# Catalog packages

> Reviewed plugins sellers install as drafts, and the package format for publishing your own.

Source: https://shopfa.st/docs/plugins/catalog

The catalog in **Settings → Developers → Plugins** lists reviewed packages: NOWPayments (crypto payments), License
generator, Disposable email guard, Slack order alerts and Discord order feed. Installing one creates a **draft** copy in
the store: the seller can read every line, run its fixtures and fill in its settings before approving and activating
it. Updates never replace a store's copy behind its back.

## Package format

A catalog package is self-contained:

| Field | |
| --- | --- |
| `slug` | Unique, lowercase |
| `category` | Payments, Delivery, Fraud, Notifications |
| `author`, `verified` | Who maintains it; `verified` once ShopFast reviewed it |
| `manifest` | The same `manifest.json` as any plugin |
| `source` | `plugin.lua` |
| `fixtures` | Tests that must pass for the package to be listed |

Review checks that the fixtures pass, that `permissions.http` lists only the provider's own API hosts, that callbacks
verify signatures with `crypto.equal`, and that the plugin logs no secrets.

To propose a package, send it to [developers@shopfa.st](mailto:developers@shopfa.st) as a manifest, source and
fixtures.