ycode/resources/updates/manifest-contract.md

YCode Update Manifest Contract v1

The release tooling and updater backend use this exact document:

{
  "payload": {
    "schemaVersion": 1,
    "version": "0.0.2",
    "publishedAt": "2026-10-20T10:00:00.000Z",
    "notes": {
      "zh": "更新说明",
      "en": "Release notes"
    },
    "platforms": {
      "windows-x64": {
        "url": "http://192.168.10.6/ycode/releases/versions/0.0.2/YCode-0.0.2-Setup-x64.exe",
        "size": 123456789,
        "sha256": "64-lowercase-hex-characters"
      }
    }
  },
  "signature": "base64-encoded-64-byte-ed25519-signature"
}

Rules:

• The Ed25519 signature covers exactly Buffer.from(JSON.stringify(payload), "utf8").
• Payload property insertion order is part of the contract and must be preserved.
• publishedAt is canonical UTC ISO-8601 with millisecond precision.
• version is strict SemVer. Build metadata does not establish newer precedence.
• sha256 is lowercase hexadecimal; size is the exact installer byte length.
• The artifact URL is absolute HTTP(S), has no query, fragment or credentials, and is exactly <base>/versions/<version>/<safe-installer-name>.exe.
• The client and release tooling require the artifact origin to match the manifest origin.
• latest.json is served at <base>/latest.json; artifacts are immutable version directories.
• resources/updates/public-key.pem is the SPKI PEM trust anchor. Private keys never enter the repository, the server, build artifacts or logs.

Default base URL: http://192.168.10.6/ycode/releases/