release: publish Plugin SDK 1.0 stable API

API_SUPPORT.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
-  "sdkVersion": "1.0.0-rc.1",
-  "releaseStatus": "candidate",
-  "pluginPeerRange": "1.0.0-rc.1",
+  "sdkVersion": "1.0.0",
+  "releaseStatus": "stable",
+  "pluginPeerRange": ">=1.0.0 <2.0.0",
   "policy": "docs/SUPPORT_POLICY.md",
   "exports": [
     {

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 1.0.0 — 2026-10-05
+
+- Publish the RC API as the stable 1.x line with an exact SDK archive and new plugin
+  peer `>=1.0.0 <2.0.0`; preserve verified historical and exact RC1 archive metadata.
+- Activate the documented support/deprecation policy and publish release contents,
+  migration/rollback guidance and measured Windows/Linux × Node 22/24 guards.
+- Security audit and vulnerability validation remain pending under the owner
+  deferral. Functional acceptance and stable API status do not imply audit passage.
+
 ## 1.0.0-rc.1
 
 - Add a versioned public host/port conformance suite with machine and human reports,

PUBLIC_SURFACE.json

@@ -37,6 +37,7 @@
     "docs/PUBLIC_SCOPE.md",
     "docs/PUBLISHING.md",
     "docs/RC_ACCEPTANCE.md",
+    "docs/RELEASE_1_0.md",
     "docs/SECRETS.md",
     "docs/SETTINGS.md",
     "docs/SUPPORT_POLICY.md",

README.md

@@ -10,13 +10,15 @@ a small ESM package, TypeScript declarations and versioned contracts. Connect
 your own workspace and tools with the Node.js host and HTTP client. The SDK has
 **zero runtime dependencies**.
 
-Version **1.0.0-rc.1** is the stable API release candidate. The
+Version **1.0.0** is the stable API release. The
 [API inventory](API_SUPPORT.json), [support and migration policy](docs/SUPPORT_POLICY.md)
 and [host conformance suite](docs/CONFORMANCE.md) make its scope reviewable.
 Run `npm run example:conformance`, `npm run example:conformance-browser` or
 `npm run example:combined` to check independent Node/browser hosts and the combined
-language/settings/edit/job/watch/transfer workload. RC packages pin the exact
-prerelease peer; they do not establish GA or DDS product acceptance.
+language/settings/edit/job/watch/transfer workload. New plugin packages declare `>=1.0.0 <2.0.0`. The
+[1.0 release contents and acceptance](docs/RELEASE_1_0.md) distinguish functional
+acceptance from the deferred security audit. SDK delivery is separate from DDS
+product acceptance.
 
 Version 0.13 adds six [project templates and guarded contract generation](docs/DEVTOOLS.md),
 [deterministic synthetic test hosts](docs/testing.md) and opt-in
@@ -55,7 +57,7 @@ application, private engines/services and production signing systems are outside
 this repository. Read the [public scope](docs/PUBLIC_SCOPE.md) and
 [compatibility table](docs/COMPATIBILITY.md) for exact boundaries.
 
