@dxos/plugin-registry 0.8.4-staging.60fe92afc8 → 0.9.1-main.c7dcc2e112

package/dx.config.ts

@@ -0,0 +1,20 @@
+//
+// Copyright 2025 DXOS.org
+//
+
+import { Config2 } from '@dxos/app-framework/config';
+import { trim } from '@dxos/util';
+
+export default Config2.make({
+  plugin: {
+    key: 'org.dxos.plugin.registry',
+    name: 'Plugins',
+    author: 'DXOS',
+    description: trim`
+      Plugin management system for discovering, installing, and configuring workspace extensions.
+      Browse available plugins and customize your workspace capabilities.
+    `,
+    icon: { key: 'ph--squares-four--regular' },
+    tags: ['system'],
+  },
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dxos/plugin-registry",
-  "version": "0.8.4-staging.60fe92afc8",
+  "version": "0.9.1-main.c7dcc2e112",
   "description": "Braneframe plugin gallery",
   "homepage": "https://dxos.org",
   "bugs": "https://github.com/dxos/dxos/issues",
@@ -52,28 +52,35 @@
   "types": "dist/types/src/index.d.ts",
   "files": [
     "dist",
+    "dx.config.ts",
     "src"
   ],
   "dependencies": {
     "@effect-atom/atom-react": "^0.5.0",
     "@effect/cli": "0.75.2",
     "yaml": "^2.8.2",
-    "@dxos/app-toolkit": "0.8.4-staging.60fe92afc8",
-    "@dxos/app-framework": "0.8.4-staging.60fe92afc8",
-    "@dxos/cli-util": "0.8.4-staging.60fe92afc8",
-    "@dxos/client-protocol": "0.8.4-staging.60fe92afc8",
-    "@dxos/compute": "0.8.4-staging.60fe92afc8",
-    "@dxos/effect": "0.8.4-staging.60fe92afc8",
-    "@dxos/log": "0.8.4-staging.60fe92afc8",
-    "@dxos/plugin-graph": "0.8.4-staging.60fe92afc8",
-    "@dxos/react-ui-form": "0.8.4-staging.60fe92afc8",
-    "@dxos/keys": "0.8.4-staging.60fe92afc8",
-    "@dxos/invariant": "0.8.4-staging.60fe92afc8",
-    "@dxos/plugin-observability": "0.8.4-staging.60fe92afc8",
-    "@dxos/react-ui-mosaic": "0.8.4-staging.60fe92afc8",
-    "@dxos/react-ui-markdown": "0.8.4-staging.60fe92afc8",
-    "@dxos/react-ui-stack": "0.8.4-staging.60fe92afc8",
-    "@dxos/util": "0.8.4-staging.60fe92afc8"
+    "@dxos/app-framework": "0.9.1-main.c7dcc2e112",
+    "@dxos/app-toolkit": "0.9.1-main.c7dcc2e112",
+    "@dxos/client": "0.9.1-main.c7dcc2e112",
+    "@dxos/client-protocol": "0.9.1-main.c7dcc2e112",
+    "@dxos/cli-util": "0.9.1-main.c7dcc2e112",
+    "@dxos/compute": "0.9.1-main.c7dcc2e112",
+    "@dxos/edge-client": "0.9.1-main.c7dcc2e112",
+    "@dxos/invariant": "0.9.1-main.c7dcc2e112",
+    "@dxos/echo": "0.9.1-main.c7dcc2e112",
+    "@dxos/keys": "0.9.1-main.c7dcc2e112",
+    "@dxos/plugin-graph": "0.9.1-main.c7dcc2e112",
+    "@dxos/log": "0.9.1-main.c7dcc2e112",
+    "@dxos/protocols": "0.9.1-main.c7dcc2e112",
+    "@dxos/context": "0.9.1-main.c7dcc2e112",
+    "@dxos/plugin-observability": "0.9.1-main.c7dcc2e112",
+    "@dxos/react-ui-form": "0.9.1-main.c7dcc2e112",
+    "@dxos/react-ui-mosaic": "0.9.1-main.c7dcc2e112",
+    "@dxos/react-ui-stack": "0.9.1-main.c7dcc2e112",
+    "@dxos/types": "0.9.1-main.c7dcc2e112",
+    "@dxos/react-ui-markdown": "0.9.1-main.c7dcc2e112",
+    "@dxos/util": "0.9.1-main.c7dcc2e112",
+    "@dxos/effect": "0.9.1-main.c7dcc2e112"
   },
   "devDependencies": {
     "@effect-atom/atom-react": "^0.5.0",
@@ -84,11 +91,11 @@
     "react": "~19.2.3",
     "react-dom": "~19.2.3",
     "vite": "^8.0.16",
-    "@dxos/plugin-testing": "0.8.4-staging.60fe92afc8",
-    "@dxos/random": "0.8.4-staging.60fe92afc8",
-    "@dxos/react-ui": "0.8.4-staging.60fe92afc8",
-    "@dxos/ui-theme": "0.8.4-staging.60fe92afc8",
-    "@dxos/storybook-utils": "0.8.4-staging.60fe92afc8"
+    "@dxos/plugin-testing": "0.9.1-main.c7dcc2e112",
+    "@dxos/react-ui": "0.9.1-main.c7dcc2e112",
+    "@dxos/storybook-utils": "0.9.1-main.c7dcc2e112",
+    "@dxos/ui-theme": "0.9.1-main.c7dcc2e112",
+    "@dxos/random": "0.9.1-main.c7dcc2e112"
   },
   "peerDependencies": {
     "@effect-atom/atom-react": "^0.5.0",
@@ -96,8 +103,8 @@
     "effect": "3.21.3",
     "react": "~19.2.3",
     "react-dom": "~19.2.3",
-    "@dxos/react-ui": "0.8.4-staging.60fe92afc8",
-    "@dxos/ui-theme": "0.8.4-staging.60fe92afc8"
+    "@dxos/react-ui": "0.9.1-main.c7dcc2e112",
+    "@dxos/ui-theme": "0.9.1-main.c7dcc2e112"
   },
   "publishConfig": {
     "access": "public"

