Rebind code ships in two tiers, and one file decides which you’re in:
  • Script tier — a bare .lua/.luau file, no rebind.toml anywhere above it. The modeline comment at the top of the file owns all configuration.
  • Package tier — a directory (or any ancestor of the script) containing rebind.toml. The toml is package truth: it owns identity and can set every runtime option, overriding the entry’s modeline.
Promotion is additive: start with a single script, and when it outgrows one file, rebind new a package and move it in — nothing about the code changes.

Layout

The entry defaults to main.luau, then main.lua. requires resolve inside the package root: <mod>.luau, <mod>.lua, <mod>/init.luau, <mod>/init.lua.

rebind.toml

[marketplace] is optional until rebind publish, which demands it (plus short_description and icon) with precise errors. Pricing rules: one_time needs price_cents > 0; subscription needs subscription_cents > 0 and a subscription_interval of daily | weekly | monthly; free requires drm = false.

Precedence: toml over modeline

Inside a package, the entry’s modeline still works — an entry can run standalone during development — but any key also set in rebind.toml wins, and the collision is surfaced as a warning on the script’s log channel. A bare script outside any package keeps the classic contract: its modeline must declare name, version, and min_sdk.

Scripts inside a package

Any script under a package root — say scripts/wiggle.luau — runs in that package’s context, with deliberate limits: So a one-shot helper needs zero boilerplate:
exit() (alias for Script.Exit()) ends the script cleanly when it’s done.

The .rbp artifact

rebind package produces the registry artifact: a gzipped tarball of the package — plaintext source and assets, with VCS/build junk and any .rbp excluded. Review and distribution happen server-side; DRM protection is applied automatically when the package is distributed through the marketplace. The artifact you build and upload is never encrypted locally.