-Version **1.0.0-rc.1** supports Node 22 and 24. Manifest v1 diagnostic plugins remain
+Version **1.0.0** supports Node 22 and 24. Manifest v1 diagnostic plugins remain
 compatible. Manifest v2 adds commands, permission-scoped workspace and backend
 APIs, and open-source or proprietary distribution metadata. Themes export to
 the XML format already supported by DDS. The workspace host runs trusted plugins
@@ -115,7 +117,7 @@ mkdir my-dds-plugin
 cd my-dds-plugin
 npm init -y
 npm pkg set type=module
-npm install --ignore-scripts --save-exact https://github.com/Altifigence/dds-plugin-sdk/releases/download/v1.0.0-rc.1/altifigence-dds-plugin-sdk-1.0.0-rc.1.tgz
+npm install --ignore-scripts --save-exact https://github.com/Altifigence/dds-plugin-sdk/releases/download/v1.0.0/altifigence-dds-plugin-sdk-1.0.0.tgz
 ```
 
 Copy the example's `plugin.mjs` and `run.mjs` into this directory, then run:

SECURITY.md

@@ -1,6 +1,6 @@
 # Security
 
-The current release candidate is **1.0.0-rc.1**. It retains the security fixes from
+The current stable API release is **1.0.0**. It retains the security fixes from
 0.3.2. Update workspace servers and clients together, using a current patched
 Node 22 or 24; do not use a pre-0.3.2 workspace host.
 Report an SDK
@@ -12,6 +12,10 @@ exploit details or project data in an issue.
 Include the SDK version, a minimal synthetic reproducer, expected behavior and
 impact. Omit credentials, customer source and private filesystem paths.
 
+The post-0.7 security audit and vulnerability validation are pending under the
+owner's 2026-10-05 deferral. Functional and release checks do not complete that
+audit or establish that its unvalidated candidates are resolved.
+
 ## 0.3.2 boundary fixes
 
 The review reproduced file-access and resource-lifetime gaps in 0.3.1 with
@@ -55,7 +59,7 @@ protect storage, verify the current identity and implement revocation themselves
 
 ## 한국어
 
-현재 출시 후보는 **1.0.0-rc.1**이며 0.3.2의 보안 수정을 유지합니다. workspace **서버와 클라이언트를 모두
+현재 안정 API 릴리스는 **1.0.0**이며 0.3.2의 보안 수정을 유지합니다. workspace **서버와 클라이언트를 모두
 0.3.2 이상**으로 갱신하고 Node 22/24의 최신 보안 패치를 사용하세요. 클라이언트만
 갱신하면 오래된 서버의 파일 검사와 요청 수신 제한은 바뀌지 않습니다.
 

docs/COMPATIBILITY.md

@@ -1,5 +1,14 @@
 # Compatibility and availability
 
+## 1.0 stable API
+
+`1.0.0` retains the RC runtime/protocol API. Newly packed plugins use
+`>=1.0.0 <2.0.0`; raise the minimum before using an API added in a later minor.
+The verifier preserves exact historical 0.3.x–0.13.x and `1.0.0-rc.1` metadata.
+Revalidate and repack an RC plugin as a new plugin version for stable installation.
+Archive verification does not widen installation ranges. See [release contents](RELEASE_1_0.md)
+for accepted profiles and the separately deferred security audit.
+
 ## 1.0 release candidate
 
 `1.0.0-rc.1` retains the 0.13 public runtime and protocol contracts and adds
@@ -76,7 +85,7 @@ is unchanged. These features do not establish a DDS product editor integration.
 | Browser-only DDS host | Native workspace transport is unavailable |
 | Language providers | Diagnostics plus completion, hover, definition, references and document symbols in SDK hosts since 0.3.0; no released DDS editor bridge is implied |
 | Project edit sessions | Client helpers in 0.3.0 over unchanged workspace protocol v1, including 0.2.x servers |
-| Download verification | Node API/CLI since 0.3.1; 0.13.0 accepts exact 0.3.x–0.13.x package metadata; no extraction, code execution or publisher authentication |
+| Download verification | Node API/CLI since 0.3.1; 1.0.0 accepts exact 0.3.x–0.13.x, RC1 and current stable package metadata; no extraction, code execution or publisher authentication |
 | Development tools | `init`, `doctor`, `dev` since 0.4.0; six templates, `generate`, synthetic testing and local profiles in 0.13 |
 | Command jobs | Opt-in SDK host/client extension since 0.4.0; progress/logs/UTF-8 artifacts; v1 hello unchanged |
 | File and job observation | Client helpers since 0.5.0; 0.6 uses revision reads when supported; job reads need enabled 0.4+ hosts |

docs/PUBLISHING.md

@@ -26,7 +26,7 @@ notes for the capabilities and hosts actually supported by that release.
    what data the plugin uses, which backend receives it, and how users can find
    updates and contact the publisher about security.
 4. List the plugin's distribution files explicitly in `dds-package.json`, then
-   validate and pack them with the SDK 1.0.0-rc.1 CLI described below. Inspect the
+   validate and pack them with the SDK 1.0.0 CLI described below. Inspect the
    archive; do not list credentials, private project data or files that you do
    not intend to distribute.
 5. Publish the immutable versioned `.tgz`, its external `.release.json` and
@@ -44,10 +44,10 @@ file. Errors do not print the detected value. This is a conservative additional
 check, not a complete secret or malware scanner. Inspect your source and final
 archive; obfuscated credentials and confidential implementation may evade it.
 
-## Package format and SDK 1.0.0-rc.1 CLI
+## Package format and SDK 1.0.0 CLI
 
 The CLI has been available since SDK 0.2.0; SDK 0.1.0 does not provide it.
-Use an installed 1.0.0-rc.1 package containing the `dds-plugin` executable.
+Use an installed 1.0.0 package containing the `dds-plugin` executable.
 For a new project, start with [init and doctor](DEVTOOLS.md).
 
 Prepare this layout:
@@ -87,9 +87,9 @@ The manifest, disclosure, manifest entry and selected license file must all be
 listed. The packer automatically includes `dds-package.json` and generates
 `package.json`; do not list either file in `files`. The generated npm metadata
 uses `type: "module"`, the manifest entry and a peer dependency on this SDK:
-`1.0.0-rc.1`. The packer targets its current tested SDK line; it does not
+`>=1.0.0 <2.0.0`. The packer targets its current tested SDK line; it does not
 infer compatibility by inspecting imports. Older archives from the 0.2.x–0.13.x
-CLIs exclude SDK 1.0.0-rc.1 in their peer ranges. Validate against 1.0.0-rc.1 and
+and 1.0.0-rc.1 CLIs exclude SDK 1.0.0 in their peer ranges. Validate against 1.0.0 and
 publish a new plugin version with this packer when migrating those archives.
 List `NOTICE`, third-party notices, other runtime modules, assets and source material
 explicitly when they are applicable. The CLI does not determine which legal
@@ -153,7 +153,7 @@ separate from validating and packaging your own plugin.
 
 ## Select a distribution channel
 
-Before installing a downloaded plugin, use the SDK 1.0.0-rc.1
+Before installing a downloaded plugin, use the SDK 1.0.0
 [`dds-plugin verify` command](VERIFYING.md) or `verifyPluginArchive()` API to
 check its archive and release metadata without running or extracting it.
