayload, assertContentBindings, finishAdmission } = require('./semantic-admission.js');
+const { fail, failure, isFailure, closed, provider, assetProtectionDeclaration } = require('./protection-declaration.js');
+const { decodeEnvelope, validateEnvelopeShape } = require('./protection-envelope-codec.js');
+const { signatureContentPreimage } = require('./browser-native/signature-domain.js');
+const { ChecksumsDocument1: checksumsShape } = require('./protection-validators.generated.js');
+function checkDeclaration(manifest) {
+  const profile = assetProtectionDeclaration(manifest);
+  if (!profile) fail('NOT_DECLARED', 'declaration');
+  if (profile.id !== 'kdna.envelope.aead') fail('PROFILE_UNSUPPORTED', 'declaration');
+  if (manifest.entitlement.offline === false || manifest.entitlement.revocable === true) fail('DECLARATION_CONFLICT', 'authorization');
+  return profile;
+}
+function inputs(value, inputProvider) {
+  closed(value, ['bytes', 'plaintextPayload', 'observation'], ['signaturePolicy']);
+  if (!(value.bytes instanceof Uint8Array) || !(value.plaintextPayload instanceof Uint8Array)) fail('INPUT_INVALID', 'input');
+  const policy = value.signaturePolicy === undefined ? { requireSignature: false, expectedPublicKeyHex: null } : closed(value.signaturePolicy, ['requireSignature', 'expectedPublicKeyHex']);
+  if (typeof policy.requireSignature !== 'boolean' || (policy.expectedPublicKeyHex !== null && (typeof policy.expectedPublicKeyHex !== 'string' || !/^[0-9a-f]{64}$/.test(policy.expectedPublicKeyHex)))) fail('INPUT_INVALID', 'input');
+  const o = closed(value.observation, ['kind', 'proof', 'checked_at_ms', 'selection']);
+  if (o.kind !== 'consumer_unlock_observation' || o.proof !== 'observation_not_authority' || !uint(o.checked_at_ms)) fail('OBSERVATION_INVALID', 'observation');
+  const s = closed(o.selection, ['slotIndex', 'slot', 'kdf_profile']);
+  if (!uint(s.slotIndex) || !identifier(s.slot) || !['scrypt-sha256', 'argon2id'].includes(s.kdf_profile)) fail('OBSERVATION_INVALID', 'observation');
+  return { bytes: new Uint8Array(value.bytes), plaintext: new Uint8Array(value.plaintextPayload), observation: { kind: o.kind, proof: o.proof, checked_at_ms: o.checked_at_ms, selection: { slotIndex: s.slotIndex, slot: s.slot, kdf_profile: s.kdf_profile } }, signaturePolicy: { ...policy }, trustedProvider: provider(inputProvider, 'password') };
+}
+function assertObservationBinding(observation, envelope) {
+  const slots = envelope.key_slots;
+  if (observation.selection.slotIndex >= slots.length) fail('OBSERVATION_BINDING_INVALID', 'binding');
+  const slot = slots[observation.selection.slotIndex];
+  if (slot.slot !== observation.selection.slot || slot.kdf_profile !== observation.selection.kdf_profile) fail('OBSERVATION_BINDING_INVALID', 'binding');
+}
+// Verbatim port of protection-integrity.makeChecksums (node-bound there).
+function makeChecksums(entries, manifest, E) {
+  const names = runtimeEntryNames(entries, manifest);
+  return { profile: 'kdna.checksums.document/1', profile_version: '1.0.0', algorithm: 'sha256', digest_profile: 'kdna.digest-basis.runtime-entry-set', digest_profile_version: '0.2.0', covered_entries: names, entries: names.map(name => ({ name, bytes: entries[name].length, digest: digest(entries[name]) })), entry_set_digest: E };
+}
+function parseKdsigBundle(raw) {
+  // The same bundle domain the node helper and the browser section verifier accept.
