Package format

Rebind code ships in two tiers, and one file decides which you’re in:

• Script tier — a bare .lua/.luau file, no rebind.toml anywhere above it. The modeline comment at the top of the file owns all configuration.
• Package tier — a directory (or any ancestor of the script) containing rebind.toml. The toml is package truth: it owns identity and can set every runtime option, overriding the entry’s modeline.

Promotion is additive: start with a single script, and when it outgrows one file, rebind new a package and move it in — nothing about the code changes.

Layout

hello/
  rebind.toml          # the package manifest
  main.luau            # the entry (or set [package].entry)
  lib/util.luau        # optional modules — require("lib/util")
  scripts/wiggle.luau  # optional standalone tools — rebind run scripts/wiggle.luau
  assets/icon.png      # optional binary assets
  README.md            # optional long description for the store listing

The entry defaults to main.luau, then main.lua. requires resolve inside the package root: <mod>.luau, <mod>.lua, <mod>/init.luau, <mod>/init.lua.

rebind.toml

[package]
name = "hello"          # the identifier — public identity is @yourhandle/hello
version = "0.0.1"
min_sdk = "3.0.0"       # oldest Rebind version the package runs on
# entry = "main.luau"   # optional, this is the default

[runtime]               # optional — every modeline key works here
# tick_rate = 1000
# window = ["cs2"]      # activate only when a matching window is focused
# process = ["cs2.exe"]
# permissions = ["net"] # gate Net.* / System.Exec ("exec") use
# instance = "replace"  # replace | single | multiple
# hardware_only = false
# key_block = true
# mouse_block = false

[marketplace]           # only needed to publish
short_description = "One line for the store card"
category = "utility"    # gaming | utility | macro | qol
pricing_model = "free"  # free | one_time | subscription
icon = "assets/icon.png"
tags = []

[marketplace] is optional until rebind publish, which demands it (plus short_description and icon) with precise errors. Pricing rules: one_time needs price_cents > 0; subscription needs subscription_cents > 0 and a subscription_interval of daily | weekly | monthly; free requires drm = false.

Precedence: toml over modeline

Inside a package, the entry’s modeline still works — an entry can run standalone during development — but any key also set in rebind.toml wins, and the collision is surfaced as a warning on the script’s log channel. A bare script outside any package keeps the classic contract: its modeline must declare name, version, and min_sdk.

-- script tier: the modeline is the manifest
-- rebind: name=wiggle version=0.1.0 min_sdk=3.0.0
-- rebind: permission=net

Scripts inside a package

Any script under a package root — say scripts/wiggle.luau — runs in that package’s context, with deliberate limits:

So a one-shot helper needs zero boilerplate:

function OnStart()
  HID.MoveTo(500, 500)
  exit()
end

exit() (alias for Script.Exit()) ends the script cleanly when it’s done.

The .rbp artifact

rebind package produces the registry artifact: a gzipped tarball of the package — plaintext source and assets, with VCS/build junk and any .rbp excluded. Review and distribution happen server-side; DRM protection is applied automatically when the package is distributed through the marketplace. The artifact you build and upload is never encrypted locally.