CMAPI update feeds and package contract

Framework updates

CMAPI 1.0.0 reads a SourceNine Labs-owned JSON document from:

https://sourceninelabs.github.io/CMAPI/updates/cmapi.json

CMAPI\config.json selects stable or beta with CmapiUpdateChannel; invalid values revert to stable. Automatic launch-time checks are informational and silent on timeout, invalid data, or an offline connection. They never prevent the game from starting.

The feed uses a small, versioned JSON format:

{
  "SchemaVersion": 1,
  "Product": "CMAPI",
  "PublishedUtc": "2026-08-22T00:00:00.0000000Z",
  "Channels": {
    "Stable": {
      "Version": "1.0.0",
      "MinimumUpdaterVersion": "0.15.0",
      "Critical": false,
      "ReleaseNotesUrl": "https://sourceninelabs.github.io/CMAPI/changelog/1.0.0/",
      "Package": {
        "FileName": "CMAPI-1.0.0-win-x64.zip",
        "Url": "https://github.com/SourceNineLabs/CMAPI/releases/download/v1.0.0/CMAPI-1.0.0-win-x64.zip",
        "Sha256": "<64 lowercase hexadecimal characters>",
        "SizeBytes": 12345678
      },
      "SupportedGameBuilds": [
        {
          "GameVersion": "2.008",
          "AssemblyMvid": "520dcd8f-2c13-4a99-b871-44c7ad40bcc1",
          "Status": "tested"
        }
      ]
    }
  }
}

Build-Release.ps1 creates CMAPI-<version>-update-feed.json from the verified final ZIP. Publish that file as updates/cmapi.json in the GitHub Pages project. If the other channel is already live, pass the current JSON through -UpdateFeedBasePath so the build keeps that channel unchanged. Run Test-CmapiUpdateFeed.ps1 against the merged file before publishing it.

User-approved update flow

CMAPI.exe --update is the only automatic staging entry point. It:

1. requires Planet Crafter to be closed;
2. downloads the HTTPS feed with a bounded timeout;
3. validates schema, product, channel, semantic versions, official GitHub release origin, release-notes origin, exact filename, size, and SHA-256;
4. reads the installed Assembly-CSharp.dll MVID and refuses an update whose compatibility list does not include it;
5. downloads into a unique LocalAppData directory with a 512 MiB limit;
6. verifies exact byte count and SHA-256 before opening the archive;
7. rejects absolute, traversal, duplicate, colon-containing, and symbolic-link ZIP entries and enforces a 1 GiB expanded-size limit;
8. requires the verified archive to contain Setup and its package manifest;
9. starts Setup with the staged package and detected game path.

The updater does not edit the live game installation. Setup independently validates every package file and performs the existing recoverable transaction. The user must still review and approve Update. If preparation fails, the live installation remains untouched and the official manual release URL is shown.

The feed itself is not cryptographically signed in 1.0.0. Trust is bounded by HTTPS, strict SourceNine Labs origins, and the SHA-256 recorded in the Pages feed. A future detached-signature layer can be added as a new schema version without weakening the current fail-closed checks.

Mod updates

CMAPI continues to support informational stable GitHub release checks for mod manifests using GitHub:owner/repository. Nexus: and CMAPI: remain reserved until an authenticated provider or SourceNine Labs registry exists.

CMAPI never automatically replaces a mod. This avoids overwriting user configuration, unofficial patches, and local developer builds.