Site Bundle

A Site Bundle is the folder or ZIP file that you upload to Liteshop. It contains the Site’s static files and a liteshop.json manifest.

Structure

index.html and liteshop.json must be at the root of the bundle:

site.zip
├── index.html
├── liteshop.json
├── styles.css
├── main.js
└── assets/
    └── hero.webp

Paths are relative and case-sensitive. Don’t include symbolic links, paths with .., server code, dependency folders such as node_modules, environment files, or secrets. References in your files can be relative, such as assets/hero.webp, or start at the root, such as /assets/hero.webp. Both resolve from the root of the bundle, so the default output of build tools such as Vite works without extra configuration. Every reference must name a file in the bundle.

Files

A bundle can contain these file types:

HTML, CSS, JavaScript (.js, .mjs), and JSON
Plain text, such as robots.txt, and XML, such as sitemap.xml
Web app manifests
Images: JPEG, PNG, WebP, AVIF, GIF, SVG, and ICO. A PNG saved as .ico is accepted.
Fonts: WOFF, WOFF2, TTF, and OTF

Each file’s contents must match its extension. SVG files can’t contain scripts or external references.

Limit	Value
ZIP file size	32 MB
Total size of all files	50 MB
Size of one file	10 MB
Number of files	2,000

Security rules

Every Site runs with a strict security policy. The policy and the validator enforce these rules:

Load scripts and stylesheets from the bundle only. Scripts from other websites are rejected.
Put JavaScript in bundled files loaded with <script src="...">, or in inline <script> elements. Liteshop allows each inline script by its hash, up to 100 per HTML file.
Don’t use HTML event attributes such as onclick, or javascript: links. Use addEventListener instead.
Don’t use frames or forms that post to a server.
Images can use data:image/... URLs. Links to other websites, mailto: links, and tel: links work normally.

The policy also blocks network requests to other websites, WebSockets, web workers, service workers, and eval. When code appears to use one of these features, validation reports a warning instead of an error, because framework code often mentions these APIs without using them. A Site with warnings can be published, but the blocked feature doesn’t work.

Manifest

The manifest is liteshop.json at the root of the bundle. It follows the JSON Schema for Site Specification version 0.1:

{
  "$schema": "https://docs.liteshop.me/schemas/site-v0.1.json",
  "specVersion": "0.1",
  "site": {
    "name": "Example Guesthouse",
    "defaultLocale": "en",
    "supportedLocales": ["en"],
    "timezone": "Europe/Paris"
  },
  "frontend": {
    "entry": "index.html",
    "notFound": "404.html"
  },
  "capabilities": {}
}

Property	Description
`site.name`	The Site’s name. When a Deployment goes live, it becomes the Site’s name in the dashboard.
`site.defaultLocale`	The main language, such as `en` or `fr`. Every label in the manifest must have text in this language.
`site.supportedLocales`	All the Site’s languages, including the default one.
`site.timezone`	An IANA time zone name, such as `Europe/Paris`. Booking dates and times use it. Numeric offsets aren’t accepted.
`frontend.entry`	The page served at `/`, usually `index.html`.
`frontend.notFound`	Optional. A page served with status 404 when no file matches the request.
`frontend.fallback`	Optional. A page served with status 200 for paths without an extension that match no file, for client-side routers. Usually `index.html`.
`capabilities`	Required. The features the Site uses: `forms`, `bookings`, and `catalogue`. Use `{}` for a Site without features.
`baseDeployment`	Set by Liteshop in downloaded versions. Keep it unchanged; see Publish an update.

Declare a capability only if the Site uses it. Don’t add an empty one, such as "forms": []. IDs of Forms, fields, Resources, Offers, Calendar Connections, and Catalogue Items use lowercase kebab case, such as contact-form. Keep them unchanged across updates, because messages, bookings, and orders refer to them. The Site Owner can change the Site’s name, languages, and time zone in Settings > Site details, which publishes a new Deployment.

How Liteshop serves pages

Liteshop finds the Site from the request’s address and serves its live Deployment:

/ serves frontend.entry.
A path ending with / serves index.html in that folder.
A path without an extension, such as /about, serves about.html. If only about/index.html exists, Liteshop redirects to /about/.
A path without an extension that matches no file serves frontend.fallback, if declared.
Any other missing file serves frontend.notFound with status 404, if declared.

The fallback and not-found pages are served at any path, so reference their files from the root, such as /assets/app.js. The /_liteshop/ path is reserved for Liteshop, and liteshop.json itself is never served.

Checklist

Before you upload a bundle, check the following:

index.html and liteshop.json are at the root.
Every reference names a file in the bundle, with matching case.
liteshop.json follows the schema, and every label has text in the default language.
IDs are lowercase kebab case and unchanged from earlier versions.
The bundle contains no secrets and loads nothing from other websites.
An update keeps baseDeployment unchanged.

Get started

Build with code

Frameworks

Reference