+  if (raw.length < 3 || raw.length > 1048576) fail('SIGNATURE_INVALID', 'integrity');
+  if (raw[0] === 0xef && raw[1] === 0xbb && raw[2] === 0xbf) fail('SIGNATURE_INVALID', 'integrity');
+  let value;
+  try { value = parseJson(raw); } catch { fail('SIGNATURE_INVALID', 'integrity'); }
+  const fields = ['algorithm', 'content_digest', 'profile', 'profile_version', 'public_key', 'signature'];
+  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).length !== fields.length || !fields.every(k => Object.hasOwn(value, k) && typeof value[k] === 'string')) fail('SIGNATURE_INVALID', 'integrity');
+  if (!/^sha256:[0-9a-f]{64}$/.test(value.content_digest) || !/^[0-9a-f]{64}$/.test(value.public_key) || !/^[0-9a-f]{128}$/.test(value.signature)) fail('SIGNATURE_INVALID', 'integrity');
+  if (value.profile !== 'kdsig.ed25519' || value.profile_version !== '0.1.0' || value.algorithm !== 'ed25519') fail('PROFILE_UNSUPPORTED', 'integrity');
+  return value;
+}
+async function verifyIntegrityBrowser(entries, manifest, E, policy) {
+  const integrity = { checksums: 'absent', signature: 'absent', signature_content_digest: null };
+  if (Object.hasOwn(entries, 'checksums.json')) {
+    const raw = entries['checksums.json']; let value;
+    try { if (raw.length > 1048576) throw Error(); value = parseJson(raw); } catch { fail('CHECKSUMS_INVALID', 'integrity'); }
+    if (value?.profile !== 'kdna.checksums.document/1' || value?.profile_version !== '1.0.0') fail('PROFILE_UNSUPPORTED', 'integrity');
+    if (!checksumsShape(value) || canonicalJson(value) !== canonicalJson(makeChecksums(entries, manifest, E))) fail('CHECKSUMS_INVALID', 'integrity');
+    integrity.checksums = 'verified_document_1';
+  }
+  if (Object.hasOwn(entries, 'signature.kdsig')) {
+    const bundle = parseKdsigBundle(entries['signature.kdsig']);
+    if (policy.expectedPublicKeyHex !== null && bundle.public_key !== policy.expectedPublicKeyHex) fail('SIGNATURE_PIN_MISMATCH', 'integrity');
+    const signatureDigest = digest(signatureContentPreimage(entries));
+    if (bundle.content_digest !== signatureDigest) fail('SIGNATURE_INVALID', 'integrity');
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle || typeof subtle.importKey !== 'function' || typeof subtle.verify !== 'function') throw Object.assign(new Error('WebCrypto Ed25519 unavailable'), { reason: 'READ_CORE_CAPABILITY_UNAVAILABLE' });
+    try {
+      const key = await subtle.importKey('raw', fromHex(bundle.public_key), 'Ed25519', false, ['verify']);
+      const ok = await subtle.verify('Ed25519', key, fromHex(bundle.signature), utf8('kdsig.ed25519:0.1.0:' + signatureDigest));
+      if (ok !== true) fail('SIGNATURE_INVALID', 'integrity');
+    } catch (error) { if (isFailure(error)) throw error; throw Object.assign(new Error('WebCrypto Ed25519 failed'), { reason: 'READ_CORE_CAPABILITY_UNAVAILABLE' }); }
+    integrity.signature = policy.expectedPublicKeyHex === null ? 'verified_self_key' : 'verified_pinned_key';
+    integrity.signature_content_digest = signatureDigest;
+  } else if (policy.requireSignature || policy.expectedPublicKeyHex !== null) fail('SIGNATURE_INVALID', 'integrity');
+  return integrity;
+}
+async function admitProtectedBrowser(input, inputProvider) {
+  let copied, plaintext, stage = 'input';
+  try {
+    copied = inputs(input, inputProvider); plaintext = copied.plaintext; const bytes = copied.bytes;
+    stage = 'container'; const entries = parseContainer(bytes, inflate);
+    stage = 'manifest'; const manifest = validate('Manifest', parseJson(entries['kdna.json']));
+    const profile = checkDeclaration(manifest);
+    const digests = { A: digest(bytes), C: digest(contentTreePreimage(entries)), E: digest(runtimeEntryPreimage(entries, manifest)) };
+    assertContentBindings(manifest, digests.C);
