com.emdashcms.experimental.package.release

{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "artifact": {
      "description": "The installable plugin bundle artifact.",
      "properties": {
        "blob": {
          "accept": [
            "application/gzip"
          ],
          "description": "Artifact bytes stored as a blob in the publisher's PDS.",
          "maxSize": 262144,
          "type": "blob"
        },
        "checksum": {
          "description": "Lowercase base32 multibase-encoded sha2-256 multihash of the artifact bytes (multihash code 0x12). EmDash clients reject unsupported hash functions rather than skipping verification.",
          "maxLength": 256,
          "type": "string"
        },
        "contentType": {
          "description": "MIME type of the artifact, per RFC6838.",
          "maxLength": 256,
          "type": "string"
        },
        "height": {
          "description": "Pixel height, for image artifacts.",
          "maximum": 8192,
          "minimum": 1,
          "type": "integer"
        },
        "id": {
          "description": "Unique ID within the artifact type.",
          "maxLength": 128,
          "type": "string"
        },
        "lang": {
          "description": "BCP 47 language tag for localised artifacts (icon, screenshot).",
          "format": "language",
          "type": "string"
        },
        "releaseAsset": {
          "description": "Whether the URL points to a platform release asset rather than a directly-served file. When true, clients MUST send 'Accept: application/octet-stream' when downloading.",
          "type": "boolean"
        },
        "requiresAuth": {
          "description": "Whether the artifact requires authentication to access.",
          "type": "boolean"
        },
        "signature": {
          "description": "Optional cryptographic signature of the artifact. EmDash clients do not require it because integrity is proven through the atproto MST signature over the record's checksum.",
          "maxLength": 1024,
          "type": "string"
        },
        "url": {
          "description": "URL where the artifact can be downloaded.",
          "format": "uri",
          "maxLength": 2048,
          "type": "string"
        },
        "width": {
          "description": "Pixel width, for image artifacts (icon, screenshot, banner).",
          "maximum": 8192,
          "minimum": 1,
          "type": "integer"
        }
      },
      "required": [
        "checksum"
      ],
      "type": "object"
    },
    "artifacts": {
      "description": "Map of artifact-type-name to artifact. Common artifact-type keys are 'package' (the installable bundle, REQUIRED), 'icon', 'screenshots' (a list), and 'banner'. Custom types use an 'x-' prefix and pass through as unrecognised fields.",
      "properties": {
        "banner": {
          "ref": "#imageArtifact",
          "type": "ref"
        },
        "icon": {
          "ref": "#imageArtifact",
          "type": "ref"
        },
        "package": {
          "description": "The installable plugin bundle.",
          "ref": "#artifact",
          "type": "ref"
        },
        "screenshots": {
          "description": "Ordered screenshot gallery for the plugin's detail page.",
          "items": {
            "ref": "#imageArtifact",
            "type": "ref"
          },
          "maxLength": 8,
          "type": "array"
        }
      },
      "required": [
        "package"
      ],
      "type": "object"
    },
    "imageArtifact": {
      "description": "A raster image artifact for a plugin listing.",
      "properties": {
        "blob": {
          "accept": [
            "image/png",
            "image/jpeg",
            "image/webp"
          ],
          "description": "Image bytes stored as a blob in the publisher's PDS.",
          "maxSize": 1048576,
          "type": "blob"
        },
        "checksum": {
          "description": "Lowercase base32 multibase-encoded sha2-256 multihash of the artifact bytes (multihash code 0x12). EmDash clients reject unsupported hash functions rather than skipping verification.",
          "maxLength": 256,
          "type": "string"
        },
        "contentType": {
          "description": "MIME type of the artifact, per RFC6838.",
          "maxLength": 256,
          "type": "string"
        },
        "height": {
          "description": "Pixel height.",
          "maximum": 8192,
          "minimum": 1,
          "type": "integer"
        },
        "id": {
          "description": "Unique ID within the artifact type.",
          "maxLength": 128,
          "type": "string"
        },
        "lang": {
          "description": "BCP 47 language tag for a localised artifact.",
          "format": "language",
          "type": "string"
        },
        "releaseAsset": {
          "description": "Whether the URL points to a platform release asset rather than a directly-served file. When true, clients MUST send 'Accept: application/octet-stream' when downloading.",
          "type": "boolean"
        },
        "requiresAuth": {
          "description": "Whether the artifact requires authentication to access.",
          "type": "boolean"
        },
        "signature": {
