Build bounded activities for the Cornerstone sandbox.

Create, validate, test, and package static Activity plugins against the versioned manifest and MessageChannel bridge.

@cornerstonestack/activity-plugin-sdk is currently a private workspace package. Public documentation does not enable installation, import, publication, entitlement, or workspace access.

Sandbox architecture

Activity plugins are pre-built static files.
They run in a network-disabled, opaque-origin iframe with scripts only.
They communicate only through the versioned MessageChannel bridge.
Archives contain relative runtime assets and no CDN or node_modules dependency.

Authoring workflow

yarn plugin:create confidence-check
yarn plugin:dev confidence-check
yarn plugin:test confidence-check
yarn plugin:validate confidence-check
yarn plugin:pack confidence-check

Starter templates

React

The recommended first-party template includes JSX source, a framework-independent model, shared runtime adapter, Core controls, component/runtime tests, and direct plus iframe stories.

Vanilla

A framework-free static starter retained for legacy and third-party development.

Custom Element

A framework-free custom-element starter using the same bridge envelope and explicit form-submission safeguards.

Browser bridge

ready(): Announce that the plugin has initialized.
error(payload): Report a handled failure to the host diagnostic UI.
submit(response): Submit data matching the manifest responseSchema.
resize(height): Request a frame height within manifest limits.
log(payload): Expose structured preview-only diagnostics.

const client = await connectCornerstoneActivity({
  onInit: ({ configuration }) => render(configuration),
  onState: ({ response }) => response && restore(response),
  onCommand: (command) => handleCommand(command),
})

await client.ready()
await client.resize(document.documentElement.scrollHeight)
await client.submit({ confidence: 4 })

Manifest contract

schemaVersion

id

name

version

apiVersion

runtime

capabilities

configurationSchema

responseSchema

Security rules

Do not put secrets, tokens, remote URLs, source maps, package managers, or runtime dependencies in an archive.
Production frames have no network, same-origin, forms, downloads, popups, or navigation permissions.
Cancel native form submission and persist learner state only through submit().
Logging is preview-only and is not persisted as learner data.
Keep raw bridge messages, window, and MessageChannel out of feature views.

The public Site documents authoring contracts only. Authenticated plugin import, validation against a workspace, publication, assignment, installed state, entitlements, and participant data remain Studio-owned workflows.