Plugin manifest reference

Use kind: "extension" and JSON syntax. The registry exposes the kind-specific schema; the SDK’s parsePluginManifest adds semantic checks that JSON Schema cannot express.

Example

This is a contract fixture. The example image and digest are placeholders, not a published or installable plugin. Replace them with an actual immutable artifact before publication.

{
  "name": "project-notes",
  "version": "1.0.0",
  "kind": "extension",
  "description": "Scoped project notes",
  "protocolVersion": 1,
  "sdkVersion": 1,
  "dataProtocolVersion": 1,
  "coreVersion": ">=0.1.0 <1.0.0",
  "image": "registry.example.com/plugins/notes@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
  "dependencies": [],
  "capabilities": [
    "project.read",
    "plugin.data.read",
    "plugin.data.write"
  ],
  "schemaVersion": 1,
  "readableSchema": {
    "min": 1,
    "max": 1
  },
  "migrations": [],
  "tables": [],
  "services": {
    "required": [
      {
        "name": "data",
        "version": 1
      }
    ],
    "optional": []
  },
  "configuration": {
    "type": "object",
    "properties": {},
    "additionalProperties": false
  },
  "actions": [
    {
      "name": "notes.read",
      "intent": "read",
      "capabilities": [
        "plugin.data.read"
      ]
    },
    {
      "name": "notes.write",
      "intent": "write",
      "capabilities": [
        "plugin.data.write"
      ]
    }
  ],
  "jobs": [
    {
      "name": "notes.maintenance",
      "intervalSeconds": 60,
      "capabilities": [
        "plugin.data.write"
      ]
    }
  ],
  "navigation": [],
  "slots": [],
  "events": [],
  "secrets": [],
  "httpBindings": []
}

Required runtime fields

All fields below live at the manifest root alongside name, version and kind. Empty arrays are valid where a plugin declares no corresponding feature.

Field	Contract
`protocolVersion`, `sdkVersion`, `dataProtocolVersion`	Each is exactly `1`.
`coreVersion`	Valid SemVer range for the Webdock core.
`image`	OCI image reference pinned with `@sha256:` and 64 lowercase hexadecimal characters. Mutable tags are rejected.
`dependencies`	Up to 32 distinct `{id, version}` entries with exact SemVer versions; no self-dependency.
`capabilities`	Explicit names from the capability catalog below; no duplicates.
`schemaVersion`	Positive integer for plugin-owned relational data.
`readableSchema`	`{min, max}` inclusive range containing `schemaVersion`.
`migrations`	Ordered, contiguous, checksummed declarative steps; required through the current version when tables are declared.
`tables`	Declared columns, keys, indexes and foreign keys; at most 32 tables.
`services`	`required` and `optional` arrays of `{name, version: 1}`; no repeated service across either list.
`configuration`	Bounded JSON Schema using the SDK-supported subset. No remote references or executable extensions.
`actions`	Named `read` or `write` operations with declared capabilities and optional input/output schemas.
`jobs`	Named jobs; scheduled jobs have `intervalSeconds` of at least 60.
`navigation`	Named entries with labels and relative `/ui/...` paths.
`slots`	Typed UI contributions, order, relative UI path and capabilities.
`events`	Named versioned schemas with handlers that reference declared jobs.
`secrets`, `httpBindings`	Binding names only; never secret values or arbitrary host destinations.

Service names: project, data, db, cache, jobs, events, storage, secrets, http, audit, log. UI slots: project.overview.panel, project.actions, operator.plugin.settings. Paths cannot contain traversal, query strings or external origins.

Capabilities

Area	Names
Project	`project.read`
Documents	`plugin.data.read`, `plugin.data.write`
Relational data	`plugin.db.read`, `plugin.db.write`
Cache	`plugin.cache.read`, `plugin.cache.write`
Jobs	`plugin.jobs.read`, `plugin.jobs.enqueue`, `plugin.jobs.cancel`
Events	`plugin.events.emit`, `plugin.events.subscribe`
Objects	`plugin.storage.read`, `plugin.storage.write`
Secret bindings	`plugin.secrets.read`
HTTP bindings	`plugin.http.read`, `plugin.http.request`
Audit	`plugin.audit.emit`

An action, job or UI slot may request only capabilities declared by its plugin. Read actions cannot request mutation capabilities. Capabilities in a manifest are requests, not grants; host authorization still depends on the installation, actor and customer/project scope.

Data migrations

The v1 contract allows createTable, addNullableColumn, createIndex and addForeignKey. Checksums are SHA-256 hexadecimal values. Migration versions must start at 1 and remain contiguous; tables must agree with declared key columns and foreign-key targets. Arbitrary SQL, executable migration code, destructive schema changes and backfills are outside this contract.

Validation and trust

The registry schema validates structure and preserves the declared extension. The Webdock SDK additionally checks SemVer ranges, dependency uniqueness, readable-schema compatibility, migration ordering, capability relationships, event handlers and key references. Passing the registry validator is necessary but insufficient for host admission. The planned host installer verifies the signed release identity, manifest and descriptor hashes, selected asset size and image digest against operator-established trust. The public signing key is at https://registry.webdock.dev/.well-known/registry-key.json; fetching that key alone does not establish trust. Catalog metadata, publication approval and an MCP login do not activate a runtime. See current implementation status.

Integrations

Mail

Plugins

Operate Webdock

Contribute

Plugin manifest reference

Example

Required runtime fields

Capabilities

Data migrations

Validation and trust

​Example

​Required runtime fields

​Capabilities

​Data migrations

​Validation and trust

Example

Required runtime fields

Capabilities

Data migrations

Validation and trust