Package Format

Rebind code ships in two tiers, and one file decides which you’re in:

Script tier: a bare .lua/.luau file, no rebind.toml anywhere above it. The modeline comment at the top of the file owns all configuration.
Package tier: a directory (or any ancestor of the script) containing rebind.toml. The toml is package truth: it owns identity and can set every runtime option, overriding the entry’s modeline.

Promotion is additive: start with a single script, and when it outgrows one file, rebind new a package and move it in. Nothing about the code changes.

Layout

hello/
  rebind.toml          # the package manifest
  main.luau            # the entry (or set [package].entry)
  lib/util.luau        # optional modules: require("lib/util")
  scripts/wiggle.luau  # optional standalone tools: rebind run scripts/wiggle.luau
  assets/icon.png      # binary assets; listing media must live here
  README.md            # ships in the package, and is the listing's overview

The entry defaults to main.luau, then main.lua. requires resolve inside the package root: <mod>.luau, <mod>.lua, <mod>/init.luau, <mod>/init.lua.

rebind.toml

[package]
name = "hello"          # the identifier: public identity is @yourhandle/hello
version = "0.0.1"
min_sdk = "3.4.1"       # oldest Rebind version the package runs on
# entry = "main.luau"   # optional, this is the default

[runtime]               # optional: every modeline key works here
# tick_rate = 1000
# window = ["chrome"]   # activate only when a matching window is focused
# process = ["chrome.exe"]
# process_regex = ["^(chrome|firefox)\\.exe$"]
# exclude_window = ["Private"]
# exclude_process_regex = ["^(obs64|discord)\\.exe$"]
# permissions = ["net"] # gate Net.* / System.Exec ("exec") use
# memory_limit_mb = 64  # raise the Luau heap (MB) for image-heavy scripts
# instance = "replace"  # replace | single | multiple
# hardware_only = false
# key_block = true
# mouse_block = false

The toml key is permissions (a list). In a modeline, permission= and permissions= behave identically: either takes one value or a comma-separated list, and every line adds to the set. An empty set means “declared, needs nothing”: permissions = [] in the toml, or permissions=none (or a bare permissions=) in a modeline. Omitting the key entirely is the opposite, and grants every permission. See Permissions. A package you intend to publish must declare the key. The registry refuses a version that leaves it undeclared, since “undeclared” reads as every permission, and rebind check fails it offline once [marketplace] is present. Declaring the empty set is always available for a script that needs nothing. Publishing adds a third section, [marketplace]. It is only read by rebind check and rebind publish, never by the runtime: see the marketplace listing.

Precedence: toml over modeline

Inside a package, the entry’s modeline still works (an entry can run standalone during development), but any key also set in rebind.toml wins, and the collision is surfaced as a warning on the script’s log channel. A bare script outside any package declares min_sdk in its modeline.

-- script tier: the modeline is the manifest
-- rebind: name=wiggle version=0.1.0 min_sdk=3.0.0
-- rebind: permission=net

Scripts inside a package

Any script under a package root (for example scripts/wiggle.luau) runs in that package’s context, with deliberate limits:

Inherited	Not inherited
`[package]` `min_sdk` and `version` (as defaults; its own modeline still wins)	`name`: the script keeps its file name (own log channel)
`require` resolution from the package root	`[runtime]` keys: a tool script declares its own permissions

So a one-shot helper needs zero boilerplate:

function OnStart()
  HID.MoveTo(500, 500)
  exit()
end

exit() (alias for Script.Exit()) ends the script cleanly when it’s done.

The .rbp artifact

rebind package produces the registry artifact: a gzipped tarball of the package (plaintext source and assets, with VCS/build junk and any .rbp excluded).

The marketplace listing

The script marketplace has not been released yet. This section is documented for authors preparing packages ahead of launch.

[marketplace] is publish-time configuration. A package without it is a valid dev package; rebind publish refuses without it. rebind new scaffolds the block commented out.

[marketplace]
summary = "One line, shown in the grid."
category = "utility"          # gaming | utility | macro | qol
tags = ["remap", "productivity"]
icon = "assets/icon.png"      # optional, see Listing media
media = ["assets/shot-1.png", "assets/demo.mp4"]
private = false               # true: reachable by direct link only
drm = false                   # requires a price

# absent = free · one_time AND an interval key together = hybrid
[marketplace.price]
one_time = 15.00              # usd, two decimals max
monthly = 5.00                # or weekly / daily, one interval key at most

Field	Required	Notes
`summary`	to publish	the one-line shelf label (grid card, search)
`category`	yes	`gaming`, `utility`, `macro`, `qol`
`[marketplace.price]`	for paid listings	absent = free. The key is the model: `one_time` sells a lifetime purchase; `monthly`/`weekly`/`daily` sells a subscription; both together sell both
`drm`	no	defaults `false`; a free listing with `drm = true` is rejected
`private`	no	defaults `false`; private listings never appear in browse or profiles but stay purchasable by direct link
`tags`	no	free-form strings
`icon`	no	optional 128x128 listing icon, separate from gallery media
`media`	to publish	ordered cover and gallery media, including at least one png screenshot

Prices are USD with at most two decimals. Subscription prices are locked in at subscribe time: an approved price change applies to new subscribers only. Existing subscribers keep their price until they cancel. rebind check validates the whole block offline: category, the price table, and every media path. rebind preview renders the listing as a local HTML page before anything is uploaded. Everything here is also re-validated server side at publish. summary is limited to 140 characters. Details belong in README.md.

Listing media

Both icon and media are file paths inside the package. You never supply a URL; publish uploads the files and the marketplace stores its own keys.

Rule	Value
Location	under `assets/`, relative, no `..` segments
Formats	`.png` and `.mp4` only
Gallery size	at most 8 entries in `media`
Icon	exactly 128x128 png, at most 512 KiB
Screenshot	exactly 1280x800 or 640x400 png, at most 2 MiB
Video	mp4, at most 16 MiB

The first screenshot png in media becomes the cover used by the grid and product page. Publish removes it from the remaining gallery so it does not appear twice. At least one screenshot png is required, even when icon is set. The optional icon is a separate 128x128 listing asset and never becomes a gallery slide. Remaining media entries keep their declaration order.

README.md

A README.md at the package root is the listing’s long description. It ships inside the .rbp as well, so an installed copy reads offline.

Rendered as markdown in the product page overview card.
64 KiB cap. Over it is an error, not a truncation.
Packages only. A bare script never picks one up.
Without one, the product page falls back to summary.

Packages are always plaintext

drm = true on a package is rejected at publish. DRM is a single-file feature: the runtime resolves require() off disk, so a DRM package would decrypt straight back onto the buyer’s disk. Publish a single-file script for DRM. Paid is independent of DRM. Entitlement gates on price, so a paid package with drm = false is still gated at download.

Getting Started

Concepts

Cookbook

Reference

Remote Control

Help

Package Format

Layout

rebind.toml

Precedence: toml over modeline

Scripts inside a package

The .rbp artifact

The marketplace listing

Listing media

README.md

Packages are always plaintext

​Layout

​rebind.toml

​Precedence: toml over modeline

​Scripts inside a package

​The .rbp artifact

​The marketplace listing

​Listing media

​README.md

​Packages are always plaintext

Layout

rebind.toml

Precedence: toml over modeline

Scripts inside a package

The .rbp artifact

The marketplace listing

Listing media

README.md

Packages are always plaintext