officejs-manifest-validator

CLI validator for Office.js XML add-in manifests. Runs Microsoft's official schema validation, then a static analysis pass covering things the gateway doesn't catch.

Installation

npm install -g officejs-manifest-validator

Usage

validate-manifest <manifest.xml> [options]

| Option | Default | Description | |---|---|---| | --timeout <ms> | 5000 | HTTP request timeout per URL | | --skip-urls | off | Skip URL reachability checks entirely | | --only-local | off | Only probe localhost / 127.x.x.x URLs | | --help | | Print usage |

Exit code 0 = clean (or warnings only), 1 = errors found — suitable for CI.

What it checks

Pass 1 — Microsoft schema validation

Posts the manifest to validationgateway.omex.office.net, the same endpoint used by the official office-addin-manifest validate command. If the gateway is unreachable (offline, on-prem CI), this pass degrades to a warning and the static checks still run.

Pass 2 — Static analysis

| Check | Errors on | Warns on | |---|---|---| | Resource ID integrity | resid="X" with no matching declared resource | Declared resource IDs never referenced | | Duplicate IDs | Same id= on multiple controls or groups | — | | Required fields | Missing <Id>, <Version>, <ProviderName>, <DefaultLocale>, <DisplayName>, <Description> | — | | GUID format | <Id> that isn't a valid GUID | — | | FunctionFile | ExecuteFunction buttons with no <FunctionFile>, or <FunctionFile resid> pointing to unknown resource | — | | URL reachability | External URLs returning 4xx or unreachable | localhost URLs unreachable (dev server may not be running) | | AppDomain coverage | — | External host used in resources but absent from <AppDomains> |

CI example

- name: Validate Office manifest
  run: npx officejs-manifest-validator manifest.xml --skip-urls

Notes

• Self-signed certificates on localhost are accepted.
• URL probes use HEAD requests with a concurrency of 8.
• Orphaned resource IDs (declared but unreferenced) produce a warning only — the Office host only resolves IDs that are actually referenced at runtime.

Requirements

Node.js 18 or later.

License

MIT