+    const integrity = await verifyIntegrityBrowser(entries, manifest, digests.E, copied.signaturePolicy);
+    const envelope = validateEnvelopeShape(decodeEnvelope(entries['payload.kdnab']), profile);
+    assertObservationBinding(copied.observation, envelope);
+    stage = 'payload'; const payload = decodeValidatedPayload(manifest, plaintext);
+    stage = 'interpretation'; const result = finishAdmission(manifest, payload, entries, digests, integrity.checksums === 'verified_document_1' ? digests.E : null);
+    const disclosure = freeze({ slot_selection: { ...copied.observation.selection }, observation_not_authority: true, provenance: 'host_supplied_triple' });
+    return freeze(result.status === 'accepted' ? { status: 'accepted', snapshot: result.snapshot, disclosure } : { status: 'catalog_only', catalog: result, disclosure });
+  } catch (error) {
+    if (isFailure(error) || stage === 'input') return failure(error);
+    return freeze({ status: 'core_rejected', stage, core: rejected(error?.code === 'MODULE_NOT_FOUND' ? 'READ_CORE_CAPABILITY_UNAVAILABLE' : error?.reason ?? 'READ_CORE_INVALID', error.component_failure ?? null, error.diagnostic ?? null) });
+  } finally {
+    plaintext?.fill(0);
+  }
+}
+module.exports = { admitProtectedBrowser };

package/src/public-contract/protection-contract.generated.json

@@ -1,5 +1,6 @@
 {
   "api_typescript": "export type ProtectedSignaturePolicy = { readonly requireSignature: boolean; readonly expectedPublicKeyHex: string | null };\nexport type ProtectionGrantExpectations = { readonly issuer: string; readonly signing_key_id: string; readonly issuer_public_key: string; readonly account_id: string; readonly entitlement_id: string; readonly entitlement_profile: 'account' | 'org'; readonly device_id: string; readonly device_agreement_public_key: string; readonly device_signing_public_key: string };\nexport type ProtectedCredential = { readonly kind: 'none' } | { readonly kind: 'password'; readonly password: Uint8Array; readonly slotIndex?: number } | { readonly kind: 'external-grant'; readonly grantBytes: Uint8Array; readonly deviceAgreementPrivateKeyPkcs8: Uint8Array; readonly mode: 'online' | 'offline'; readonly expected: ProtectionGrantExpectations };\nexport type ProtectedAdmissionOptions = { readonly credential: ProtectedCredential; readonly signaturePolicy: ProtectedSignaturePolicy };\nexport type ProtectionStateScope = { readonly issuer: string; readonly account_id: string; readonly entitlement_id: string };\nexport type ProtectionHighWater = { readonly scope: ProtectionStateScope; readonly highest_status_version: number; readonly status: 'active' | 'revoked' | 'expired'; readonly last_trusted_time_ms: number; readonly revision: number };\nexport type ProtectionStateAdvance = { readonly scope: ProtectionStateScope; readonly device_id: string; readonly verified: { readonly grant_digest: string; readonly status_version: number; readonly status: 'active' | 'revoked' | 'expired'; readonly observed_at_ms: number } };\nexport type ProtectionRefreshContext = ProtectionStateScope & { readonly device_id: string; readonly A: string; readonly grant_id: string; readonly status_version: number; readonly purpose: 'authorization' | 'projection' | 'host_handoff' | 'transport_commit' };\nexport type TrustedProtectionProvider = { readonly kind: 'local'; readonly clock: () => number } | { readonly kind: 'external'; readonly clock: () => number; readonly capabilities: { readonly offline: boolean; readonly status_refresh: boolean; readonly revocation: boolean }; readonly readAdvance: (input: ProtectionStateAdvance) => Promise<ProtectionHighWater>; readonly refresh?: (context: ProtectionRefreshContext) => Promise<Uint8Array> };\nexport type ProtectionPhase = 'projection' | 'host_observation' | 