Update package manifest schema

Author: CrSjimo

README.md

@@ -49,7 +49,7 @@ Interactive text output uses inspection spinners and progress bars with a packag
 
 ## Metadata and architecture
 
-Only the `singer` category has its declaration file parsed. All other categories, including `inference`, retain their expanded `desc.json` entry and expose category, ID and any checked direct file path. Their declaration files are not parsed, their variables are not expanded, and declaration fields are not extracted or indexed. Their category and ID remain indexed and usable in contribution selectors. No name or declaration expansion state is fabricated for them. Singer contributions additionally expose common module fields, avatar, background and demo audio when extractable. Contribution-specific fields and import/export relationships are not validated. String `path` values directly in `desc.json` and package readme paths must reference regular files inside the package. Resource paths within contribution declarations are neither checked nor opened. A non-string `path` in an opaque category is retained as category-owned data.
+Only the `singer` category has its declaration file parsed. All other categories, including `inference`, retain their expanded `desc.json` entry and expose category, ID and any checked direct file path. Their declaration files are not parsed, their variables are not expanded, and declaration fields are not extracted or indexed. Their category and ID remain indexed and usable in contribution selectors. No name or declaration expansion state is fabricated for them. Singer contributions additionally expose common module fields, avatar, background and demo audio when extractable. Contribution-specific fields and import/export relationships are not validated. String `path` values directly in `desc.json` and package license and readme paths must reference regular files inside the package. Resource paths within contribution declarations are neither checked nor opened. A non-string `path` in an opaque category is retained as category-owned data.
 
 The package manifest and singer JSON declarations support UTF-8 BOM and comments, reject duplicate keys and trailing commas, and preserve unknown fields. Variable expansion follows declaration order and scope and never rescans substituted text. Parsing limits include 16 MiB per parsed declaration, 128 levels, one million value nodes, and a 64 MiB cumulative metadata budget. Malformed singer fields produce extraction diagnostics rather than installation failures; unreadable or invalid singer JSON declarations are rejected. These JSON requirements do not apply to opaque contribution declaration files. All package files still participate in archive integrity checks, content hashing and extraction limits.
 

docs/installed-database.md

@@ -172,7 +172,7 @@ def content_hash(files):
 
 ## Metadata Ownership
 
-The database is an installation-time management and listing index. `desc.json` retains complete package metadata and opaque entries. Singer declarations retain complete singer metadata. The database excludes declaration bodies, declaration paths, expansion state, copyright, readme, URL, singer media fields, and import or export relationships. It also excludes resolved dependency edges, source archive paths, remote repository records, and installed file inventories.
+The database is an installation-time management and listing index. `desc.json` retains complete package metadata and opaque entries. Singer declarations retain complete singer metadata. The database excludes declaration bodies, declaration paths, expansion state, license paths, readme paths, URL, singer media fields, and import or export relationships. It also excludes resolved dependency edges, source archive paths, remote repository records, and installed file inventories.
 
 Installed package contents are immutable under the management protocol. Replacement uses installation with `--overwrite-existing` if the same identity has different content. External file edits can produce stale indexed metadata, dependencies, and recorded hashes. `list` does not rescan declarations. `info --installed` reopens package and singer metadata without reindexing or recomputing the installed hash. A registered identity mismatch is rejected. Opaque declaration files are not parsed by information queries.
 

docs/interoperability.md

@@ -97,6 +97,7 @@ The root version response contains no query envelope. The executable version is
 | Category, interface, or variant ID | The string contains contribution ID segments separated by `.`. Category IDs are extensible and case-sensitive. |
 | Package version | The string contains four decimal integer components, such as `"1.2.0.0"`. Components have arbitrary precision and no leading zeros except the value `0`. |
 | `Text` | The object maps language keys to strings and includes the default key `_`. Extracted shorthand strings become `{"_":"value"}`. Empty strings and all language keys are retained. |
+| `FilePaths` | The object has the `Text` representation. Every value is a nonempty, fully qualified, lexically normalized host path to a regular file inside the package. |
 | `Dependency` | The object contains a package `id` and normalized target `version`. The target does not identify a resolved provider version. |
 | Content hash | The string contains 128 lowercase hexadecimal characters representing the [content tree digest](installed-database.md#content-hash). |
 
