---
path: /studio/yemaya/plugin-marketplace
surface: studio
domain: yemaya
auth: signed-in + studio entitlement
source: apps/oshun/web/src/app/studio/yemaya/plugin-marketplace/page.tsx
status: walked
last_walked:
  '2026-05-29 automated runtime walk (Playwright headless) — render, /v1 data
  (2xx), console/page-errors, expected content, screenshot verified; live
  screen-reader, touch, offline, and telemetry-delivery checks pending a manual
  AT pass. Evidence: WALKTHROUGH/results/runtime-sweep-2026-05-29.md; body
  re-derived 2026-06-03 from current source (lane-console architecture)'
---

# Studio · Yemaya · Plugin Marketplace

## Purpose

Admin lane console that validates a plugin manifest against the publish-readiness
rules — semver, host-compatibility range, known type, entry point, known
permissions, and a high-risk security-review flag. The validation lane is wired
to the live plugin-manifest validator over
`/v1/admin/yemaya/plugin-marketplace`; access is admin-scoped and fail-closed.

## Entry points

- No breadcrumb panel on this page.
- Reachable from sibling Yemaya routes that quick-action here (e.g.,
  `asset-marketplace`), and from the `marketplace` aggregator that embeds this
  lane.
- Direct URL / bookmark (signed-in + studio entitlement).

## Layout regions

`page.tsx` renders `ShellLayout active="studio"` and:

- **Workspace panel** (`StudioYemayaPluginMarketplaceWorkspace`,
  `data-yemaya-plugin-marketplace-workspace`):
  - `<h1>` (`WorkspaceHeading`) **"Yemaya Plugin Marketplace Workspace"**.
  - Summary paragraph (`data-yemaya-plugin-marketplace-summary`).
  - **Manifest Validation Lane** (`data-yemaya-pm-lane-heading`, `<h2>`): the
    catalog-loaded form (`data-yemaya-pm-form`).
- **Route Map panel** (`data-yemaya-plugin-marketplace-route-map`): `<h2>` "Route
  Map" + five entries from `STUDIO_YEMAYA_PLUGIN_MARKETPLACE_ROUTE_MAP`.
- **Quick-action panel**: two `quickAction` links.

## States

- [ ] **Loading** — `data-yemaya-pm-loading` "Loading plugin-marketplace
      validator…" until the GET catalog resolves.
- [ ] **Unauthorized** — `data-yemaya-pm-unauthorized` "Access restricted." on a
      401/403 (Yemaya admin scope required).
- [ ] **Error** — `data-yemaya-pm-error` "Could not load the plugin-marketplace
      validator." on a non-OK / malformed catalog response.
- [ ] **Ready (form)** — engine summary (`data-yemaya-pm-engine-summary`) + the
      manifest form render once the catalog loads.
- [ ] **Result** — `data-yemaya-pm-result` with a verdict headline
      (`data-yemaya-pm-headline`); submit-side validation surfaces in
      `data-yemaya-pm-validate-error`.

## Interactions

### Manifest Validation Lane

- [ ] **"Plugin manifest (JSON)"** — `<textarea data-yemaya-pm-manifest>`
      (aria-label "plugin manifest json"), prefilled with a sample manifest.
- [ ] **"Validate manifest"** — `<button data-yemaya-pm-submit>`; submitting POSTs
      the manifest to `/v1/admin/yemaya/plugin-marketplace/validate` and renders
      the valid/error/warning verdict + the security-review flag for high-risk
      permissions.

### Route map

`data-yemaya-plugin-marketplace-route-map` — five non-interactive entries:

- [ ] `/studio/yemaya/plugin-marketplace` — primary workspace
- [ ] `/studio/yemaya/plugin-marketplace/scenes/[sceneId]`
- [ ] `/studio/yemaya/plugin-marketplace/exports/[exportId]`
- [ ] `/studio/yemaya/plugin-marketplace/revisions/[revisionId]`
- [ ] `/studio/yemaya/plugin-marketplace/governance/[policyId]`

### Quick actions

- [ ] **"Open Yemaya Asset Marketplace workspace"** →
      `/studio/yemaya/asset-marketplace`.
- [ ] **"Back to Studio workspace index"** → `/studio`.

## Data & contracts

- **Reads**: `GET /v1/admin/yemaya/plugin-marketplace` (catalog: summary +
  known types/permissions) on mount.
- **Writes**: `POST /v1/admin/yemaya/plugin-marketplace/validate` (manifest →
  validation result).
- **Realtime**: none.
- **Caching**: client `fetch` on mount with `cache: 'no-store'`;
  `buildBffAuthHeaders()`.
- **Auth/role check**: admin-scoped, fail-closed (401/403 → unauthorized state);
  signed-in + studio entitlement enforced by the proxy/middleware.

## Cross-references

- Studio overview: [`studio-overview.md`](../../studio-overview.md)
- Workspace source:
  `apps/oshun/web/src/components/studio/StudioYemayaPluginMarketplaceWorkspace.tsx`
- Route map source:
  `apps/oshun/web/src/components/studio/StudioYemayaPluginMarketplaceRouteMap.ts`
- Aggregated by: [`studio-yemaya-marketplace.md`](./studio-yemaya-marketplace.md)
  (Plugin Marketplace Lane)
- Sibling lane:
  [`studio-yemaya-asset-marketplace.md`](./studio-yemaya-asset-marketplace.md)
- Feature spec: [`V1/features.md`](../../../../V1/features.md)

## Open questions / known gaps

- [ ] The route-map dynamic children (scenes / exports / revisions / governance)
      are sitemap-only — confirm whether any are backed by `page.tsx` files yet.