Publish an extension

There are two tiers: listed and verified.

#Listed: open, no account

An extension is listed in the gallery when its package:

1. is published to npm or crates.io;
2. carries the keyword orrery-extension;
3. has a valid orrery.toml at the package root.

{
  "name": "orrery-ext-buildgraph",
  "version": "1.2.0",
  "keywords": ["orrery-extension"],
  "files": ["orrery.toml", "index.mjs"]
}

For a crate, put the keyword in Cargo.toml's keywords and make sure orrery.toml is in the packaged files.

A nightly job crawls both registries and checks each manifest. A package whose manifest fails is skipped and the reason is logged. Listed extensions stay unpinned, and the gallery says so next to the grants they ask for.

Add an optional [listing] table for the gallery card (see Manifest reference).

Status: the crawl and the gallery are being built. Publishing with the keyword now is enough to be picked up when they ship.

#Verified: the signed index

Publish to npm or crates.io first, then, from the extension's folder:

orrery publish --dry-run     # build the index entry and print it; --json prints it as JSON
orrery publish               # open the pull request
orrery publish ./my-ext      # another folder

orrery publish:

1. checks orrery.toml and runs orrery ext test on the package;
2. downloads the version you already published to npm or crates.io, and refuses if it is not the manifest's version;
3. hashes it the way an install will, and builds the entry: name, version, source, sha256, grants, author;
4. opens a pull request to kouji-dev/orrery-registry with the GitHub CLI (gh, signed in), adding entries/<id>/<version>.toml.

The index repository's CI fetches the package again, re-checks the hash and the conformance run, and diffs the grants against the previous version. A maintainer merges, and the index is re-signed and published at https://getorrery.dev/registry/index.toml.

Not live yet: the index repository's signing key and its first entries are still being set up. Until they are, --dry-run is the useful form, and a bare-name install of your extension will not resolve.

• A bare name is a verified name. It belongs to whoever first verifies it, and later versions must come from the same author. Listed-only packages never take a bare name.
• Report and revoke. Every gallery card links to an issue template in the index repository. A revoked version is removed from the index and added to its revoked list, and clients refuse to load it after their next index fetch.

#Before you publish

• Run orrery ext test ./your-extension. No model, no network.
• Ask only for what you need, and say why in your README. An install prompt is only meaningful if someone could have said no.
• Commit a lockfile. Your dependencies are not reviewed, even for a verified extension. See Grants and the supply chain.