@dxos/protocols 0.9.0 → 0.9.1-main.c7dcc2e112

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dxos/protocols",
-  "version": "0.9.0",
+  "version": "0.9.1-main.c7dcc2e112",
   "description": "Protobuf definitions for DXOS protocols.",
   "homepage": "https://dxos.org",
   "bugs": "https://github.com/dxos/dxos/issues",
@@ -37,7 +37,8 @@
     "./buf/*": {
       "browser": "./dist/src/buf/proto/gen/*.js",
       "import": "./dist/src/buf/proto/gen/*.js"
-    }
+    },
+    "./lexicons/*": "./src/lexicons/*"
   },
   "types": "dist/src/index.d.ts",
   "files": [
@@ -46,18 +47,18 @@
   ],
   "dependencies": {
     "@bufbuild/protobuf": "2.11.0",
-    "@dxos/codec-protobuf": "0.9.0",
-    "@dxos/effect": "0.9.0",
-    "@dxos/errors": "0.9.0",
-    "@dxos/invariant": "0.9.0",
-    "@dxos/keys": "0.9.0",
-    "@dxos/timeframe": "0.9.0"
+    "@dxos/codec-protobuf": "0.9.1-main.c7dcc2e112",
+    "@dxos/effect": "0.9.1-main.c7dcc2e112",
+    "@dxos/errors": "0.9.1-main.c7dcc2e112",
+    "@dxos/invariant": "0.9.1-main.c7dcc2e112",
+    "@dxos/keys": "0.9.1-main.c7dcc2e112",
+    "@dxos/timeframe": "0.9.1-main.c7dcc2e112"
   },
   "devDependencies": {
     "@bufbuild/buf": "1.65.0",
     "@bufbuild/protoc-gen-es": "2.11.0",
     "effect": "3.21.3",
-    "@dxos/protobuf-compiler": "0.9.0"
+    "@dxos/protobuf-compiler": "0.9.1-main.c7dcc2e112"
   },
   "peerDependencies": {
     "effect": "3.21.3"

package/src/Config2.ts

@@ -0,0 +1,68 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+// @import-as-namespace
+
+import * as Schema from 'effect/Schema';
+
+/** A plugin preview image with optional theme-specific URLs (`light` / `dark`). */
+export const Screenshot = Schema.Struct({
+  light: Schema.optional(Schema.String),
+  dark: Schema.optional(Schema.String),
+});
+export type Screenshot = Schema.Schema.Type<typeof Screenshot>;
+
+/** Icon reference: Phosphor icon key with an optional theme hue. */
+export const Icon = Schema.Struct({
+  key: Schema.String.pipe(Schema.nonEmptyString()),
+  hue: Schema.optional(Schema.String),
+});
+export type Icon = Schema.Schema.Type<typeof Icon>;
+
+export const Plugin = Schema.Struct({
+  /** Reverse-domain NSID — the plugin's globally-unique key (e.g. `org.dxos.plugin.excalidraw`). */
+  key: Schema.String.pipe(Schema.nonEmptyString()),
+  name: Schema.String.pipe(Schema.nonEmptyString()),
+  description: Schema.optional(Schema.String),
+  /**
+   * Author or organization name. Only used for bundled plugins. For plugins published to the
+   * registry this field is ignored — the verified publisher (handle ?? did) is used instead.
+   */
+  author: Schema.optional(Schema.String),
+  homePage: Schema.optional(Schema.String),
+  source: Schema.optional(Schema.String),
+  screenshots: Schema.optional(Schema.Array(Screenshot)),
+  tags: Schema.optional(Schema.Array(Schema.String)),
+  icon: Schema.optional(Icon),
+  spec: Schema.optional(Schema.String),
+  /** Composer plugin ids this plugin depends on at runtime (NSIDs). */
+  dependsOn: Schema.optional(Schema.Array(Schema.String)),
+});
+export type Plugin = Schema.Schema.Type<typeof Plugin>;
+
+/**
+ * Publish orchestration for `dx registry publish`: build command, output directory, and optional
+ * hosting override. All three are consumed together — they are a single workflow, not separate concerns.
+ */
+export const Publish = Schema.Struct({
+  buildCommand: Schema.optional(Schema.String),
+  outputDirectory: Schema.optional(Schema.String),
+  assetBaseUrl: Schema.optional(Schema.String),
+});
+export type Publish = Schema.Schema.Type<typeof Publish>;
+
+/**
+ * The `dx.config.ts` schema: the TypeScript-authored replacement for the
+ * plugin section of `dx.yml`. v1 carries one plugin's self-declared `meta` plus optional publish
+ * orchestration; it will grow to absorb the rest of the (currently proto-based) config over time and
+ * eventually become the canonical config.
+ */
+export const Config = Schema.Struct({
+  plugin: Plugin,
+  publish: Schema.optional(Publish),
+});
+export type Config = Schema.Schema.Type<typeof Config>;
+
+/** Identity helper: authors a typed `dx.config.ts`. Validation runs at load time, not here. */
+export const make = (config: Config): Config => config;

