Manifest Reference

Every VeloCMS plugin must include a manifest.jsonat its root. The manifest is validated at install time by the tenant's VeloCMS instance, and again during the marketplace review pipeline. Missing required fields cause hard failures; invalid values cause descriptive error messages.

Complete example

{
  "id": "com.example.mailchimp-sync",
  "name": "Mailchimp Sync",
  "version": "1.2.0",
  "description": "Syncs new blog members to a Mailchimp audience automatically.",
  "author": "Example Corp",
  "homepage": "https://example.com/velocms-mailchimp",
  "repository": "https://github.com/example/velocms-mailchimp",
  "license": "MIT",
  "capabilities": ["members:read", "network:fetch"],
  "hooks": ["afterMemberSignup"],
  "network_access": {
    "allowedDomains": ["api.mailchimp.com"],
    "reasoning": "Sync member emails to Mailchimp audience"
  },
  "builtin": false,
  "enabled": true,
  "entry": "./dist/runtime.js"
}

Required fields

Field	Type	Constraints
id	string	Reverse domain. Pattern: /^[a-z0-9-]+(\.[a-z0-9-]+)*$/. Min 2 segments.
name	string	Max 100 chars
version	string	Semver. e.g. "1.0.0", "2.1.0-beta.1"
description	string	Max 500 chars
capabilities	string[]	From PLUGIN_CAPABILITIES allowlist. May be empty.
hooks	string[]	From HOOK_NAMES allowlist. May be empty.
builtin	boolean	false for third-party plugins
enabled	boolean	true = active on install by default

Optional fields

Field	Type	Notes
author	string	Max 100 chars
homepage	string	Must be a valid URL
repository	string	Must be a valid URL
license	string	SPDX identifier (e.g. "MIT")
network_access.allowedDomains	string[]	Exact hostnames only. No wildcards.
network_access.reasoning	string	Shown to tenants in consent dialog
entry	string	Path to compiled runtime entry point

ID format rules

Plugin IDs use reverse domain notation. All lowercase, alphanumeric plus hyphens, dot-separated segments, minimum two segments:

// Valid
"com.example.my-plugin"
"org.myorg.analytics"
"io.github.username.plugin-name"

// Invalid
"my-plugin"             // no dots — rejected
"com.example.MyPlugin"  // uppercase — rejected
"com.example.my_plugin" // underscore — rejected