Package registry help

This site is the DiscordLua package registry at pkg.discordlua.org. Packages are portable Lua modules with a package.json manifest, shipped as integrity-checked .dlpkg archives and installed into dislua-modules/.

This registry is separate from the runtime docs catalog on discordlua.org/docs.

Install & use packages

Install DiscordLua with DiscordLua-Setup.exe, then:

dislua pkg add <package>
dislua pkg add <package>@^1.2.0
dislua pkg install
dislua pkg update
dislua pkg outdated
dislua pkg list
dislua pkg remove <package>

add records a caret range in package.json (unless you pin an exact version), resolves transitive dependencies, writes dislua-lock.json, and extracts into dislua-modules/. Plain install restores from the lockfile when it still satisfies your dependency ranges.

Project layout

my-bot/
├── package.json          # your app or library manifest
├── modules.json          # installed package index
├── dislua-lock.json      # resolved versions + integrity
└── dislua-modules/
    └── <name>/
        ├── package.json
        ├── README.md
        └── src/...

Publish

1. Create an account on this site and verify your email.
2. Run dislua pkg login and approve the device code at /cli/authorize.
3. dislua pkg init [name] → edit sources → dislua pkg validate.
4. dislua pkg pack (optional) then dislua pkg publish or dislua pkg publish --dry-run.

Non-admin accounts may publish one successful version per UTC day. Versions are immutable. Use .pkgignore to exclude secrets and junk; defaults already skip .env, .git, credentials, and lockfiles.

Reserved names (for example discord, dislua-*, discord-*) cannot be published by the community.

CLI reference

dislua pkg login | logout | whoami | doctor
dislua pkg search <query>
dislua pkg info <package>
dislua pkg init [name]
dislua pkg validate | pack | publish [--dry-run]
dislua pkg add | install | update | outdated | list | remove
dislua pkg star | unstar <package>
dislua pkg deprecate <package> [message]
dislua pkg undeprecate <package>
dislua pkg owner add|remove|transfer <package> <username>
dislua pkg report <package> <reason> [details...]
dislua pkg admin overview | reports

Default registry: https://pkg.discordlua.org. Override with DISCORDLUA_PKG_REGISTRY.

Loading with require

Installed packages resolve from ./dislua-modules relative to the working directory:

local helpers = require("helpers")           -- package.json "main"
local util = require("helpers.util")         -- helpers/util.lua or helpers/src/util.lua

HTTP API

Base path: /api/v1. JSON errors use { "error": { "code", "message" } }. Rate limits return HTTP 429 with Retry-After.

Public

• GET /health, GET /meta, GET /homepage, GET /search
• GET /packages/:name, /versions, /versions/:version
• GET /packages/:name/-/v/:version/download — integrity headers included

Auth & account

• Register / login / logout / me / sessions / email verify / password reset
• Publish tokens + CLI device flow (/auth/cli/*)
• Cookie mutations require a matching Origin (CSRF)

Publish & social

• POST /packages/publish (Bearer session or publish token)
• Star, deprecate, maintainers, ownership transfer, report

Admin

• Overview, reports, suspend users, unpublish, yank/unyank, verification, audit

Security & limits

• Passwords hashed with scrypt; sessions and publish tokens are opaque secrets.
• README Markdown is sanitized (no raw HTML).
• Archives are content-addressed and immutable per version; downloads verify SHA-256.
• SQLite-backed rate limits on auth, search, publish, download, social, admin, and global API traffic.
• Install never runs package scripts.

Local registry

cd registry
npm install
npm run dev
set DISCORDLUA_PKG_REGISTRY=http://127.0.0.1:8790
dislua pkg doctor

Operator deploy notes live in the repository under registry/deploy/. Production DNS for pkg.discordlua.org is applied only with explicit approval.

DiscordLua runtime docs · discordlua.org