Plugins

Ship a block as a signed package

Plugins are TypeScript source plus a manifest, zipped and Ed25519-signed. The loader transpiles with sucrase and registers your blocks at runtime.

The manifest

openbook.json declares the plugin’s id, its entry file (main) and a little metadata. Blocks and commands are registered at runtime by the entry, not listed here.

openbook.json

json

{
  "id": "acme.sparkline",
  "name": "Sparkline",
  "version": "1.0.0",
  "description": "A tiny inline chart over a named input.",
  "author": "Acme",
  "icon": "📈",
  "main": "src/index.ts"
}

Package & sign

Zip the source with its manifest and sign it. Signing establishes provenance — it proves who built the plugin. It is not a sandbox, so review the source of anything you install, exactly as you would an npm package.

bash

# A plugin is just source + manifest, zipped:
sparkline.zip
├─ openbook.json     # the manifest above
└─ src/index.ts      # export default activate(api) — registers blocks

# Pack and dev-sign it (Ed25519). Provenance, not sandboxing —
# signing proves who built it; review the source you install.
node scripts/pack-plugin.mjs ./sparkline sparkline.zip --sign

How it loads

At install, the loader verifies the signature, transpiles the TS with sucrase into CommonJS, and runs the entry’s default-exported activate(api) so its api.blocks.register() calls take effect — the same registry the built-in kit uses. Imports resolve inside the zip, plus two host modules: react and @book.dev/plugin-sdk. Your blocks then appear in the slash menu under “Extensions”.