@floegence/redevplugin-contracts 2.0.9 → 3.0.0

package/dist/release-signing.js

@@ -1,11 +1,10 @@
 export const rootDelegationSchemaVersion = "redevplugin.release_root_delegation.v1";
 export const packageSignatureSchemaVersion = "redevplugin.package_signature.v1";
-export const releaseMetadataSchemaVersionV8 = "redevplugin.release_metadata.v8";
-export const releaseMetadataSchemaVersion = releaseMetadataSchemaVersionV8;
+export const releaseMetadataSchemaVersion = "redevplugin.release_metadata";
 export const sourcePolicySchemaVersion = "redevplugin.release_source_policy.v3";
-export const sourcePolicyPointerSchemaVersion = "redevplugin.release_source_policy_pointer.v1";
-export const revocationSchemaVersion = "redevplugin.release_revocation.v2";
-export const revocationPointerSchemaVersion = "redevplugin.release_revocation_pointer.v1";
+export const sourcePolicyPointerSchemaVersion = "redevplugin.release_source_policy_pointer.v2";
+export const revocationSchemaVersion = "redevplugin.release_revocation.v3";
+export const revocationPointerSchemaVersion = "redevplugin.release_revocation_pointer.v2";
 export const signatureAlgorithmEd25519 = "ed25519";
 export const genesisPreviousDocumentSHA256 = "0".repeat(64);
 export const signingUsages = {
@@ -41,12 +40,12 @@ const maximumDocumentBytes = 1024 * 1024;
 const maximumPatternValueCodeUnits = 4096;
 const signingPrefix = textEncoder.encode("REDEVPLUGIN-SIGNING-V1\0");
 const newIDPattern = /^[a-z][a-z0-9._-]{0,127}$/;
-const legacyIDPattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const releaseIDPattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 const epochPattern = /^(0|[1-9][0-9]*)$/;
 const positiveEpochPattern = /^[1-9][0-9]*$/;
 const sha256Pattern = /^[0-9a-f]{64}$/;
 const prefixedSHA256Pattern = /^sha256:[0-9a-f]{64}$/;
-const legacySHA256Pattern = /^(?:sha256:)?[0-9a-f]{64}$/;
+const packageSHA256Pattern = /^(?:sha256:)?[0-9a-f]{64}$/;
 const artifactRefPattern = /^[A-Za-z0-9._/@+-]+$/;
 const hostnamePattern = /^[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/;
 const semverPattern = { test: isCanonicalSemver };
@@ -259,7 +258,7 @@ function validateSortedIDs(values, minimum, maximum, lower = true) {
     if (!Array.isArray(values) || values.length < minimum || values.length > maximum)
         invalidDocument();
     let previous = "";
-    const pattern = lower ? newIDPattern : legacyIDPattern;
+    const pattern = lower ? newIDPattern : releaseIDPattern;
     for (const value of values) {
         if (!matchesPattern(pattern, value) || compareUTF8(value, previous) <= 0)
             invalidDocument();
@@ -312,7 +311,7 @@ function validatePackageInput(value) {
     exactKeys(value, ["source_id", "channel", "version", "algorithm", "key_id", "publisher_id", "plugin_id", "package_hash", "manifest_hash", "entries_hash", "signed_at"]);
     if (!matchesPattern(newIDPattern, value.source_id) || !matchesPattern(newIDPattern, value.channel) || value.algorithm !== signatureAlgorithmEd25519 || !matchesPattern(newIDPattern, value.key_id))
         invalidDocument();
-    if (!matchesPattern(legacyIDPattern, value.publisher_id) || !matchesPattern(legacyIDPattern, value.plugin_id) || !matchesPattern(semverPattern, value.version))
+    if (!matchesPattern(releaseIDPattern, value.publisher_id) || !matchesPattern(releaseIDPattern, value.plugin_id) || !matchesPattern(semverPattern, value.version))
         invalidDocument();
     if (!matchesPattern(prefixedSHA256Pattern, value.package_hash) || !matchesPattern(prefixedSHA256Pattern, value.manifest_hash) || !matchesPattern(prefixedSHA256Pattern, value.entries_hash))
         invalidDocument();
@@ -347,13 +346,13 @@ function validatePackageSignature(context, value, requireSignature) {
 function validateReleaseMetadata(value) {
     assertRecord(value);
     closeReleaseMetadata(value);
-    if (!validReleaseMetadataUIProtocolPair(value.schema_version, value.compatibility.ui_protocol_version) || !matchesPattern(newIDPattern, value.source_id))
+    if (value.schema_version !== releaseMetadataSchemaVersion || !matchesPattern(newIDPattern, value.source_id))
         invalidDocument();
-    if (!matchesPattern(legacyIDPattern, value.publisher_id) || !matchesPattern(legacyIDPattern, value.plugin_id) || !matchesPattern(semverPattern, value.version) || !validArtifactRef(value.release_metadata_ref))
