8ce164bb0c
Records the move from Scala to Go, the compiled-plugin decision, the Płytarium port as the v1 target, and the Go ecosystem research that backs the choice. No code yet.
24 lines
1.2 KiB
Markdown
24 lines
1.2 KiB
Markdown
---
|
|
title: WASM extension API for untrusted third-party extensions
|
|
trigger_condition: Core plugin API (models, form fields, components, events) has been stable for one full milestone and at least two compiled plugins extend each other through it.
|
|
planted_date: 2026-09-16
|
|
---
|
|
|
|
# WASM extension API
|
|
|
|
Decided during the opening exploration: primary plugins compile in (Caddy/xcaddy model), and a second, narrow extension surface runs sandboxed at runtime for third parties who cannot or should not rebuild the binary.
|
|
|
|
## Shape
|
|
|
|
- Runtime: `extism` on `wazero` (pure Go, no cgo).
|
|
- Surface: deliberately narrow. Hooks on events, custom form field renderers, HTTP handlers under a namespaced prefix, read-only model queries through a host function. No direct DB access, no model extension.
|
|
- Packaging: one `.wasm` per extension plus a manifest. Installable from the admin without rebuild.
|
|
|
|
## Why not now
|
|
|
|
Both RPC and WASM plugins fail the same way for a CMS core: the plugin surface (register models, extend other plugins' models, add form widgets, add components) is too wide to marshal across a boundary. Only once the compiled API settles do we know which narrow slice is worth exposing.
|
|
|
|
## Related
|
|
|
|
- `../notes/why-go-not-scala.md` (plugin decision)
|