Manifest Reference
Field-by-field reference for xema-biome.json, generated directly from the platform manifest schema so it can never drift from what the biome host actually validates. The manifest is the wrapped { "name", "version", "xema": { … } } shape; everything under xema is discriminated on xema.target (server or web).
For the narrative guide — folder layout, worked examples, validation workflow — read Authoring first.
Top-level shape
The manifest tolerates extra top-level fields (it doubles as an npm package.json-adjacent file), but validates these:
| Field | Type | Required | Notes |
|---|
name | string | yes | pattern /^@[^/]+\/[^/]+$/ |
version | string | yes | — |
xema | object (discriminated on target) — see Server biomes below, Web biomes below | yes | — |
Server biomes (xema.target: "server")
A server biome ships backend contributions — agents, skills, workflows, optional API services — that the biome host boots and supervises.
| Field | Type | Required | Notes |
|---|
id | string | yes | pattern /^[a-z][a-z0-9-]*$/ |
displayName | string | yes | — |
description | string | no | — |
display | object — see xema.display | no | — |
scope | enum | yes | one of: kernel, system, base, platform |
target | literal "server" | yes | — |
capabilityDomain | string | no | pattern /^[a-z][a-z0-9-]*$/ |
components | array of objects — see xema.components[] | yes | — |
dependencies | string[] | no | entries: pattern /^[a-z][a-z0-9-]*$/ |
extends | string | string[] | no | — |
trustTier | enum | no | one of: first-party, third-party |
connectorRequirements | array of objects — see xema.connectorRequirements[] | no | — |
eventNamespaces | string[] | no | entries: max 256 chars; entries: pattern /^[a-z0-9][a-z0-9_-]*(?:\.[a-z0-9][a-z0-9_-]*)*$/ |
sharedEventTypes | string[] | no | entries: max 256 chars; entries: pattern /^[a-z0-9][a-z0-9_-]*(?:\.[a-z0-9][a-z0-9_-]*)*$/ |
provisioning | array of objects — see xema.provisioning[] | no | — |
signature | object — see xema.signature | no | — |
bundleSource | object (discriminated on kind) — see xema.bundleSource (kind: "npm"), xema.bundleSource (kind: "tarball"), xema.bundleSource (kind: "oci") | no | — |
signedBy | string | no | — |
contributions | object — see xema.contributions | no | — |
requiresCapabilities | string[] | no | entries: pattern /^[a-z][a-z0-9-]*:[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)*@\d+$/ |
requiresCapabilitiesForAgents | string[] | no | entries: pattern /^[a-z][a-z0-9-]*:[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)*@\d+$/ |
requiresCapabilitiesForService | string[] | no | entries: pattern /^[a-z][a-z0-9-]*:[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)*@\d+$/ |
exposesCapabilities | string[] | no | entries: pattern /^[a-z][a-z0-9-]*:[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)*@\d+$/ |
ownsCapabilityDomains | string[] | no | entries: pattern /^[a-z][a-z0-9-]*$/ |
workflowConfig | object — see xema.workflowConfig | no | — |
audience | enum | no | one of: org, operator |
storeListed | boolean | no | — |
kind | enum | no | one of: app, connector, library |
xema.display
| Field | Type | Required | Notes |
|---|
icon | string | no | — |
category | string | no | — |
summary | string | no | — |
accent | string | no | — |
xema.components[]
| Field | Type | Required | Notes |
|---|
key | string | yes | pattern /^[a-z][a-z0-9-]*$/ |
kind | enum | yes | one of: content, web, adapter, service, worker, job |
artifact | object (discriminated on kind) — see xema.components[].artifact (kind: "package-content"), xema.components[].artifact (kind: "web-bundle"), xema.components[].artifact (kind: "host-module"), xema.components[].artifact (kind: "oci-image"), xema.components[].artifact (kind: "shared-oci-image") | yes | — |
entrypoint | object (discriminated on kind) — see xema.components[].entrypoint (kind: "materialize"), xema.components[].entrypoint (kind: "static-bundle"), xema.components[].entrypoint (kind: "module-export"), xema.components[].entrypoint (kind: "oci-default"), xema.components[].entrypoint (kind: "node-module") | yes | — |
