Validate package updates and compatibility metadata

Aurelia’s update adapter supplies stable identity to the native WordPress updater; the update service owns metadata transport, download authorization, release channels, rollout and revocation. The adapter must not depend on Pro or inspect a license. An offer is valid only when it is strictly newer, comes from the trusted HTTPS origin and matches the expected Aurelia identity.

Validate before unpacking

1. Require version, package, package_sha256 and package_size metadata; optional URL, requirements and tested fields must remain primitive.
2. Request a fresh authorized URL at download time. Do not persist a one-time download secret. Verify exact byte size and constant-time SHA-256 before unpacking.
3. Reject path traversal, symlinks, unsafe extensions, multiple roots and a root other than aurelia/. Exclude source files, maps, tests, scripts, fixtures, evidence, vendor and dotfiles from production packages.
4. Validate theme headers, compatibility identity, asset and translation manifest hashes and the required screenshot before promotion.
5. Build twice with the deterministic timestamp and file order; the bytes must be identical. A changed defect fix advances the candidate version instead of rebuilding the same version.

Keep checksum evidence with the release record and make failure a WP_Error. The update adapter validates packages; it does not decide entitlement or booking behavior.