package/src/edge/edge.ts

@@ -339,6 +339,9 @@ export enum OAuthProvider {
   TRELLO = 'trello',
 }
 
+/** atproto OAuth scopes for the Atmosphere integration and account-recovery flows. */
+export const ATPROTO_OAUTH_SCOPES = ['atproto', 'transition:generic', 'transition:email'] as const;
+
 export const InitiateOAuthFlowRequestSchema = Schema.Struct({
   provider: Schema.Enums(OAuthProvider),
   spaceId: Schema.String.pipe(Schema.filter(SpaceId.isValid)), // TODO(burdon): Use SpaceId.
@@ -761,6 +764,65 @@ export const RequestAccessRequestSchema = Schema.Struct({
 export type RequestAccessRequest = Schema.Schema.Type<typeof RequestAccessRequestSchema>;
 export type RequestAccessResponse = { received: boolean };
 
+//
+// Metering (VP auth)
+//
+
+/** Structured usage key aligned with {@link MeteringLimitSchema} (without cap/window fields). */
+export const MeteringUsageKeySchema = Schema.Struct({
+  /** Event type (e.g. `ai`). */
+  eventType: Schema.String,
+  /** Value key being metered (e.g. `outputTokens`). */
+  valueKey: Schema.String,
+  /**
+   * Positional match against the event's subtype segments (e.g. model); `*` matches any
+   * segment, and positions beyond the pattern are unconstrained.
+   */
+  subtypePattern: Schema.Array(Schema.String),
+});
+export type MeteringUsageKey = Schema.Schema.Type<typeof MeteringUsageKeySchema>;
+
+/** Rolling-window usage total for a structured key. */
+export const MeteringUsageItemSchema = Schema.Struct({
+  ...MeteringUsageKeySchema.fields,
+  amount: Schema.Number,
+});
+export type MeteringUsageItem = Schema.Schema.Type<typeof MeteringUsageItemSchema>;
+
+/** A single raw usage bucket (1h resolution) for a structured key. */
+export const MeteringUsageBucketSchema = Schema.Struct({
+  ...MeteringUsageKeySchema.fields,
+  /** Bucket start timestamp (epoch ms, floored to the hour). */
+  bucketStart: Schema.Number,
+  amount: Schema.Number,
+});
+export type MeteringUsageBucket = Schema.Schema.Type<typeof MeteringUsageBucketSchema>;
+
+export const MeteringLimitSchema = Schema.Struct({
+  /** Event type the limit applies to (e.g. `ai`). */
+  eventType: Schema.String,
+  /** Value key being limited (e.g. `outputTokens`). */
+  valueKey: Schema.String,
+  /**
+   * Positional match against the event's subtype segments (e.g. model); `*` matches any
+   * segment, and positions beyond the pattern are unconstrained.
+   */
+  subtypePattern: Schema.Array(Schema.String),
+  /** Rolling-window cap; `null` means unlimited. */
+  limit: Schema.NullOr(Schema.Number),
+  /** Window duration in seconds. */
+  windowDuration: Schema.Number,
+});
+export type MeteringLimit = Schema.Schema.Type<typeof MeteringLimitSchema>;
+
+export const GetProfileUsageResponseSchema = Schema.Struct({
+  profileId: Schema.String,
+  usage: Schema.Array(MeteringUsageItemSchema),
+  limits: Schema.Array(MeteringLimitSchema),
+  buckets: Schema.Array(MeteringUsageBucketSchema),
+});
+export type GetProfileUsageResponse = Schema.Schema.Type<typeof GetProfileUsageResponseSchema>;
+
 //
 // Admin (X-API-KEY)
 //

package/src/edge/registry.ts

@@ -4,33 +4,15 @@
 
 import * as Schema from 'effect/Schema';
 