protocol | object (discriminated on kind) — see xema.components[].protocol (kind: "none"), xema.components[].protocol (kind: "web"), xema.components[].protocol (kind: "adapter"), xema.components[].protocol (kind: "http"), xema.components[].protocol (kind: "worker"), xema.components[].protocol (kind: "job") | yes | — |
hostAbi | object — see xema.components[].hostAbi | no | — |
scheduler | enum | no | one of: platform, runtime |
installationClass | enum | no | one of: core, agentic, optional |
processFacts | object — see xema.components[].processFacts | no | — |
dispatchesRuntimeComponents | array of objects — see xema.components[].dispatchesRuntimeComponents[] | object — see xema.components[].dispatchesRuntimeComponents[] | no | — |
callsRuntimeComponents | array of objects — see xema.components[].dispatchesRuntimeComponents[] | no | — |
requiresOperations | string[] | no | entries: max 128 chars; entries: pattern /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*:[a-z][a-z0-9]*(?:[-.][a-z0-9]+)*@[1-9][0-9]{0,3}$/ |
hostCapabilities | string[] | no | entries: pattern /^[a-z][a-z0-9-]*:[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)*@\d+$/ |
requiresWorkloadPrivileges | enum[] | no | entries one of: mintWorkerContexts, createUserDelegations, createOrgDelegations, createEphemeralUserDelegations |
deployPlaneOperations | string[] | no | entries: max 128 chars; entries: pattern /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*:[a-z][a-z0-9]*(?:[-.][a-z0-9]+)*@[1-9][0-9]{0,3}$/ |
delegationHolderRole | enum | no | one of: armed-tool-relay |
requiresAudiences | string[] | no | entries: max 128 chars; entries: pattern /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*(?:\.[a-z][a-z0-9]*(?:-[a-z0-9]+)*)+\.v[1-9][0-9]{0,3}$/ |
ownsAudienceNamespaces | string[] | no | entries: max 128 chars; entries: pattern /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*(?:\.[a-z][a-z0-9]*(?:-[a-z0-9]+)*)*$/ |
hookPoints | array of objects — see xema.components[].hookPoints[] | no | — |
optionalOperations | string[] | no | entries: max 128 chars; entries: pattern /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*:[a-z][a-z0-9]*(?:[-.][a-z0-9]+)*@[1-9][0-9]{0,3}$/ |
callsBackOperationHolders | string[] | no | entries: max 128 chars; entries: pattern /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*:[a-z][a-z0-9]*(?:[-.][a-z0-9]+)*@[1-9][0-9]{0,3}$/ |
requestsInstalledOperations | string[] | no | entries: max 128 chars; entries: pattern /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*:[a-z][a-z0-9]*(?:[-.][a-z0-9]+)*@[1-9][0-9]{0,3}$/ |
requestsOnBehalfOfOperations | string[] | no | entries: max 128 chars; entries: pattern /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*:[a-z][a-z0-9]*(?:[-.][a-z0-9]+)*@[1-9][0-9]{0,3}$/ |
subscribesEvents | array of objects — see xema.components[].subscribesEvents[] | no | max 32 entries |
requiresOrganizationSweeps | enum[] | no | entries one of: erase-sweep, org-erasure, app-erasure, index-maintenance, connector-secret-custody, credential-refresh, connection-health-probe, member-notification, ended-holder-erasure, scm-project-binding-maintenance, contribution-convergence, retention-expiry-erasure, installation-cleanup, capability-catalogue-evaluation, workspace-allocation-maintenance, notification-self-heal, release-plane-reconciliation, workflow-run-evaluation, connector-delivery-evaluation, scheduled-automation-tick, workflow-blob-custody |
editionInputs | enum[] | no | entries one of: capability-domain-owners, artifact-signer-trust |
imageClass | enum | no | one of: common, privileged, web-access |
executionModes | enum[] | yes | entries one of: materialized, web-hosted, shared-host, composed, isolated, runner |
requirements | object — see xema.components[].requirements | yes | — |
xema.connectorRequirements[]
| Field | Type | Required | Notes |
