Plugins: document topbar/sidebar slots, message decorators, SRI

docs/plugins.md

@@ -21,7 +21,14 @@ Add script URLs to `plugins` in [`config.json`](https://orbit.tchatou.fr/docs/co
 ```
 
 They load in order, after the app boots. Host them anywhere the page can reach
-(same-origin recommended).
+(same-origin recommended). For a third-party origin, pin the file with
+Subresource Integrity by giving an object instead of a URL:
+
+```json
+{ "plugins": [{ "url": "https://cdn.example/x.js", "integrity": "sha384-…" }] }
+```
+
+(`crossorigin` defaults to `anonymous` when an `integrity` hash is set.)
 
 ## A quick plugin
 
@@ -75,6 +82,7 @@ instead. See **[Compiled plugins](https://orbit.tchatou.fr/docs/compiled-plugins
 | `orbit.storage.get(key, def)/set(key, val)` | namespaced persistence |
 | `orbit.addUi(slot, render)` | add UI to a slot (returns a remover) |
 | `orbit.addSettingsSection({label, icon?, render})` | add a whole Settings section |
+| `orbit.addMessageDecorator(m => …)` | append UI to every message; `m` = `{id, nick, text, kind, ts, mine}` |
 | `orbit.h / orbit.html` | render helpers |
 | `log(…)` | namespaced console logger |
 
@@ -89,10 +97,14 @@ instead. See **[Compiled plugins](https://orbit.tchatou.fr/docs/compiled-plugins
 | Slot | Where |
 |---|---|
 | `composer_button` | a button in the message composer toolbar |
+| `topbar_item` | an item in the channel topbar action row (next to search / notifications) |
+| `sidebar_item` | an item in the conversation sidebar header (next to the compose button) |
 | `settings_section` | a whole section in Settings (own nav entry + pane) — use `orbit.addSettingsSection()` |
 
-More slots (message decorators, side panels) will be added as the core grows
+Message decorators are added with `orbit.addMessageDecorator(m => …)` rather than
-stable homes for them.
+a slot — the callback runs for every rendered message. Every contributed slot and
+decorator renders inside its own error boundary, so a crashing plugin renders
+nothing instead of taking down the app.
 
 ## Trust & security