package/src/RegistryPlugin.node.ts

@@ -7,11 +7,11 @@ import { AppPlugin } from '@dxos/app-toolkit';
 
 import { meta } from '#meta';
 
-import { plugin } from './commands';
+import { plugin, registry } from './commands';
 
 export const RegistryPlugin = Plugin.define(meta).pipe(
   AppPlugin.addCommandModule({
-    commands: [plugin],
+    commands: [plugin, registry],
   }),
   Plugin.make,
 );

package/src/RegistryPlugin.test.ts

@@ -10,7 +10,7 @@ import { RegistryPlugin } from '#plugin';
 
 import { meta } from './meta';
 
-const moduleId = (name: string) => `${meta.id}.module.${name}`;
+const moduleId = (name: string) => `${meta.profile.key}.module.${name}`;
 
 describe('RegistryPlugin', () => {
   test('modules activate on the expected events', async ({ expect }) => {

package/src/capabilities/app-graph-builder.ts

@@ -4,7 +4,7 @@
 
 import * as Effect from 'effect/Effect';
 
-import { Capabilities, Capability, type Registry, Plugin } from '@dxos/app-framework';
+import { Capabilities, Capability, Plugin } from '@dxos/app-framework';
 import { AppCapabilities, LayoutOperation, SettingsOperation } from '@dxos/app-toolkit';
 import { Operation } from '@dxos/compute';
 import { DXN } from '@dxos/keys';
@@ -21,19 +21,19 @@ import { LOAD_PLUGIN_DIALOG } from '../containers';
  * modules and only exists so the article surface can render details for
  * registry plugins that haven't been installed yet.
  */
-const toDisplayPlugin = (entry: Registry.Plugin): Plugin.Plugin =>
+const toDisplayPlugin = (entry: Plugin.Meta): Plugin.Plugin =>
   ({
     [Plugin.PluginTypeId]: Plugin.PluginTypeId,
     meta: Plugin.makeMeta({
-      key: DXN.make(entry.id),
-      name: entry.name,
-      description: entry.description,
-      homePage: entry.homePage,
-      source: entry.source,
-      screenshots: entry.screenshots,
-      tags: entry.tags,
-      icon: entry.icon,
-      iconHue: entry.iconHue,
+      key: DXN.make(entry.profile.key),
+      name: entry.profile.name,
+      description: entry.profile.description,
+      homePage: entry.profile.homePage,
+      source: entry.profile.source,
+      screenshots: entry.profile.screenshots,
+      tags: entry.profile.tags,
+      icon: entry.profile.icon,
+      author: entry.profile.author,
     }),
     modules: [],
   }) as Plugin.Plugin;
@@ -52,7 +52,7 @@ export default Capability.makeModule(
               id: 'openRegistry',
               data: () => Operation.invoke(SettingsOperation.OpenPluginRegistry),
               properties: {
-                label: ['open-plugin-registry.label', { ns: meta.id }],
+                label: ['open-plugin-registry.label', { ns: meta.profile.key }],
                 icon: 'ph--squares-four--regular',
                 disposition: 'menu',
               },
@@ -77,9 +77,9 @@ export default Capability.makeModule(
           return Effect.succeed([
             Node.make({
               id: REGISTRY_ID,
-              type: meta.id,
+              type: meta.profile.key,
               properties: {
-                label: ['plugin-registry.label', { ns: meta.id }],
+                label: ['plugin-registry.label', { ns: meta.profile.key }],
                 icon: 'ph--squares-four--regular',
                 disposition: 'pin-end',
                 position: 'first',
@@ -91,7 +91,7 @@ export default Capability.makeModule(
                   type: 'category',
                   data: registryCategoryId('bundled'),
                   properties: {
-                    label: ['bundled-plugins.label', { ns: meta.id }],
+                    label: ['bundled-plugins.label', { ns: meta.profile.key }],
                     icon: 'ph--squares-four--regular',
                     key: REGISTRY_KEY,