|---|
adapterKind | string | yes | pattern /^[a-z][a-z0-9-]*$/ |
optional | boolean | no | — |
purpose | string | yes | — |
capabilities | string[] | yes | entries: pattern /^[a-z]+(\.[a-z][a-z0-9-]*)+$/ |
xema.provisioning[]
| Field | Type | Required | Notes |
|---|
id | string | yes | pattern /^[a-z][a-z0-9-]*$/ |
kind | enum | yes | one of: scaffold, equip |
triggers | enum[] | yes | entries one of: workspace-boot, runtime-request |
guard | enum | yes | one of: repo_empty, path_absent, marker_absent, always |
selector | object — see xema.provisioning[].selector | yes | — |
xema.signature
| Field | Type | Required | Notes |
|---|
algorithm | string | yes | — |
value | string | yes | — |
keyId | string | yes | — |
xema.bundleSource (kind: "npm")
| Field | Type | Required | Notes |
|---|
kind | literal "npm" | yes | — |
name | string | yes | — |
version | string | yes | — |
registryUrl | string | no | — |
authTokenEnv | string | no | — |
integrity | string | no | pattern `/^sha(256 |
xema.bundleSource (kind: "tarball")
| Field | Type | Required | Notes |
|---|
kind | literal "tarball" | yes | — |
uploadId | string | yes | — |
expectedSha256 | string | no | pattern /^[a-f0-9]{64}$/ |
xema.bundleSource (kind: "oci")
| Field | Type | Required | Notes |
|---|
kind | literal "oci" | yes | — |
ociRef | string | yes | — |
xema.contributions
| Field | Type | Required | Notes |
|---|
inline | array of objects — see xema.contributions.inline[] | no | — |
xema.workflowConfig
| Field | Type | Required | Notes |
|---|
runAs | string | yes | pattern /^[a-z][a-z0-9-]*$/ |
xema.components[].artifact (kind: "package-content")
| Field | Type | Required | Notes |
|---|
kind | literal "package-content" | yes | — |
path | string | yes | — |
xema.components[].artifact (kind: "web-bundle")
| Field | Type | Required | Notes |
|---|
kind | literal "web-bundle" | yes | — |
path | string | yes | — |
xema.components[].artifact (kind: "host-module")
| Field | Type | Required | Notes |
|---|
kind | literal "host-module" | yes | — |
path | string | yes | — |
xema.components[].artifact (kind: "oci-image")
| Field | Type | Required | Notes |
|---|
kind | literal "oci-image" | yes | — |
path | string | yes | — |
xema.components[].artifact (kind: "shared-oci-image")
| Field | Type | Required | Notes |
|---|
kind | literal "shared-oci-image" | yes | — |
component | string | yes | pattern /^[a-z][a-z0-9-]*$/ |
xema.components[].entrypoint (kind: "materialize")
| Field | Type | Required | Notes |
|---|
kind | literal "materialize" | yes | — |
xema.components[].entrypoint (kind: "static-bundle")
| Field | Type | Required | Notes |
|---|
kind | literal "static-bundle" | yes | — |
root | string | yes | — |
xema.components[].entrypoint (kind: "module-export")
| Field | Type | Required | Notes |
|---|
kind | literal "module-export" | yes | — |
module | string | yes | — |
exportName | string | yes | — |
xema.components[].entrypoint (kind: "oci-default")
| Field | Type | Required | Notes |
|---|
kind | literal "oci-default" | yes | — |
xema.components[].entrypoint (kind: "node-module")
| Field | Type | Required | Notes |
|---|
kind | literal "node-module" | yes | — |
module | string | yes | — |
xema.components[].protocol (kind: "none")
| Field | Type | Required | Notes |
|---|
kind | literal "none" | yes | — |
xema.components[].protocol (kind: "web")
| Field | Type | Required | Notes |
|---|
kind | literal "web" | yes | — |
revision | string | yes | pattern /^v[1-9]\d*$/ |
xema.components[].protocol (kind: "adapter")
| Field | Type | Required | Notes |
|---|
kind | literal "adapter" | yes | — |
revision | string | yes | pattern /^v[1-9]\d*$/ |
xema.components[].protocol (kind: "http")
| Field | Type | Required | Notes |
|---|
kind | literal "http" | yes | — |
revision | string | yes | pattern /^v[1-9]\d*$/ |
serviceName | string | yes | pattern /^[a-z][a-z0-9-]*$/ |
displayName | string | no | — |
description | string | no | — |
