package.yaml

format: 1
package: example-plugin
version: 0.1.0
kind: managed
authors: [Your Name]
description: "An example SharpMUSH extension. Replace this with your own."
license: MIT
homepage: https://github.com/your-github-user/example-plugin
keywords: [plugin, dll, managed]

# A managed package distributes a COMPILED C# plugin DLL through the package
# manager. It carries NO softcode `objects:` and NO `application:` block — only
# the `binaries:` section below. Installing it verifies each file against its
# SHA-256, then (after the operator's two-part trust opt-in — server allow-list
# AND per-apply allow_managed_code) deposits the bytes into plugins/<id>/ for the
# boot-time loader to pick up on the next restart.
#
# A managed package runs ARBITRARY compiled C# in full server trust — there is no
# sandbox (same posture as a hand-dropped DLL). The SHA-256 hashes guard integrity
# (the bytes are what this manifest committed to), not trust.
binaries:
  # The plugin/server contract version your DLL was built against. The installer
  # refuses a package built for a newer contract than the target server provides.
  min_server_version: ">=0.1"
  files:
    # file: = a FLAT name (no path separators, no '..'). Each deposits directly
    # into plugins/<id>/. sha256: = the 64-hex digest of the built bytes.
    #
    # The build-and-release CI computes these hashes from the deterministic build
    # and rewrites this block before tagging — DO NOT hand-maintain them. The
    # zeros below are a placeholder so the manifest parses before the first CI run.
    - file: ExamplePlugin.dll
      sha256: "0000000000000000000000000000000000000000000000000000000000000000"
    - file: ExamplePlugin.deps.json
      sha256: "0000000000000000000000000000000000000000000000000000000000000000"
    - file: plugin.json
      sha256: "0000000000000000000000000000000000000000000000000000000000000000"