@helyx/module-manifest

Schemas, parsing and deterministic dependency ordering for Helyx module manifests and dashboard contributions.

Requirements

• Node.js 24–26
• npm 11 or newer

Use parseModuleManifest at trust boundaries. Invalid identifiers, versions, release stages, dependencies, settings, privacy declarations or dashboard actions are rejected before module execution. Every manifest must declare releaseStatus as planned, testing, beta or live.

Current manifest policy: v0.5

New Helyx modules use manifest v0.5. It retains the v0.4 privacy, classification and deployment policy and adds reviewed feature-level access, feature-scoped Discord capabilities and adapter risk, commandless permission operations, explicit settings mutation authority, range inputs, bounded managed-resource import, generic settings previews and managed-resource support visibility. An optional validated featureId associates individual settings, previews and managed-resource controls with a feature declared by that same v0.5 manifest.

The deployment policy remains:

• deploymentSupport: hosted, self-hosted or both;
• credentialRisk: none, low, medium, high or very-high;
• deploymentReason: an internal, non-secret explanation of at most 300 characters; and
• the v0.3 module classification fields (moduleKind, customerSelectable, countsAsInstalledModule and healthExposure).

Data-holding modules list their bounded collections and subject fields; no-data modules explicitly declare containsPersonalData: false. Parsers keep accepting v0.1 through v0.4 for compatibility; older versions do not gain or imply v0.5 feature, permission or disclosure authority. New manifests must use v0.5 and register a matching executable privacy provider through the SDK, including a zero-record provider when no personal data is held. The bot loader checks provider identity, version and declaration parity. The module-authoring guides bundled in @helyx/bot/documentation/ explain build, test and packaging requirements; exported schemas are the runtime validation contract.

Publication status

Published as a public scoped package under the Helyx Source Available Licence. Read the packaged LICENSE before installing, using, modifying, or distributing the software.