Packages and manifests
Every immediate child directory under the script root is treated as a
possible package. A package must contain manifest.json.
Manifest fields
| Field | Type | Required | Meaning |
|---|---|---|---|
id | string | yes | Stable, unique package identifier. |
name | string | yes | Name shown in the Scripts workspace. |
version | string | yes | Semantic package version. |
apiVersion | integer | yes | FumoEngine API version. Currently 1. |
entry | string | yes | Package-relative .js or .mjs entry file. |
description | string | no | Human-readable package summary. |
author | string | no | Package author. |
capabilities | string[] | yes | Host features requested by the package. |
dependencies | object | no | Package IDs mapped to semantic version ranges. |
assets | string[] | no | Files decoded and cached before entry evaluation. |
http.hosts | string[] | no | Exact or wildcard hosts allowed for HTTP. |
Paths are canonicalized before loading. Symlinked package directories, absolute paths, and paths escaping the package root are rejected.
Capabilities
Capabilities declare what a package intends to use. Common capabilities are
console, events, draw, trace, input.write, assets, sound,
http, and ffi.
FFI requires both a manifest request:
{
"capabilities": ["console", "ffi"]
}
and Settings > Script Engine > Insecure scripting.
Dependencies
Dependencies load before their consumers. Supported ranges include exact
versions, *, caret and tilde ranges, and whitespace-separated comparators:
{
"dependencies": {
"author.common-library": "^1.2.0",
"author.protocol": ">=2.0.0 <3.0.0"
}
}
Missing, disabled, incompatible, and cyclic dependencies keep the consumer unloaded and put a specific reason in its Scripts workspace status.
Assets and HTTP
Every file used through fumo:assets or fumo:sound must be declared:
{
"assets": [
"images/marker.png",
"sounds/notify.wav",
"data/presets.json"
],
"http": {
"hosts": ["api.example.com", "*.static.example.com"]
}
}
The runtime preloads declared assets before entry evaluation. Safe mode only permits HTTPS.