basePath | string | no | pattern /^\// |
openapi | string | no | — |
authScopes | enum[] | yes | entries one of: public, org, project, installation |
requiresServices | string[] | no | — |
optionalServices | string[] | no | — |
exposesCapabilities | string[] | no | — |
capabilities | array of objects — see xema.components[].protocol.capabilities[] | no | — |
databaseKey | string | no | pattern /^[a-z][a-z0-9-]*$/ |
databaseExtensions | string[] | no | entries: max 63 chars; entries: pattern /^[a-z_][a-z0-9_-]*$/ |
resources | array of objects — see xema.components[].protocol.resources[] | no | — |
providesResources | array of objects — see xema.components[].protocol.providesResources[] | no | — |
workflowClientOf | array of objects — see xema.components[].protocol.workflowClientOf[] | no | — |
identity | object — see xema.components[].protocol.identity | no | — |
browserSession | object — see xema.components[].protocol.browserSession | no | — |
xema.components[].protocol (kind: "worker")
| Field | Type | Required | Notes |
|---|
kind | literal "worker" | yes | — |
requiresServices | string[] | no | — |
optionalServices | string[] | no | — |
resources | array of objects — see xema.components[].protocol.resources[] | no | — |
providesResources | array of objects — see xema.components[].protocol.providesResources[] | no | — |
revision | literal "v2" | yes | — |
taskQueues | array of objects — see xema.components[].protocol.taskQueues[] | yes | — |
nexus | object — see xema.components[].protocol.nexus | no | — |
xema.components[].protocol (kind: "job")
| Field | Type | Required | Notes |
|---|
kind | literal "job" | yes | — |
revision | string | yes | pattern /^v[1-9]\d*$/ |
xema.components[].hostAbi
| Field | Type | Required | Notes |
|---|
name | enum | yes | one of: xema-web-host, xema-adapter-host, xema-service-host, xema-worker-runtime, xema-job-runner |
versionRange | string | yes | — |
xema.components[].processFacts
| Field | Type | Required | Notes |
|---|
exclusive | object — see xema.components[].processFacts.exclusive | no | — |
credentialCustody | literal true | no | — |
foreignCodeExecution | literal true | no | — |
governedEgressEdge | literal true | no | — |
publicIngressEdge | literal true | no | — |
ownWorkloadIdentity | literal true | no | — |
reachableAlone | literal true | no | — |
xema.components[].dispatchesRuntimeComponents[]
| Field | Type | Required | Notes |
|---|
biomeId | string | yes | pattern /^[a-z][a-z0-9-]*$/ |
componentKey | string | yes | pattern /^[a-z][a-z0-9-]*$/ |
xema.components[].dispatchesRuntimeComponents[]
| Field | Type | Required | Notes |
|---|
supplementalRuntimeComponentId | string | yes | pattern /^[a-z0-9](?:[a-z0-9._-]{0,254}[a-z0-9])?$/ |
xema.components[].hookPoints[]
| Field | Type | Required | Notes |
|---|
id | string | yes | max 200 chars; pattern /^[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*)*$/ |
operation | string | yes | max 200 chars; pattern /^[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*)*$/ |
modes | array of objects — see xema.components[].hookPoints[].modes[] | yes | — |
writableFields | string[] | yes | entries: min length 2; entries: max 1024 chars |
inputProjection | string[] | yes | entries: min length 2; entries: max 1024 chars |
participation | enum[] | yes | entries one of: required, optional |
limits | object — see xema.components[].hookPoints[].limits | yes | — |
respond | object — see xema.components[].hookPoints[].respond | no | — |
reentry | object — see xema.components[].hookPoints[].reentry | no | — |
concurrencyScope | enum | no | one of: tenant, lineage |
bindingsRefused | object — see xema.components[].hookPoints[].bindingsRefused | no | — |
xema.components[].subscribesEvents[]
| Field | Type | Required | Notes |
|---|
types | string | string[] | yes | max 64 entries |
tiers | enum[] | yes | max 4 entries; entries one of: internal, project, user, public |