-/**
- * Hydrated plugin metadata, mirroring the @dxos/app-framework `Plugin.Meta` shape.
- *
- * Defined locally rather than imported from @dxos/app-framework to keep the protocols
- * package free of UI/runtime dependencies. Consumers can treat decoded values as
- * `Plugin.Meta` directly.
- */
-export const PluginMetaSchema = Schema.Struct({
-  id: Schema.String.pipe(Schema.nonEmptyString()),
-  name: Schema.String.pipe(Schema.nonEmptyString()),
-  description: Schema.optional(Schema.String),
-  author: Schema.optional(Schema.String),
-  homePage: Schema.optional(Schema.String),
-  source: Schema.optional(Schema.String),
-  screenshots: Schema.optional(Schema.Array(Schema.String)),
-  tags: Schema.optional(Schema.Array(Schema.String)),
-  icon: Schema.optional(Schema.String),
-  iconHue: Schema.optional(Schema.String),
-});
-export type PluginMeta = Schema.Schema.Type<typeof PluginMetaSchema>;
+import * as Config2 from '../Config2.ts';
 
 /**
- * Health signal the registry service attaches to a hydrated entry when a refresh fails.
- * Clients surface the appropriate badge or filter entries based on this field.
+ * A snapshot of a plugin's declared dependencies resolved to concrete installed versions at build
+ * time (`{ "@dxos/app-framework": "0.8.3", "react": "19.2.0", … }`). The host derives SDK
+ * compatibility from the subset it shares with the plugin (the externalized `@dxos/*` packages).
  */
-export const PluginHealthSchema = Schema.Literal('ok', 'release-missing', 'manifest-invalid', 'repo-unavailable');
-export type PluginHealth = Schema.Schema.Type<typeof PluginHealthSchema>;
+export const DependencyMapSchema = Schema.Record({ key: Schema.String, value: Schema.String });
+export type DependencyMap = Schema.Schema.Type<typeof DependencyMapSchema>;
 
 /**
  * Filename of the entry module every plugin must publish at the root of its bundle.
@@ -50,7 +32,7 @@ export const PLUGIN_ENTRY_FILENAME = 'index.mjs';
  * Paths in `assets` are relative to the manifest's URL.
  */
 export const PluginManifestSchema = Schema.Struct({
-  ...PluginMetaSchema.fields,
+  ...Config2.Plugin.fields,
   /** Plugin version (semver). Sourced from the publishing project's `package.json`. */
   version: Schema.String.pipe(Schema.nonEmptyString()),
   /**
@@ -58,107 +40,166 @@ export const PluginManifestSchema = Schema.Struct({
    * Must include {@link PLUGIN_ENTRY_FILENAME}; consumers verify on parse.
    */
   assets: Schema.Array(Schema.String).pipe(Schema.minItems(1)),
+  /** Declared dependencies resolved to installed versions at build time (SDK-compat source). */
+  dependencies: Schema.optional(DependencyMapSchema),
 });
 export type PluginManifest = Schema.Schema.Type<typeof PluginManifestSchema>;
 
+// ─── ATProto-native registry view ────────────────────────────────────────────
+
 /**
- * Single hydrated plugin entry returned by the registry service.
+ * A single installable release of a plugin, projected from a `package.release`
+ * ATProto record.
  */
-export const PluginEntrySchema = Schema.Struct({
-  /** GitHub repository in `owner/name` form. Empty string for entries sourced from a `manifestUrl`. */
-  repo: Schema.String,
-  /** Plugin metadata from the repo's latest-release `manifest.json`. */
-  meta: PluginMetaSchema,
+export const PluginReleaseSchema = Schema.Struct({
+  /** Semver version string, e.g. `0.8.3`. */
+  version: Schema.String.pipe(Schema.nonEmptyString()),
+  /** URL the host dynamic-imports to install this specific version. */
+  moduleUrl: Schema.String.pipe(Schema.nonEmptyString()),
   /**
-   * URL of the plugin's `manifest.json`. Composer's URL loader fetches this, eagerly caches
-   * every declared asset via the platform `PluginAssetCache`, then dynamic-imports the entry.
-   * The URL must be CORS-safe and have its declared assets reachable as siblings.
+   * Dependencies this release was built against, resolved to installed versions. The host derives
+   * SDK compatibility from the `@dxos/*` subset to decide whether to offer this release.
    */
-  moduleUrl: Schema.String,
-  /** Release tag the entry was resolved from (e.g. `v0.1.0`). Empty string for `manifestUrl` entries. */
-  releaseTag: Schema.String,
-  /** Health signal set by the service when an entry fails to refresh. */
-  health: PluginHealthSchema,
-  /** Unix ms when this entry was last successfully hydrated. */
-  hydratedAt: Schema.Number,
+  dependencies: Schema.optional(DependencyMapSchema),
 });
-export type PluginEntry = Schema.Schema.Type<typeof PluginEntrySchema>;
+export type PluginRelease = Schema.Schema.Type<typeof PluginReleaseSchema>;
 