                     testId: 'pluginRegistry.bundled',
@@ -103,7 +103,7 @@ export default Capability.makeModule(
                   type: 'category',
                   data: registryCategoryId('installed'),
                   properties: {
-                    label: ['installed-plugins.label', { ns: meta.id }],
+                    label: ['installed-plugins.label', { ns: meta.profile.key }],
                     icon: 'ph--check--regular',
                     key: REGISTRY_KEY,
                     testId: 'pluginRegistry.installed',
@@ -115,7 +115,7 @@ export default Capability.makeModule(
                   type: 'category',
                   data: registryCategoryId('recommended'),
                   properties: {
-                    label: ['recommended-plugins.label', { ns: meta.id }],
+                    label: ['recommended-plugins.label', { ns: meta.profile.key }],
                     icon: 'ph--star--regular',
                     key: REGISTRY_KEY,
                     testId: 'pluginRegistry.recommended',
@@ -127,25 +127,29 @@ export default Capability.makeModule(
                   type: 'category',
                   data: registryCategoryId('labs'),
                   properties: {
-                    label: ['labs-plugins.label', { ns: meta.id }],
+                    label: ['labs-plugins.label', { ns: meta.profile.key }],
                     icon: 'ph--flask--regular',
                     key: REGISTRY_KEY,
                     testId: 'pluginRegistry.labs',
                     count: categoryCount(registryCategoryId('labs')),
                   },
                 }),
-                Node.make({
-                  id: registryCategoryId('registry'),
-                  type: 'category',
-                  data: registryCategoryId('registry'),
-                  properties: {
-                    label: ['registry-plugins.label', { ns: meta.id }],
-                    icon: 'ph--users-three--regular',
-                    key: REGISTRY_KEY,
-                    testId: 'pluginRegistry.registry',
-                    count: registryCount,
-                  },
-                }),
+                ...(registryCount > 0
+                  ? [
+                      Node.make({
+                        id: registryCategoryId('registry'),
+                        type: 'category',
+                        data: registryCategoryId('registry'),
+                        properties: {
+                          label: ['registry-plugins.label', { ns: meta.profile.key }],
+                          icon: 'ph--users-three--regular',
+                          key: REGISTRY_KEY,
+                          testId: 'pluginRegistry.registry',
+                          count: registryCount,
+                        },
+                      }),
+                    ]
+                  : []),
               ],
             }),
           ]);
@@ -165,7 +169,7 @@ export default Capability.makeModule(
                 });
               }),
               properties: {
-                label: ['load-by-url.label', { ns: meta.id }],
+                label: ['load-by-url.label', { ns: meta.profile.key }],
                 icon: 'ph--cloud-arrow-down--regular',
                 disposition: 'list-item-primary',
               },
@@ -177,16 +181,16 @@ export default Capability.makeModule(
         match: NodeMatcher.whenId(`root/${REGISTRY_ID}`),
         connector: (_node, get) => {
           const manager = capabilities.get(Capabilities.PluginManager);
-          const installedIds = new Set(manager.getPlugins().map((plugin) => plugin.meta.id));
+          const installedIds = new Set(manager.getPlugins().map((plugin) => plugin.meta.profile.key));
 