scope | object (discriminated on kind) — see xema.components[].subscribesEvents[].scope (kind: "org"), xema.components[].subscribesEvents[].scope (kind: "realm") | yes | — |
addressed | literal true | no | — |
required | literal true | no | — |
xema.components[].requirements
| Field | Type | Required | Notes |
|---|
tenancy | object — see xema.components[].requirements.tenancy | yes | — |
isolation | object — see xema.components[].requirements.isolation | yes | — |
trust | object — see xema.components[].requirements.trust | yes | — |
locality | object — see xema.components[].requirements.locality | yes | — |
state | object (discriminated on kind) — see xema.components[].requirements.state (kind: "stateless"), xema.components[].requirements.state (kind: "ephemeral"), xema.components[].requirements.state (kind: "durable") | yes | — |
resources | object — see xema.components[].requirements.resources | yes | — |
runtime | object — see xema.components[].requirements.runtime | yes | — |
io | object — see xema.components[].requirements.io | yes | — |
scaling | object — see xema.components[].requirements.scaling | yes | — |
xema.provisioning[].selector
| Field | Type | Required | Notes |
|---|
configPointer | string | yes | — |
matchKind | enum | yes | one of: each-app-target |
xema.contributions.inline[]
| Field | Type | Required | Notes |
|---|
kind | string | yes | — |
id | string | yes | pattern /^[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9][a-z0-9._-]*)*$/ |
manifest | unknown (free-form JSON) | yes | — |
xema.components[].protocol.capabilities[]
| Field | Type | Required | Notes |
|---|
protocol | string | yes | pattern /^[a-z0-9][a-z0-9.-]*\/[a-z0-9][a-z0-9._-]*$/ |
revision | string | yes | — |
operations | string[] | yes | entries: pattern /^[a-z][a-z0-9._-]*$/ |
references | string[] | no | — |
endpointProtocols | enum[] | no | entries one of: http, grpc, event-hub, mcp |
xema.components[].protocol.resources[]
| Field | Type | Required | Notes |
|---|
kind | string | yes | max 128 chars; pattern /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*(?:\.[a-z][a-z0-9]*(?:-[a-z0-9]+)*)+$/ |
logicalName | string | yes | max 63 chars; pattern /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/ |
scope | enum | yes | one of: system, org |
inclusion | enum | yes | one of: required, optional |
sharing | enum | no | one of: owner, shared |
whyNotOrgScoped | string | no | — |
capabilities | string[] | no | entries: pattern /^[a-z][a-z0-9-]*:[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)*@\d+$/ |
xema.components[].protocol.providesResources[]
| Field | Type | Required | Notes |
|---|
kind | string | yes | max 128 chars; pattern /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*(?:\.[a-z][a-z0-9]*(?:-[a-z0-9]+)*)+$/ |
xema.components[].protocol.workflowClientOf[]
| Field | Type | Required | Notes |
|---|
biome | string | no | pattern /^[a-z][a-z0-9-]*$/ |
component | string | yes | pattern /^[a-z][a-z0-9-]*$/ |
taskQueue | string | object — see xema.components[].protocol.workflowClientOf[].taskQueue | yes | — |
xema.components[].protocol.identity
| Field | Type | Required | Notes |
|---|
applications | string[] | no | entries: pattern /^[a-z][a-z0-9-]{0,62}$/ |
xema.components[].protocol.browserSession
| Field | Type | Required | Notes |
|---|
cookies | string[] | yes | entries: pattern /^[A-Za-z0-9!#$%&'*+\-.^_ |
operations | array of objects — see xema.components[].protocol.browserSession.operations[] | no | — |
xema.components[].protocol.taskQueues[]
| Field | Type | Required | Notes |
|---|
name | string | yes | — |
placement | enum | no | one of: execution-target |
serves | enum[] | yes | entries one of: workflows, activities, nexus |
fairness | enum | yes | one of: org, none |
xema.components[].protocol.nexus
| Field | Type | Required | Notes |
|---|
provides | array of objects — see xema.components[].protocol.nexus.provides[] | no | — |
requires | array of objects — see xema.components[].protocol.nexus.requires[] | no | — |
xema.components[].processFacts.exclusive