 /**
- * Response body of `GET /registry/plugins`.
+ * Verbatim content of a `package.profile` ATProto record. `key` is the record's rkey (a reverse-domain
+ * NSID), denormalized into the body. Version-independent identity + display metadata; provenance
+ * (`author`) is resolved separately from the publisher DID/handle.
  */
-export const GetPluginsResponseBodySchema = Schema.Struct({
-  /** Wire-format schema version, pinned to 1. */
-  version: Schema.Literal(1),
-  /** Hydrated entries. Order matches the order in the upstream catalog manifest. */
-  plugins: Schema.Array(PluginEntrySchema),
-  /** Unix ms timestamp of the most recent successful refresh cycle. */
-  refreshedAt: Schema.Number,
+export const PluginProfileSchema = Schema.Struct({
+  /** Reverse-domain NSID — the plugin's globally-unique key and the `package.profile` rkey (e.g. `org.dxos.plugin.excalidraw`). */
+  key: Schema.String.pipe(Schema.nonEmptyString()),
+  /** Plugin display name. */
+  name: Schema.String.pipe(Schema.nonEmptyString()),
+  /** Short description of plugin functionality. */
+  description: Schema.optional(Schema.String),
+  /** Publisher's homepage or plugin documentation URL. */
+  homePage: Schema.optional(Schema.String),
+  /** Source repository URL. */
+  source: Schema.optional(Schema.String),
+  /** Tags to help categorize the plugin. */
+  tags: Schema.optional(Schema.Array(Schema.String)),
+  /** Preview images — theme-keyed screenshot URLs shown on the plugin's card. */
+  screenshots: Schema.optional(Schema.Array(Config2.Screenshot)),
+  /** Icon identifier resolvable by `@ch-ui/icons` (e.g. `ph--sparkle--regular`), with an optional palette hue. */
+  icon: Schema.optional(Config2.Icon),
+  /** Composer plugin ids this plugin depends on at runtime (NSIDs). Author-declared, version-independent. */
+  dependsOn: Schema.optional(Schema.Array(Schema.String)),
+  /** Relative path inside the package to a bundled MDL spec (consumed by plugin-code). */
+  spec: Schema.optional(Schema.String),
 });
-export type GetPluginsResponseBody = Schema.Schema.Type<typeof GetPluginsResponseBodySchema>;
+export type PluginProfile = Schema.Schema.Type<typeof PluginProfileSchema>;
 
