Extension manifest
Every extension is described by ONE manifest validated by zExtensionManifest (packages/core/src/extensions/manifest.ts). The taxonomy is closed: everything an extension can touch is a field here, and nothing else exists. First-party manifests are TypeScript objects validated at test time; configSchema is generated from the registry's Zod via z.toJSONSchema.
Runtime is a declared dependency (ADR 0026 §2): platform = compiled into Mozaik's workers (first-party only — the schema refuses it for any other publisher); sandbox = sealed store-scoped worker (lands at P1; extension.install refuses it until then); external = standing service via webhooks (M11). Sync/async picks the interface contract, never the runtime.
The machine-readable schema: /schemas/manifest.schema.json.
Fields
| field | type | required | notes |
|---|---|---|---|
id | string (/^[a-z0-9-]+\.[a-z0-9-]+$/) | yes | |
version | string (/^\d+\.\d+\.\d+$/) | yes | |
publisher | string (≤60 chars) | yes | |
labelTR | string (≤60 chars) | yes | |
descriptionTR | string (≤200 chars) | yes | |
runtime | "platform" | "sandbox" | "external" | yes | |
scopes | array<string (/^[a-z:_-]+$/, ≤40 chars)> (≤10) | yes | |
pii | object | no | |
buyer | array<"name" | "email" | "phone" | "address" | "city" | "ip"> (≤6) | yes | |
purposeTR | string (≤200 chars) | yes | |
provider | object | object | object | object | object | object | object | no | |
configSchema | object | yes | |
secrets | array<object> (≤8) | no | |
webhooks | array<object> (≤4) | no | |
jobs | array<object> (≤3) | no | |
mail | array<object> (≤5) | no | |
events | array<object> (≤5) | no | |
ui | object | no | |
settingsForm | object | no | |
fieldLabelsTR | object | yes | |
fieldHintsTR | object | no | |
widgetHints | object | no | |
hidden | array<string (/^\/[a-zA-Z0-9_/]+$/, ≤80 chars)> (≤10) | no | |
order | array<string (/^\/[a-zA-Z0-9_/]+$/, ≤80 chars)> (≤20) | no | |
selectOptions | object | no | |
panels | array<object> (≤4) | no | |
actions | array<object> (≤3) | no | |
pages | array<object> (≤3) | no | |
themeSections | array<object> (≤3) | no | |
csp | object | no | |
scriptSrc | array<string (/^https:\/\/[a-z0-9.-]+$/, ≤120 chars)> (≤4) | no | |
frameSrc | array<string (/^https:\/\/[a-z0-9.-]+$/, ≤120 chars)> (≤4) | no | |
connectSrc | array<string (/^https:\/\/[a-z0-9.-]+$/, ≤120 chars)> (≤4) | no | |
formAction | array<string (/^https:\/\/[a-z0-9.-]+$/, ≤120 chars)> (≤4) | no |
Provider kinds
The provider block is a discriminated union on kind: