Extension manifest
Every extension is described by ONE manifest validated by zExtensionManifest (packages/core/src/extensions/manifest.ts). The taxonomy is closed: everything an extension can touch is a field here, and nothing else exists. First-party manifests are TypeScript objects validated at test time; configSchema is generated from the registry's Zod via z.toJSONSchema.
Runtime is a declared dependency (ADR 0026 §2): platform = compiled into Mozaik's workers (first-party only: the schema refuses it for any other publisher); sandbox = sealed store-scoped worker (P2 seals the sandbox runtime: ADR 0027; extension.install refuses it until then); external = standing service via webhooks (M11). Sync/async picks the interface contract, never the runtime.
The machine-readable schema: /schemas/manifest.schema.json.
Fields
| field | type | required | notes |
|---|---|---|---|
id | string (/^[a-z0-9-]+\.[a-z0-9-]+$/) | yes | |
version | string (/^\d+\.\d+\.\d+$/) | yes | |
publisher | string (≤60 chars) | yes | |
labelTR | string (≤60 chars) | yes | |
descriptionTR | string (≤200 chars) | yes | |
runtime | "platform" | "sandbox" | "external" | yes | |
requires | object | no | |
api | string (≤60 chars) | no | |
storefront | string (≤60 chars) | no | |
contract | integer (1..9007199254740991) | no | |
scopes | array<string (/^[a-z:_-]+$/, ≤40 chars)> (≤10) | yes | |
pii | object | no | |
buyer | array<"name" | "email" | "phone" | "address" | "city" | "ip"> (≤6) | yes | |
inbound | array<"name" | "email_masked" | "phone" | "address" | "city" | "tax_id"> (≤6) | no | |
purposeTR | string (≤200 chars) | yes | |
provider | object | object | object | object | object | object | object | no | |
configSchema | object | yes | |
secrets | array<object> (≤8) | no | |
webhooks | array<object> (≤4) | no | |
jobs | array<object> (≤3) | no | |
mail | array<object> (≤5) | no | |
events | array<object> (≤5) | no | |
catalogFields | array<object> (≤24) | no | |
ui | object | no | |
settingsForm | object | no | |
fieldLabelsTR | object | yes | |
fieldHintsTR | object | no | |
widgetHints | object | no | |
hidden | array<string (/^\/[a-zA-Z0-9_/]+$/, ≤80 chars)> (≤10) | no | |
order | array<string (/^\/[a-zA-Z0-9_/]+$/, ≤80 chars)> (≤20) | no | |
selectOptions | object | no | |
panels | array<object> (≤4) | no | |
actions | array<object> (≤3) | no | |
pages | array<object> (≤3) | no | |
channelTabs | array<object> (≤6) | no | |
storefront | object | no | |
blocks | array<object> (≤4) | no | |
sections | array<object> (≤3) | no | |
pages | array<object> (≤3) | no | |
exposeConfig | array<string (/^\/[a-zA-Z0-9_/-]+$/)> (≤12) | no | |
themeSections | array<object> (≤3) | no | |
agent | object | yes | |
summaryEN | string (≤400 chars) | yes | |
setup | array<object> (≤12) | yes | |
ops | array<object> (≤12) | no | |
docs | array<string (/^[a-z0-9-]{1,60}$/)> (≤8) | no | |
csp | object | no | |
scriptSrc | array<string (/^https:\/\/[a-z0-9.-]+$/, ≤120 chars)> (≤4) | no | |
frameSrc | array<string (/^https:\/\/[a-z0-9.-]+$/, ≤120 chars)> (≤4) | no | |
connectSrc | array<string (/^https:\/\/[a-z0-9.-]+$/, ≤120 chars)> (≤4) | no | |
formAction | array<string (/^https:\/\/[a-z0-9.-]+$/, ≤120 chars)> (≤4) | no |
Provider kinds
The provider block is a discriminated union on kind: