---
title: WASM extension API for untrusted third-party extensions
trigger_condition: Core plugin API (models, form fields, components, events) has been stable for one full milestone and at least two compiled plugins extend each other through it.
planted_date: 2026-09-16
---

# WASM extension API

Decided during the opening exploration: primary plugins compile in (Caddy/xcaddy model), and a second, narrow extension surface runs sandboxed at runtime for third parties who cannot or should not rebuild the binary.

## Shape

- Runtime: `extism` on `wazero` (pure Go, no cgo).
- Surface: deliberately narrow. Hooks on events, custom form field renderers, HTTP handlers under a namespaced prefix, read-only model queries through a host function. No direct DB access, no model extension.
- Packaging: one `.wasm` per extension plus a manifest. Installable from the admin without rebuild.

## Why not now

Both RPC and WASM plugins fail the same way for a CMS core: the plugin surface (register models, extend other plugins' models, add form widgets, add components) is too wide to marshal across a boundary. Only once the compiled API settles do we know which narrow slice is worth exposing.

## Related

- `../notes/why-go-not-scala.md` (plugin decision)