Manifest reference

manifest.json is a UTF-8 JSON object. It is signed as exact bytes and cannot exceed 65,536 bytes. Reformatting it after signing invalidates the release.

Use manifest.schema.json for editor completion and CI. The production validator remains authoritative where JSON Schema cannot express byte-length rules.

Complete example

{
  "schema_version": 1,
  "protocol_version": 1,
  "namespace": "acme/featured-products",
  "version": "1.0.0",
  "name": "Featured products",
  "description": "Show selected storefront products and add them to the cart.",
  "entrypoint": "index.html",
  "capabilities": [
    "site.theme.read",
    "catalog.products.read",
    "cart.manage"
  ],
  "properties": {
    "heading": {
      "type": "text",
      "label": "Heading",
      "default": "Featured products"
    }
  }
}

Schema version 1 rejects unknown top-level fields, including $schema. Configure your editor to associate manifest.schema.json with files named manifest.json instead of adding a schema field to the release manifest. The scaffold already uses a valid release manifest.

Required fields

Field	Rule
`schema_version`	Integer `1`.
`protocol_version`	Integer `1`.
`namespace`	Exact `publisher-slug/package-slug`. Immutable after registration.
`version`	Semantic version such as `1.2.0` or `2.0.0-beta.1`.
`name`	1 to 120 UTF-8 bytes.
`entrypoint`	Relative `.html` path inside `runtime/`.
`capabilities`	A list of up to 32 known capability keys. Use `[]` when none are needed.
`properties`	An object containing up to 64 visual controls. Use `{}` when none are needed.

Optional fields

Field	Rule
`description`	Up to 500 UTF-8 bytes. Describe the visible outcome.

Unknown fields are rejected.

Property controls

Every property definition requires type and label. Supported types are boolean, color, image, number, select, text, textarea, and url.

Field	Applies to	Rule
`type`	All	One supported type.
`label`	All	1 to 100 bytes.
`default`	All	Must match the property type.
`required`	All	Boolean.
`help`	All	Up to 300 bytes.
`options`	`select`	1 to 100 unique `{label, value}` objects.
`min`, `max`	`number`	Numeric bounds. `min` cannot exceed `max`.

Property names begin with a lowercase letter and contain only letters, numbers, and underscores. They can be at most 64 characters.

Runtime setting limits are 500 bytes for text and select values, 4,096 bytes for textarea values, and 2,048 bytes for image and URL values. Colors use six- or eight-digit hex notation. URL and image values may be empty, site-relative, http, or https URLs. Full URLs require a valid DNS name or IP address and cannot contain credentials. A required string property cannot have a blank default. All defaults together cannot exceed 16,384 JSON-encoded bytes.

Properties are public. Never put secrets, tokens, customer information, or private configuration in a default or setting.

Capabilities

The closed capability list is documented in Runtime API and represented exactly in contract.json. Declaring a capability only asks for access. New permissions are off until the store user approves them.

Adding a capability in a later release triggers another permission review. Removing a capability automatically removes the obsolete grant.

Entrypoint and bundle

The ZIP contains exactly one HTML file, and it must be the declared entrypoint. Paths are relative, case-distinct only once, and limited to safe ASCII path segments. Symlinks are rejected.

The entrypoint cannot contain:

inline JavaScript;
inline event handlers;
authored Content Security Policy headers;
frames, objects, embeds, or applets;
remote or missing module scripts.

The platform injects its own base URL, parent origin, and runtime module at launch.