           const installedNodes = manager.getPlugins().map((plugin) =>
             Node.make({
-              id: plugin.meta.id,
+              id: plugin.meta.profile.key,
               type: 'org.dxos.plugin',
               data: plugin,
               properties: {
-                label: plugin.meta.name ?? plugin.meta.id,
-                icon: plugin.meta.icon ?? 'ph--circle--regular',
+                label: plugin.meta.profile.name ?? plugin.meta.profile.key,
+                icon: plugin.meta.profile.icon?.key ?? 'ph--circle--regular',
                 disposition: 'hidden',
               },
             }),
@@ -194,16 +198,16 @@ export default Capability.makeModule(
 
           const registryEntries = get(manager.pluginRegistry.plugins).entries;
           const registryNodes = registryEntries
-            .filter((entry) => !installedIds.has(DXN.make(entry.id)))
+            .filter((entry) => !installedIds.has(DXN.make(entry.profile.key)))
             .map((entry) => {
               const plugin = toDisplayPlugin(entry);
               return Node.make({
-                id: plugin.meta.id,
+                id: plugin.meta.profile.key,
                 type: 'org.dxos.plugin',
                 data: plugin,
                 properties: {
-                  label: plugin.meta.name ?? plugin.meta.id,
-                  icon: plugin.meta.icon ?? 'ph--circle--regular',
+                  label: plugin.meta.profile.name ?? plugin.meta.profile.key,
+                  icon: plugin.meta.profile.icon?.key ?? 'ph--circle--regular',
                   disposition: 'hidden',
                 },
               });

package/src/capabilities/dev-plugin-loader.ts

@@ -29,7 +29,7 @@ export default Capability.makeModule(
 
     log.info('loading dev plugin from registry settings', { url });
     yield* manager.add(url).pipe(
-      Effect.flatMap((plugin) => manager.enable(plugin.meta.id)),
+      Effect.flatMap((plugin) => manager.enable(plugin.meta.profile.key)),
       Effect.tapError((error) => Effect.sync(() => log.warn('dev plugin auto-load failed', { url, error }))),
       Effect.ignore,
     );

package/src/capabilities/react-surface.tsx

@@ -7,7 +7,6 @@ import React, { type ComponentProps, useMemo } from 'react';
 
 import { Capabilities, Capability, Plugin } from '@dxos/app-framework';
 import { Surface, usePluginManager } from '@dxos/app-framework/ui';
-import { AppCapabilities } from '@dxos/app-toolkit';
 import { AppSurface } from '@dxos/app-toolkit/ui';
 
 import { DisableDependentsAlert } from '#components';
@@ -86,9 +85,7 @@ export default Capability.makeModule(() =>
       }),
       Surface.create({
         id: 'pluginSettings',
-        role: 'article',
-        filter: (data): data is { subject: AppCapabilities.Settings } =>
-          AppCapabilities.isSettings(data.subject) && data.subject.prefix === meta.id,
+        filter: AppSurface.settings(AppSurface.Article, meta.profile.key),
         component: ({ data: { subject } }) => <RegistrySettingsContainer subject={subject} />,
       }),
     ]),

package/src/capabilities/settings.ts

@@ -17,7 +17,7 @@ const DEFAULT_DEV_PLUGIN_URL = `http://localhost:${PLUGIN_DEV_SERVER_PORT}/manif
 export default Capability.makeModule(() =>
   Effect.sync(() => {
     const settingsAtom = createKvsStore({
-      key: meta.id,
+      key: meta.profile.key,
       schema: RegistrySettingsSchema,
       defaultValue: () => ({ devPluginUrl: DEFAULT_DEV_PLUGIN_URL }),
     });
@@ -25,7 +25,7 @@ export default Capability.makeModule(() =>
     return [
       Capability.contributes(RegistryCapabilities.Settings, settingsAtom),
       Capability.contributes(AppCapabilities.Settings, {
-        prefix: meta.id,
+        prefix: meta.profile.key,
         schema: RegistrySettingsSchema,
         atom: settingsAtom,
       }),

