Manifest

The index of a publish. It lists every component contract a design system publishes: where each one lives, where it came from, and the content address that catches any edit to it.

Schema file	`schemas/v0/manifest.schema.json`
Dialect	`https://json-schema.org/draft/2020-12/schema`
`$id`	`https://knapsack-oss.github.io/design-system-contract/schemas/v0/manifest.schema.json` (identifier only, not a network location; see schema identifiers)
Root type	`object`
Required	`contractVersion`, `artifacts`
Additional members	Not permitted (`additionalProperties: false`)
Example file	`examples/manifest.json`

Field summary

Member	Type	Required	Constraint
`$schema`	string	No	`minLength: 1`
`contractVersion`	string	Yes	`minLength: 1`
`artifacts`	array of artifact record	Yes	None on the array itself
`artifacts[].path`	string	Yes	`minLength: 1`
`artifacts[].address`	string	Yes	pattern `^sha256:[0-9a-f]{64}$`
`artifacts[].origin`	string	Yes	`enum: ["inferred", "synced"]`

The schema defines no default values.

Root members

`$schema` #

Path: /$schema
Type: string
Required: Optional
Constraints: minLength: 1
Default: None

Optional pointer to this schema. The URL is the schema's $id and is served from this site.

"$schema": "https://knapsack-oss.github.io/design-system-contract/schemas/v0/manifest.schema.json"

`contractVersion` #

Path: /contractVersion
Type: string
Required: Required
Constraints: minLength: 1. No format constraint.
Default: None

Version of the published contract set this manifest describes. Free text. The schema does not require semantic versioning; the example value "0.1.0" follows that convention, but the schema accepts any non-empty string.

This is the version of the publisher's contract set, not the version of the Design System Contract format.

Valid

"contractVersion": "0.1.0"
"contractVersion": "2026-09 release"

`artifacts` #

Path: /artifacts
Type: array of artifact record
Required: Required
Constraints: No minItems; an empty array is valid against the schema.
Default: None

One record per component contract. The manifest never lists itself, and lists only component contracts (SR-136). Every contractId among the listed contracts must be unique. The schema cannot check this; a publisher checks it at publish.

"artifacts": [
  {
    "path": "button-primary.contract.json",
    "address": "sha256:b11ac43d1cf8120534e96ec2d90c24a4c2d9b20364fe01e27632ee7ad63b7dd4",
    "origin": "synced"
  }
]

Any other root member #

Rule: additionalProperties: false at the root

A root member other than $schema, contractVersion, and artifacts fails schema validation (SR-134). v0.1 defines no signer, signature, syncTimestamp, or sourceSystemVersion member.

Fails validation

{
  "contractVersion": "0.1.0",
  "artifacts": [],
  "signature": "..."
}

Artifact record

Artifact record (`$defs/artifactRecord`) #

Path: /artifacts/{index}
Type: object
Required members: path, address, origin
Permitted members: Only the three required members (additionalProperties: false, SR-135)

Describes one component contract file. v0.1 defines no per-record ratified, signature, or canonicalForm member; each fails validation.

{
  "path": "button-primary.contract.json",
  "address": "sha256:b11ac43d1cf8120534e96ec2d90c24a4c2d9b20364fe01e27632ee7ad63b7dd4",
  "origin": "synced"
}

`path` #

Path: /artifacts/{index}/path
Type: string
Required: Required
Constraints: minLength: 1. No pattern.
Default: None

Location of the contract file, relative to the manifest's own directory. The schema constrains length only; it does not check that the path is relative, that the file exists, or that the file is a component contract.

"path": "button-primary.contract.json"
"path": "contracts/button-primary.contract.json"

`address` #

Path: /artifacts/{index}/address
Type: string
Required: Required
Constraints: pattern ^sha256:[0-9a-f]{64}$ (lowercase hex only)
Default: None

sha256: plus the lowercase hex SHA-256 (Secure Hash Algorithm, 256-bit) digest of the contract's canonical form (RFC 8785, Request for Comments 8785, the JSON Canonicalization Scheme, as UTF-8). A mismatch makes the artifact invalid. The schema checks the format only; it does not recompute the digest.

Valid

"address": "sha256:b11ac43d1cf8120534e96ec2d90c24a4c2d9b20364fe01e27632ee7ad63b7dd4"

Invalid

"address": "sha256:E67003F8B545A3B081EAE58B5F392AC0BF9FF33619B5E6F826DAF7D8BC272434"  // uppercase hex
"address": "b11ac43d1cf8120534e96ec2d90c24a4c2d9b20364fe01e27632ee7ad63b7dd4"         // no prefix
"address": "sha512:b11ac43d1cf8120534e96ec2d90c24a4c2d9b20364fe01e27632ee7ad63b7dd4"  // other algorithm

`origin` #

Path: /artifacts/{index}/origin
Type: string
Required: Required
Constraints: enum: ["inferred", "synced"]
Default: None

Value	Meaning
`inferred`	Derived without owner confirmation.
`synced`	Retrieved from the design system's source of truth.

authored is not a legal value in v0.1.

"origin": "synced"

Fails validation

"origin": "authored"

Rules the schema does not check

A JSON Schema validator that accepts a manifest has not checked the following. This repository ships no checker tool for them.

Rule	Checked by	Spec
Every listed contract's `contractId` is unique	Publisher	SR-133
The manifest does not list itself and lists only component contracts	Publisher	SR-136
Each `address` equals the recomputed content address of the file at `path`	Consumer	SR-137

Complete example

Source: examples/manifest.json. The listed contract is examples/button-primary.contract.json, in the same directory.

{
  "$schema": "https://knapsack-oss.github.io/design-system-contract/schemas/v0/manifest.schema.json",
  "contractVersion": "0.1.0",
  "artifacts": [
    {
      "path": "button-primary.contract.json",
      "address": "sha256:b11ac43d1cf8120534e96ec2d90c24a4c2d9b20364fe01e27632ee7ad63b7dd4",
      "origin": "synced"
    }
  ]
}

Manifest

Field summary

Root members

$schema #

contractVersion #

artifacts #