| Field | Type | Required | Notes |
|---|
reason | string | yes | min length 20 |
xema.components[].hookPoints[].modes[]
| Field | Type | Required | Notes |
|---|
mode | enum | yes | one of: admit, transform, defer, respond |
actionKinds | enum[] | yes | entries one of: capability, workflow, function |
xema.components[].hookPoints[].limits
| Field | Type | Required | Notes |
|---|
maxFanOut | number | yes | integer; min 1; max 256 |
maxPayloadBytes | number | yes | integer; min 1; max 1048576 |
maxConcurrency | number | yes | integer; min 1; max 64 |
deadlineMs | number | yes | integer; min 1; max 60000 |
xema.components[].hookPoints[].respond
| Field | Type | Required | Notes |
|---|
responseSchemaId | string | yes | max 200 chars; pattern /^[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*)*$/ |
maxResponseBytes | number | yes | integer; min 1; max 1048576 |
xema.components[].hookPoints[].reentry
| Field | Type | Required | Notes |
|---|
maxDepth | number | yes | integer; min 1; max 3 |
xema.components[].hookPoints[].bindingsRefused
| Field | Type | Required | Notes |
|---|
refused | enum | yes | one of: lineage-unsealed |
xema.components[].subscribesEvents[].scope (kind: "org")
| Field | Type | Required | Notes |
|---|
kind | literal "org" | yes | — |
xema.components[].subscribesEvents[].scope (kind: "realm")
| Field | Type | Required | Notes |
|---|
kind | literal "realm" | yes | — |
xema.components[].requirements.tenancy
| Field | Type | Required | Notes |
|---|
allowed | enum[] | yes | entries one of: deployment, org, project, invocation |
tenantContext | enum | yes | one of: none, verified |
xema.components[].requirements.isolation
| Field | Type | Required | Notes |
|---|
minimum | enum | yes | one of: none, process, container, vm |
xema.components[].requirements.trust
| Field | Type | Required | Notes |
|---|
minimum | enum | yes | one of: untrusted, verified, trusted, system |
xema.components[].requirements.locality
| Field | Type | Required | Notes |
|---|
allowed | enum[] | yes | entries one of: cloud, customer-private, gpu |
xema.components[].requirements.state (kind: "stateless")
| Field | Type | Required | Notes |
|---|
kind | literal "stateless" | yes | — |
xema.components[].requirements.state (kind: "ephemeral")
| Field | Type | Required | Notes |
|---|
kind | literal "ephemeral" | yes | — |
recovery | enum | yes | one of: rebuildable, checkpointed |
xema.components[].requirements.state (kind: "durable")
| Field | Type | Required | Notes |
|---|
kind | literal "durable" | yes | — |
scope | enum | yes | one of: deployment, org, project |
persistence | enum | yes | one of: database, object-store, filesystem |
consistency | enum | yes | one of: eventual, strong |
tenantFencing | literal "required" | yes | — |
xema.components[].requirements.resources
| Field | Type | Required | Notes |
|---|
minimum | object — see xema.components[].requirements.resources.minimum | yes | — |
preferred | object — see xema.components[].requirements.resources.minimum | no | — |
accelerator | object — see xema.components[].requirements.resources.accelerator | no | — |
xema.components[].requirements.runtime
| Field | Type | Required | Notes |
|---|
kind | enum | yes | one of: none, node, python, go, wasm, native |
versionRange | string | no | — |
architectures | enum[] | no | entries one of: amd64, arm64 |
nativeLibraries | string[] | no | — |
xema.components[].requirements.io
| Field | Type | Required | Notes |
|---|
ingress | enum | yes | one of: none, http, webhook |
egress | enum | yes | one of: none, platform, internet |
rawBody | boolean | yes | — |
devices | enum[] | yes | entries one of: accelerator, camera, microphone, serial, usb |
xema.components[].requirements.scaling
| Field | Type | Required | Notes |
|---|
mode | enum | yes | one of: singleton, horizontal, partitioned, invocation-only |
concurrency | object — see xema.components[].requirements.scaling.concurrency | yes | — |
