# YCode Update Manifest Contract v1

The release tooling and updater backend use this exact document:

```json
{
  "payload": {
    "schemaVersion": 1,
    "version": "0.0.2",
    "publishedAt": "2026-10-20T10:00:00.000Z",
    "notes": {
      "zh": "更新说明",
      "en": "Release notes"
    },
    "platforms": {
      "windows-x64": {
        "url": "http://192.168.10.6/ycode/releases/versions/0.0.2/YCode-0.0.2-Setup-x64.exe",
        "size": 123456789,
        "sha256": "64-lowercase-hex-characters"
      }
    }
  },
  "signature": "base64-encoded-64-byte-ed25519-signature"
}
```

Rules:

- The Ed25519 signature covers exactly `Buffer.from(JSON.stringify(payload), "utf8")`.
- Payload property insertion order is part of the contract and must be preserved.
- `publishedAt` is canonical UTC ISO-8601 with millisecond precision.
- `version` is strict SemVer. Build metadata does not establish newer precedence.
- `sha256` is lowercase hexadecimal; `size` is the exact installer byte length.
- The artifact URL is absolute HTTP(S), has no query, fragment or credentials, and is exactly
  `<base>/versions/<version>/<safe-installer-name>.exe`.
- The client and release tooling require the artifact origin to match the manifest origin.
- `latest.json` is served at `<base>/latest.json`; artifacts are immutable version directories.
- `resources/updates/public-key.pem` is the SPKI PEM trust anchor. Private keys never enter the
  repository, the server, build artifacts or logs.

Default base URL: `http://192.168.10.6/ycode/releases/`