'host_handoff' | 'read_return' | 'transport_commit' | 'execution';\nexport type ProtectionCurrent = { readonly status: 'current'; readonly receipt: ProtectionReceipt };\nexport type ProtectionObserved = ProtectionCurrent & { readonly checkpoint: ProtectionCheckpoint };\nexport type ProtectionSource = { readonly kind: 'snapshot'; readonly snapshot: CanonicalReadSnapshot } | { readonly kind: 'catalog'; readonly catalog: CoreAdmissionCatalogOnly };\nexport type ProtectionBindingResult = { readonly status: 'bound'; readonly binding: ProtectionBinding } | ProtectedAdmissionFailed;\nexport type ProtectedExportOptions = ({ readonly kind: 'integrity' } | { readonly kind: 'password'; readonly asset_uid: string; readonly entitlement: { readonly profile: 'password'; readonly offline?: boolean; readonly revocable?: boolean }; readonly slots: ReadonlyArray<{ readonly slot: string; readonly kdf_profile: 'scrypt-sha256' | 'argon2id' }> } | { readonly kind: 'external-grant'; readonly asset_uid: string; readonly entitlement: { readonly profile: 'account' | 'org'; readonly offline?: boolean; readonly revocable?: boolean }; readonly key_ref: string; readonly issuer_key_id: string }) & { readonly checksums: boolean; readonly signature: 'none' | 'ed25519' };\nexport type ProtectedProducerSecrets = { readonly passwords: ReadonlyArray<{ readonly slot: string; readonly password: Uint8Array }>; readonly signingSeed?: Uint8Array; readonly issuerRootKey?: never } | { readonly issuerRootKey: Uint8Array; readonly signingSeed?: Uint8Array; readonly passwords?: never } | { readonly signingSeed?: Uint8Array; readonly issuerRootKey?: never; readonly passwords?: never };\nexport type ProtectedExportResult = { readonly status: 'produced'; readonly bytes: Uint8Array; readonly evidence: ProtectedExportEvidence } | ProtectedCoreRejected | ProtectedAdmissionFailed;\nexport declare function getProtectionContract(): ProtectionRuntimeDescriptor;\nexport declare function admitProtectedNode(input: string | Uint8Array, options: ProtectedAdmissionOptions, provider: TrustedProtectionProvider): Promise<ProtectedAdmissionResult>;\nexport declare function bindProtectionOperation(operation: ProtectionOperation): ProtectionBindingResult;\nexport declare function disposeProtectionOperation(operation: ProtectionOperation): void;\nexport declare function protectSourceBytes(input: Uint8Array, options: ProtectedExportOptions, secrets: ProtectedProducerSecrets): Promise<ProtectedExportResult>;\n",
+  "browser_api_typescript": "import type { CanonicalReadSnapshot, CoreAdmissionCatalogOnly, CoreAdmissionRejected } from './types.js';\nimport type { ProtectionDiagnostic, ProtectionRuntimeDescriptor, ProtectedSignaturePolicy, TrustedProtectionProvider } from './protection-node.js';\nexport type ConsumerUnlockSelection = { readonly \"slotIndex\": number; readonly \"slot\": string; readonly \"kdf_profile\": \"scrypt-sha256\" | \"argon2id\"; };\nexport type ConsumerUnlockObservation = { readonly \"kind\": \"consumer_unlock_observation\"; readonly \"proof\": \"observation_not_authority\"; readonly \"checked_at_ms\": number; readonly \"selection\": ConsumerUnlockSelection; };\nexport type ProtectedBrowserInput = { readonly \"bytes\": Uint8Array; readonly \"plaintextPayload\": Uint8Array; readonly \"observation\": ConsumerUnlockObservation; readonly \"signaturePolicy\"?: ProtectedSignaturePolicy; };\nexport type ProtectedBrowserDisclosure = { readonly \"slot_selection\": ConsumerUnlockSelection; readonly \"observation_not_authority\": true; readonly \"provenance\": \"host_supplied_triple\"; };\nexport type ProtectedBrowserAccepted = { readonly \"status\": \"accepted\"; readonly \"snapshot\": CanonicalReadSnapshot; readonly \"disclosure\": ProtectedBrowserDisclosure; };\nexport type