ADR 0034 — Theme marketplace catalogue (superseded)

The original design imagined a project-operated catalogue: an R2 bucket fronted by a hostname holding curated theme and plugin submissions, which the admin install dialog would browse and install from. ADR 0044 reversed this. A hosted catalogue is the only out-of-repo runtime dependency the install surface would carry, and a catalogue that resolves to a TLS error is worse than none — every fresh deploy would meet an unavailable banner the moment the install dialog opened.

As shipped, packages install two ways: Browse bundled (first-party packages baked into the Worker, installed through the internal _first_party:// resolver) and Install by URL (paste an https:// URL to a signed tarball). The signed-package security model is the trust gate, not a listing.

The catalogue was not fully abandoned at the key layer: the signing keys a community-run catalogue would need — cusp-catalogue-2026 (purpose catalogue), community-theme, and community-plugin — remain pre-registered in src/worker/install/key-registry.ts. Standing a catalogue back up would be its own decision with its own host commitments, but no current code makes it harder.