+    if (!matchesPattern(releaseIDPattern, value.publisher_id) || !matchesPattern(releaseIDPattern, value.plugin_id) || !matchesPattern(semverPattern, value.version) || !validArtifactRef(value.release_metadata_ref))
         invalidDocument();
     if ((value.distribution_ref.distribution !== "registry_ref" && value.distribution_ref.distribution !== "host_artifact_ref") || !validArtifactRef(value.distribution_ref.artifact_ref))
         invalidDocument();
-    if (!legacySHA256Pattern.test(value.hashes.package_sha256) || !legacySHA256Pattern.test(value.hashes.manifest_sha256) || !legacySHA256Pattern.test(value.hashes.entries_sha256))
+    if (!packageSHA256Pattern.test(value.hashes.package_sha256) || !packageSHA256Pattern.test(value.hashes.manifest_sha256) || !packageSHA256Pattern.test(value.hashes.entries_sha256))
         invalidDocument();
     const metadataSignature = value.release_metadata_signature;
     if (metadataSignature.algorithm !== signatureAlgorithmEd25519 || !matchesPattern(newIDPattern, metadataSignature.key_id) || !validArtifactRef(metadataSignature.signature_ref) || !matchesPattern(epochPattern, metadataSignature.source_policy_epoch) || !matchesPattern(epochPattern, metadataSignature.revocation_epoch))
@@ -361,41 +360,10 @@ function validateReleaseMetadata(value) {
     const packageSignature = value.package_signature;
     if (packageSignature.algorithm !== signatureAlgorithmEd25519 || !matchesPattern(newIDPattern, packageSignature.key_id) || !validArtifactRef(packageSignature.signature_bundle_ref) || !matchesPattern(epochPattern, packageSignature.source_policy_epoch) || !matchesPattern(epochPattern, packageSignature.revocation_epoch))
         invalidDocument();
-    if (!matchesPattern(semverPattern, value.compatibility.min_redevplugin_version) || !matchesPattern(semverPattern, value.compatibility.min_runtime_version))
-        invalidDocument();
-    if (value.compatibility.supported_targets !== undefined) {
-        if (!Array.isArray(value.compatibility.supported_targets))
-            invalidDocument();
-        const allowed = new Set(["darwin/amd64", "darwin/arm64", "linux/amd64", "linux/arm64"]);
-        let previous = "";
-        for (const target of value.compatibility.supported_targets) {
-            if (typeof target !== "string" || !allowed.has(target) || compareUTF8(target, previous) <= 0)
-                invalidDocument();
-            previous = target;
-        }
-    }
-    let previousHost = "";
-    for (const requirement of value.host_requirements ?? []) {
-        if (!matchesPattern(legacyIDPattern, requirement.host_id) || compareUTF8(requirement.host_id, previousHost) <= 0)
-            invalidDocument();
-        if (requirement.min_host_version !== undefined && !matchesPattern(semverPattern, requirement.min_host_version))
-            invalidDocument();
-        let previousCapability = "";
-        for (const capability of requirement.required_capability_contracts ?? []) {
-            if (!matchesPattern(legacyIDPattern, capability.capability_id) || !matchesPattern(semverPattern, capability.capability_version))
-                invalidDocument();
-            const identity = `${capability.capability_id}\0${capability.capability_version}`;
-            if (compareUTF8(identity, previousCapability) <= 0)
-                invalidDocument();
-            validateCapabilityContractRef(capability.contract);
-            previousCapability = identity;
-        }
-        previousHost = requirement.host_id;
-    }
     if (value.release_evidence !== undefined) {
-        if (value.release_evidence.notices_sha256 !== undefined && !legacySHA256Pattern.test(value.release_evidence.notices_sha256))
+        if (value.release_evidence.notices_sha256 !== undefined && !packageSHA256Pattern.test(value.release_evidence.notices_sha256))
             invalidDocument();
-        if (value.release_evidence.provenance_sha256 !== undefined && !legacySHA256Pattern.test(value.release_evidence.provenance_sha256))
+        if (value.release_evidence.provenance_sha256 !== undefined && !packageSHA256Pattern.test(value.release_evidence.provenance_sha256))
             invalidDocument();
         if (value.release_evidence.generated_at !== undefined)
             parseCanonicalTime(value.release_evidence.generated_at);
@@ -412,14 +380,6 @@ function validateReleaseMetadata(value) {
