benchweave-sdk package

Package a finished plugin into the submission artefact set (offline).

benchweave-sdk package [OPTIONS] PLUGIN_DIR

Keyless by default; --publisher-key applies the publisher’s own signature at package time (the registry validates and labels, never signs).

Full --help output

Usage: benchweave-sdk package [OPTIONS] PLUGIN_DIR

  Package a finished plugin into the submission artefact set (offline).

  Keyless by default; --publisher-key applies the publisher's own signature at
  package time (the registry validates and labels, never signs).

Options:
  --registry-clone PATH    A clone of benchweave-registry (namespace rules,
                           prior releases)  [required]
  --source-url TEXT        The plugin source repository URL  [required]
  --revision TEXT          Immutable commit digest (40- or 64-hex) being
                           released  [required]
  --publisher TEXT         Your vetted publisher id  [required]
  --plugin TEXT            Plugin name (default: the directory name)
  --version TEXT           Release version (default: the plugin's pyproject
                           version)
  --out PATH               Output directory for the artefact set  [required]
  --capability TEXT        Declared capability, repeatable: network-egress |
                           subprocess-or-native-library | filesystem-writes;
                           pass none for an explicit none
  --dependency TEXT        Registry dependency
                           <registry_id>/<package_id>@<version>:<sha256>,
                           repeatable
  --transport-triple TEXT  Admitted triple <id>@<version>:<sha256> a
                           transport-declaring descriptor publishes
  --publisher-key PATH     The publisher's Ed25519 private key: sign the
                           manifest at package time (the registry validates
                           and labels; it never signs)
  --timestamp-token PATH   An RFC 3161 TimeStampToken (DER) over manifest.sig,
                           from 'benchweave-sdk timestamp' or a TSA directly;
                           binds a trusted signing time to the signature
  --tsa-url TEXT           The TSA named in the timestamp record
  --licence-spdx TEXT      [default: MIT]
  --help                   Show this message and exit.

Arguments

PLUGIN_DIR: PATH

Required.

Options

--registry-clone: PATH

Required. A clone of benchweave-registry (namespace rules, prior releases)

--source-url: TEXT

Required. The plugin source repository URL

--revision: TEXT

Required. Immutable commit digest (40- or 64-hex) being released

--publisher: TEXT

Required. Your vetted publisher id

--plugin: TEXT

Plugin name (default: the directory name)

--version: TEXT

Release version (default: the plugin’s pyproject version)

--out: PATH

Required. Output directory for the artefact set

--capability: TEXT

Declared capability, repeatable: network-egress | subprocess-or-native-library | filesystem-writes; pass none for an explicit none

--dependency: TEXT

Registry dependency /@:, repeatable

--transport-triple: TEXT

Admitted triple @: a transport-declaring descriptor publishes

--publisher-key: PATH

The publisher’s Ed25519 private key: sign the manifest at package time (the registry validates and labels; it never signs)

--timestamp-token: PATH

An RFC 3161 TimeStampToken (DER) over manifest.sig, from benchweave-sdk timestamp or a TSA directly; binds a trusted signing time to the signature

--tsa-url: TEXT

The TSA named in the timestamp record

--licence-spdx: TEXT = MIT