package/src/categories.ts

@@ -27,13 +27,14 @@ export const getCategoryPredicate = (
 ): PluginPredicate => {
   switch (category) {
     case registryCategoryId('bundled'):
-      return ({ meta }) => !core.includes(meta.id) && !remoteIds.has(meta.id);
+      return ({ meta }) => !core.includes(meta.profile.key) && !remoteIds.has(meta.profile.key);
     case registryCategoryId('installed'):
-      return ({ meta }) => !core.includes(meta.id) && enabled.includes(meta.id);
+      return ({ meta }) => !core.includes(meta.profile.key) && enabled.includes(meta.profile.key);
     case registryCategoryId('recommended'):
-      return ({ meta }) => !core.includes(meta.id) && !remoteIds.has(meta.id) && !meta.tags?.includes('labs');
+      return ({ meta }) =>
+        !core.includes(meta.profile.key) && !remoteIds.has(meta.profile.key) && !meta.profile.tags?.includes('labs');
     case registryCategoryId('labs'):
-      return ({ meta }) => meta.tags?.includes('labs') ?? false;
+      return ({ meta }) => meta.profile.tags?.includes('labs') ?? false;
     default:
       return () => false;
   }

package/src/commands/index.ts

@@ -2,13 +2,5 @@
 // Copyright 2025 DXOS.org
 //
 
-import * as Command from '@effect/cli/Command';
-
-import { disable } from './disable';
-import { enable } from './enable';
-import { list } from './list';
-
-export const plugin: Command.Command<any, any, any, any> = Command.make('plugin').pipe(
-  Command.withDescription('Manage plugins.'),
-  Command.withSubcommands([enable, disable, list]),
-);
+export * from './plugin';
+export * from './registry';

package/src/commands/{disable.ts → plugin/disable.ts}

@@ -11,14 +11,14 @@ import { Plugin } from '@dxos/app-framework';
 import { CommandConfig } from '@dxos/cli-util';
 import { invariant } from '@dxos/invariant';
 
-import { saveEnabledPlugins } from '../storage';
+import { saveEnabledPlugins } from '../../storage';
 
 export const handler = Effect.fn(function* ({ id }: { id: string }) {
   const { json, profile } = yield* CommandConfig;
   const manager = yield* Plugin.Service;
 
   const plugins = manager.getPlugins();
-  const plugin = plugins.find((p: Plugin.Plugin) => p.meta.id === id);
+  const plugin = plugins.find((p: Plugin.Plugin) => p.meta.profile.key === id);
   invariant(plugin, `Plugin not found: ${id}`);
 
   const core = manager.getCore();
@@ -34,7 +34,7 @@ export const handler = Effect.fn(function* ({ id }: { id: string }) {
   if (json) {
     yield* Console.log(JSON.stringify({ id, enabled: false }, null, 2));
   } else {
-    yield* Console.log(`Plugin "${plugin.meta.name ?? id}" disabled.`);
+    yield* Console.log(`Plugin "${plugin.meta.profile.name ?? id}" disabled.`);
   }
 });
 

package/src/commands/{enable.ts → plugin/enable.ts}

@@ -11,14 +11,14 @@ import { Plugin } from '@dxos/app-framework';
 import { CommandConfig } from '@dxos/cli-util';
 import { invariant } from '@dxos/invariant';
 
