- Script tier — a bare
.lua/.luaufile, norebind.tomlanywhere above it. The modeline comment at the top of the file owns all configuration. - Package tier — a directory (or any ancestor of the script) containing
rebind.toml. The toml is package truth: it owns identity and can set every runtime option, overriding the entry’s modeline.
rebind new a package and move it in — nothing about the code changes.
Layout
main.luau, then main.lua. requires resolve inside
the package root: <mod>.luau, <mod>.lua, <mod>/init.luau, <mod>/init.lua.
rebind.toml
[marketplace] is optional until rebind publish, which demands it (plus
short_description and icon) with precise errors. Pricing rules: one_time
needs price_cents > 0; subscription needs subscription_cents > 0 and a
subscription_interval of daily | weekly | monthly; free requires
drm = false.
Precedence: toml over modeline
Inside a package, the entry’s modeline still works — an entry can run standalone during development — but any key also set inrebind.toml wins, and the
collision is surfaced as a warning on the script’s log channel. A bare script
outside any package keeps the classic contract: its modeline must declare
name, version, and min_sdk.
Scripts inside a package
Any script under a package root — sayscripts/wiggle.luau — runs in that
package’s context, with deliberate limits:
So a one-shot helper needs zero boilerplate:
exit() (alias for Script.Exit()) ends the script cleanly when it’s done.
The .rbp artifact
rebind package produces the registry artifact: a gzipped tarball of the
package — plaintext source and assets, with VCS/build junk and any .rbp
excluded. Review and distribution happen server-side; DRM protection is applied
automatically when the package is distributed through the marketplace. The
artifact you build and upload is never encrypted locally.