task-d.7.9

docs/setup/setup-plugin-development.md

@@ -0,0 +1,37 @@
+# Setup Plugin Development
+
+Setup plugins let modules extend setup without editing the setup wizard directly.
+
+Plugin source lives under:
+
+```text
+src/features/setup/plugins/
+```
+
+Required plugin contract:
+
+- plugin id and version
+- installation profiles
+- setup templates
+- wizard steps
+- readiness checks
+- verification checks
+- CSV preview validators
+- import handlers
+- reset scopes
+- reseed targets
+- golden dataset registration
+
+Core plugins:
+
+- `foundation`: setup platform foundations, state, seed manifests, reset framework, CSV framework
+- `crm`: CRM templates, CRM verification, CRM reset scopes, and CRM golden dataset
+
+Future modules should add a plugin class and register it in `plugin-registry.ts`. They should not add one-off setup logic directly to the wizard.
+
+Safety rules:
+
+- Plugins cannot bypass Auth.js setup route protection.
+- Reset scopes must declare destructive behavior and affected tables.
+- CSV templates must declare ownership to avoid duplicate file contracts.
+- Seed tasks must be idempotent before execution is exposed.