Module Creator
Manifest, assets, and capabilities
Describe a module without giving package code direct authority over Fabled.
The canonical manifest
The canonical filename is fabled.module.json. The CLI can read the legacy fabled-module.json only when the canonical file is absent; a project containing both is rejected. manifestVersion is currently 1, package ids are publisher-id.module-slug, and releases use exact semantic versions.
- Identity: id, name, description, version, publisher, and license.
- Compatibility: fabledApi plus minimum, verified, and optional maximum Fabled versions; gameSystems may contain * or explicit system ids.
- Runtime: runtimeTier, targets, activationEvents, contributions, requested permissions, relationships, and privacy declarations.
- State: dataSchemaVersion with optional storage, migrations, and service contracts.
- Package data: every asset declares a safe relative path, type, byte length, and lowercase SHA-256 digest; locales map BCP-47 tags to locale assets.
Targets and contributions
| Model | Current v1 values |
|---|---|
| Targets | account, campaign, vtt, character, forge |
| Contributions | commands, command placements, panels, VTT effects, content packs, event handlers, realtime topics, settings |
| Placement slots | global command, Chat composer, campaign blade/settings, character action/sheet, VTT toolbar/context menu/selection overlay |
| Runtime tiers | declarative, authoritativeDeclarative, workerPreview, serverPreview |
Request the smallest capability envelope
Permissions are requests, not authority. Every required or optional capability needs a specific human-readable reason. Fabled validates that the capability exists, is available for the selected target and runtime tier, and has the required account, user, campaign, or combined consent.
- Read examples: visible or owned content/elements, campaign summary, visible scene, controlled or visible tokens, presence, visible Chat and dice, module health, and own settings.
- Action examples: self dice rolls, user Chat posts, controlled framework invocation, campaign audio/VTT effects, token/door/fog/initiative writes, scoped settings, module-owned storage, and module realtime publishing.
- network.fetch.declared exists in the catalog but is currently unavailable and has no admitted targets.
Assets, settings, storage, and services
JSON automation, content, effect, frame, locale, schema, and migration assets are structurally bounded. Binary image, audio, worker, WebAssembly, and other assets remain package data unless a reviewed host/runtime contract consumes them.
- Settings can be device, account, campaign, or userCampaign scoped and use boolean, integer, number, string, or color values.
- Storage can be device, account, campaign, userCampaign, scene, or entity scoped, requests up to 5 MiB, and declares delete-on-uninstall or 30-day retention.
- Data schema version changes require contiguous, bounded, idempotent migration assets.
- Provided and consumed services declare versions, schemas, operations, commands, and required capabilities; a consumer cannot borrow a provider's authority.