Capabilities
The closed set of capabilities a plugin manifest may request — document access, rendering surfaces, network, storage, workers, and more — generated from the manifest schema.
In short Capabilities are how a plugin asks for power, and how the host constrains it. The set is closed and enforced — a manifest can only request what's listed here, and the host grants exactly that. Generated from the manifest schema (ADR-019), so it can't fall out of date with the runtime.
| Capability | Shape | Values | Purpose |
|---|---|---|---|
| document | object { read, write, readNative, openNative } | — | |
| rendering | array of enum | sceneLayeroverlayhitTestresourceProvider | |
| keybindings | boolean | — | The bundle registers keybindings directly via contribute.keybinding. Keybindings have no id to list under contributes, so this boolean is their capability declaration. |
| editContext | array of string | — | |
| assets | array of enum | fontsimages | Asset-store reads the bundle uses. "fonts" gates host.assets.getFontFace (W-06); "images" gates host.assets.getPlacedImage (C-5 / I-04, core v42). See DESIGN.md §13. |
| network | boolean | object { origins, purpose } | — | Network reach the bundle declares (D-03). Boolean shorthand, or a per-origin allow-list + purpose. Reach is always consent-gated; documents do not fetch on open. |
| dataProviders | object { publish, consume } | — | Data-provider roles (paged.data §7.1 / D-09). 'publish' = categories the bundle may register providers in; 'consume' = categories it may discover + read. The neutral cross-plugin composition; plugins rendezvous at host.dataProviders, never by direct contact. |
| storage | object { blob, quotaBytes } | — | Persistent binary storage (K-4 / S-08). 'blob' gates the OPFS-backed host.blob byte store; 'quotaBytes' requests a ceiling (host enforces the stricter of it and its hard per-plugin cap). |
| clipboard | enum | nonevectorfull | |
| workers | object { max, sharedMemory, maxSharedBytes } | — | Worker spawn + SharedArrayBuffer (K-3 / S-07 / I-02). 'max' is the worker-count ceiling requested (host clamps to min(declared, hardwareConcurrency, 8)); 'sharedMemory' declares SAB use (gates allocateShared); 'maxSharedBytes' requests a per-bundle shared-memory ceiling (host enforces the stricter of it and its 256 MiB default cap). Gates host.workers. |
| secrets | object { sources } | — | Host credential-store door (D-11; rfc-credential-store). 'sources' grants host.secrets for authenticated DB-attach / remote sources. REFERENCE-ONLY + host-owned: plugins hold credentialRef strings, never secret material; the surface has set/exists/forget and NO get. Gates host.secrets. |
| documents | object { export, open } | — | Documents door (D-26; host.documents). 'export' grants exportPaged (serialize the active document, the whole container); 'open' grants open (replace the active document with plugin-built bytes; the host asks the user before discarding unsaved edits). An absent field denies that door. |
| gpu | object { realm } | — | WebGPU usage declaration (I-07 / C-1 Stage B realm-local; ADR-018). DECLARE-ONLY: no GPUDevice is handed to the bundle — it legitimizes the realm-local WebGPU usage the bundle already does in its own JS realm (paged.image Engine-B). realm:"bundle" is the only value accepted today; realm:"shared" (future host-device-sharing) is reserved and REJECTED until the zero-copy walls lift. No requestGpuDevice surface exists. |
| wasm | array of object | — | Declared WebAssembly artifacts the bundle ships and loads at runtime (capability-gated, declared-only, budgeted). See docs/wasm-packaging.md. |
Building a drawing tool
How to ship a canvas tool from a plugin — the GestureHandler contract, the gesture kit's page-anchored drag helpers, preview publishing, and committing one undoable mutation. The pattern behind Paged's own pen tool.
Contributions
The surfaces a plugin can add to the editor — tools, panels, commands, object types, importers/exporters, and more — generated from the manifest schema.