Packaging your extension

A marketplace package is a .vpkg — a gzip tarball built by verentis pack that carries everything a workspace needs:

manifest.yaml                       # your app/engine/bundle manifest (always plaintext)
files/                              # bundled payload → children of the installed manifest node
  schemas/report.schema.json
  browser/dist/worker.js
catalog/                            # optional marketplace presentation (always plaintext)
  index.json
  assets/<sha256>.svg
  docs/<sha256>.md
.verentis/
  package.yaml                      # name, publisher, version, kind
  digests.json                      # sha256 per entry — the signing payload
  signatures/developer.dsse.json    # your Ed25519 signature (added by pack)
  signatures/marketplace.dsse.json  # marketplace countersignature (added on approval)
  encryption.json                   # present only for encrypted packages

Package identity is {publisher}/{name}@{version}. By default an application or engine record installs at /applications/{name} (for example /applications/my-app). Payload files remain children of that record unless an application uses spec.install[] to place them elsewhere. Manifest-relative references still work for child payloads: json-schema.source: ./schemas/report.schema.json and runtimes.wasm.adapter: ./browser/dist/worker.js resolve to the bundled files.

The packaging section

Add a top-level packaging section to your manifest:

packaging:
  publisher: acme            # your publisher name
  files:                     # globs (relative to the manifest) selecting the payload
    - "schemas/**/*.json"
    - "browser/dist/worker.js"
  encryption: none           # none | optional | required
  bundle:                    # (Bundle kind only)
    default-path: /data/my-bundle

An explicit files list selects the complete payload and overrides automatic selection. Without it, the packer derives payload files from manifest-relative schema source values and spec.install[].from globs. Declare files whenever the package needs additional files such as engine workers or bundle content.

Marketplace presentation

The optional top-level marketplace block is independent of packaging.files:

marketplace:
  logo: ./marketplace/logo.svg
  hero:
    source: ./marketplace/hero.webp
    alt: Workflow editor overview
  images:
    - source: ./marketplace/editor.webp
      alt: Editor showing a completed workflow
  readme: ./README.md
  changelog: ./CHANGELOG.md
  assets:
    - "marketplace/docs/**/*.{png,jpg,jpeg,webp,svg}"

verentis pack writes these files to deterministic, content-addressed catalog/assets/** and catalog/docs/** entries described by catalog/index.json. Catalog entries are covered by package digests and signatures but stay plaintext even when the payload is encrypted.

Pack, verify, publish

verentis pack                 # → my-app-0.1.0.vpkg (digested + signed)
verentis verify my-app-0.1.0.vpkg
verentis publish my-app-0.1.0.vpkg

pack computes a sha256 digest for the manifest and every payload entry; the registry rejects any tampered upload. With a signing key configured (verentis keygen) the digest document is signed (DSSE, Ed25519) — publishers with registered keys must sign.

Encrypted packages

For proprietary payloads, verentis pack --encrypt seals every files/ entry with AES-256-GCM. manifest.yaml, catalog/**, and .verentis/** stay plaintext so discovery, moderation, presentation, and registration keep working. The content key is wrapped per recipient. Configure the platform recipient with verentis login --sealing-key <base64> (or VERENTIS_SEALING_KEY), or provide custom recipients via --recipient id=base64Key; packing fails if no recipient is available.

Encrypted packages install sealed: the tarball stays intact as a single node and members are decrypted transiently by the platform on read — plaintext never lands in the workspace tree.

Production readiness

Pre-publish checklist

Next