> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tappify.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# What is an extension

> An extension is a manifest plus a bundle you build and an owner installs on their project.

An extension is a manifest plus a bundle. You build it, an owner installs it on their
project, and it renders inside Tappify's dashboard — the host — next to Tappify's own
numbers. Start with [Your first extension](/extensions/start/your-first-extension) to have
one running in ten minutes.

The manifest, `tappify.extension.json`, declares three things:

| It declares               | Which means                                                                                                                     |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| What you render           | Widgets, tabs, pages, row actions and a settings panel, anchored to named host pages and slots                                  |
| What data you move        | Read queries against the owner's store data, hosted storage for your own documents, a connector that syncs metrics              |
| What the assistant can do | Tools, actions, skills and prompts the owner's assistant can reach once the assistant work ships; the manifest accepts them now |

The bundle is the code behind those declarations: a Module Federation remote that Tappify
serves from its own CDN and mounts in a shadow root on the owner's page.

## What Tappify owns and what you own

Tappify owns the chrome, the session, the tokens, the approval cards and the provenance
mark. You own the pixels inside your mount and the endpoints behind your own server.

<CardGroup cols={2}>
  <Card title="Tappify draws" icon="frame">
    Loading, failure and missing-scope states, the vendor tile on every surface you render,
    the consent screen, every approval card, and the expand panel's chrome.
  </Card>

  <Card title="You draw" icon="code">
    Your component's content, its own empty and error states inside the card, and the
    responses from your server.
  </Card>
</CardGroup>

Everything crosses one bridge, `tap`, which the host provides. Your code never touches the
host's DOM, router, cookies or storage, never sees a Tappify session credential or another
extension's data, and never writes to the owner's store without an approval card. The full
list is on [What extensions can never do](/extensions/reference/never).

When your extension fails to load, the host draws a card saying so and the rest of Tappify
carries on. That contract is why the mount is a shadow root and why the loader has an
8-second timeout.

## The pieces you install

| Piece                    | What it is                                                                             |
| ------------------------ | -------------------------------------------------------------------------------------- |
| `@tappify/extension-sdk` | The hooks, the UI kit, the manifest schema, the server handler and the testing helpers |
| `tappify`                | The CLI that scaffolds, types, serves, checks and publishes                            |
| Your vendor account      | A Tappify workspace with a sandbox project, where unpublished builds run               |

<CardGroup cols={2}>
  <Card title="Create a vendor account" icon="id-card" href="/extensions/start/create-a-vendor-account">
    One command creates the vendor, the workspace and the sandbox project.
  </Card>

  <Card title="Your first extension" icon="rocket" href="/extensions/start/your-first-extension">
    Scaffold, run, see it on a project, publish.
  </Card>
</CardGroup>