creating-plugins

Create a TypeScript package with a descriptor factory in src/index.ts returning a PluginDescriptor, and a default definePlugin export in src/sandbox-entry.ts containing hooks and routes. Register the descriptor in astro.config.mjs under plugins or sandboxed.

Standard plugins use definePlugin with hooks and routes, run in trusted or sandboxed mode, and can be published to the marketplace. Native plugins support React admin components and Portable Text blocks but only run in trusted mode.

No. Sandboxed plugins must use Block Kit, a declarative JSON UI rendered by the host, so no plugin JavaScript runs in the browser. React admin components and Portable Text block types are native-plugin-only features.

Capabilities like read:content, network:fetch, and email:send are declared in the plugin descriptor and control which APIs appear on the plugin context. In sandboxed mode they are enforced at runtime; in trusted mode they document intent only.

Sandboxed plugins run in isolated V8 isolates via Cloudflare Dynamic Worker Loader, where Node.js built-ins like fs and path are unavailable. Use Web APIs instead, and access the network only through ctx.http.fetch with declared allowedHosts.

Run emdash plugin bundle to create a .tar.gz tarball, authenticate with emdash plugin login via GitHub, then run emdash plugin publish. Bundles are validated for size, Node.js built-ins, and pass an automated security audit.