Site Bundle Reference - Liteshop

Archive structure

site.zip
├── index.html
├── liteshop.json
├── styles.css
├── main.js
└── assets/
    └── hero.webp

Paths are relative and case-sensitive. Do not include symlinks, absolute paths, .. traversal, build tooling, server code, package directories, environment files, or secrets. Allowed content includes HTML, CSS, JavaScript, JSON, JPEG, PNG, WebP, sanitized SVG, and ICO.

Security restrictions

Use bundled scripts, styles, and images. Do not use external scripts or stylesheets, frames, service workers, web workers, eval, WebSockets, external form targets, or arbitrary network requests. Ordinary https:, mailto:, and tel: links are allowed.

Manifest

The ZIP root must contain liteshop.json using schema version 0.1:

{
  "$schema": "https://docs.liteshop.me/schemas/site-v0.1.json",
  "specVersion": "0.1",
  "site": {
    "name": "Example Guesthouse",
    "defaultLocale": "en",
    "supportedLocales": ["en"],
    "timezone": "Europe/Paris"
  },
  "frontend": {
    "entry": "index.html",
    "notFound": "404.html"
  },
  "capabilities": {
    "forms": [
      {
        "id": "contact",
        "name": { "en": "Contact" },
        "fields": [
          {
            "id": "email",
            "type": "email",
            "label": { "en": "Email" },
            "required": true,
            "maxLength": 254
          }
        ]
      }
    ]
  }
}

The capability declaration is reserved for later activation. Until Forms is marked available, the frontend must not load the Liteshop browser SDK or call liteshop.forms.submit.

Updates

An exported Deployment includes baseDeployment. Preserve it exactly. Liteshop refuses to Publish the update when another Deployment has become active since the export.

Validation checklist

index.html and liteshop.json are at the ZIP root.
Every local reference exists with matching case.
The manifest follows the published JSON Schema.
Localized labels include the default locale.
Identifiers use stable lowercase kebab case.
The bundle contains no secrets or unsupported network dependencies.
The frontend uses only capabilities marked available.
An update preserves baseDeployment.