@hyprune/schema 0.9.0 → 0.11.0

package/lib/validate.mjs

@@ -423,6 +423,8 @@ function validateMachine(value, fail) {
 function traitCombinations(names, fail) {
   for (const a of names) for (const c of names) if (a < c && !(traitPairs[a] || []).includes(c)) fail(`traits: ${a} and ${c} can't be combined`);
 }
+// RFC-0010 canonical character clip names (talk: the companions amendment).
+const canonicalClips = ['idle', 'idle_fidget', 'walk', 'run', 'turn_left', 'turn_right', 'look_around', 'wave', 'nod', 'sit', 'sit_idle', 'stand', 'talk'];
 function objectTraitRules(traits, slots, fail, inside = () => {}) {
   const quat = (q, where) => { if (Math.abs(Math.hypot(...q) - 1) > 0.002) fail(`${where}: quaternion must be normalized`); };
   const unique = (items, field, label) => { const ids = items.map(v => v[field]); if (new Set(ids).size !== ids.length) fail(`${label}: duplicate ${field}`); };
@@ -473,6 +475,14 @@ function validateObjectManifest(value, version, options, fail, warn) {
   const traits = value.traits, slots = value.slots || {}, names = Object.keys(traits), b = value.bounds;
   if (options.directory !== undefined && options.directory !== value.id) fail(`id: "${value.id}" differs from its directory "${options.directory}"`);
   traitCombinations(names, fail);
+  // Companion block (object format 0.10 draft, RFC-0010 companions amendment).
+  if (value.companion) {
+    if (!traits.character) fail('companion: only characters can be companions');
+    else for (const clip of value.companion.idles || []) {
+      if (!(clip in traits.character.clips)) fail(`companion: idle variant "${clip}" is not a clip of traits.character`);
+      if (canonicalClips.includes(clip)) fail(`companion: "${clip}" is a canonical clip, not an idle variant`);
+    }
+  }
   for (let j = 0; j < 3; j++) if (b.min[j] >= b.max[j]) fail(`bounds: min ${'xyz'[j]} must be below max`);
   const t = objectLimits.boundsTolerance, surfaces = new Set(traits.movable ? traits.movable.surfaces || ['floor'] : []);
   const one = surfaces.size === 1 ? [...surfaces][0] : undefined;
@@ -893,3 +903,140 @@ export function validate(kind, value, method, version, options = {}) {
   }
   return { valid: errors.length === 0, errors };
 }
+
+// Registry documents (RFC-0015), versioned on their own under registry/v0.N/: the index
+// (and one entry of it, the shape of a registry entry file), the release record and
+// sources.json. Discovered from the directories like every other contract.
+const registryRoot = new URL('../registry/', import.meta.url);
+export const registryVersions = existsSync(registryRoot)
+  ? readdirSync(registryRoot).filter(d => /^v0\.\d+$/.test(d)).map(d => d.slice(1)).sort(byVersion) : [];
+const registrySchemas = { 'registry-index': 'index', 'registry-entry': 'index', 'release-record': 'release-record', sources: 'sources' };
+for (const v of registryVersions) for (const name of new Set(Object.values(registrySchemas)))
+  if (existsSync(new URL(`v${v}/${name}.schema.json`, registryRoot))) ajv.addSchema(JSON.parse(readFileSync(new URL(`v${v}/${name}.schema.json`, registryRoot))));
+/** RFC-0015 archive limits per package type (compressed bytes, expanded bytes, files, single file). */
+export const registryLimits = Object.freeze({
+  world: Object.freeze({ bytes: 512 * 1048576, expandedBytes: 1024 * 1048576, files: 10000, fileBytes: 128 * 1048576 }),
+  library: Object.freeze({ bytes: 256 * 1048576, expandedBytes: 512 * 1048576, files: 4000, fileBytes: 32 * 1048576 }),