@@ -135,22 +136,24 @@ A singer contribution has category ID exactly equal to `singer`. An opaque contr
 
 ### Package Manifest
 
-`PackageManifest` contains required `id`, `version`, `formatVersion`, `runtimeLevel`, `compatVersion`, `dependencies`, `contributions`, and `manifest`. Optional fields are `name`, `description`, `vendor`, `copyright`, `readme`, `url`, and `diagnostics`. `dependencies` and `contributions` are arrays, including `[]` if empty. `diagnostics`, if present, is a nonempty string array.
+`PackageManifest` contains required `id`, `version`, `formatVersion`, `runtimeLevel`, `compatVersion`, `dependencies`, `contributions`, and `manifest`. Optional fields are `name`, `description`, `vendor`, `license`, `readme`, `url`, and `diagnostics`. `dependencies` and `contributions` are arrays, including `[]` if empty. `diagnostics`, if present, is a nonempty string array.
 
 | Declaration field | Extracted representation |
 | --- | --- |
 | `$version` | `formatVersion` contains the normalized format version. The supported value is `"1.0.0.0"`. |
 | `runtimeLevel` | `runtimeLevel` contains the supported integer value `1`. |
 | `id`, `version`, `compatVersion` | The extracted fields retain their names. Versions are normalized. An absent `compatVersion` defaults to `version`. |
-| `name`, `description`, `vendor`, `copyright` | Each extracted field contains a complete `Text` object. |
-| `readme` | The extracted `Text` object contains fully qualified, lexically normalized host paths. Every localized path must reference a regular file within the package. |
+| `name`, `description`, `vendor` | Each extracted field contains a complete `Text` object. |
+| `license`, `readme` | Each extracted field contains a complete `FilePaths` object. All language keys are retained. |
 | `url` | The extracted field contains the expanded string. An absent field is omitted. An explicit empty string remains `""`. URI syntax and network availability are not checked. |
 | `dependencies`, `contributions` | The extracted arrays contain declared dependencies and full contribution objects. |
 | `vars` | Variable definitions are consumed during expansion and omitted from the expanded manifest. |
 
-`manifest` contains expanded `desc.json` with arbitrary fields and JSON types retained. It does not preserve source formatting, comments, or byte order marks. Typed normalization does not modify the retained declaration representation. For example, `manifest.version` can contain `"1.0"` while the typed `version` contains `"1.0.0.0"`. `manifest.readme` contains expanded declaration paths while typed `readme` contains resolved host paths.
+`license` and `readme` use identical path rules. A declaration accepts a shorthand string such as `"license": "LICENSE.txt"` or a language map such as `"license": {"_": "LICENSE.txt", "zh-CN": "docs/许可证.txt"}`. A language map requires the default key `_`. Variable expansion precedes path resolution. Every localized path is checked, regardless of the selected output language. Null values, empty paths, missing files, directories, and references outside the package are rejected. An absent field remains omitted.
 
-The database stores package name, description, and vendor for installed package summaries. Copyright, readme, URL, and arbitrary extension fields remain available through full information responses and are absent from installed package summaries.
+`manifest` contains expanded `desc.json` with arbitrary fields and JSON types retained. It does not preserve source formatting, comments, or byte order marks. Typed normalization does not modify the retained declaration representation. For example, `manifest.version` can contain `"1.0"` while the typed `version` contains `"1.0.0.0"`. `manifest.license` and `manifest.readme` contain expanded declaration paths while typed `license` and `readme` contain resolved host paths.
+
+The database stores package name, description, and vendor for installed package summaries. License paths, readme paths, URL, and arbitrary extension fields remain available through full information responses and are absent from installed package summaries.
 
 ### Contributions
 
@@ -178,7 +181,7 @@ Full singer `level` uses a JSON number. Indexed summaries and the database use d
 
 An installed contribution selector filters only `package.contributions`. `package.manifest` and `installation.contributions` retain the complete package declaration and index.
 