readiness | object (discriminated on kind) — see xema.components[].requirements.scaling.readiness (kind: "none"), xema.components[].requirements.scaling.readiness (kind: "protocol"), xema.components[].requirements.scaling.readiness (kind: "host-signal") | yes | — |
drain | object (discriminated on kind) — see xema.components[].requirements.scaling.drain (kind: "none"), xema.components[].requirements.scaling.drain (kind: "graceful") | yes | — |
hints | object — see xema.components[].requirements.scaling.hints | yes | — |
xema.components[].protocol.workflowClientOf[].taskQueue
| Field | Type | Required | Notes |
|---|
name | enum | yes | one of: xema_default, xema_agent, xema_human |
placement | enum | yes | one of: execution-target |
xema.components[].protocol.browserSession.operations[]
| Field | Type | Required | Notes |
|---|
method | enum | yes | one of: GET, HEAD, POST, PUT, PATCH, DELETE |
path | string | yes | — |
xema.components[].protocol.nexus.provides[]
| Field | Type | Required | Notes |
|---|
service | string | yes | max 63 chars; pattern /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/ |
version | string | yes | pattern /^v[1-9]\d*$/ |
taskQueue | string | yes | pattern /^[a-z][a-z0-9-]{0,40}$/ |
operations | array of objects — see xema.components[].protocol.nexus.provides[].operations[] | yes | — |
xema.components[].protocol.nexus.requires[]
| Field | Type | Required | Notes |
|---|
service | string | yes | max 63 chars; pattern /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/ |
version | string | yes | pattern /^v[1-9]\d*$/ |
operations | string[] | yes | entries: pattern /^[a-z][a-zA-Z0-9]*$/ |
optional | literal true | no | — |
xema.components[].requirements.resources.minimum
| Field | Type | Required | Notes |
|---|
cpu | string | yes | pattern `/^(?:[1-9]\d*m |
memory | string | yes | pattern `/^[1-9]\d*(?:Ki |
ephemeralStorage | string | yes | pattern `/^[1-9]\d*(?:Ki |
xema.components[].requirements.resources.accelerator
| Field | Type | Required | Notes |
|---|
count | number | yes | integer; > 0 |
preferredCount | number | no | integer; > 0 |
vendor | string | no | — |
class | string | no | — |
minimumMemory | string | no | pattern `/^[1-9]\d*(?:Ki |
features | string[] | no | — |
xema.components[].requirements.scaling.concurrency
| Field | Type | Required | Notes |
|---|
handling | enum | yes | one of: serial, parallel |
maximumPerInstance | number | yes | integer; > 0 |
maximumNexusOperationsPerInstance | number | no | integer; > 0 |
xema.components[].requirements.scaling.readiness (kind: "none")
| Field | Type | Required | Notes |
|---|
kind | literal "none" | yes | — |
xema.components[].requirements.scaling.readiness (kind: "protocol")
| Field | Type | Required | Notes |
|---|
kind | literal "protocol" | yes | — |
initialDelaySeconds | number | yes | integer; min 0 |
xema.components[].requirements.scaling.readiness (kind: "host-signal")
| Field | Type | Required | Notes |
|---|
kind | literal "host-signal" | yes | — |
initialDelaySeconds | number | yes | integer; min 0 |
xema.components[].requirements.scaling.drain (kind: "none")
| Field | Type | Required | Notes |
|---|
kind | literal "none" | yes | — |
xema.components[].requirements.scaling.drain (kind: "graceful")
| Field | Type | Required | Notes |
|---|
kind | literal "graceful" | yes | — |
maximumSeconds | number | yes | integer; > 0 |
xema.components[].requirements.scaling.hints
| Field | Type | Required | Notes |
|---|
cpu | enum | yes | one of: latency, throughput, batch |
memory | enum | yes | one of: steady, burstable |
startup | enum | yes | one of: fast, warmup |
xema.components[].protocol.nexus.provides[].operations[]
| Field | Type | Required | Notes |
|---|
name | string | yes | pattern /^[a-z][a-zA-Z0-9]*$/ |
mode | enum | yes | one of: sync, async |
Web biomes (xema.target: "web")
A web biome is a static frontend bundle the host shell loads; it contributes pages, navigation entries, and slot panels, and never runs server-side.
