Plugin manifest

Generated from schemas/plugin-manifest.schema.json by scripts/gen-config-docs. Do not edit this page: edit the schema or the generator.

The signed manifest shipped with an out-of-process plugin. The operator references it from usage.plugins[].manifest; the trust store decides whether the signer and the artefact are trusted.

Fields

Field Type Required Description

Field	Type	Required	Description
`schemaVersion`	integer (fixed: `1`)	yes	Manifest schema version. Always 1.
`kind`	string (one of: `extension`, `auth`)	yes	Plugin kind. auth requires the trust store to allow auth modules; extensions cover routes, injection, events and transforms.
`name`	string	yes	Reverse-DNS plugin name. Must match a trust store allowedNames entry (exact or glob). Minimum length: 1.
`version`	string	yes	Plugin version (semantic version recommended). Minimum length: 1.
`apiVersion`	string	yes	Plugin API version implemented by the artefact (currently v1). Minimum length: 1.
`hostAPI`	string	yes	Host API constraint, for example >=1.0 <2.0 or *. Compared with the trust store coreVersion. Minimum length: 1.
`publisher`	string	no	Optional publisher identity.
`keyId`	string	yes	Signing key id; must exist in the trust store keys map. Minimum length: 1.
`artifact`	object	yes	The signed artefact (binary, container or OCI reference). Its digest is verified before the plugin is trusted.
`dependencies`	array of object	no	Other artefacts this plugin depends on. Each digest must be allow-listed in the trust store.
`capabilities`	array of string (one of: `events`, `inject`, `auth`)	no	Declared capabilities. An extension cannot declare auth; events requires the events capability.
`licenseFeature`	string	no	Optional commercial licence feature required to load this plugin. The host refuses the plugin when the feature is absent.
`events`	object	no	Usage-event subscription. Only these types are produced for this plugin.
`signature`	object	yes	Ed25519 signature over the canonical manifest with signature zeroed, plus the artefact digest.

schemaVersion

integer (fixed: 1)

yes

Manifest schema version. Always 1.

kind

string (one of: extension, auth)

yes

Plugin kind. auth requires the trust store to allow auth modules; extensions cover routes, injection, events and transforms.

name

string

yes

Reverse-DNS plugin name. Must match a trust store allowedNames entry (exact or glob). Minimum length: 1.

version

string

yes

Plugin version (semantic version recommended). Minimum length: 1.

apiVersion

string

yes

Plugin API version implemented by the artefact (currently v1). Minimum length: 1.

hostAPI

string

yes

Host API constraint, for example >=1.0 <2.0 or *. Compared with the trust store coreVersion. Minimum length: 1.

publisher

string

Optional publisher identity.

keyId

string

yes

Signing key id; must exist in the trust store keys map. Minimum length: 1.

artifact

object

yes

The signed artefact (binary, container or OCI reference). Its digest is verified before the plugin is trusted.

dependencies

array of object

Other artefacts this plugin depends on. Each digest must be allow-listed in the trust store.

capabilities

array of string (one of: events, inject, auth)

Declared capabilities. An extension cannot declare auth; events requires the events capability.

licenseFeature

string

Optional commercial licence feature required to load this plugin. The host refuses the plugin when the feature is absent.

events

object

Usage-event subscription. Only these types are produced for this plugin.

signature

object

yes

Ed25519 signature over the canonical manifest with signature zeroed, plus the artefact digest.

artifact

The signed artefact (binary, container or OCI reference). Its digest is verified before the plugin is trusted.

