Publishing Plugins

Once you’ve built a plugin, you can publish it to the EmDash Marketplace so other sites can install it from the admin dashboard.

Prerequisites

Before publishing, make sure your plugin:

• Has a valid package.json with the "." export pointing to your plugin entry
• Uses definePlugin() with a unique id and valid semver version
• Declares its capabilities (what APIs it needs access to)

Bundle Format

Published plugins are distributed as .tar.gz tarballs containing:

The manifest.json is generated automatically from your definePlugin() call. It contains the plugin ID, version, capabilities, hook names, route names, and admin configuration — but no executable code.

Building a Bundle

The emdash plugin bundle command produces a tarball from your plugin source:

cd packages/plugins/my-plugin
emdash plugin bundle

This will:

Entrypoint Resolution

The bundle command finds your code through package.json exports:

{
  "exports": {
    ".": { "import": "./dist/index.mjs" },
    "./sandbox": { "import": "./dist/sandbox-entry.mjs" },
    "./admin": { "import": "./dist/admin.mjs" }
  }
}

If "./sandbox" is missing, the command looks for src/sandbox-entry.ts as a fallback.

Options

emdash plugin bundle [--dir <path>] [--outDir <path>]

Validation

The bundle command checks:

• Size limit — Total bundle must be under 5MB
• No Node.js built-ins — backend.js cannot import fs, path, child_process, etc. (sandbox code runs in a V8 isolate, not Node.js)
• Icon dimensions — icon.png should be 256x256 (warns if wrong, still includes it)
• Screenshot limits — Max 5 screenshots, max 1920x1080

Publishing

The emdash plugin publish command uploads your tarball to the marketplace:

emdash plugin publish

This will find the most recent .tar.gz in your dist/ directory and upload it. You can also specify the tarball explicitly or build before publishing:

# Explicit tarball path
emdash plugin publish --tarball dist/my-plugin-1.0.0.tar.gz

# Build first, then publish
emdash plugin publish --build

Authentication

The first time you publish, the CLI authenticates you via GitHub:

The token lasts 30 days. After it expires, you’ll be prompted to re-authenticate on the next publish.

You can also manage authentication separately:

# Log in without publishing
emdash plugin login

# Log out (clear stored token)
emdash plugin logout

First-Time Registration

If your plugin ID doesn’t exist in the marketplace yet, emdash plugin publish registers it automatically before uploading the first version.

Version Requirements

Each published version must have a higher semver than the last. You cannot overwrite or republish an existing version.

Security Audit

Every published version goes through an automated security audit. The marketplace scans your backend.js and admin.js for:

• Data exfiltration patterns
• Credential harvesting via settings
• Obfuscated code
• Resource abuse (crypto mining, etc.)
• Suspicious network activity

The audit produces a verdict of pass, warn, or fail, which is displayed on the plugin’s marketplace listing. Depending on the marketplace’s enforcement level, a fail verdict may block publication entirely.

Options

emdash plugin publish [--tarball <path>] [--build] [--dir <path>] [--registry <url>]

Complete Workflow

Here’s the typical publish cycle:

# 1. Make your changes
# 2. Bump the version in definePlugin() and package.json
# 3. Bundle and publish in one step
emdash plugin publish --build

Or if you prefer to inspect the bundle first:

# Build the tarball
emdash plugin bundle

# Check the output
tar tzf dist/my-plugin-1.1.0.tar.gz

# Publish
emdash plugin publish