Package format
Canonical manifests, package exports, capability resources and lineage.
Custom plugin authoring uses craven.plugin.yaml at the package root. This is the package-level declaration; runtime code must also export the corresponding executable interfaces.
Package layout
craven.plugin.yaml
package.json # when runtime code is needed
src/index.ts # runtime implementation
skills/orders-review/SKILL.md # when a skill is bundledKeep one canonical package manifest. The authoring validator rejects a root manifest.json and .claude-plugin/plugin.json. Bundled skill paths must exist and their files need valid YAML frontmatter with a description.
Manifest fields
| Field | Purpose |
|---|---|
name | Required package identity |
packageName or package | Package identifier; defaults to name in the parser |
version | Artifact version |
displayName, description | Reader-facing identity and purpose |
author.name, author.url | Publisher information |
capabilities | Capability keys, kinds, contracts and entrypoints |
Each capability has a unique meaningful key, kind, display name and description. Executable capabilities name their runtimeEntrypoint; resource-based skills use resourcePath. A transform additionally declares top-level lineage.mode.
Contracts can use a schema or the supported fields shorthand, but not both on the same contract. Use complete nested schemas where required rather than inventing undocumented shorthand. See a minimal skill package for a complete resource-only example.
Runtime package
When code is needed, include package.json and its actual dependencies. Export the built entry using the package’s exports or main configuration. The runtime declaration is named cravenPlugin with kind: plugin, apiVersion: 1 and the executable capability declarations.
The sandbox validator resolves the package entry from exports, main or the default dist/index.js path and inspects the runtime. Declaring an entry file that is absent or exporting only metadata does not implement the capability.
Include build, typecheck and behavior tests appropriate to the runtime. Dependency installation and declared validation commands run inside the authoring sandbox; inspect their real output before publishing.
Assets and versions
Published packages are stored as asset-package artifacts with a content hash and artifact version. Catalog indexing creates capability and contract records. Installing selects a published artifact version and configured capabilities; editing an installation’s credentials is different from publishing new code.
FAQ
Does a connector manifest alone implement a plugin?
No. It describes inputs and supported behavior. Executable exports, file resources and dependency/build output must exist and match the declaration.
Can I put credentials in the package?
Put them in protected installation configuration or supported secret references. Package artifacts, skills and tests should not contain real credentials.