ProtectedBrowserCatalogOnly = { readonly \"status\": \"catalog_only\"; readonly \"catalog\": CoreAdmissionCatalogOnly; readonly \"disclosure\": ProtectedBrowserDisclosure; };\nexport type ProtectedBrowserCoreRejected = { readonly \"status\": \"core_rejected\"; readonly \"stage\": \"container\" | \"manifest\" | \"payload\" | \"interpretation\"; readonly \"core\": CoreAdmissionRejected; };\nexport type ProtectedBrowserFailed = { readonly \"status\": \"protection_failed\"; readonly \"diagnostic\": ProtectedBrowserDiagnostic; };\n// The observation-phase codes are the reviewed family extension settled under\n// D-CBPA-IMPL-3 (2026-10-06); the shared node codes keep their stages.\nexport type ProtectedBrowserDiagnostic = (ProtectionDiagnostic | { readonly \"code\": \"PROTECTION_OBSERVATION_INVALID\"; readonly \"stage\": \"observation\"; } | { readonly \"code\": \"PROTECTION_OBSERVATION_BINDING_INVALID\"; readonly \"stage\": \"binding\"; } | { readonly \"code\": \"PROTECTION_NOT_DECLARED\"; readonly \"stage\": \"declaration\"; });\nexport type ProtectedBrowserAdmissionResult = (ProtectedBrowserAccepted | ProtectedBrowserCatalogOnly | ProtectedBrowserCoreRejected | ProtectedBrowserFailed);\nexport declare function getProtectionContract(): ProtectionRuntimeDescriptor;\nexport declare function admitProtectedBrowser(input: ProtectedBrowserInput, provider: TrustedProtectionProvider): Promise<ProtectedBrowserAdmissionResult>;",
   "capability_shapes": {
     "ProtectionBinding": "{ readonly source: () => ProtectionSource | ProtectedAdmissionFailed; readonly observe: (phase: ProtectionPhase) => Promise<ProtectionObserved | ProtectionCurrentFailure>; readonly assertCurrent: (checkpoint: ProtectionCheckpoint) => ProtectionCurrent | ProtectionCurrentFailure }"
   },
@@ -13,7 +14,7 @@
     "schema_path": "specs/checksums-document-1.schema.json",
     "version": "1.0.0"
   },
-  "definition_digest": "sha256:0c84c6fb73b3f6fbb453a7b7494baba81249814d6a9a6f72719ce219392751ab",
+  "definition_digest": "sha256:c88dfae7dc756d00fad579b02c7ea0f14b21f3d1ca3edecbf2fad8f4c5fd9e4a",
   "delivery_history": {
     "acknowledgement": "Only literal synchronous true confirms the configured trusted transport handoff. False/throw/thenable/invalid return leaves outcome_unknown. Never await or execute an untrusted then method to improve the result. Callback itself may already have sent data.",
     "disposal": "Disposal closes authority and clears secrets best effort but retains the redacted per-token delivery history while its token/owning Read remains reachable, so a later failure cannot erase past attempts.",
@@ -177,8 +178,8 @@
         "packages/kdna-core/src/public-contract/protection-declaration.js:1-75",
         "packages/kdna-core/src/public-contract/protection-admission.js:1-94",
         "packages/kdna-core/src/public-contract/protection-producer.js:1-75",
-        "packages/kdna-core/src/public-contract/protection-crypto.js:1-91",
-        "packages/kdna-core/src/public-contract/protection-envelope-codec.js:1-78"
+        "packages/kdna-core/src/public-contract/protection-crypto.js:1-82",
+        "packages/kdna-core/src/public-contract/protection-envelope-codec.js:1-138"
       ],
       "proof": [
         {
@@ -707,8 +708,8 @@
         "packages/kdna-core/src/public-contract/protection-declaration.js:1-75",
         "packages/kdna-core/src/public-contract/protection-admission.js:1-94",
         "packages/kdna-core/src/public-contract/protection-producer.js:1-75",
-        "packages/kdna-core/src/public-contract/protection-crypto.js:1-91",
-        "packages/kdna-core/src/public-contract/protection-envelope-codec.js:1-78"
+        "packages/kdna-core/src/public-contract/protection-crypto.js:1-82",
+        "packages/kdna-core/src/public-contract/protection-envelope-codec.js:1-138"
