EXTENSIBILITY

A solid core. An extensible periphery.

The app owns editorial truth, rendering and every ceiling. Extensions get narrow, versioned seams. You add a registry, install individual items by reference, and approve every one of them yourself.

Read the author guide Browse the schemas

Four extension kinds · Ed25519-signed registries · No server component · Agent-authorable

extension-kit

# scaffold an extension

$node scripts/extension-kit.mjs init my-ext \

--kind browse_provider --namespace acme

# check → pack → deploy to @local, on every save

$node scripts/extension-kit.mjs dev my-ext \

--local-registry ~/alchemist-local --watch

✓ manifest parity ✓ third-party notices

✓ payload conformance ✓ deterministic pack

→ deployed @local/acme/my-ext v1.0.0

@alchemist/corridorkey

REGISTRY NAMESPACE

Added by you from an out-of-band descriptor. Its Ed25519 key is pinned on first use; a later key change is a hard refusal, never a re-prompt.

ITEM SLUG

A versioned, platform-targeted signed archive. Consent is per item, keyed to the SHA-256 of its exact manifest bytes.

What we borrow from shadcn

The addressing and configuration model: namespaced registries added by the user, @ns/item references, cross-registry dependencies resolved topologically, and selective install of exactly the items you name.

What we deliberately do not

The payload model. shadcn copies source files into your project; this is a compiled Zig binary. Source installation and embedded scripting are out of scope, and only native codec libraries may execute inside the editor.

ofx_pack

INFORMATIONAL

OpenFX effect packs

An OpenFX plug-in bundle, plus an optional runtime directory for models and inference engines.

HOW IT RUNS

Hosted by the AlchemistOfxHost helper process. OpenFX 1.5.1, Filter context, RGBA byte and float, render scale, temporal access. Every discovered Filter appears in the Compositing node picker.

browse_provider

ENFORCED

Media Browser sources

A source for the Media Browser — a Frame.io-style integration, or a bridge to your asset manager.

HOW IT RUNS

Your executable, spawned as a contained child with an environment allowlist and no inherited secrets, speaking bounded JSON-RPC on stdio. Requests cap at 64 KiB, responses at 256 KiB, calls at five seconds.

app_plugin

ENFORCED AT THE HOST BOUNDARY

Event hooks and menu actions

Bounded event subscriptions and context-menu contributions on clips, bin media and tracks.

HOW IT RUNS

The same contained transport. events.receive and menu.invoke are gated by declared contributions and capabilities — a disabled or unconsented extension receives neither.

codec_plugin

INFORMATIONAL · SIGNED-ONLY

Native decoders

A native video or audio decoder. C ABI 1 for video, ABI 2 for audio, video or both.

HOW IT RUNS

Loaded inside the editor after explicit pre-load consent, with decoder- and frame-owned library lifetime. Signed registries only — never from @local, even during development.

TIER	REGISTRIES	KEY HANDLING	BADGE
Verified	The built-in @alchemist registry	Ed25519 public key compiled into the binary — the same posture as the update feed. A client trusts only keys it shipped with.	Verified
Unverified	Any registry you add yourself	Key pinned on first add after a dialog showing its SHA-256 fingerprint, publisher and URL. A later key change is a hard refusal, not a re-prompt.	Unverified
Local	The @local dev registry	None. Unsigned and directory-backed, read only while developer mode is explicitly on.	unsigned local build

Projects reference, never ship

A project package may reference @ns/slug but cannot contain an extension, and a reference never auto-installs. An unresolved item stays offline with its parameters preserved rather than discarded.

Unverified and local items never auto-update

Only @alchemist items check on the app's existing cadence. Everything else moves when you move it.

Crash containment is not a security sandbox.

An enabled native extension executes as you. Out-of-process hosting stops a crashed plug-in from taking the editor down — it does not confine what that process can read or send. Capability declarations are enforced for browse providers and app plugins, where the app controls the boundary; for OFX packs and codec libraries they are informational, and the consent dialog says so in exactly those words. We would rather lose an install than imply a guarantee we cannot keep.

Scaffold

init lays down the manifest, third-party notices and a payload skeleton for your chosen kind.

Iterate locally

dev --watch runs whole-payload conformance, packs deterministically and deploys to @local on every change.

Sign and publish

A registry is one signed index.json plus one artifact URL per item. Any web host or object store works.

Hand over trust

Users import your descriptor out of band, review your fingerprint, and pin it themselves.

Publishing a registry

# one-time key ceremony

$openssl genpkey -algorithm ed25519 \

-out acme-registry-private.pem

# describe, sign, publish

$node scripts/extension-kit.mjs release-item \

my-ext.zip --platform windows > item.json

$node scripts/extension-registry.mjs generate \

--output index.json --namespace acme \

--private-key acme-registry-private.pem

extension.json

{

"namespace": "acme",

"slug": "my-keyer",

"kind": "ofx_pack",

"version": "v1.2.0-acme.3",

"display": {

"title": "My Keyer",

"grouping": "Keying"

},

"ofx": { "bundle": "MyKeyer.ofx.bundle" }

}

Written to be read by a coding agent.

Increasingly the author of a niche extension is a user's coding agent, not a vetted publisher. So the contracts are machine-readable: the index, item, manifest and RPC schemas are the ground truth, tested against the app's own parsers so the two implementations cannot drift. Hand an agent those schema files plus the author guide — they are written to be sufficient on their own.

extension-index.schema.json

extension-item.schema.json

extension-manifest.schema.json

browse-provider-rpc.schema.json

No marketplace

No discovery ranking, no ratings, no payments. You add a registry you already trust and install the item you already wanted.

No embedded scripting

No in-process app plugins and no script runtime. Signed native codec libraries are the single explicit exception, under their own pre-load consent contract.

No project-shipped extensions

A project package may reference @ns/slug but can never carry the code, and a reference never triggers an install.

No silent updates

Nothing auto-updates unless your build shipped the key that signs it. Unverified and local items move only when you move them.

THE INTENDED THIRD RUNG

A sandboxed tier, not built yet.

WASM or an interpreter — the rung where real enforcement and low authoring friction finally meet, and an agent-authored extension becomes installable without a heavyweight trust decision. The manifest's kind and capabilities fields are already shaped so it slots in without a schema break.

A solid core. An extensible periphery.

Registries you add. Items you name.

Narrow seams, one per job.

No signing, no hosting, no server.

What this is not.

Build the part we didn't.

A solid core. An extensible periphery.

Registries you add. Items you name.

Narrow seams, one per job.

Authority is handed over explicitly, never ambiently.

No signing, no hosting, no server.

What this is not.

Build the part we didn't.