block.json 1.4.0

A manifest is the install, compatibility, accessibility, and Adapt boundary for owned Block source.

Required fields

Field	Rule
`name`	Stable kebab-case ID
`version`	Semver
`description`	Non-empty purpose
`files`	Relative copy paths; no traversal
`a11y`	Landmark, keyboard, contrast expectations

Extended fields

id, category, dependencies, peerDependencies, tokens, components, framework(s), adaptContract, compatibility, license, author, repository, origin, and integrity provide the Phase-5 contract.

Adapt contract

{
  "roles": ["hero"],
  "density": ["compact", "comfortable", "spacious"],
  "layout": ["stack", "split"],
  "allowedActions": ["density", "layout"]
}

Security

Manifest capability is declarative. It cannot register runtime hooks, external fetch, free DOM/CSS, innerHTML, cloud AI, eval, or script URLs.