 Supply an independently obtained expected SHA-256 when selecting exact release

docs/RELEASE_1_0.md

@@ -0,0 +1,62 @@
+# SDK 1.0 release contents and acceptance
+
+1.0.0 is the stable public SDK API release. Its source tag and immutable tarball,
+SHA256SUMS, exact CI commit and acceptance receipt are on the GitHub release.
+The release has no runtime npm dependencies. LICENSE and NOTICE cover this SDK;
+plugin publishers retain responsibility for their own and third-party terms.
+
+Security audit and vulnerability validation remain **pending** under the owner's
+2026-10-05 deferral (DDS-243). This release does not claim audit passage or resolution
+of unvalidated review candidates. Functional delivery continues under that decision.
+
+## Included API
+
+The complete machine-readable inventory is [API_SUPPORT.json](../API_SUPPORT.json).
+It contains 38 exported paths, runtime names, declaration names/digests and each
+environment/stability classification. Declarations and 86 versioned JSON schemas
+ship beside the implementation. The package allowlist is [PUBLIC_SURFACE.json](../PUBLIC_SURFACE.json).
+
+Included: plugin/manifest contracts; themes; user-owned workspaces and tools;
+commands and durable jobs/history; conditional files, project query/watch and
+reviewed edits; stored text/binary results; browser/Node upload/download queues;
+language assistance and semantic display; settings, secret references, localization;
+six development templates, generation/testing/diagnostics; 18 conformance profiles.
+OPFS checkpoint recovery remains experimental and requires the documented Worker,
+Web Locks and actual browser acceptance. Optional features require discovery and grants.
+
+The functional release matrix covers Windows/Linux and Node 22.23.3/24.21.0, with
+TypeScript 5.9.3. RC browser proof used Chromium 154 on Windows: 12 profiles supported,
+six Node-only profiles unsupported and zero failed. The GA receipt identifies fresh
+consumer checks and any byte-identical or unchanged-code evidence reused from RC.
+The [RC report](RC_ACCEPTANCE.md) describes fault fixtures and the measured four-profile
+performance guard; sampled process memory and logical I/O are not whole-OS guarantees.
+
+## Install, migrate and recover
+
+Install the exact public SDK archive with lifecycle scripts disabled, verify its
+release hash, run the [conformance example](CONFORMANCE.md), and exercise your plugin.
+Use the [official installation guide](https://docs.altifigence.com/developers/plugin-sdk/)
+and [development guide](https://docs.altifigence.com/developers/plugin-sdk-development/).
+The six templates include tests, types, doctor, generation and pack/verify scripts.
+
+The stable plugin peer is `>=1.0.0 <2.0.0`. RC1 and legacy archives retain their
+original peers; publishing a newly validated plugin version changes installation
+eligibility. Old/new clients and hosts still need common optional contracts.
+Use [support and migration](SUPPORT_POLICY.md) for runtime dates, deprecation and
+maintenance windows. Report defects through GitHub Issues; use the private report
+route in [SECURITY.md](../SECURITY.md) for vulnerabilities.
+
+To return to an earlier SDK, stop owned work, retain the prior immutable SDK/plugin
+archives and configuration export, then explicitly select compatible versions.
+Review current permissions and make a fresh connection. Durable result recovery is
+readback-only; old output references are not fresh authority. External effects and
+incompatible application settings are not automatically undone. Test the downgrade
+against the formats and optional features actually used; the SDK does not change
+installed plugins or settings automatically.
+
+## Subsequent SDK work
+
+1.1 is planned to add reviewed dependency bundles, detached provenance verification
+and explicitly approved updates. 1.2 is planned to add workflow DAGs, incremental
+caching, external-tool streams and LSP bridging. Neither is claimed in this tarball.
+DDS UI/Engine/Cloud/Marketplace integration and native installers are separate releases.

docs/SUPPORT_POLICY.md

@@ -1,8 +1,9 @@
 # SDK 1.x support and migration
 
-`1.0.0-rc.1` is a release candidate. Install the exact archive and use the exact
-plugin peer `1.0.0-rc.1` during RC testing. It does not assert GA acceptance or a
-DDS product release. The policy below becomes the stable-line policy at 1.0 GA.
+`1.0.0` is the stable SDK line. Pin the installed archive; newly packed plugins
+use `>=1.0.0 <2.0.0`. The policy below applies to this line. Security audit and
+vulnerability validation remain pending under the owner's 2026-10-05 deferral;
+stable API status does not constitute security or DDS product acceptance.
 
 ## Public API and optional features
 
@@ -26,14 +27,14 @@ experimental changes are announced in minor-release notes and require fresh
 acceptance. Its presence is not a cross-browser compatibility claim. Other browser
 ports also require their documented capability and permission checks.
 
-No stable API is deprecated at RC1. Future deprecations appear in declarations,
+No stable API is deprecated in 1.0.0. Future deprecations appear in declarations,
 the changelog and migration guide for at least two minor releases and six months
 before removal in a new major. Runtime execution does not emit unsolicited warning
 logs or change grants. A security emergency is documented explicitly.
 
 ## Versions and maintenance
 
-GA plugin packages use `>=1.0.0 <2.0.0`; a plugin using a later minor's new API must
+Stable 1.0 plugin packages use `>=1.0.0 <2.0.0`; a plugin using a later minor's new API must
 declare that higher minimum. The packer records its release's supported range;
 it does not infer compatible source or widen an existing archive. RC packages
 require an explicit prerelease peer. Old archives retain their original peer

docs/VERIFYING.md

@@ -1,7 +1,7 @@
 # Verify a downloaded plugin release
 
-SDK **1.0.0-rc.1** provides a Node.js API and CLI for checking archives produced by the
-**0.3.x through 0.13.x DDS plugin packers**. Keep the publisher's `.tgz` and corresponding
+SDK **1.0.0** provides a Node.js API and CLI for checking archives produced by the
+**0.3.x through 0.13.x, RC1 and current stable DDS plugin packers**. Keep the publisher's `.tgz` and corresponding
 `.tgz.release.json` together. Verification reads these local files without
 extracting them, importing a plugin, running a package script or installing it.
 It makes no network requests.
@@ -33,7 +33,7 @@ const receipt = await verifyPluginArchive(process.argv[2], {
 console.log(receipt.pluginId, receipt.pluginVersion, receipt.artifact.sha256);
 ```
 