-`${root}`, `${dir}`, and typed readme paths depend on the read context. Installed information uses the installed package directory. Pack planning uses the source directory. Archive information uses the archive parent directory as a logical root without extracting files there. A singer declaration has `${dir}` set to its containing directory. Extracted singer resource strings are not independently resolved or normalized. Expanded absolute paths are specific to the applicable read context.
+`${root}`, `${dir}`, and typed license and readme paths depend on the read context. Installed information uses the installed package directory. Pack planning uses the source directory. Archive information uses the archive parent directory as a logical root without extracting files there. A singer declaration has `${dir}` set to its containing directory. Extracted singer resource strings are not independently resolved or normalized. Expanded absolute paths are specific to the applicable read context.
 
 ## Mutation Envelopes
 

docs/schemas/cli-output.schema.json

@@ -43,6 +43,11 @@
       "additionalProperties": { "type": "string" },
       "description": "The object retains all language keys and explicit empty strings. The key '_' identifies the default value."
     },
+    "filePaths": {
+      "$ref": "#/$defs/text",
+      "additionalProperties": { "type": "string", "minLength": 1 },
+      "description": "Each localized value is a nonempty, fully qualified, lexically normalized host path in the package read context. Each reference must identify a regular file inside the package."
+    },
     "diagnosticArray": {
       "type": "array",
       "items": { "type": "string" }
@@ -159,8 +164,8 @@
         "name": { "$ref": "#/$defs/text" },
         "description": { "$ref": "#/$defs/text" },
         "vendor": { "$ref": "#/$defs/text" },
-        "copyright": { "$ref": "#/$defs/text" },
-        "readme": { "$ref": "#/$defs/text", "description": "Each localized value is a fully qualified, lexically normalized host path in the package read context. Each reference must identify a regular file inside the package." },
+        "license": { "$ref": "#/$defs/filePaths" },
+        "readme": { "$ref": "#/$defs/filePaths" },
         "url": { "type": "string", "description": "The value is the website string after variable expansion. An explicit empty string is retained. The field is omitted if absent." },
         "manifest": { "type": "object", "description": "The object contains expanded desc.json with vars removed. Arbitrary package fields and JSON types are retained. Source formatting and comments are excluded." },
         "diagnostics": { "$ref": "#/$defs/diagnosticArray" }

