Rapid plugins — community registry

Public registry for community-contributed Rapid plugins. Plugin authors submit a PR adding their entry to community-plugins.json; a GitHub Action validates the manifest format, signature presence, hash format, and URL pattern reasonableness before the entry can merge.

Status: v1.2 work in progress. Rapid v1.1 ships with a single first-party archive plugin bundled in the MSI; the marketplace browser UI and the addon-runtime fetch path that consumes this registry land in v1.2.

Submitting a plugin

1. Build your plugin against the rapid-plugin-api contract crate (currently semver 0.2.0). The site-adapter template is a working starting point.
2. Sign your plugin.wasm with an ed25519 key. Generate one via the rapid-keygen binary in faisalkindi/rapid:crates/rapid-signing-tools. You keep the private key; publish your public key in your plugin repo's README so users can verify signatures independently.
3. Host your plugin's manifest.json and plugin.wasm in a GitHub Release on your own repo. Both files must be downloadable by URL without authentication.
4. Open a PR against this repo adding your entry to community-plugins.json. The validation workflow (see .github/workflows/validate-plugin-entry.yml) runs on every PR and fails the build if your entry is malformed.
5. After review (manual safety pass for url_patterns + author identity), the entry merges. Rapid clients pick up the new entry on their next periodic registry fetch.

Schema

community-plugins.json follows the schema in schema/community-plugins.schema.json. Fields per entry:

• name — globally unique slug. Lowercase ASCII alnum + dash. Must match the name in your plugin's own manifest.json.
• version — semver string (e.g. 1.0.0). Submit a new PR for each release.
• author — { name, github, donate? } object.
• description — short user-facing description (≤ 200 chars).
• kind — "site_adapter" | "format_converter" | "archive".
• manifest_url — direct-fetchable URL to the signed manifest.json in your GitHub Release. Must be https://github.com/....
• url_patterns — for site_adapter plugins: list of URL patterns. Patterns matching * literal or *://* or https://* without subdomain restriction are rejected by the validator.
• min_rapid_version — minimum Rapid client version needed.
• min_rapid_plugin_api_version — semver of rapid-plugin-api your plugin compiled against.

Top-level fields:

• manifest_schema_version — currently 1.
• entries — array of plugin entries described above.

Trust model

• Anyone may submit a plugin. The validator checks shape, not safety.
• Rapid's runtime sandboxes plugins (Wasmtime), so a malicious plugin cannot escape the WASI capabilities its manifest.json declared and that the Rapid host validated.
• Rapid badges plugins as verified-by-rapid after a manual review pass for popular community contributions. Verification is opt-in and signals quality / trust, not safety (sandbox already does that).
• First-party Rapid plugins (the bundled ones) ship inside the Rapid MSI itself — they don't go through this registry.

License

This repository's contents are MIT-licensed. Individual plugins linked from this registry retain their own licenses; check each plugin's repo before redistributing.