Skip to content

Marketplace Server Changelog

  • Keep public marketplace discovery and version metadata on the current manifest contract so obsolete stored versions cannot break plugin detail pages after a valid 0.1 upload.
  • Establish the stable Recall Marketplace Server.
    • Serve the 0.1 marketplace contract and validated plugin manifest snapshots.
    • Authenticate publishers and enforce plugin ownership and package scopes.
    • Validate plugin archives and declared JavaScript or theme entries before storage.
    • Bound request and expanded archive sizes, reject unsafe or duplicate archive paths, store canonicalized archives, protect cookie mutations from CSRF, and require a production auth secret.
    • Commit plugin metadata atomically in D1 and store each submission under a unique immutable R2 key.
    • Support publisher pages, version history, download tracking, and soft deletion.
    • Add Cloudflare deployment documentation and Bun coverage for the public, authentication, archive, manifest, and persistence boundaries.