internal/cli/metadata_test.go

@@ -14,9 +14,10 @@ import (
 func TestInfoCompleteMetadataFromArchiveAndInstallation(t *testing.T) {
 	scratch := t.TempDir()
 	source, root, archive := filepath.Join(scratch, "source"), filepath.Join(scratch, "packages"), filepath.Join(scratch, "voice.dspk")
-	desc := []byte(`{"$version":"1","runtimeLevel":1,"id":"vendor/voice","version":"1","vars":[{"name":"title","value":"Voice"},{"name":"docs","value":"${root}/docs"}],"name":"${title}","vendor":"Vendor","description":"Description ${title}","copyright":{"_":"","en":"Copyright ${title}","zh-CN":"版权 ${title}"},"readme":{"_":"docs/../docs/readme.txt","zh-CN":"${docs}/说明.txt"},"url":"https://example.test/${title}","contributions":{"singer":[{"id":"main","path":"singer.json"}],"vendor.custom":[{"id":"data","configuration":{"file":"../../unchecked"}}]},"extension":{"text":"${title}","enabled":true}}`)
+	desc := []byte(`{"$version":"1","runtimeLevel":1,"id":"vendor/voice","version":"1","vars":[{"name":"title","value":"Voice"},{"name":"docs","value":"${root}/docs"}],"name":"${title}","vendor":"Vendor","description":"Description ${title}","license":{"_":"docs/../docs/LICENSE-${title}.txt","en":"${docs}/LICENSE.en.txt","zh-CN":"${docs}/许可证.txt"},"readme":{"_":"docs/../docs/readme.txt","zh-CN":"${docs}/说明.txt"},"url":"https://example.test/${title}","contributions":{"singer":[{"id":"main","path":"singer.json"}],"vendor.custom":[{"id":"data","configuration":{"file":"../../unchecked"}}]},"extension":{"text":"${title}","enabled":true}}`)
 	for name, content := range map[string][]byte{
 		"desc.json": desc, "docs/readme.txt": []byte("Readme"), "docs/说明.txt": []byte("说明"),
+		"docs/LICENSE-Voice.txt": []byte("License"), "docs/LICENSE.en.txt": []byte("English license"), "docs/许可证.txt": []byte("许可证"),
 		"singer.json": []byte(`{"name":"Singer","avatar":"../../unchecked.png"}`),
 	} {
 		filename := filepath.Join(source, filepath.FromSlash(name))
@@ -50,13 +51,16 @@ func TestInfoCompleteMetadataFromArchiveAndInstallation(t *testing.T) {
 	checkMetadata := func(info packagemanager.Info, expectedRoot string) {
 		t.Helper()
 		p := info.Package
-		if p.Name["_"] != "Voice" || p.Vendor["_"] != "Vendor" || p.Description["_"] != "Description Voice" || len(p.Copyright) != 3 || p.Copyright["_"] != "" || p.Copyright["en"] != "Copyright Voice" || p.Copyright["zh-CN"] != "版权 Voice" || p.URL == nil || *p.URL != "https://example.test/Voice" {
+		if p.Name["_"] != "Voice" || p.Vendor["_"] != "Vendor" || p.Description["_"] != "Description Voice" || p.URL == nil || *p.URL != "https://example.test/Voice" {
 			t.Fatalf("incomplete typed metadata: %+v", p)
 		}
+		if len(p.License) != 3 || p.License["_"] != filepath.Join(expectedRoot, "docs", "LICENSE-Voice.txt") || p.License["en"] != filepath.Join(expectedRoot, "docs", "LICENSE.en.txt") || p.License["zh-CN"] != filepath.Join(expectedRoot, "docs", "许可证.txt") {
+			t.Fatal("License paths were resolved in an incorrect context.", p.License, expectedRoot)
+		}
 		if len(p.Readme) != 2 || p.Readme["_"] != filepath.Join(expectedRoot, "docs", "readme.txt") || p.Readme["zh-CN"] != filepath.Join(expectedRoot, "docs", "说明.txt") {
 			t.Fatal("readme resolved in the wrong context", p.Readme, expectedRoot)
 		}
-		if p.Manifest["extension"].(map[string]any)["text"] != "Voice" || p.Manifest["readme"].(map[string]any)["_"] != "docs/../docs/readme.txt" {
+		if p.Manifest["extension"].(map[string]any)["text"] != "Voice" || p.Manifest["readme"].(map[string]any)["_"] != "docs/../docs/readme.txt" || p.Manifest["license"].(map[string]any)["_"] != "docs/../docs/LICENSE-Voice.txt" {
 			t.Fatal("expanded declaration lost or rewritten", p.Manifest)
 		}
 		if _, exists := p.Manifest["vars"]; exists {
@@ -83,9 +87,12 @@ func TestInfoCompleteMetadataFromArchiveAndInstallation(t *testing.T) {
 	if err != nil || !bytes.Equal(installedDesc, desc) {
 		t.Fatal("metadata parsing rewrote desc.json", err)
 	}
-	for _, args := range [][]string{{"--file", archive}, {"--installed", "vendor/voice=1"}} {
-		out := invoke(append([]string{"--language", "*", "info"}, args...)...)
-		for _, text := range []string{"Copyright[_]: \n", "Copyright[en]: Copyright Voice", "Copyright[zh-CN]: 版权 Voice", "Readme[_]:", "Readme[zh-CN]:", "URL: https://example.test/Voice", "Avatar[_]: ../../unchecked.png"} {
+	for _, test := range []struct {
+		args []string
+		root string
+	}{{[]string{"--file", archive}, scratch}, {[]string{"--installed", "vendor/voice=1"}, installedRoot}} {
+		out := invoke(append([]string{"--language", "*", "info"}, test.args...)...)
+		for _, text := range []string{"License[_]: " + filepath.Join(test.root, "docs", "LICENSE-Voice.txt"), "License[en]: " + filepath.Join(test.root, "docs", "LICENSE.en.txt"), "License[zh-CN]: " + filepath.Join(test.root, "docs", "许可证.txt"), "Readme[_]:", "Readme[zh-CN]:", "URL: https://example.test/Voice", "Avatar[_]: ../../unchecked.png"} {
 			if !strings.Contains(out, text) {
 				t.Fatalf("info omitted %q:\n%s", text, out)
 			}
@@ -97,7 +104,7 @@ func TestInfoCompleteMetadataFromArchiveAndInstallation(t *testing.T) {
 	if err := json.Unmarshal([]byte(invoke("--json", "list")), &listing); err != nil || len(listing.Data) != 1 {
 		t.Fatal("invalid installed index response", listing, err)
 	}
-	for _, field := range []string{"copyright", "readme", "url", "manifest"} {
+	for _, field := range []string{"license", "readme", "url", "manifest"} {
 		if _, exists := listing.Data[0][field]; exists {
 			t.Errorf("full metadata leaked into the installed-package index: %s", field)
 		}