+  index: Object.freeze({ bytes: 16 * 1048576, entries: 20000, versions: 64, thumbnails: 4, custom: 32 }),
+});
+const SEMVER_PARTS = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
+/** SemVer 2.0 parse; undefined when invalid (including numeric pre-release identifiers with leading zeros). */
+export function parseSemver(text) {
+  const m = typeof text === 'string' ? SEMVER_PARTS.exec(text) : null;
+  if (!m) return undefined;
+  const pre = m[4] === undefined ? [] : m[4].split('.');
+  if (pre.some(p => /^0\d+$/.test(p))) return undefined;
+  return { major: Number(m[1]), minor: Number(m[2]), patch: Number(m[3]), prerelease: pre, build: m[5] ?? null };
+}
+/** SemVer precedence: negative when a < b, 0 when equal (build metadata ignored), positive when a > b. Throws on invalid versions. */
+export function compareSemver(a, b) {
+  const x = parseSemver(a), y = parseSemver(b);
+  if (!x || !y) throw new Error(`Invalid SemVer: ${!x ? a : b}`);
+  for (const k of ['major', 'minor', 'patch']) if (x[k] !== y[k]) return x[k] < y[k] ? -1 : 1;
+  if (!x.prerelease.length || !y.prerelease.length) return Math.sign(y.prerelease.length - x.prerelease.length);
+  for (let i = 0; i < Math.max(x.prerelease.length, y.prerelease.length); i++) {
+    const p = x.prerelease[i], q = y.prerelease[i];
+    if (p === undefined) return -1;
+    if (q === undefined) return 1;
+    const pn = /^\d+$/.test(p), qn = /^\d+$/.test(q);
+    if (pn && qn) { const d = BigInt(p) - BigInt(q); if (d) return d < 0n ? -1 : 1; }
+    else if (pn !== qn) return pn ? -1 : 1;
+    else if (p !== q) return p < q ? -1 : 1;
+  }
+  return 0;
+}
+/**
+ * The version a tag names by the RFC-0015 tag convention: `v<version>` for a repository
+ * with one package, `<name>-v<version>` (name a lowercase slug) for one of several.
+ * Returns {name|null, version} or undefined when the tag follows neither form.
+ */
+export function tagVersion(tag) {
+  if (typeof tag !== 'string') return undefined;
+  const m = /^(?:([a-z0-9]+(?:-[a-z0-9]+)*)-)?v(\d[0-9A-Za-z.+-]*)$/.exec(tag);
+  if (!m || !parseSemver(m[2])) return undefined;
+  return { name: m[1] ?? null, version: m[2] };
+}
+const spdxValid = text => { try { parseSpdx(text); return true; } catch { return false; } };
+// Semantic rules of one index entry (shared by kinds registry-index and registry-entry).
+function registryEntryRules(entry, label, fail) {
+  const limits = registryLimits[entry.type];
+  const tags = new Set(), versions = new Set();
+  entry.versions.forEach((v, i) => {
+    const at = `${label}versions/${i} (${v.tag})`;
+    if (tags.has(v.tag)) fail(`${at}: duplicate tag`); tags.add(v.tag);
+    if (versions.has(v.version)) fail(`${at}: duplicate version ${v.version}`); versions.add(v.version);
+    if (!parseSemver(v.version)) fail(`${at}: version ${v.version} is not SemVer (numeric pre-release identifiers can't have leading zeros)`);
+    const named = tagVersion(v.tag);
+    if (!named || named.version !== v.version) fail(`${at}: tag must name version ${v.version} (v${v.version} or <name>-v${v.version})`);
+    if (i > 0 && parseSemver(v.version) && parseSemver(entry.versions[i - 1].version) && compareSemver(entry.versions[i - 1].version, v.version) <= 0)
+      fail(`${at}: versions must be newest first (${entry.versions[i - 1].version} before ${v.version})`);
+    if (!spdxValid(v.license)) fail(`${at}: license: invalid SPDX expression`);