       ]
     },
     "PROTECTION-RESULTS": {
@@ -801,8 +802,8 @@
   "runtime_not_implemented": [],
   "schema_binding": {
     "package_versions": {
-      "@aikdna/kdna-core": "0.36.0-rc.r2.7",
-      "@aikdna/kdna-read": "0.11.0-rc.r2.7"
+      "@aikdna/kdna-core": "0.37.0",
+      "@aikdna/kdna-read": "0.11.1"
     },
     "version_tuple": {
       "container": "0.5.0",
@@ -820,9 +821,9 @@
   "schema_id": "urn:kdna:schema:protection-admission:1.0.0:binding:r2:7",
   "schema_path": "specs/protection-admission-r2-binding-7.schema.json",
   "specification": {
-    "bytes": 37918,
+    "bytes": 37902,
     "path": "specs/protection-admission.md",
-    "sha256": "995681e3836abc3087c98adfd5d18bba59de3d6ee31d3a351438bd43b8c732ba"
+    "sha256": "7dbc85924d7c0a1d0d4556aeac92de8ac91d331185b4a65d066c0d165c3fadcc"
   },
   "types": {
     "ChecksumsDocument1": {
@@ -1059,7 +1060,7 @@
               "type": "string"
             },
             "version": {
-              "const": "0.36.0-rc.r2.7",
+              "const": "0.37.0",
               "type": "string"
             }
           },
@@ -2294,7 +2295,7 @@
               "type": "string"
             },
             "version": {
-              "const": "0.36.0-rc.r2.7",
+              "const": "0.37.0",
               "type": "string"
             }
           },

package/src/public-contract/protection-crypto.js

@@ -4,28 +4,18 @@ const { fail } = require('./protection-declaration.js');
 const { aesWrap, aesUnwrap } = require('../crypto-profile.js');
 const { externalEnvelopeAad, deriveExternalAssetCek } = require('../external-key-grant.js');
 const { digest } = require('./digests.js');
-const { PasswordEnvelope: passwordShape, ExternalEnvelope: externalShape } = require('./protection-validators.generated.js');
+const { decode64Bytes, validateEnvelopeShape, passwordAadBytes } = require('./protection-envelope-codec.js');
+// The pure shapes live in the codec module (browser-reusable); these wrappers keep the
+// retained result identities (Buffer outputs, same verdicts, same codes) so every existing
+// caller in this package stays unchanged.
 function decode64(value, length = null, url = false) {
-  const encoding = url ? 'base64url' : 'base64';
-  if (typeof value !== 'string') fail('ENVELOPE_INVALID','envelope');
-  const decoded = Buffer.from(value,encoding);
-  if (decoded.toString(encoding) !== value || (length !== null && decoded.length !== length)) fail('ENVELOPE_INVALID','envelope');
-  return decoded;
+  return Buffer.from(decode64Bytes(value, length, url));
 }
 function validateEnvelope(value, profile) {
-  if (value?.profile !== profile.id || (value.profile_version ?? value.contract_version) !== profile.version) fail('PROFILE_UNSUPPORTED','envelope');
-  if (profile.id === 'kdna.envelope.aead') {
-    if (!passwordShape(value) || value.kdf_profile !== value.key_slots[0].kdf_profile) fail('ENVELOPE_INVALID','envelope');
-    for (const slot of value.key_slots) { decode64(slot.kdf_params.salt,16); decode64(slot.wrapped_key,40); }
-    decode64(value.iv,12); decode64(value.tag,16); decode64(value.ciphertext);
-  } else {
-    if (!externalShape(value) || value.entry_path !== 'payload.kdnab') fail('ENVELOPE_INVALID','envelope');
-    decode64(value.iv,12,true); decode64(value.tag,16,true); decode64(value.ciphertext,null,true);
-  }
-  return value;
+  return validateEnvelopeShape(value, profile);
 }
 function passwordAad(manifest) {
-  return Buffer.from(['kdna.envelope.aead','0.1.0',manifest.asset_uid,manifest.asset_id,manifest.version,'payload.kdnab',manifest.access,manifest.entitlement.profile].join('\n'));
+  return Buffer.from(passwordAadBytes(manifest));
 }
 function deriveKek(password, slot) {
   const salt = decode64(slot.kdf_params.salt,16);