Manifest format

Every plugin ships fluxplug.json beside its packaged entry. The manifest is validated before code runs.

Minimal manifest

{
  "schemaVersion": 1,
  "apiVersion": 2,
  "id": "standalone-demo",
  "name": "My first plugin",
  "version": "1.0.0",
  "entry": "dist/index.js",
  "capabilities": ["ui"],
  "settings": [],
  "integrity": {
    "sha256": "0000000000000000000000000000000000000000000000000000000000000000"
  }
}

The zeros are a build-time placeholder. The packager replaces them with the real SHA-256; do not distribute an unbuilt manifest.

Fields

Field	Contract
schemaVersion	1; manifest-format version
apiVersion	Set to 2 for current executable plugins; missing or incompatible API versions cannot execute
id	1–64 lowercase letters, numbers, dots, underscores, or hyphens; first character is a letter or number
name	Nonempty display name, maximum 80 characters
version	Nonempty plugin version, maximum 40 characters
entry	Safe relative JavaScript path, contained in the package
capabilities	Requested permissions, maximum 16 entries
settings	Setting definitions, maximum 100
integrity.sha256	64 hexadecimal characters matching the built entry
description / author	Optional, maximum 500 / 120 characters
integrity.signature	Optional metadata; publisher signatures are not verified in this release

Setting definitions

Each setting has key, title, kind, and defaultValue, with optional description. The kind is boolean, string, or number and must match the default’s type. Keys are bounded safe identifiers; reserved prototype names are rejected. See settings and storage.

Identity and trust

The ID must match definePlugin’s identity. Keep it stable across upgrades so data remains associated with the same plugin. A matching integrity hash proves the code matches the reviewed manifest, not that its author is trustworthy.

Manifest schema version, SDK API version, and product version 2.0.0-beta.1 are separate compatibility concepts.