Manifest

Every plugin has a manifest.json at the root of its directory and of its .shiremod package.

{
  "id": "com.example.myplugin",
  "name": "My First Plugin",
  "version": "1.0.0",
  "author": "Developer",
  "description": "Example Shire plugin",
  "apiVersion": "1.0",
  "language": "python",
  "entrypoint": "main.py",
  "permissions": ["player.read", "ui.create", "notifications.show"],
  "dependencies": [],
  "integrity": {
    "sha256": "optional 64 hex characters"
  }
}

Fields

Field	Required	Rules
`id`	yes	`[a-z0-9][a-z0-9._-]{1,62}[a-z0-9]`; stable and unique
`name`	yes	1–96 characters
`version`	yes	1–32 characters; semantic version recommended
`author`	yes	up to 96 characters
`description`	yes	up to 512 characters
`apiVersion`	yes	`1.x` for API 1.0
`language`	yes	`python`, `node`, `javascript`, `typescript`, `dotnet`, `lua`, `executable`, `native`
`entrypoint`	yes	safe relative path; no `..`, no absolute path, no drive colon
`permissions`	yes	array of known permissions, at most 32, unique
`dependencies`	no	array of plugin ids, at most 16; checked for presence
`integrity`	no	object; `sha256` is 64 hex characters

Language and entrypoint

Language	Host launch
`python`	`python.exe <entrypoint>` (falls back to `py.exe -3`)
`node`, `javascript`, `typescript`	`node.exe <entrypoint>`
`dotnet`	`dotnet.exe <entrypoint>` (a published DLL)
`lua`	`lua.exe <entrypoint>`
`executable`, `native`	runs `<entrypoint>` directly

The Host searches PATH for interpreters. If the interpreter is missing, the plugin state becomes error with an explicit message in the Plugin Manager.

For compiled languages, language: "executable" plus a built .exe is the simplest package. The SDK templates use out/plugin.exe (C++/Rust) and publish/Plugin.dll (.NET).

Permissions

The declared set is the maximum the plugin may request. The user approves it in the Plugin Manager. The Host checks the granted subset on every call.

See Permissions and Security and the generated API reference for the current vocabulary.

Dependencies

dependencies is validated for presence by id. Version constraints, transitive resolution and conflict detection are roadmap items; declare a dependency only when the plugin actually needs another plugin to be installed. The Host does not load dependencies automatically.

Integrity

shire-plugin pack prints the SHA-256 of the whole package. The Host also stores the package hash in its registry and shows it in the Plugin Manager. integrity.sha256 is metadata for a future catalogue/signature flow; the Host does not treat it as a signature.

Versioning rules

apiVersion major must match the Host's supported major (currently 1).
Additive methods and event fields are introduced in minor API versions.
Removing or renaming a method/field requires a major API bump and a migration guide.
Plugins should call api.info, compare capabilities, and degrade gracefully rather than assuming that a newer Host has every older method.