first commit

2026-07-11 14:56:10 +08:00
commit 7e05d0a4e7
660 changed files with 78119 additions and 0 deletions
@@ -0,0 +1,57 @@
+## ADDED Requirements
+
+### Requirement: Marketplace APIs expose registry-backed plugin catalog data
+
+The platform SHALL expose marketplace list and detail APIs derived from installed game plugin registry metadata.
+
+#### Scenario: Marketplace list returns installed plugin data
+- **WHEN** a client requests marketplace plugins with optional status, server type, capability, or keyword filters
+- **THEN** the platform MUST return bounded plugin summaries with identity, version, display metadata, server type, install status, capabilities, pages, permissions, and AI purposes
+
+#### Scenario: Marketplace detail returns safe plugin metadata
+- **WHEN** a client requests one marketplace plugin detail
+- **THEN** the platform MUST return manifest-backed metadata and MUST NOT expose raw host paths, direct run sockets, raw credentials, platform auth storage, storage backend credentials, or raw AI provider keys
+
+### Requirement: Marketplace state actions are platform-mediated
+
+The platform SHALL provide safe marketplace actions for changing installed plugin state without external package download or run execution.
+
+#### Scenario: Plugin is enabled or disabled
+- **WHEN** an operator enables or disables a marketplace plugin
+- **THEN** the platform MUST validate the plugin ID, update registry state, and return the redacted marketplace plugin detail
+
+#### Scenario: Unknown plugin action is rejected
+- **WHEN** an operator submits a state action for a missing plugin ID or unsupported action
+- **THEN** the platform MUST return a stable JSON error and MUST NOT change other plugin state
+
+### Requirement: Marketplace frontend uses centralized API contracts
+
+The frontend SHALL keep marketplace API types and client methods in `platform_web/api` and SHALL use them from the plugin marketplace page.
+
+#### Scenario: Page loads marketplace data
+- **WHEN** the Plugin Marketplace page renders with a reachable backend
+- **THEN** it MUST fetch plugin summaries from the marketplace API and render loading, error, empty, and populated states
+
+#### Scenario: Page filters and opens detail
+- **WHEN** an operator filters or selects a plugin
+- **THEN** the page MUST use API-backed data to update the list/detail view without relying on hidden page-local DTO contracts
+
+### Requirement: Marketplace UI preserves safety and theme constraints
+
+The Plugin Marketplace page SHALL preserve the platform_web magical-girl crystal-moonlight operations console style and avoid unsafe or unrelated marketplace concepts.
+
+#### Scenario: UI renders plugin cards and actions
+- **WHEN** marketplace data is displayed
+- **THEN** the UI MUST show game plugin metadata, capability tags, status controls, and install/enable actions without billing, cloud host sales, provider marketplace, raw secrets, or generic SaaS storefront behavior
+
+#### Scenario: Browser walkthrough verifies no secret rendering
+- **WHEN** frontend marketplace behavior is claimed complete
+- **THEN** a browser walkthrough MUST verify the page renders API-backed plugin data and visible text excludes raw credential markers
+
+### Requirement: Marketplace implementation is verified
+
+The change SHALL include backend tests, frontend tests/build, browser walkthrough evidence, structure validation, and strict OpenSpec validation.
+
+#### Scenario: Verification commands pass
+- **WHEN** the change is complete
+- **THEN** platform tests, platform_web tests/typecheck/build, `scripts/check-structure.sh`, and `openspec validate implement-plugin-marketplace-api-driven-ui --strict` MUST pass