-import { saveEnabledPlugins } from '../storage';
+import { saveEnabledPlugins } from '../../storage';
 
 export const handler = Effect.fn(function* ({ id }: { id: string }) {
   const { json, profile } = yield* CommandConfig;
   const manager = yield* Plugin.Service;
 
   const plugins = manager.getPlugins();
-  const plugin = plugins.find((p: Plugin.Plugin) => p.meta.id === id);
+  const plugin = plugins.find((p: Plugin.Plugin) => p.meta.profile.key === id);
   invariant(plugin, `Plugin not found: ${id}`);
 
   const enabled = yield* manager.enable(id);
@@ -31,7 +31,7 @@ export const handler = Effect.fn(function* ({ id }: { id: string }) {
   if (json) {
     yield* Console.log(JSON.stringify({ id, enabled: true }, null, 2));
   } else {
-    yield* Console.log(`Plugin "${plugin.meta.name ?? id}" enabled.`);
+    yield* Console.log(`Plugin "${plugin.meta.profile.name ?? id}" enabled.`);
   }
 });
 

package/src/commands/plugin/index.ts

@@ -0,0 +1,14 @@
+//
+// Copyright 2025 DXOS.org
+//
+
+import * as Command from '@effect/cli/Command';
+
+import { disable } from './disable';
+import { enable } from './enable';
+import { list } from './list';
+
+export const plugin: Command.Command<any, any, any, any> = Command.make('plugin').pipe(
+  Command.withDescription('Manage plugins.'),
+  Command.withSubcommands([enable, disable, list]),
+);

package/src/commands/{list.ts → plugin/list.ts}

@@ -20,11 +20,11 @@ export const handler = Effect.fn(function* () {
   const core = manager.getCore();
 
   const formattedPlugins: FormattedPlugin[] = plugins.map((plugin: Plugin.Plugin) => {
-    const isEnabled = enabled.includes(plugin.meta.id);
-    const isCore = core.includes(plugin.meta.id);
+    const isEnabled = enabled.includes(plugin.meta.profile.key);
+    const isCore = core.includes(plugin.meta.profile.key);
     return {
-      id: plugin.meta.id,
-      name: plugin.meta.name ?? plugin.meta.id,
+      id: plugin.meta.profile.key,
+      name: plugin.meta.profile.name ?? plugin.meta.profile.key,
       enabled: isEnabled,
       core: isCore,
     };

package/src/commands/registry/index.ts

@@ -0,0 +1,30 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import * as Command from '@effect/cli/Command';
+
+import { publish } from './publish';
+import { publishPackage } from './publish-package';
+import { publishPublisher } from './publish-publisher';
+import { records } from './records';
+import { unpublish } from './unpublish';
+import { verify } from './verify';
+
+/**
+ * `dx registry *` — commands for publishing and inspecting records that the
+ * DXOS plugin registry indexes from AT Protocol. Auth uses an App Password
+ * (per-user secret minted at https://bsky.app/settings/app-passwords); OAuth
+ * support is a follow-up.
+ *
+ * - `publish` — config-driven: build from dx.yml, host the bundle, write records.
+ * - `publish-package` — low-level: write profile + release records from flags.
+ * - `publish-publisher` — write the publisher's own profile record.
+ * - `unpublish` — remove a package (profile + releases) from your PDS.
+ * - `verify` — write a publisher.verification record (indexed only from the configured verifier).
+ * - `records` — list everything the authenticated repo has published under `org.dxos.experimental.*`.
+ */
+export const registry: Command.Command<any, any, any, any> = Command.make('registry').pipe(
+  Command.withDescription('Publish to and inspect the AT Protocol-backed DXOS plugin registry.'),
+  Command.withSubcommands([publish, publishPackage, publishPublisher, unpublish, verify, records]),
+);