+    if (v.bytes > limits.bytes) fail(`${at}: bytes ${v.bytes} exceed the ${entry.type} archive limit ${limits.bytes}`);
+    if (v.expandedBytes > limits.expandedBytes) fail(`${at}: expandedBytes ${v.expandedBytes} exceed the ${entry.type} limit ${limits.expandedBytes}`);
+    if (v.files > limits.files) fail(`${at}: files ${v.files} exceed the ${entry.type} limit ${limits.files}`);
+    if (entry.type === 'library' && v.requires?.libraries?.length) fail(`${at}: a library requires no libraries`);
+    if ((v.requires?.libraries || []).some(r => r.startsWith(entry.id + '@'))) fail(`${at}: requires itself`);
+  });
+}
+function releaseRecordRules(r, fail) {
+  const limits = registryLimits[r.type], stem = `${r.id}-${r.version}`;
+  if (!parseSemver(r.version)) fail(`version: ${r.version} is not SemVer (numeric pre-release identifiers can't have leading zeros)`);
+  if (!spdxValid(r.license)) fail('license: invalid SPDX expression');
+  const named = tagVersion(r.source.tag);
+  if (!named || named.version !== r.version) fail(`source.tag: ${r.source.tag} must name version ${r.version} (v${r.version} or <name>-v${r.version})`);
+  if (r.archive.name !== `${stem}.tar.zst`) fail(`archive.name: must be ${stem}.tar.zst`);
+  if (r.archive.bytes > limits.bytes) fail(`archive.bytes: ${r.archive.bytes} exceed the ${r.type} archive limit ${limits.bytes}`);
+  if (r.archive.expandedBytes > limits.expandedBytes) fail(`archive.expandedBytes: ${r.archive.expandedBytes} exceed the ${r.type} limit ${limits.expandedBytes}`);
+  if (r.archive.files > limits.files) fail(`archive.files: ${r.archive.files} exceed the ${r.type} limit ${limits.files}`);
+  if (r.type === 'library' && r.requires?.libraries?.length) fail('requires.libraries: a library requires no libraries');
+  const names = (r.thumbnails || []).map(t => t.name);
+  names.forEach((name, i) => { if (!name.startsWith(`${stem}.thumb-${i + 1}.`)) fail(`thumbnails/${i}: name must be ${stem}.thumb-${i + 1}.png or .jpg`); });
+}
+function sourcesRules(doc, fail) {
+  const ids = new Set();
+  (doc.custom || []).forEach((s, i) => {
+    const at = `custom/${i} (${s.id})`;
+    if (ids.has(s.id)) fail(`${at}: duplicate id`); ids.add(s.id);
+    if (['official', 'community'].includes(s.id)) fail(`${at}: id is reserved for a built-in source`);
+    if (s.label.trim() !== s.label) fail(`${at}: label has leading or trailing spaces`);
+    const extra = { index: ['repo', 'sha256'], github: ['url', 'sha256'], url: ['repo'] }[s.kind].filter(k => s[k] !== undefined);
+    if (extra.length) fail(`${at}: kind ${s.kind} takes no ${extra.join(', ')}`);
+    if (s.kind === 'url') {
+      const path = new URL(s.url).pathname;
+      if (path.endsWith('.tar.zst') && !s.sha256) fail(`${at}: an archive URL needs its sha256`);
+      if (!path.endsWith('.tar.zst') && !path.endsWith('.json')) fail(`${at}: a package URL is a .tar.zst archive or a .release.json record`);
+      if (path.endsWith('.json') && s.sha256) fail(`${at}: a release record URL supplies its own hash`);
+    }
+  });
+}
+/**
+ * Validate a registry document (RFC-0015). Kinds: `registry-index` (an index document),
+ * `registry-entry` (one entry, e.g. a registry entry file, which may carry `$schema`),
+ * `release-record` and `sources`. Adds the rules a schema can't express: unique ids,
+ * versions unique and newest first by SemVer, the tag naming the version, SPDX
+ * expressions, per-type archive limits.
