com.emdashcms.experimental.package.profileExtension

{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "Typed embedded object carrying the package repository anchor and optional delegated-release policy. Lives under the profile record's extensions map keyed by this NSID. The $type field is required when embedded; clients use it to dispatch to this schema.",
      "properties": {
        "releasePolicy": {
          "ref": "#releasePolicy",
          "type": "ref"
        },
        "repository": {
          "description": "Canonical HTTPS source repository URL. Lexicon validates URI syntax and length; consumers must require HTTPS and canonicalization.",
          "format": "uri",
          "maxLength": 1024,
          "type": "string"
        }
      },
      "required": [
        "repository"
      ],
      "type": "object"
    },
    "releasePolicy": {
      "description": "Optional delegated-release policy. Absent fields normalize for consumers to requireProvenance false, confirmation escalation-only, and no approvers.",
      "properties": {
        "approvers": {
          "description": "Atproto DIDs authorized to approve releases. Lexicon validates DID syntax and the 32-item cap; consumers must reject duplicate DIDs.",
          "items": {
            "format": "did",
            "type": "string"
          },
          "maxLength": 32,
          "type": "array"
        },
        "confirmation": {
          "description": "When a release requires human confirmation. The generated TypeScript type exposes escalation-only and always; Lexicon runtime validators do not enforce knownValues, so consumers must reject other values.",
          "knownValues": [
            "escalation-only",
            "always"
          ],
          "type": "string"
        },
        "requireProvenance": {
          "description": "Whether releases require a verifiable provenance reference.",
          "type": "boolean"
        }
      },
      "type": "object"
    }
  },
  "description": "EmDash delegated-release policy embedded inside a package profile record under its extensions field. EXPERIMENTAL: shape may change before stabilisation.",
  "id": "com.emdashcms.experimental.package.profileExtension",
  "lexicon": 1
}