package/src/commands/registry/publish-package.ts

@@ -0,0 +1,119 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import * as Command from '@effect/cli/Command';
+import * as Options from '@effect/cli/Options';
+import * as FetchHttpClient from '@effect/platform/FetchHttpClient';
+import * as Console from 'effect/Console';
+import * as Effect from 'effect/Effect';
+import * as Function from 'effect/Function';
+import * as Option from 'effect/Option';
+
+import { ClientService } from '@dxos/client';
+import { type PluginProfile, type PluginRelease } from '@dxos/protocols';
+
+import { AUTH_OPTION_DESCRIPTIONS, NSID, putRecord, resolveSession } from './util';
+
+/**
+ * `dx registry publish-package` — publishes both the mutable
+ * `package.profile` (rkey = key) and a `package.release`
+ * (rkey = `<key>:<version>`) record to the authenticated user's PDS.
+ *
+ * The two writes are independent `putRecord` (upsert) calls; if the second fails the
+ * first is left in place (the indexer treats a profile with no releases as
+ * present-but-unpublishable, so a half-success is benign). Releases are conceptually
+ * single-write per version but not enforced — see docs/registry-spec.md (Integrity).
+ */
+export const publishPackage = Command.make(
+  'publish-package',
+  {
+    handle: Options.text('handle').pipe(Options.withDescription(AUTH_OPTION_DESCRIPTIONS.handle), Options.optional),
+    appPassword: Options.text('app-password').pipe(
+      Options.withDescription(AUTH_OPTION_DESCRIPTIONS.appPassword),
+      Options.optional,
+    ),
+    key: Options.text('key').pipe(
+      Options.withDescription(
+        'Plugin key — a reverse-domain NSID (e.g. org.dxos.plugin.excalidraw); also the profile record rkey.',
+      ),
+    ),
+    name: Options.text('name').pipe(Options.withDescription('Human-readable package name.')),
+    description: Options.text('description').pipe(
+      Options.withDescription('Short description shown in the registry.'),
+      Options.withDefault(''),
+    ),
+    version: Options.text('version').pipe(
+      Options.withDescription('Semver version (no build metadata). The release rkey is `<key>:<version>`.'),
+    ),
+    moduleUrl: Options.text('module-url').pipe(
+      Options.withDescription('HTTPS URL to the bundle or manifest for this release.'),
+    ),
+    homepage: Options.text('homepage').pipe(Options.withDescription('Homepage URL.'), Options.optional),
+    source: Options.text('source').pipe(Options.withDescription('Source repository URL.'), Options.optional),
+    tag: Options.text('tag').pipe(
+      Options.withDescription('Tag (repeatable). Categorizes the package for discovery.'),
+      Options.repeated,
+    ),
+    iconKey: Options.text('icon-key').pipe(
+      Options.withDescription('Icon identifier (e.g. ph--sparkle--regular) resolvable by @ch-ui/icons.'),
+      Options.optional,
+    ),
+    iconHue: Options.text('icon-hue').pipe(Options.withDescription('Icon palette hue (e.g. blue).'), Options.optional),
+    manifestHash: Options.text('manifest-hash').pipe(
+      Options.withDescription('Optional content hash for the bundle/manifest.'),
+      Options.optional,
+    ),
+  },
+  (options) =>
+    Function.pipe(
+      Effect.gen(function* () {
+        const client = yield* ClientService;
+        const session = yield* resolveSession({
+          handle: Option.getOrUndefined(options.handle),
+          appPassword: Option.getOrUndefined(options.appPassword),
+          client,
+        });
+        const createdAt = new Date().toISOString();
+
+        const homepage = Option.getOrUndefined(options.homepage);
+        const source = Option.getOrUndefined(options.source);
+        const iconKey = Option.getOrUndefined(options.iconKey);
+        const iconHue = Option.getOrUndefined(options.iconHue);
+        const icon =
+          iconKey !== undefined ? { key: iconKey, ...(iconHue !== undefined && { hue: iconHue }) } : undefined;
+
+        const profile: PluginProfile & { createdAt: string } = {
+          key: options.key,
+          name: options.name,
+          ...(options.description.length > 0 && { description: options.description }),
+          ...(homepage !== undefined && { homePage: homepage }),
+          ...(source !== undefined && { source }),
+          ...(options.tag.length > 0 && { tags: options.tag }),
+          ...(icon !== undefined && { icon }),
+          createdAt,
+        };
+
+        const profileResult = yield* putRecord(session, NSID.PackageProfile, options.key, profile);
+        yield* Console.log(`Profile  ${profileResult.uri}`);
+
+        const manifestHash = Option.getOrUndefined(options.manifestHash);
+        const release: PluginRelease & { package: string; createdAt: string } = {
+          package: options.key,
+          version: options.version,
+          moduleUrl: options.moduleUrl,
+          createdAt,
+          ...(manifestHash !== undefined && { manifestHash }),
+        };
+
+        const releaseResult = yield* putRecord(
+          session,
+          NSID.PackageRelease,
+          `${options.key}:${options.version}`,
+          release,
+        );
+        yield* Console.log(`Release  ${releaseResult.uri}`);
+      }),
+      Effect.provide(FetchHttpClient.layer),
+    ),
+).pipe(Command.withDescription("Publish a package profile + release to the authenticated user's PDS."));