first commit

platform_web/contracts/plugin-page-bridge.md

@@ -0,0 +1,24 @@
+# Plugin Page Bridge Contract
+
+Plugin page runs with safe platform context.
+
+## Host Context
+
+- `pluginId`: installed plugin ID.
+- `routeKey`: current plugin route.
+- `serverInstanceId`: optional selected server instance.
+- `themeTokens`: safe theme tokens.
+- `permissions`: effective plugin permissions.
+
+## Host APIs
+
+- `api.request`: platform-scoped request only.
+- `jobs.dispatch`: authorized job dispatch.
+- `logs.query`: historical log query and analysis windows.
+- `artifacts.open`: artifact upload/download references.
+- `files.request`: scoped file operation requests.
+- `ai.invoke`: platform-mediated AI invocation.
+
+## Forbidden
+
+The host must not expose raw auth storage, AI keys, run credentials, host paths, or storage backend credentials.