Railbase core v0.5.7

Data-resident plugins: the core now installs plugins as encrypted, license-gated JS bundles in its own Vault and runs them in the goja runtime — no 33 MB out-of-process binary, no extra port, no subprocess.

• Marketplace install path branches on kind:"js" AFTER verifying sha256 + Ed25519 + the min_core gate, then lands the bundle via installPlugin and remounts routes live (no restart).
• uninstall removes the catalog row but KEEPS plugin data.
• Plugin code is AES-256-GCM encrypted at rest (release pins the key); a dormant/unpaid plugin's code is never decrypted.
• translate is the first plugin to ship this way (its standalone binary is retired); the in-process Register path stays for embedders.

Binaries pin the vendor key set + lock the marketplace to railbase.app. Verify downloads against checksums.txt.