@abraca/plugin

@abraca/plugin

The shared plugin contract for Abracadabra — the AbraPlugin shape, PluginManifest types, a capability-guarded host, an iframe sandbox, and an in-process registry. Shared by @abraca/nuxt and cou-shell. Zero dependencies.

Documentation

Full, code-derived documentation lives in docs/ — the AbraPlugin contract, manifest & capability tokens, the host/sandbox isolation model, and the registry + source spec. It is the source of truth.

What's inside

• AbraPlugin — the universal plugin shape (editor + server contributions); version-decoupled via structural markers (no pinned yjs/TipTap/Vue).
• PluginManifest — declarative descriptor types (the Zod validator lives in @abraca/schema).
• createPluginHost — capability-guarded fetch/clipboard/notifications.
• loadSandboxedPlugin — null-origin iframe, postMessage-only.
• PluginRegistry — in-process built-in + space-plugin manager with contribution aggregators.

::

Phase-1 host gating is advisory (a plugin can grab globalThis.fetch); the iframe sandbox is the real boundary, and functions don't cross postMessage. integrity is documented as bare hex here but @abraca/plugin-cli writes sha256-<hex> — see the docs.

License

MIT.