| Field | Type | Required | Notes |
|---|
id | string | yes | pattern /^[a-z][a-z0-9-]*$/ |
displayName | string | yes | — |
description | string | no | — |
display | object — see xema.display | no | — |
scope | enum | yes | one of: kernel, system, base, platform |
target | literal "web" | yes | — |
components | array of objects — see xema.components[] | yes | — |
systemSurface | boolean | no | — |
optionalServerBiomes | string[] | no | entries: pattern /^[a-z][a-z0-9-]*$/ |
signature | object — see xema.signature | no | — |
bundleSource | object (discriminated on kind) — see xema.bundleSource (kind: "npm"), xema.bundleSource (kind: "tarball"), xema.bundleSource (kind: "oci") | no | — |
signedBy | string | no | — |
contributions | object — see xema.contributions | no | — |
requiresCapabilities | string[] | no | entries: pattern /^[a-z][a-z0-9-]*:[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)*@\d+$/ |
requiresCapabilitiesForAgents | string[] | no | entries: pattern /^[a-z][a-z0-9-]*:[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)*@\d+$/ |
requiresCapabilitiesForService | string[] | no | entries: pattern /^[a-z][a-z0-9-]*:[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)*@\d+$/ |
exposesCapabilities | string[] | no | entries: pattern /^[a-z][a-z0-9-]*:[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)*@\d+$/ |
ownsCapabilityDomains | string[] | no | entries: pattern /^[a-z][a-z0-9-]*$/ |
workflowConfig | object — see xema.workflowConfig | no | — |
audience | enum | no | one of: org, operator |
storeListed | boolean | no | — |
kind | enum | no | one of: app, connector, library |
xema.signature
| Field | Type | Required | Notes |
|---|
algorithm | string | yes | — |
value | string | yes | — |
keyId | string | yes | — |
Convention content directories
Biome content is discovered by on-disk presence — there is no per-kind declaration list in the manifest. Drop files into the conventional directory and the platform seeds them at boot/install:
| Content kind | Directory | What goes in it |
|---|
agents | agents/ | Agent definition files, one authoritative <slug>.md per agent; mode and metadata come from frontmatter. |
artifactTypes | artifact-types/ | Custom artifact type definitions. |
biomeInstallSchema | install-schema/ | Install-wizard resource-selection schema. Required when the biome declares integrationRequirements[]. |
deliverableSpecs | deliverable-specs/ | Deliverable spec bundles (structured output contracts). |
icons | icons/ | Icon assets referenced by the biome display metadata. |
mcpCatalog | mcp-catalog/ | MCP catalog entries the biome contributes. |
mcpTools | mcp-tools/ | MCP tool descriptors. |
projectKits | project-kits/ | Project kit definitions. |
provisioningScaffolds | provisioning/ | Workspace-provisioning scaffold recipes, one <id>.yaml per scaffold declared in xema.provisioning[]. |
roleCapabilities | role-capabilities/ | Role-to-capability mappings. |
runtimePlugins | plugins/ | Agent-runtime plugins, one directory per runtime id (plugins/<runtimeId>/). |
runtimeTools | tools/ | Agent-runtime custom tools, one directory per runtime id (tools/<runtimeId>/). |
skills | skills/ | Skill folder bundles, one directory per skill with a SKILL.md at its root (sub-skills nest recursively). Runtime-agnostic. |
toolProfiles | tool-profiles/ | Tool profile definitions. |
workflowConfig | workflow-config/ | Workflow YAML definitions and configuration. |
workspaceManifestTemplates | workspace-manifest-templates/ | Reusable agent-workspace manifest templates. |
workspaceManifests | workspace-manifests/ | Agent workspace manifests, one <slug>.workspace.yaml per workspace. |
One content kind pairs a presence-discovered directory with an explicit manifest roster:
provisioning/ ⟷ xema.provisioning[] — every provisioning/<id>.yaml must have a matching scaffold declaration.
Contribution envelopes
Single-file, typed contributions (capabilities, connector bindings, document templates, …) ship through the contribution protocol instead of a convention directory. Two equivalent forms, both validated against the same envelope shape:
- File-per-contribution — one
*.contribution.json per entry inside the biome's conventional contributions/ directory.
- Inline — entries under
xema.contributions.inline[] in the manifest itself.
Directory entries are read first; inline entries layer on top (last write wins on a (kind, id) collision between the two forms, and duplicate entries fail the biome's boot fast).
Each envelope carries:
1{
2 "kind": "capability",
3 "id": "my-contribution-slug",
4 "manifest": { }
5}
kind — a closed contribution-kind token from the contribution contract.id — kind-local slug, unique per (kind, biome); the platform namespaces it with the biome id at install time.manifest — the kind-specific body, validated by the owning platform service at boot.
Previous: ← Store
Next: Examples →