[package]

The [package] table is the package's identity: what it is called, what version it is at, and who stands behind it.

[package]
name = "chief/core"
version = "0.1.0"
description = "The core of Chief, a Luau module framework"
authors = ["ryancundiff"]
repository = "ryancundiff/chief"
license = "MIT"
logo = "assets/logo.png"
private = true

name#

Required. scope/name — exactly two parts separated by one /. Each part allows lowercase letters, digits, dashes, and underscores (dashes are in because wally names use them); anything else, uppercase included, is rejected. The scope belongs to the GitHub account that first publishes under it — see Publishing.

version#

Required. Standard semver (0.1.0, 1.2.3-rc.1), no leading v. Published versions are immutable; bump this to ship changes.

description#

Optional. The registry caps it at 200 characters (counted as characters, not bytes) and embr publish fails before uploading when it is over. This is the text search results and package cards show.

authors#

Optional list of GitHub usernames, shape-checked (1–39 characters, alphanumeric or dashes, no leading, trailing, or double dash) but not verified to exist.

Authors are not display names or emails — every login here is appended to the scope's owner list on publish and gains publish access to the entire scope, append-only. Treat the field like the access control list it is; details in Publishing.

repository#

Optional. Accepted as owner/repo shorthand, an https URL, or an ssh remote; the registry normalizes all three to an https URL. This link is self-declared — any package can point at any repository. A version published from GitHub Actions carries a verified provenance block whose repository is checked against the scope's owners; that one is a fact, and the site resolves readme-relative assets against it when present.

license#

Optional SPDX id (MIT, Apache-2.0, GPL-3.0-only, ...). embr init offers a picker.

logo#

Optional. The path of a .png, .jpg, .jpeg, or .webp file in the package, relative to the manifest. The registry shows it in place of the box icon, on the package page and in search. The file always ships, even when includes leaves it out.

embr publish refuses a missing file, another file type, or a file over 512 KiB. The registry also checks that the file's bytes match its extension. SVG is never accepted.

private#

Optional, default false. When true, embr publish refuses the package (prints "package is private, refusing to publish" and succeeds doing nothing). Conventional on workspace roots that only exist to hold members.