compute_digest(db) -> digest

Compute the canonical SHA-256 digest of a package

Computes a deterministic SHA-256 hash over all package content in a MNEME database. The digest covers manifest fields in fixed order, module sources sorted by name, and CLI script sources sorted by name. The signature and pubkey fields are excluded from the digest. Used for both signing and verification.

pubkey_fingerprint(pubkey) -> fingerprint

Compute a short fingerprint for a public key

load_trusted_pubkey(key_path) -> pubkey, err

Load the trusted public key for signature verification

Loads the trusted Ed25519 public key used for package verification. If key_path is provided, reads from that file. Otherwise checks the LILPACK_PUB_KEY environment variable. Falls back to the built-in default public key.

verify_signature(db_path, trusted_pubkey) -> ok, err, pubkey

Verify the Ed25519 signature of a .lilpack file

Opens the MNEME database at db_path, recomputes the canonical digest, and verifies the embedded Ed25519 signature. If trusted_pubkey is provided, the signature is verified against it; otherwise falls back to the default trusted key (from LILPACK_PUB_KEY env or built-in). Returns true, nil, pubkey on success, or nil, error_message on failure.

read_manifest(db_path) -> manifest, err

Read and validate a LILPACK manifest from a MNEME database

Opens the MNEME database at db_path and reads the __lilpack manifest keyspace. Validates required fields (version, name, modules, signature, pubkey) and decodes optional JSON fields (dependencies, builtins, modes, cli). Returns the manifest table on success, or nil and an error message on failure. Unsigned packages are rejected.

init() -> extensions

Initialize the LILPACK package system

Initializes the package system: strips standard Lua searchers, discovers and verifies installed packages, and installs the LILPACK and script-local searchers into the require chain. Returns a table of discovered extensions (builtins, modes, cli). Safe to call multiple times; subsequent calls return the cached extensions table.

packages() -> registry

Return the package registry

modules() -> registry

Return the module registry

extensions() -> extensions

Return discovered shell extensions from installed packages