Plugin extensions

Site-installed plugins live under:

plugins/<plugin-key>/plugin.json

The manifest declares identity, version, license, bootstrap file, capabilities, dependencies, default activation, boot stage, and static-export behavior where needed. The bootstrap file returns a callable that receives the plugin runtime helper and normalized manifest.

The supported runtime can register routes, settings, admin navigation, help, shortcodes, public assets, metadata, entry fragments, theme slots, housekeeping, content lifecycle handlers, CLI commands, media references, imports, exports, and static-export artifacts. Request only the bounded services exposed by the runtime.

Keep web and CLI registration separate. A CLI run has no browser request or public theme. Content lifecycle handlers should queue remote work; housekeeping or a dedicated command can deliver it.

An inactive plugin does not boot. A boot failure is reported without taking down the complete application. Installed plugin code is still trusted local code, not sandboxed code.

Run php8.4 bin/tinymash.php system:plugins after installation. Correct manifest warnings and boot errors before enabling the plugin on a public site.