rspace-online/backlog/tasks/task-46 - Implement-Cross-App-Embedding-r-ecosystem-apps-in-rSpace-canvases.md

id	title	status	assignee	created_date	labels	milestone	dependencies	references	priority
TASK-46	Implement Cross-App Embedding: r-ecosystem apps in rSpace canvases	To Do		2026-02-18 20:07	feature phase-5 ecosystem	m-1	TASK-41 TASK-42	rspace-online/lib/shape-registry.ts rspace-online/server/index.ts rspace-online/website/canvas.html	high

Description

Allow r-ecosystem apps (rWallet, rVote, rMaps, etc.) to embed their live UI into rSpace canvases via dynamically loaded Web Components.

Ecosystem App Manifest Protocol:

• Each app hosts /.well-known/rspace-manifest.json
• Manifest declares: appId, name, icon, moduleUrl, shapes[] (tagName, defaults, portDescriptors, eventDescriptors)

New file lib/ecosystem-bridge.ts:

• EcosystemBridge class: loadManifest(), loadModule(), createSandboxedEmbed()
• Two embedding modes:
  1. Trusted (Web Component): dynamic import(), shares CRDT directly, full port/event access
  2. Sandboxed (iframe): postMessage bridge for untrusted apps, limited API

New Automerge shape type:

• type: "ecosystem-embed", appId, moduleUrl, config, sandboxed boolean

Server additions:

• GET /api/ecosystem/:appId/manifest — proxy to avoid CORS
• Server pre-fetches and caches ecosystem manifests

Canvas.html additions:

• Dynamic toolbar section for ecosystem apps (loaded from manifests)
• Lazy module loading on first use
• Service Worker caches modules for offline

Runtime:

1. Server fetches ecosystem manifests → toolbar shows app buttons
2. User adds ecosystem shape → module import()-ed → Web Component registered → shape created
3. Remote sync: create-shape for ecosystem-embed triggers lazy module load on other clients
4. Embedded components participate in port/event system like native shapes

Acceptance Criteria

• #1 Ecosystem manifest protocol defined and documented
• #2 EcosystemBridge loads manifests and dynamic imports modules
• #3 Trusted Web Components share CRDT and port/event system
• #4 Sandboxed iframe mode works with postMessage bridge
• #5 Server proxy avoids CORS for manifest/module loading
• #6 Toolbar dynamically shows ecosystem app buttons
• #7 Remote clients lazy-load modules when ecosystem shapes appear
• #8 Service Worker caches ecosystem modules for offline