Plugin authoring

Manifest v2, permissions, sandbox, and review flow.

Trust model

Authors prepare a ZIP and submit it manually. Staff reviews, publishes via platform-web, then shops enable via entitlement + grant. Merchants never upload ZIPs. No OAuth / App Bridge.

Minimum package

plugin.zip
  plugin.json
  README.md
  icon.svg
  settings-schema.json
  admin/panels.json
  storefront/sections/*.liquid
  handlers/events/*.js   # only when review allows handlers

Permissions

Declared in plugin.json. Host APIs include settings.read, products.read, allowlisted http.fetch, shop-scoped kv. Forbidden: raw SQL, process, PAN.

Storefront

Plugin sections live under storefront/sections and cannot override theme section files.

Review

Ten-item checklist (manifest, README, icon, static analysis, network allowlist, …).

See docs/roadmap/06-plugin-spec.md and ADR 0011.