-Save that code as `verify.mjs` in an ESM project with SDK 1.0.0-rc.1 installed. Run it
+Save that code as `verify.mjs` in an ESM project with SDK 1.0.0 installed. Run it
 with the archive path, metadata path and independently obtained hash as its
 three arguments. The API returns a frozen report, and the CLI serializes it as
 JSON. The report contains the plugin
@@ -82,9 +82,9 @@ The receipt describes the bytes read during that call. If another process can
 change a download before installation or use, recheck the expected hash on the
 actual bytes being consumed. A report is not a grant to execute a mutable path.
 
-1.0.0-rc.1 preserves existing runtime/workspace contracts and verifies the exact
+1.0.0 preserves existing runtime/workspace contracts and verifies the exact
 published peer metadata from 0.3.x through 0.13.x, plus exact RC metadata
-(`1.0.0-rc.1`). Each prior minor line retains its original minor-bounded range.
+(`1.0.0-rc.1`) and the stable `>=1.0.0 <2.0.0` range. Each prior minor line retains its original minor-bounded range.
 Verification does not alter the peer range or authorize installation on another
 SDK line: validate and repack a new version for the selected SDK. Existing 0.3.x–0.13.x packages that
 satisfy the strengthened file policy can be verified unchanged. The verifier rejects private
@@ -96,7 +96,7 @@ SDK's own npm release tarball.
 