+ * @param version registry format (default: the newest registry/v0.N)
+ * @throws on an unknown kind or version
+ */
+export function validateRegistry(kind, value, version = registryVersions.at(-1)) {
+  if (!Object.hasOwn(registrySchemas, kind)) throw new Error(`Unknown registry kind: ${kind}`);
+  if (!registryVersions.includes(version)) throw new Error(`Unknown registry version: ${version}`);
+  const id = `https://hyprune.com/schema/registry/v${version}/${registrySchemas[kind]}.schema.json${kind === 'registry-entry' ? '#/$defs/entry' : ''}`;
+  const key = `registry:${version}:${kind}`;
+  if (!validators.has(key)) validators.set(key, ajv.getSchema(id));
+  const check = validators.get(key);
+  if (!check(value)) return { valid: false, errors: check.errors.map(e => `${e.instancePath || '/'} ${e.message}`) };
+  const errors = [], fail = m => errors.push(m);
+  if (kind === 'registry-entry') registryEntryRules(value, '', fail);
+  if (kind === 'registry-index') {
+    const ids = new Set();
+    value.entries.forEach((entry, i) => {
+      if (ids.has(entry.id)) fail(`entries/${i}: duplicate id ${entry.id}`); ids.add(entry.id);
+      if (entry.$schema !== undefined) fail(`entries/${i}: $schema belongs to entry files, not index entries`);
+      registryEntryRules(entry, `entries/${i} ${entry.id}: `, fail);
+    });
+  }
+  if (kind === 'release-record') releaseRecordRules(value, fail);
+  if (kind === 'sources') sourcesRules(value, fail);
+  return { valid: errors.length === 0, errors };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyprune/schema",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Versioned JSON Schemas for Hyprune world packages and the IPC protocol, with a validator and CLI for world authors",
   "license": "MIT",
   "type": "module",
@@ -39,6 +39,7 @@
     "lib/",
     "v0*/**",
     "extensions/",
+    "registry/",
     "examples/",
     "CHANGELOG.md",
     "README.md",

package/registry/v0.1/index.schema.json

@@ -0,0 +1,309 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hyprune.com/schema/registry/v0.1/index.schema.json",
+  "title": "Hyprune registry index 0.1 (RFC-0015): the document every index source serves; $defs.entry is one entry and the shape of a registry entry file",
+  "type": "object",
+  "properties": {
+    "indexVersion": {
+      "const": "0.1"
+    },
+    "name": {
+      "type": "string",
+      "$ref": "#/$defs/line",
+      "maxLength": 64
+    },
+    "homepage": {
+      "$ref": "#/$defs/https"
+    },
+    "serial": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 9007199254740991
+    },
+    "generated": {
+      "type": "string",
+      "maxLength": 40,
+      "pattern": "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:([0-5][0-9]|60)(\\.[0-9]{1,9})?Z$"
+    },
+    "successor": {
+      "anyOf": [
+        {
+          "$ref": "#/$defs/https"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "entries": {
+      "type": "array",
+      "maxItems": 20000,
+      "items": {
+        "$ref": "#/$defs/entry"
+      }
+    }
+  },
+  "required": [
+    "indexVersion",
+    "serial",
+    "generated",
+    "entries"
+  ],
+  "additionalProperties": false,
+  "$defs": {
+    "id": {
+      "type": "string",
+      "minLength": 3,
+      "maxLength": 128,
+      "pattern": "^[a-z][a-z0-9-]*(\\.[a-z][a-z0-9-]*)+$"
+    },
+    "version": {
+      "description": "SemVer 2.0 without build metadata (published versions).",
+      "type": "string",
+      "minLength": 5,
+      "maxLength": 64,
+      "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\\.[0-9A-Za-z-]+)*)?$"
+    },
+    "tag": {
+      "description": "The git tag the release was built from: v<version> or <name>-v<version>.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "pattern": "^[A-Za-z0-9._-]+$"
+    },
+    "formatVersion": {
+      "type": "string",
+      "maxLength": 16,
+      "pattern": "^0\\.(0|[1-9][0-9]*)$"
+    },
+    "license": {
+      "description": "SPDX expression (parsed by the validator).",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256
+    },
+    "sha256": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$"
+    },
+    "https": {
+      "type": "string",
+      "minLength": 9,
+      "maxLength": 2048,
+      "pattern": "^https://[^\\s/?#@]+(/[^\\s]*)?$"
+    },
+    "line": {
+      "description": "One line of plain text: no control characters.",
+      "type": "string",