          "description": "Optional cryptographic signature of the artifact. EmDash clients do not require it because integrity is proven through the atproto MST signature over the record's checksum.",
          "maxLength": 1024,
          "type": "string"
        },
        "url": {
          "description": "URL where the artifact can be downloaded.",
          "format": "uri",
          "maxLength": 2048,
          "type": "string"
        },
        "width": {
          "description": "Pixel width.",
          "maximum": 8192,
          "minimum": 1,
          "type": "integer"
        }
      },
      "required": [
        "checksum"
      ],
      "type": "object"
    },
    "main": {
      "description": "A specific versioned release of a plugin package. The record key encodes both the parent package's slug and the version, separated by ':'. A release's AT URI looks like at://did:plc:abc123/com.emdashcms.experimental.package.release/gallery-plugin:1.2.0. A release at a given version cannot be modified or replaced once published.",
      "key": "any",
      "record": {
        "properties": {
          "artifacts": {
            "description": "Map of artifact type to artifact object. MUST have at least one entry. The 'package' entry (installable bundle) is required.",
            "ref": "#artifacts",
            "type": "ref"
          },
          "auth": {
            "closed": false,
            "description": "Authentication requirements for gated artifacts. No authentication variants are currently defined.",
            "refs": [],
            "type": "union"
          },
          "extensions": {
            "description": "Open-union container for extension data, keyed by NSID. Each value is an embedded record carrying its own $type discriminator. Releases of type emdash-plugin MUST include a com.emdashcms.experimental.package.releaseExtension entry here.",
            "type": "unknown"
          },
          "package": {
            "description": "Slug of the parent package profile in the same repository. MUST match the rkey of an existing package profile record. Combined with the publisher DID, the parent profile's AT URI is at://<publisher-did>/com.emdashcms.experimental.package.profile/<package>. Aggregators MUST reject release records whose package field does not resolve to a profile in the same repository.",
            "maxLength": 64,
            "minLength": 1,
            "type": "string"
          },
          "provides": {
            "description": "Capabilities the package provides. Map of capability type to string or list of strings.",
            "type": "unknown"
          },
          "repo": {
            "description": "AT URI or HTTPS URL of the source repository for this release.",
            "format": "uri",
            "maxLength": 1024,
            "type": "string"
          },
          "requires": {
            "description": "Dependencies. Map of 'env:*' keys (extension-defined environment requirements) or package DIDs to version constraint strings. EmDash uses 'env:emdash' and 'env:astro'.",
            "type": "unknown"
          },
          "sbom": {
            "description": "Software bill of materials reference.",
            "ref": "#sbom",
            "type": "ref"
          },
          "suggests": {
            "description": "Optional packages that may be installed alongside. Same shape as requires.",
            "type": "unknown"
          },
          "version": {
            "description": "Version, conforming to a subset of semver 2.0 (build metadata '+...' is disallowed because atproto record keys cannot represent it). MUST equal the post-':' portion of the rkey byte-for-byte. Composed only of characters allowed in atproto record keys: ASCII letters, digits, '.', and '-'. Note that while atproto rkeys also permit '_' and '~', semver disallows them in version strings, so they MUST NOT appear here.",
            "maxLength": 64,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "package",
          "version",
          "artifacts"
        ],
        "type": "object"
      },
      "type": "record"
    },
    "sbom": {
      "description": "Software bill of materials reference. EmDash plugins SHOULD include sbom for CRA-readiness; clients MUST NOT refuse install solely because sbom is absent.",
      "properties": {
        "checksum": {
          "description": "Multibase-encoded multihash of the SBOM document, in the same format as artifact checksums.",
          "maxLength": 256,
          "type": "string"
        },
        "format": {
          "description": "SBOM format identifier.",
          "knownValues": [
            "cyclonedx",
            "spdx"
          ],
          "maxLength": 32,
          "type": "string"
        },
        "url": {
          "description": "URL where the SBOM document can be fetched.",
          "format": "uri",
          "maxLength": 2048,
          "type": "string"
        }
      },
      "type": "object"
    }
  },
  "description": "Plugin package release record. EXPERIMENTAL: this NSID is part of the experimental phase of the EmDash plugin registry. The stable namespace target is com.emdashcms.package.release.",
  "id": "com.emdashcms.experimental.package.release",
  "lexicon": 1
}