Loading article…
Loading 4weird…
Loading article…
DocsPlugin checklist
Docs · studio · plugins
The /games/mods browser mounts community mods and themes only after they validate: a typed manifest, an allow-listed permission set, curated theme tokens, and a sandboxed iframe. Run this checklist before submitting and your plugin passes first try.
Manifest
Every submission is validated by validateGameModManifest, which never throws — it returns { ok, errors, manifest } so bad rows drop fail-open. Mirror this shape and the error list stays empty.
manifest.json — ember-arsenal-pack (valid)
validates cleanChecklist
Each check maps to a real validation rule. Fail any of them and the row is dropped with errors listed — fix, resubmit, no harm done.
name and a URL-safe slug matching ^[a-z0-9-]+$, unique per catalog. Slugs are the identity — renames are new submissions.major.minor.patch with an optional prerelease suffix (e.g. 1.2.0, 2.0.0-beta.1). Anything else fails version validation.target_game to gravegain3d, gravegain2d, gravegain1d, battlesharks2, or global. New games never need a validator change — any slug-shaped scope is accepted.storage:local, audio:play, interop:emit, clipboard:read, clipboard:write — and nothing else. Permissions are declaration-only today and the mount grants none automatically; an unknown permission fails validation instead of being ignored.--*. The shell applies the six curated tokens (--mod-bg, --mod-fg, --mod-accent, --mod-panel, --mod-border, --mod-font); extra keys ride along forward-compatibly.script_url at an https:// bundle (relative paths allowed for first-party dev). The mount runs it in an allow-scripts-only sandboxed iframe, and only 4weird.com origins are trusted./games/mods: the browser validates every row locally and ignores invalid entries, so you see exactly what reviewers see — including the offline fallback bundle when the future live catalog endpoint isn't wired yet.