+      "minLength": 1,
+      "pattern": "^[^\\u0000-\\u001f\\u007f-\\u009f]+$"
+    },
+    "slug": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 32,
+      "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$"
+    },
+    "libraryRef": {
+      "description": "An exact library id@version (RFC-0011).",
+      "type": "string",
+      "maxLength": 200,
+      "pattern": "^[a-z][a-z0-9-]*(\\.[a-z][a-z0-9-]*)+@(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\\.[0-9A-Za-z-]+)*)?$"
+    },
+    "requires": {
+      "type": "object",
+      "properties": {
+        "libraries": {
+          "type": "array",
+          "maxItems": 64,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/libraryRef"
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "thumbnail": {
+      "type": "object",
+      "properties": {
+        "url": {
+          "$ref": "#/$defs/https"
+        },
+        "sha256": {
+          "$ref": "#/$defs/sha256"
+        },
+        "width": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 1280
+        },
+        "height": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 720
+        }
+      },
+      "required": [
+        "url",
+        "sha256",
+        "width",
+        "height"
+      ],
+      "additionalProperties": false
+    },
+    "version-entry": {
+      "description": "One published version of an entry (versions[]).",
+      "type": "object",
+      "properties": {
+        "tag": {
+          "$ref": "#/$defs/tag"
+        },
+        "version": {
+          "$ref": "#/$defs/version"
+        },
+        "formatVersion": {
+          "$ref": "#/$defs/formatVersion"
+        },
+        "published": {
+          "type": "string",
+          "pattern": "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])$"
+        },
+        "license": {
+          "$ref": "#/$defs/license"
+        },
+        "url": {
+          "$ref": "#/$defs/https"
+        },
+        "sha256": {
+          "$ref": "#/$defs/sha256"
+        },
+        "bytes": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 536870912
+        },
+        "expandedBytes": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 1073741824
+        },
+        "files": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 10000
+        },
+        "record": {
+          "type": "object",
+          "properties": {
+            "url": {
+              "$ref": "#/$defs/https"
+            },
+            "sha256": {
+              "$ref": "#/$defs/sha256"
+            }
+          },
+          "required": [
+            "url",
+            "sha256"
+          ],
+          "additionalProperties": false
+        },
+        "requires": {
+          "$ref": "#/$defs/requires"
+        },
+        "thumbnails": {
+          "type": "array",
+          "maxItems": 4,
+          "items": {
+            "$ref": "#/$defs/thumbnail"
+          }
+        },
+        "status": {
+          "enum": [
+            "available",
+            "unavailable"
+          ]
+        }
+      },
+      "required": [
+        "tag",
+        "version",
+        "formatVersion",
+        "published",
+        "license",
+        "url",
+        "sha256",
+        "bytes",
+        "expandedBytes",
+        "files"
+      ],
+      "additionalProperties": false
+    },
+    "entry": {
+      "description": "One package of an index. A registry entry file is exactly one entry and may add a $schema pointer; entries inside an index carry none.",
+      "type": "object",
+      "properties": {
+        "$schema": {
+          "$ref": "#/$defs/https"
+        },
+        "id": {
+          "$ref": "#/$defs/id"
+        },
+        "type": {
+          "enum": [
+            "world",
+            "library"
+          ]
+        },
+        "name": {
+          "type": "string",
+          "$ref": "#/$defs/line",
+          "maxLength": 64
+        },
+        "summary": {
+          "type": "string",
+          "maxLength": 140,
+          "pattern": "^[^\\u0000-\\u001f\\u007f-\\u009f]*$"
+        },
+        "description": {
+          "type": "string",
+          "maxLength": 2000,
+          "pattern": "^[^\\u0000-\\u0008\\u000b-\\u001f\\u007f-\\u009f]*$"
+        },
+        "creator": {
+          "type": "string",
+          "$ref": "#/$defs/line",
+          "maxLength": 64
+        },
+        "repo": {
+          "$ref": "#/$defs/https"
+        },
+        "tags": {
