Separate marketplace plugins from host plugins

Craft Hub treats Host Plugins and Marketplace Plugins as separate trust boundaries. Host Plugins are explicitly installed code dependencies that may execute inside a host, while Marketplace Plugins are declarative, immutable npm packages installed without lifecycle scripts or runtime imports; a versioned Plugin Catalog supplies their integrity, compatibility, permission disclosure, lifecycle status, and optional discovery metadata. Distributions may curate Managed Sources, but installing either kind of plugin never grants Project Trust.

Marketplace extension packs remain declarative: includesPlugins resolves only packages listed by the same source, is copied into the Catalog for pre-install review, and is verified against every downloaded Manifest. Included plugins remain independently manageable after installation. requiresPlugins is reserved for true hard dependencies. This composes features without turning npm runtime dependencies or Host Plugin execution into an implicit install side effect.

These are plugin trust boundaries, not a requirement for separate public and private applications. The ordinary desktop and local browser workbench restore the same explicitly approved Host extension registrations on startup. Marketplace installation does not create those registrations. Distribution manifests remain an optional packaging and provisioning mechanism; adding a Host extension to the ordinary application does not change its branding, updates, or project trust.