 ## 한국어
 
-SDK **1.0.0-rc.1**의 `dds-plugin verify`와 `verifyPluginArchive()`는 **0.3.x~0.13.x 및 현재 RC DDS
+SDK **1.0.0**의 `dds-plugin verify`와 `verifyPluginArchive()`는 **0.3.x~0.13.x 및 RC1·현재 stable DDS
 플러그인 packer**가 만든 `.tgz`와 외부 `.tgz.release.json`을 검사합니다.
 플러그인을 실행·설치하거나 파일을 디스크에 추출하지 않으며 네트워크 요청도 하지
 않습니다. 실행 명령과 API는 위 예제와 같습니다. 별도 위치의 메타데이터는
@@ -117,7 +117,7 @@ manifest·발행자 고지·진입 모듈·라이선스 및 생성된 npm 메타
 바뀔 수 있는 환경에서는 소비하는 바로 그 파일의 해시를 다시 확인해야 합니다.
 
 강화된 파일 정책을 만족하는 기존 0.3.x~0.13.x 플러그인 아카이브는 그대로 검증할 수 있고
-각각 기존 peer 범위도 유지됩니다. 새 패키지는 `1.0.0-rc.1`을
+각각 기존 peer 범위도 유지됩니다. 새 패키지는 `>=1.0.0 <2.0.0`을
 선언하며, 기존 패키지를 새 SDK에 설치하려면 발행자가 검증 후 새 버전으로 패키징해야
 합니다. 검증 자체는 호환 범위를 바꾸지 않습니다. 제외한 자격증명 경로나 Windows
 장치명이 들어 있으면 해당 파일을 제거한 새 플러그인 버전을 발행하세요.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@altifigence/dds-plugin-sdk",
-  "version": "1.0.0-rc.1",
+  "version": "1.0.0",
   "description": "Plugin, theme and user-owned workspace tools for Digital Design Studio",
   "type": "module",
   "license": "Apache-2.0",

schemas/artifact-sink-capabilities.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.0.0-rc.1/schemas/artifact-sink-capabilities.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.0.0/schemas/artifact-sink-capabilities.schema.json",
   "title": "artifact-sink-capabilities",
   "type": "object",
   "properties": {

schemas/artifact-storage-capabilities.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.0.0-rc.1/schemas/artifact-storage-capabilities.schema.json",
+  "$id": "https://github.com/Altifigence/dds-plugin-sdk/blob/v1.0.0/schemas/artifact-storage-capabilities.schema.json",
   "title": "artifact-storage-capabilities",
   "oneOf": [
     {