Decide what you deliver
| Goal | Plugin kind | Where it runs | First-time advice |
|---|---|---|---|
| Restyle the user console or public site | theme | The control plane validates and loads constrained theme content | Start from the theme tool |
| Ship declarative protection rules | rule_pack | The control plane validates against the rule model; the edge engine interprets it | Check the rule model supports what you need |
| Add a page or report | ui_page | Your own HTTPS site, mounted by the control plane in an isolated iframe | Verify the page origin, then add the bridge SDK |
| Add a DNS, SMS, mail, ICP or payment adapter | provider | An HTTPS service you deploy | Pass the sandbox contract before wiring a real vendor |
| Subscribe to events or call the open API | external_service | An HTTPS service you deploy | Pin down the permissions and failure handling |
Plugin kind, the manifest kind and the entrypoint are three things: you pick the kind when creating the plugin; the manifest’s top-level kind is always Plugin; how it runs is spec.entrypoint. Uploading a service package does not mean the control plane runs it.
For a first release ship a free plugin, then add paid plans and external services, so you are not debugging signing, review, payment and calls at once.