 /**
- * A single published version of a plugin, as returned by the registry service's
- * versions endpoint. Sourced from the publishing project's GitHub releases.
+ * A single hydrated plugin entry returned by `GET /registry/plugins`.
  *
- * The host treats `tag` opaquely; ordering — newest first — is the service's
- * responsibility (typically reverse-chronological by release date).
+ * This is an indexer-assembled *view* — analogous to emdash's `PackageView` — projected
+ * from four ATProto record types: `package.profile`, `package.release`,
+ * `publisher.profile`, and `publisher.verification`. It is NOT a direct serialization
+ * of any single ATProto record.
+ *
+ * Design notes:
+ * - `profile.key` is required to be a valid NSID (e.g. `org.dxos.plugin.excalidraw`), making it
+ *   the single identifier for both PDS addressing and the composer runtime plugin id.
+ *   `DXN.make(profile.key, latestVersion)` reconstructs the canonical plugin DXN.
+ * - `releases` inlines all known versions, eliminating a separate versions round-trip for
+ *   the version picker. Ordered newest-first.
+ * - `latestVersion` is a convenience pointer into `releases` indicating the recommended
+ *   install target.
  */
-export const PluginVersionSchema = Schema.Struct({
-  /** Release tag (e.g. `v0.1.21`). Stable identifier for this version. */
-  tag: Schema.String.pipe(Schema.nonEmptyString()),
+export const PluginViewSchema = Schema.Struct({
+  // ── Addressing / provenance (indexer-derived) ────────────────────────────
   /**
-   * URL of this version's `manifest.json`. Matches the shape of {@link PluginEntrySchema.fields.moduleUrl}
-   * but pinned to a specific release rather than the latest. Composer's URL loader fetches
-   * this when the user installs / rolls back to this version.
+   * `at://` URI of the source `package.profile` record.
+   * Globally unique and stable — never changes after the record is published.
    */
-  moduleUrl: Schema.String.pipe(Schema.nonEmptyString()),
-  /** Unix ms when the version was released. Optional — services that lack this signal can omit. */
-  releasedAt: Schema.optional(Schema.Number),
+  uri: Schema.String.pipe(Schema.nonEmptyString()),
+  /** Publisher DID, e.g. `did:plc:abc…`. Cryptographic identity; never changes. */
+  did: Schema.String.pipe(Schema.nonEmptyString()),
+  /**
+   * Publisher AT Protocol handle at index time, e.g. `alice.bsky.social`.
+   * Display-only — handles can be reassigned; never use as a stable key.
+   */
+  handle: Schema.optional(Schema.String),
+  /** Unix ms when the indexer last assembled this entry. */
+  indexedAt: Schema.Number,
+  /**
+   * Trust labels derived from curator `publisher.verification` records.
+   * An empty array means the entry has no verification signal.
+   */
+  labels: Schema.Array(Schema.String),
+
+  // ── Verbatim profile record content ─────────────────────────────────────
+  profile: PluginProfileSchema,
+
+  // ── Releases (projected from package.release records) ───────────────────
+  /**
+   * All known releases for this package, ordered newest-first.
+   * Powers the version picker directly — no separate endpoint needed.
+   */
+  releases: Schema.Array(PluginReleaseSchema),
+  /**
+   * The latest (recommended) release version. Always references an entry in `releases`.
+   * Used by the host to determine whether an update is available.
+   */
+  latestVersion: Schema.String.pipe(Schema.nonEmptyString()),
 });
-export type PluginVersion = Schema.Schema.Type<typeof PluginVersionSchema>;
+export type PluginView = Schema.Schema.Type<typeof PluginViewSchema>;
 
 /**
- * Response body of `GET /registry/plugins/:repo/versions`.
- *
- * `:repo` is the GitHub `owner/name` form, URL-encoded (so `/` is escaped).
- * Returns all hydratable releases for the repo, newest first; clients display them
- * in the version picker for install / roll-back. Unauthenticated; same surface area
- * as `GET /registry/plugins`.
+ * Response body of `GET /registry/plugins`.
  */
-export const GetPluginVersionsResponseBodySchema = Schema.Struct({
-  /** Wire-format schema version, pinned to 1. */
-  version: Schema.Literal(1),
-  /** Available versions for the requested repo, newest first. */
-  versions: Schema.Array(PluginVersionSchema),
-  /** Unix ms timestamp of the most recent successful refresh cycle for this repo. */
+export const GetPluginsResponseBodySchema = Schema.Struct({
+  /** Wire-format schema version, pinned to 2. */
+  version: Schema.Literal(2),
+  /** Hydrated entries. */
+  plugins: Schema.Array(PluginViewSchema),
+  /** Unix ms timestamp of the most recent successful index cycle. */
   refreshedAt: Schema.Number,
 });
-export type GetPluginVersionsResponseBody = Schema.Schema.Type<typeof GetPluginVersionsResponseBodySchema>;
+export type GetPluginsResponseBody = Schema.Schema.Type<typeof GetPluginsResponseBodySchema>;
 
