Skip to main content
A package is the folder your nodes live in. It carries what they share and what the marketplace shows. package.yaml describes it, and there is one per package.
package.yaml
name, displayName and version are required. The rest earn their place below.

What the marketplace shows

Categories are ai, storage, ingest, communication, cloud, flow, media, search and productivity. This is a different list from the category on a node. A package category groups it in the marketplace; a node category describes the job that node does. Both are enums, and confusing them is a lint error rather than a silently wrong grouping. You do not list the nodes here. Every node.yaml under nodes/ is found on its own, so the package cannot disagree with what it actually contains.

allowedHosts: the hosts your nodes may call

Every host any node in this package reaches, and nothing else is permitted.
Deny by default. A call to a host not on this list is refused with the host named, and non-https is refused outright, so a key cannot travel in clear text. *.example.com matches exactly one level, so files.example.com passes and a.files.example.com does not. The list is checked when you lint and again at run time, after the URL has been assembled. That second check matters because a host can itself come from a template, and only the finished URL can be judged. It is also what somebody accepts when you publish the package. Keep it short and keep it honest: a list of two hosts is read and approved in seconds, and a list that quietly grows is the one that gets questioned.

requires: what the platform must support

What your nodes need from the platform in order to run.
Publishing refuses the package where the universe cannot satisfy it. Without that, a node using a newer capability would publish cleanly and then fail when something ran it.

Sharing what nodes have in common

Two folders sit beside nodes/, and both exist so a value has one home.
credentials/ describes each credential the package’s nodes ask for. shared/ holds fragments more than one node reuses, reached with $ref.
When the API moves an endpoint, one file changes rather than every node.

When it goes wrong


Next: Troubleshooting