+          "type": "array",
+          "maxItems": 8,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/slug"
+          }
+        },
+        "versions": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/version-entry"
+          }
+        }
+      },
+      "required": [
+        "id",
+        "type",
+        "name",
+        "creator",
+        "versions"
+      ],
+      "additionalProperties": false
+    }
+  }
+}

package/registry/v0.1/release-record.schema.json

@@ -0,0 +1,181 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hyprune.com/schema/registry/v0.1/release-record.schema.json",
+  "title": "Hyprune release record 0.1 (RFC-0015): <id>-<version>.release.json, published with the archive of one tag",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "$ref": "index.schema.json#/$defs/https"
+    },
+    "recordVersion": {
+      "const": "0.1"
+    },
+    "type": {
+      "enum": [
+        "world",
+        "library"
+      ]
+    },
+    "id": {
+      "$ref": "index.schema.json#/$defs/id"
+    },
+    "version": {
+      "$ref": "index.schema.json#/$defs/version"
+    },
+    "formatVersion": {
+      "$ref": "index.schema.json#/$defs/formatVersion"
+    },
+    "name": {
+      "type": "string",
+      "$ref": "index.schema.json#/$defs/line",
+      "maxLength": 64
+    },
+    "license": {
+      "$ref": "index.schema.json#/$defs/license"
+    },
+    "archive": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "maxLength": 220,
+          "pattern": "^[a-z][a-z0-9.-]*-[0-9A-Za-z.-]+\\.tar\\.zst$"
+        },
+        "sha256": {
+          "$ref": "index.schema.json#/$defs/sha256"
+        },
+        "bytes": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 536870912
+        },
+        "expandedBytes": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 1073741824
+        },
+        "files": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 10000
+        }
+      },
+      "required": [
+        "name",
+        "sha256",
+        "bytes",
+        "expandedBytes",
+        "files"
+      ],
+      "additionalProperties": false
+    },
+    "requires": {
+      "$ref": "index.schema.json#/$defs/requires"
+    },
+    "thumbnails": {
+      "type": "array",
+      "maxItems": 4,
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "maxLength": 220,
+            "pattern": "^[a-z][a-z0-9.-]*-[0-9A-Za-z.-]+\\.thumb-[1-4]\\.(png|jpg)$"
+          },
+          "sha256": {
+            "$ref": "index.schema.json#/$defs/sha256"
+          },
+          "width": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 1280
+          },
+          "height": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 720
+          }
+        },
+        "required": [
+          "name",
+          "sha256",
+          "width",
+          "height"
+        ],
+        "additionalProperties": false
+      }
+    },
+    "source": {
+      "type": "object",
+      "properties": {
+        "repo": {
+          "$ref": "index.schema.json#/$defs/https"
+        },
+        "tag": {
+          "$ref": "index.schema.json#/$defs/tag"
+        },
+        "commit": {
+          "type": "string",
+          "pattern": "^([0-9a-f]{40}|[0-9a-f]{64})$"
+        }
+      },
+      "required": [
+        "repo",
+        "tag",
+        "commit"
+      ],
+      "additionalProperties": false
+    },
+    "tool": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "$ref": "index.schema.json#/$defs/line",
+          "maxLength": 64
+        },
+        "version": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 64,
+          "pattern": "^[0-9A-Za-z.+-]+$"
+        }
+      },
+      "required": [
+        "name",
+        "version"
+      ],
+      "additionalProperties": false
+    },
+    "checks": {
+      "description": "Informative: which local checks passed when the release was built. Clients never trust it.",
+      "type": "object",
+      "maxProperties": 16,
+      "propertyNames": {
+        "type": "string",
+        "maxLength": 32,
+        "pattern": "^[a-z][A-Za-z0-9]*$"
+      },
+      "additionalProperties": {
+        "enum": [
+          "pass",
+          "fail",
+          "skipped"
+        ]
+      }
+    }
+  },
+  "required": [
+    "recordVersion",
+    "type",
+    "id",
+    "version",
+    "formatVersion",
+    "name",
+    "license",
+    "archive",
+    "source"
+  ],
+  "additionalProperties": false
+}