Addon manifest reference

Every addon needs a manifest.json at its package root. This is the full field reference, current schema version 2.

Example

{
  "schemaVersion": 2,
  "name": "My Addon",
  "slug": "my-addon",
  "version": "1.0.0",
  "author": "Your Name",
  "description": "One-line summary shown in the Apps screen.",
  "priority": 50,
  "requires": ">=1.1.0",
  "surfaces": ["designer", "admin", "server"],
  "entrypoints": {
    "designer": "dist/my-addon.bundle.js",
    "admin": "admin-js/my-addon-admin.js",
    "server": "bootstrap.php"
  },
  "platformEntrypoints": {
    "wordpress": { "server": "bootstrap.php" }
  },
  "dependencies": [],
  "capabilities": ["designer.item-type"],
  "requiresServices": ["settings", "database", "assets"]
}

Field reference

Field	Type	Description
`schemaVersion`	number	Manifest schema version. Use `2` for new addons.
`name`	string	Human-readable name shown in the Apps & Integrations screen.
`slug`	string	Unique identifier. Must match the addon's folder name exactly — mismatches block install.
`version`	string	Semantic version of the addon package, shown to admins and used for update checks.
`author`	string	Author or vendor name, shown in the Apps screen.
`description`	string	Short description shown alongside the addon in the admin.
`priority`	number	Load order — lower loads earlier. Addons providing low-level primitives (e.g. preflight checks) should use a low number; addons that build on other addons should load later.
`requires`	string	Minimum compatible core version, e.g. `>=1.1.0`. An addon that doesn't satisfy this stays installed but is blocked from loading until the core is updated.
`surfaces`	string[]	Where the addon runs: any of `designer`, `admin`, `storefront`, `server`.
`entrypoints`	object	Exact file per declared surface. A missing entrypoint file for a declared surface blocks activation.
`platformEntrypoints`	object	Per-platform server entry, e.g. `platformEntrypoints.wordpress.server`. Lets one addon package target multiple platforms with different bootstrap files.
`dependencies`	string[]	Slugs of other addons that must also be installed and enabled. Example: `dynamic-pricing` depends on `printing-pricing`.
`capabilities`	string[]	Auditable feature flags describing what the addon does (e.g. registering a new design-item type) — used for admin visibility, not enforcement.
`requiresServices`	string[]	Declared platform services the addon needs: `settings`, `database`, `routes`, `auth`, `products`, `commerce`, `media`, `http`, `scheduler`, `sanitizer`, `translator`, `assets`, `cache`.

Package structure

plugins/my-addon/
  manifest.json
  bootstrap.php              — PHP entry point (platformEntrypoints.wordpress.server)
  dist/my-addon.bundle.js    — preferred over loose, unbundled JS files
  dist/my-addon.bundle.css
  src/                        — Vue/TS source
  hooks/                      — PHP hook registration files
  admin-js/, admin/css/       — wp-admin-only assets

Install & enable

Manual: drop the folder into plugins/{slug}/, then enable it from Apps & Integrations.
ZIP upload: admins upload one ZIP from Apps; the manifest can be at the ZIP root or one folder down.
Enabled/disabled state is stored per-site; a fresh install expands to "all discovered addons" until an admin explicitly changes it.
Uploads and state changes require admin capability and pass through CSRF protection.
Updates stage a rollback backup and revalidate the package before committing the new version.

Signing: official packages contain veyop-package.json: signing key ID, Ed25519 signature, and SHA-256 for every file. Manual upload may accept a missing signature only after the admin opts into the custom/modified warning. Invalid signatures, unknown keys, or hash mismatches always fail. Team distribution should add its public key through veyop_addon_trusted_signing_keys instead of using unsigned mode.

Origin and restore: custom addons install disabled and receive a Custom build badge. They do not receive official update prompts. To return to vendor code, download the signed ZIP from Lemon Squeezy My Orders and choose Restore official ZIP; Veyo confirms overwrite, package slug, signature, and paid entitlement before replacing files.

← Architecture overview Next: PHP hooks →