internal/cli/output/text.go

@@ -141,11 +141,8 @@ func (r *Renderer) info(v packagemanager.Info) {
 	r.field("  ", "CompatVersion", p.CompatVersion.String())
 	r.field("  ", "FormatVersion", p.FormatVersion.String())
 	r.field("  ", "RuntimeLevel", fmt.Sprint(p.RuntimeLevel))
-	r.textField("  ", "Copyright", p.Copyright)
+	r.textField("  ", "License", p.License)
 	r.textField("  ", "Readme", p.Readme)
-	if text, ok := packageinfo.TextValue(p.Manifest["license"]); ok {
-		r.textField("  ", "License", text)
-	}
 	if p.URL != nil {
 		r.field("  ", "URL", *p.URL)
 	}

internal/cli/output/text_test.go

@@ -58,19 +58,23 @@ func TestTextInfoUsesCompleteTypedMetadata(t *testing.T) {
 			r := styledRenderer(&out, io.Discard)
 			r.Language = "*"
 			p := packageinfo.PackageManifest{
-				Copyright: packageinfo.Text{"_": "", "en": "Copyright Voice", "zh-CN": "版权"},
-				Readme:    packageinfo.Text{"_": "/voice/readme.txt", "zh-CN": "/voice/说明.txt"},
-				URL:       &url,
+				License:  packageinfo.Text{"_": "/voice/LICENSE.txt", "en": "/voice/LICENSE.en.txt", "zh-CN": "/voice/许可证.txt"},
+				Readme:   packageinfo.Text{"_": "/voice/readme.txt", "zh-CN": "/voice/说明.txt"},
+				URL:      &url,
+				Manifest: map[string]any{"license": "LICENSE.txt"},
 			}
 			if err := r.Query(packagemanager.Info{Package: p}, nil); err != nil {
 				t.Fatal(err)
 			}
 			plain := ansi.Strip(out.String())
-			for _, text := range []string{"  Copyright[_]: \n", "  Copyright[en]: Copyright Voice\n", "  Copyright[zh-CN]: 版权\n", "  Readme[_]: /voice/readme.txt\n", "  Readme[zh-CN]: /voice/说明.txt\n", "  URL: " + url + "\n"} {
+			for _, text := range []string{"  License[_]: /voice/LICENSE.txt\n", "  License[en]: /voice/LICENSE.en.txt\n", "  License[zh-CN]: /voice/许可证.txt\n", "  Readme[_]: /voice/readme.txt\n", "  Readme[zh-CN]: /voice/说明.txt\n", "  URL: " + url + "\n"} {
 				if !strings.Contains(plain, text) {
 					t.Fatalf("typed metadata missing from info: %q in:\n%s", text, plain)
 				}
 			}
+			if strings.Count(plain, "License[_]:") != 1 {
+				t.Fatal("The license field was rendered more than once.", plain)
+			}
 		})
 	}
 }