-/**
- * A catalog entry. Two flavours:
- *  - `{ repo }`: the registry service hydrates from the GitHub repo's latest release.
- *    Used by the production catalog.
- *  - `{ manifestUrl }`: the registry service skips GitHub and fetches the manifest directly.
- *    Used for local development against an in-progress plugin (e.g. served by `vite preview`)
- *    so authors can iterate without publishing a release.
- */
-export const RegistryEntrySchema = Schema.Union(
-  Schema.Struct({ repo: Schema.String.pipe(Schema.nonEmptyString()) }),
-  Schema.Struct({ manifestUrl: Schema.String.pipe(Schema.nonEmptyString()) }),
-);
-export type RegistryEntry = Schema.Schema.Type<typeof RegistryEntrySchema>;
+// ─── Publisher records ────────────────────────────────────────────────────────
+
+/** Content of a `publisher.profile` ATProto record. Display metadata for a publisher DID. */
+export const PublisherProfileSchema = Schema.Struct({
+  displayName: Schema.String.pipe(Schema.nonEmptyString()),
+  bio: Schema.optional(Schema.String),
+  homepageUrl: Schema.optional(Schema.String),
+  contact: Schema.optional(Schema.String),
+});
+export type PublisherProfile = Schema.Schema.Type<typeof PublisherProfileSchema>;
 
 /**
- * Shape of the catalog manifest published in the upstream community-plugins repo.
- * Extra keys (e.g. `$schema`) are permitted.
+ * Content of a `publisher.verification` record written by the curator DID.
+ * Links a publisher DID to a trusted AT Protocol handle.
  */
-export const RegistryManifestSchema = Schema.Struct(
-  {
-    version: Schema.Literal(1),
-    plugins: Schema.Array(RegistryEntrySchema),
-  },
-  Schema.Record({ key: Schema.String, value: Schema.Unknown }),
-);
-export type RegistryManifest = Schema.Schema.Type<typeof RegistryManifestSchema>;
+export const PublisherVerificationSchema = Schema.Struct({
+  subject: Schema.String.pipe(Schema.nonEmptyString()),
+  handle: Schema.String.pipe(Schema.nonEmptyString()),
+  displayName: Schema.String.pipe(Schema.nonEmptyString()),
+  createdAt: Schema.String.pipe(Schema.nonEmptyString()),
+});
+export type PublisherVerification = Schema.Schema.Type<typeof PublisherVerificationSchema>;
+
+// ─── NSID constants ───────────────────────────────────────────────────────────
+
+/** NSID constants for the four `org.dxos.experimental.*` record collections. */
+export const NSID = {
+  PackageProfile: 'org.dxos.experimental.package.profile',
+  PackageRelease: 'org.dxos.experimental.package.release',
+  PublisherProfile: 'org.dxos.experimental.publisher.profile',
+  PublisherVerification: 'org.dxos.experimental.publisher.verification',
+} as const;
+
+export type RegistryNsid = (typeof NSID)[keyof typeof NSID];
+
+export const ALL_NSIDS: readonly RegistryNsid[] = [
+  NSID.PackageProfile,
+  NSID.PackageRelease,
+  NSID.PublisherProfile,
+  NSID.PublisherVerification,
+];

package/src/index.ts

@@ -11,6 +11,7 @@ export * from './profile-archive.ts';
 export * from './space-archive.ts';
 export * from './storage.ts';
 export type * from './types.ts';
+export * as Config2 from './Config2.ts';
 export * as FunctionProtocol from './FunctionProtocol.ts';
 export * as FeedProtocol from './FeedProtocol.ts';
 export * as TraceProtocol from './TraceProtocol.ts';