             invalidDocument();
     }
 }
-function validReleaseMetadataUIProtocolPair(schemaVersion, uiProtocolVersion) {
-    return schemaVersion === releaseMetadataSchemaVersionV8 && uiProtocolVersion === "plugin-ui-v7";
-}
-function validateCapabilityContractRef(value) {
-    if (![value.publisher_id, value.contract_id].every((item) => matchesPattern(legacyIDPattern, item)) ||
-        !matchesPattern(semverPattern, value.contract_version) || !sha256Pattern.test(value.artifact_sha256))
-        invalidDocument();
-}
 function validateSourcePolicy(value, requireSignature) {
     assertRecord(value);
     closeSourcePolicy(value);
@@ -494,7 +454,7 @@ function validateRevocation(value, requireSignature) {
         invalidDocument();
     let previous = "";
     for (const revoked of value.revoked_releases) {
-        if (!matchesPattern(legacyIDPattern, revoked.publisher_id) || !matchesPattern(legacyIDPattern, revoked.plugin_id) || !matchesPattern(semverPattern, revoked.version) || !matchesPattern(sha256Pattern, revoked.release_metadata_sha256))
+        if (!matchesPattern(releaseIDPattern, revoked.publisher_id) || !matchesPattern(releaseIDPattern, revoked.plugin_id) || !matchesPattern(semverPattern, revoked.version) || !matchesPattern(sha256Pattern, revoked.release_metadata_sha256))
             invalidDocument();
         const identity = `${revoked.publisher_id}\0${revoked.plugin_id}\0${revoked.version}\0${revoked.release_metadata_sha256}`;
         if (compareUTF8(identity, previous) <= 0)
@@ -546,7 +506,7 @@ function closePackageSignature(value) {
     exactOptionalKeys(value, ["schema_version", "algorithm", "key_id", "package_hash", "manifest_hash", "entries_hash", "signature"], ["publisher_id", "plugin_id", "signed_at"]);
 }
 function closeReleaseMetadata(value) {
-    exactOptionalKeys(value, ["schema_version", "source_id", "release_metadata_ref", "publisher_id", "plugin_id", "version", "distribution_ref", "hashes", "release_metadata_signature", "package_signature", "compatibility"], ["host_requirements", "release_evidence", "metadata"]);
+    exactOptionalKeys(value, ["schema_version", "source_id", "release_metadata_ref", "publisher_id", "plugin_id", "version", "distribution_ref", "hashes", "release_metadata_signature", "package_signature"], ["release_evidence", "metadata"]);
     for (const [key, keys] of [
         ["distribution_ref", ["distribution", "artifact_ref"]],
         ["hashes", ["package_sha256", "manifest_sha256", "entries_sha256"]],
@@ -556,26 +516,6 @@ function closeReleaseMetadata(value) {
         assertRecord(value[key]);
         exactKeys(value[key], keys);
     }
-    assertRecord(value.compatibility);
-    exactOptionalKeys(value.compatibility, ["min_redevplugin_version", "min_runtime_version", "ui_protocol_version"], ["supported_targets"]);
-    if (value.host_requirements !== undefined) {
-        if (!Array.isArray(value.host_requirements))
-            invalidDocument();
-        for (const host of value.host_requirements) {
-            assertRecord(host);
-            exactOptionalKeys(host, ["host_id"], ["min_host_version", "required_capability_contracts"]);
-            if (host.required_capability_contracts !== undefined) {
-                if (!Array.isArray(host.required_capability_contracts))
-                    invalidDocument();
-                for (const requirement of host.required_capability_contracts) {
-                    assertRecord(requirement);
-                    exactKeys(requirement, ["capability_id", "capability_version", "contract"]);
-                    assertRecord(requirement.contract);
-                    exactKeys(requirement.contract, ["publisher_id", "contract_id", "contract_version", "artifact_sha256"]);
-                }
-            }
-        }
-    }
     if (value.release_evidence !== undefined) {
         assertRecord(value.release_evidence);
         exactOptionalKeys(value.release_evidence, [], ["notices_sha256", "provenance_sha256", "generated_at"]);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@floegence/redevplugin-contracts",
-  "version": "2.0.9",
-  "description": "Embedded ReDevPlugin machine contracts and canonical release-signing APIs",
+  "version": "3.0.0",
+  "description": "Canonical ReDevPlugin release-signing and presentation-evidence APIs",
   "license": "MIT",
   "type": "module",
   "repository": {