asterobot.json is the one file of a package that isn't code. It says which other packages the package depends on, which Asterobot versions it works with and what it declares it uses.
Where it lives
- At the root of the package, next to
index.js. - It's optional. A new package has none, and Asterobot only writes one when there's something to put in it.
- The editor doesn't show it. The Files list only holds modules, and saving code never changes the manifest.
- It doesn't hold the package's name or version. Those come from where the package is installed: the Name and Version typed when the package was created, copied or imported, or the file it came from on asterobot.net. See Names and versions.
In Asteroboard, you edit the manifest on the package's own page, in its Manifest card. A manifest can also come with the package: inside a .zip you import, or in a folder you install with library install, as Zip files and the command line explains.
An example
This is the manifest of a package installed from the marketplace, as Asterobot writes it:
{
"dependencies": {
"@alice:chat-tools": {
"url": "https://asterobot.net/files/file/12-chat-tools/",
"version": "1.2.0"
}
},
"compatibleVersion": ">=1.5.0 <2.0.0",
"integrity": "sha256-9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"permissions": [
"gamedata"
],
"sourceId": 34
}The author wrote dependencies, compatibleVersion and permissions. Asterobot added integrity and sourceId when it installed the package from asterobot.net.
Fields
| Key | Type | Written by | What it holds |
|---|---|---|---|
dependencies |
Object | You | The library packages this package imports. Each key is the name the code imports, and each value is an object with a version and a url, both optional. See Dependencies. |
compatibleVersion |
String | You | The range of Asterobot versions the package works with, such as >=1.5.0 <2.0.0. See Compatibility. |
permissions |
Array of strings | You | What the package says it uses. Asterobot doesn't enforce it yet. See Permissions. |
sourceId |
Number | Asterobot | The ID of the asterobot.net file the package was installed from. Check for updates compares the package with that file, and it's how a marketplace package keeps its name when its file is renamed. |
integrity |
String | Asterobot | A checksum of the package's .js and .mjs files, starting with sha256-, recorded when the package is installed from the marketplace. Asterobot compares the files with it each time it loads the package, and refuses them with package source integrity mismatch when they changed. |
And inside each entry of dependencies:
| Key | What it holds |
|---|---|
version |
An exact version such as 1.2.0, a range such as ^1.2.0, or latest. |
url |
The address of the dependency's file on asterobot.net, or its ID. Without it, the dependency has to be in the library already. |
Asterobot keeps only these keys. Anything else in the file, such as a name or a description, is dropped as soon as the package is installed, because Asterobot writes the file again from what it understood. The file has to be valid JSON: a package whose asterobot.json doesn't parse can't be imported or installed, and if the file breaks after installation, the package disappears from Library Manager and doesn't start.
What Asterobot does with sourceId and integrity
| When | sourceId |
integrity |
|---|---|---|
| Installing or updating from the marketplace | Set to the file's ID | Computed from the files just downloaded |
| Import a .zip | Removed | Removed |
| Copy to a new version | Removed | Removed |
| Save in the editor | Kept | Removed, since the code changed |
| Save manifest | Kept | Kept |
The library install command |
Kept as they are in the folder's file | Kept as they are in the folder's file |
So whatever you write in these two keys is replaced or removed, except by library install. Leave them out of a package you're working on, which matters most when you start from a package you exported: a leftover integrity stops your package from starting as soon as you change a file, and a leftover sourceId ties it to a file on asterobot.net it didn't come from.
The Manifest card
To open a package's page, click its name in Library Manager, or click the box icon before the name at the top of the editor. The Manifest card is under the details card.
For a local package, the card is a form:
| Part | What it does |
|---|---|
| Dependencies | One row per dependency, with three boxes and a remove button. Empty, the boxes read Package name, as imported, Version and asterobot.net file URL (optional). Without any row, the card says "No dependencies." |
| Add an installed package | Lists every other package in your library as name@version. Picking one adds a row with its name and version, and no URL. A row that already had that name is replaced. |
| Add by URL | Adds an empty row for you to fill in. |
| Permissions | One badge per permission, each with a remove button, or "No permissions declared.". Type a new one in the box that reads e.g. gamedata, then click Add or press Enter. |
| Compatible with | A single box for the range of Asterobot versions, reading e.g. >=1.5.0 <2.0.0 while empty. |
| Save manifest and Reset | Both stay disabled until something changes. Reset puts the card back as the manifest was last saved. |
When you click Save manifest, spaces around each value are removed, a dependency row with an empty name is left out, and an empty or repeated permission isn't added. What you save replaces the dependencies, permissions and range the manifest had. A toast says Manifest saved. A script that's already running keeps what it loaded, and the next start uses the new manifest.
For a package with any other name, the card is read-only and says "Published by someone else, so this is read-only". It lists each dependency with its version, or latest when it has none, then the permissions and the range, or "No constraint declared." when there's no range.
When Asterobot refuses a manifest
When a save fails, the card shows Couldn't save the manifest with the reason under it.
Before saving, Asterobot checks each dependency that has no URL: it needs an exact version, and that version has to be in your library. Then it checks the versions of every dependency.
| Reason | What to do |
|---|---|
dependency "<name>" needs <name>@<version> installed, or a URL to fetch it from |
Install that version of the package, or correct the name or the version |
dependency "<name>" needs an exact version |
Fill in Version |
invalid package manifest: dependency "<name>": invalid version "<version>": <details> |
Write an exact version, a range or latest |
Error messages lists every reason, including those about a version written in the dependency's name.
Two fields aren't checked when you save. A compatibleVersion that isn't a valid range is accepted, and only fails when the package loads: see Compatibility. An empty or repeated permission, which the card doesn't let you add but a file can contain, stops the package from starting with empty package permission or duplicate package permission "<permission>".
A manifest inside a .zip or a folder goes through the same version checks when the package is installed. The Import a .zip dialog then only says Couldn't import the package, while library install prints the reason.
Next, Names and versions.
Aucun avis à afficher.