package/src/lexicons/org.dxos.experimental/README.md

@@ -0,0 +1,29 @@
+# `org.dxos.experimental.*` lexicons
+
+Experimental AT Protocol lexicons for the DXOS plugin registry. The `experimental` segment is intentional — these schemas are unstable and will be renamed to a final namespace before promotion.
+
+## Records
+
+| NSID                                           | rkey               | Purpose                                               |
+| ---------------------------------------------- | ------------------ | ----------------------------------------------------- |
+| `org.dxos.experimental.package.profile`        | `<key>`            | Mutable package metadata (one per key per DID).       |
+| `org.dxos.experimental.package.release`        | `<key>:<version>`  | Versioned artifact record (conceptually single-write).|
+| `org.dxos.experimental.publisher.profile`      | `self`             | Identity-level publisher metadata.                    |
+| `org.dxos.experimental.publisher.verification` | `<verified DID>`   | Trust attestation about a publisher.                  |
+
+## Trust model
+
+`publisher.verification` records are public and unrestricted — anyone may author one. Trust is an indexing policy, not a write gate. Today the indexer honors verification records **only** from a single configured verifier DID (`REGISTRY_CURATOR_DID`) and indexes a publisher's records only if that verifier has vouched for the author DID. Revocation is achieved by deleting the verification record — the indexer unindexes that publisher on the next backfill sweep. This single-verifier gate is intended to generalize to multiple verifiers / moderation labels (à la Bluesky labelers) once that surface exists.
+
+See `packages/sdk/app-framework/docs/registry-spec.md` for the full design, including the integrity / tamper-detection model.
+
+## Prior art
+
+These lexicons are modeled on the emdash RFC:
+
+- RFC: [emdash-cms/emdash#694](https://github.com/emdash-cms/emdash/pull/694) — design rationale, trust model trade-offs, rkey conventions, and the `experimental` namespace strategy.
+- Implementation: [emdash-cms/emdash#923](https://github.com/emdash-cms/emdash/pull/923) — client, CLI, and lexicon bindings.
+
+Differences from emdash's `com.emdashcms.experimental.*`:
+
+- `releaseExtension` / `declaredAccess` records (sandbox manifest, granular permissions) are **not** included in v0; they will be added in a follow-on once the runtime sandbox surface is defined.

package/src/lexicons/org.dxos.experimental/package.profile.json

@@ -0,0 +1,87 @@
+{
+  "lexicon": 1,
+  "id": "org.dxos.experimental.package.profile",
+  "defs": {
+    "main": {
+      "type": "record",
+      "key": "literal:key",
+      "description": "Mutable metadata for a discoverable plugin/module published on the DXOS experimental registry. The rkey is the plugin key (reverse-domain NSID, e.g. org.dxos.plugin.excalidraw). Companion org.dxos.experimental.package.release records carry versioned artifacts.",
+      "record": {
+        "type": "object",
+        "required": ["key", "name", "createdAt"],
+        "properties": {
+          "key": {
+            "type": "string",
+            "description": "Reverse-domain NSID — the plugin's globally-unique key and the profile rkey (e.g. org.dxos.plugin.excalidraw).",
+            "maxLength": 63,
+            "minLength": 1
+          },
+          "name": {
+            "type": "string",
+            "description": "Human-readable display name.",
+            "maxLength": 128
+          },
+          "description": {
+            "type": "string",
+            "description": "Short description shown in registry listings.",
+            "maxLength": 512
+          },
+          "homePage": {
+            "type": "string",
+            "format": "uri",
+            "description": "Optional canonical homepage."
+          },
+          "source": {
+            "type": "string",
+            "format": "uri",
+            "description": "Optional public source repository URL."
+          },
+          "tags": {
+            "type": "array",
+            "description": "Optional discovery tags.",
+            "maxLength": 16,
+            "items": { "type": "string", "maxLength": 32 }
+          },
+          "screenshots": {
+            "type": "array",
+            "description": "Optional preview images. Each item has optional light/dark theme URLs.",
+            "maxLength": 8,
+            "items": {
+              "type": "object",
+              "properties": {
+                "light": { "type": "string", "format": "uri" },
+                "dark": { "type": "string", "format": "uri" }
+              }
+            }
+          },
+          "icon": {
+            "type": "object",
+            "description": "Optional icon reference: Phosphor icon key with an optional theme hue.",
+            "required": ["key"],
+            "properties": {
+              "key": {
+                "type": "string",
+                "description": "Phosphor icon name (e.g. ph--compass-tool--regular).",
+                "maxLength": 64
+              },
+              "hue": { "type": "string", "description": "Theme hue hint (e.g. blue, amber).", "maxLength": 32 }
+            }
+          },
+          "dependsOn": {
+            "type": "array",
+            "description": "Optional list of plugin NSIDs this plugin depends on at runtime.",
+            "items": { "type": "string" }
+          },
+          "spec": {
+            "type": "string",
+            "description": "Optional relative path inside the package to a bundled MDL spec."
+          },
+          "createdAt": {
+            "type": "string",
+            "format": "datetime"
+          }
+        }
+      }
+    }
+  }
+}