creating-plugins

Create a TypeScript package with a descriptor factory in src/index.ts returning a PluginDescriptor, and a default definePlugin() export in src/sandbox-entry.ts containing hooks and routes. Register the descriptor in astro.config.mjs under plugins or sandboxed.

Standard plugins use definePlugin() with hooks and routes, run in trusted or sandboxed mode, and can be published to the marketplace. Native plugins support React admin components and Portable Text blocks but only run in trusted mode and cannot be sandboxed.

No. Sandboxed plugins must use Block Kit, a declarative JSON UI rendered by the host, so no plugin JavaScript runs in the browser. React admin components and Portable Text block types are native-plugin-only features.

Capabilities like content:read or network:request are declared in the plugin descriptor and control which ctx APIs are available. In sandboxed mode they are enforced at runtime via an RPC bridge; in trusted mode they serve as documentation only.

Sandboxed plugins block direct network access and Node.js built-ins. Use ctx.http.fetch() with the network:request capability and declare allowedHosts in the descriptor, replacing any fs or path usage with Web APIs.

Run emdash plugin bundle to create a .tar.gz tarball, authenticate with emdash plugin login via GitHub, then run emdash plugin publish. Bundles are validated for size, Node.js built-ins, and pass an automated security audit.