InstallHub
Manifest Schema
The complete JSON schema for manifest.json — every field, its type, constraints, and semantic meaning.
Full manifest.json Example
{
"manifestVersion": "1.0",
"packageId": "pkg-a3f9c821-4b2e-49d1-bc44-f7e2a1c09d33",
"name": "Employee Onboarding Suite",
"packageType": "workflow-package",
"version": "2.1.0",
"description": "Complete onboarding with multi-step approval, forms, and notifications",
"author": "HR Automation Team",
"authorEmail": "hr-automation@acme.com",
"organization": "Acme Corp",
"license": "Proprietary",
"homepage": "https://wiki.acme.com/packages/onboarding",
"tags": ["hr", "onboarding", "approval"],
"exportedAt": "2026-05-25T09:00:00Z",
"exportedBy": "engineer@acme.com",
"tenantId": "tenant-7f3a9b12-...",
"platformVersion": "4.2.0",
"checksum": "sha256:3a9f1c4e8d2b7f6a1e5c9d3b0a4f8e2c7d1a6b9e3f5c8d2a0b7e4f1c9d3a6b0",
"artifacts": [
{
"type": "ProcessDefinition",
"id": "proc-1001",
"name": "EmployeeOnboarding",
"version": "2.1.0",
"file": "artifacts/workflows/proc-1001.json",
"hash": "sha256:abc123def456..."
}
],
"dependencies": [
{
"type": "ProcessDefinition",
"id": "proc-1001",
"name": "EmployeeOnboarding",
"version": "2.1.0",
"hash": "sha256:abc123def456..."
}
],
"packageDependencies": [
{
"packageName": "BizFirstGO.HRBase",
"minVersion": "1.0.0",
"maxVersion": "2.0.0"
}
],
"installOrder": ["ent-44", "rule-305", "form-2005", "thread-2002", "proc-1001"]
}Root Fields
| Field | Type | Required | Constraints |
|---|---|---|---|
manifestVersion | string | Yes | Must be "1.0" |
packageId | string (UUID format) | Yes | Globally unique — generated by the exporter |
name | string | Yes | 1–100 characters |
packageType | string enum | Yes | workflow-package | form-package | app-package | agent-package | config-package |
version | string | Yes | SemVer: major.minor.patch |
description | string | No | Max 500 characters |
author | string | No | Max 100 characters |
authorEmail | string (email) | No | Valid email format if provided |
organization | string | No | Max 100 characters |
license | string | No | SPDX identifier or "Proprietary" |
homepage | string (URL) | No | Valid HTTPS URL if provided |
tags | string[] | No | Max 10 tags, each 1–30 characters, lowercase alphanumeric with hyphens |
exportedAt | ISO 8601 datetime | Yes | UTC timezone (Z suffix) |
exportedBy | string | Yes | User identity — email or service account ID |
tenantId | string | Yes | Source tenant identifier |
platformVersion | string | Yes | BizFirstGO SemVer at export time |
checksum | string | Yes | Format: sha256:{hex64} |
artifacts | ArtifactEntry[] | Yes | Min 1 item |
dependencies | DependencyEntry[] | Yes | Same items as artifacts — for import engine validation |
packageDependencies | PackageDependency[] | Yes | Can be empty array [] |
installOrder | string[] | Yes | Topologically sorted artifact IDs — must contain all artifact IDs |
ArtifactEntry Schema
{
"type": "ProcessDefinition", // required — artifact type identifier
"id": "proc-1001", // required — artifact ID in source tenant
"name": "EmployeeOnboarding", // required — human-readable name
"version": "2.1.0", // required — artifact's own SemVer
"file": "artifacts/workflows/proc-1001.json", // required — path inside ZIP
"hash": "sha256:abc123def456..." // required — SHA-256 of this file's bytes
}DependencyEntry Schema
Same structure as ArtifactEntry, but without the file field. Used by the import engine's validation layer to cross-reference the manifest against the actual ZIP contents.
{
"type": "ProcessDefinition",
"id": "proc-1001",
"name": "EmployeeOnboarding",
"version": "2.1.0",
"hash": "sha256:abc123def456..."
}PackageDependency Schema
{
"packageName": "BizFirstGO.HRBase", // required — exact package name
"minVersion": "1.0.0", // required — minimum version (inclusive)
"maxVersion": "2.0.0" // optional — maximum version (exclusive)
}JSON Formatting Rules
The manifest JSON must follow these formatting rules for deterministic parsing:
- UTF-8 encoding, no BOM
- Object keys sorted alphabetically within each object
- No trailing commas
- No JavaScript comments
- Indented with 2 spaces (4 spaces are also accepted)
- String values: double-quoted, no single quotes
- Null values: omit the field rather than writing
null