Field Type Required Description

Field	Type	Required	Description
`type`	string	yes	Artefact type: binary, container or OCI reference.
`digest`	string	yes	sha256 digest of the artefact. Verified before the plugin is trusted. Pattern: `^sha256:[a-fA-F0-9]{64}$`.
`size`	integer	no	Optional artefact size in bytes. Verified when non-zero. Minimum: 0.
`platform`	string	no	Optional platform selector, for example linux/amd64.

type

string

yes

Artefact type: binary, container or OCI reference.

digest

string

yes

sha256 digest of the artefact. Verified before the plugin is trusted. Pattern: ^sha256:[a-fA-F0-9]{64}$.

size

integer

Optional artefact size in bytes. Verified when non-zero. Minimum: 0.

platform

string

Optional platform selector, for example linux/amd64.

dependencies

Field Type Required Description

Field	Type	Required	Description
`name`	string	yes	Dependency name.
`version`	string	yes	Dependency version.
`digest`	string	yes	Dependency artefact digest; must match the trust store allowedDependencies entry. Pattern: `^sha256:[a-fA-F0-9]{64}$`.
`signer`	string	no	Optional signer identity.

name

string

yes

Dependency name.

version

string

yes

Dependency version.

digest

string

yes

Dependency artefact digest; must match the trust store allowedDependencies entry. Pattern: ^sha256:[a-fA-F0-9]{64}$.

signer

string

Optional signer identity.

events

Usage-event subscription. Only these types are produced for this plugin.

Field Type Required Description

Field	Type	Required	Description
`types`	array of string (one of: `request`, `auth`, `error`, `billing`, `audit`)	yes	Subscribed event types; each must also be configured in usage.types.
`filters`	object	no	Narrow the subscription. Empty fields mean all.
`maxLagBytes`	integer	no	Maximum lag before backpressure applies. Default: the type share. Minimum: 0.
`onMaxLag`	string (one of: `block`, `drop`)	no	Backpressure policy. block answers affected routes with 503 until the plugin catches up; drop advances the cursor to the lag limit and marks the plugin degraded.

types

array of string (one of: request, auth, error, billing, audit)

yes

Subscribed event types; each must also be configured in usage.types.

filters

object

Narrow the subscription. Empty fields mean all.

maxLagBytes

integer

Maximum lag before backpressure applies. Default: the type share. Minimum: 0.

onMaxLag

string (one of: block, drop)

Backpressure policy. block answers affected routes with 503 until the plugin catches up; drop advances the cursor to the lag limit and marks the plugin degraded.

events.filters

Narrow the subscription. Empty fields mean all.

Field Type Required Description

Field	Type	Required	Description
`hosts`	array of string	no	Request hosts or glob patterns (e.g. app.example.com, *.example.com).
`routes`	array of string	no	Route patterns, for example /api/*.
`tenants`	array of string	no	Tenant or provider ids.
`methods`	array of string	no	HTTP methods.
`statusClasses`	array of string (one of: `1xx`, `2xx`, `3xx`, `4xx`, `5xx`)	no	HTTP status classes.
`sampleRate`	number	no	Sampling rate for matching events. Default 1.0. Minimum: 0. Maximum: 1.

hosts

array of string

Request hosts or glob patterns (e.g. app.example.com, *.example.com).

routes

array of string

Route patterns, for example /api/*.

tenants

array of string

Tenant or provider ids.

methods

array of string

HTTP methods.

statusClasses

array of string (one of: 1xx, 2xx, 3xx, 4xx, 5xx)

HTTP status classes.

sampleRate

number

Sampling rate for matching events. Default 1.0. Minimum: 0. Maximum: 1.

signature

Ed25519 signature over the canonical manifest with signature zeroed, plus the artefact digest.

Field Type Required Description

Field	Type	Required	Description
`alg`	string (fixed: `ed25519`)	yes	Signature algorithm. Always ed25519.
`keyId`	string	yes	Must equal the manifest keyId.
`value`	string	yes	base64url (unpadded) Ed25519 signature over the canonical manifest plus the artefact digest.

alg

string (fixed: ed25519)

yes

Signature algorithm. Always ed25519.

keyId

string

yes

Must equal the manifest keyId.

value

string

yes

base64url (unpadded) Ed25519 signature over the canonical manifest plus the artefact digest.