# Packaging and publishing plugins

> Export a FeatherPanel plugin as an .fpa package, keep files out of it with .featherexport, install it from a file or URL, and how marketplace listings and updates work.

Source: https://featherpanel.com/docs/plugins/packaging-and-publishing/

## The .fpa format

A FeatherPanel package (`.fpa`) is a zip archive of the plugin folder, encrypted with a fixed password that the panel
knows. The files sit at the root of the archive: `conf.yml`, the entry class and the plugin folders, not a folder
around them.

When the panel installs a package it checks every entry before extracting: absolute paths, `..` segments and
symlinks are refused.

## Export a plugin

1. Turn on developer mode in the admin settings.
2. Open **Admin > Plugins**, select the plugin and choose **Export**.
3. The browser downloads `<identifier>.fpa`.

To keep files out of the package, add a `.featherexport` file to the plugin root. Each line is a pattern passed to
`zip -x`; blank lines and text after `#` are ignored. The `.featherexport` file itself is always excluded.

```text
# .featherexport
node_modules/*
src/*
*.log
.git/*
```

Build your frontend before exporting, so that only the compiled HTML, JavaScript and CSS under
`Frontend/Components/` end up in the package.

## Install a package

In **Admin > Plugins** an admin with `admin.plugins.manage` can install from:

- an uploaded `.fpa` file,
- a URL that points to an `.fpa` file,
- the online marketplace.

The panel extracts the package, runs its migrations and calls its install hook. The steps are listed on
[Lifecycle and events](https://featherpanel.com/docs/plugins/lifecycle-and-events/#install). Installing a package whose identifier is already
installed is treated as an update: settings are kept and `pluginUpdate()` runs.

## Marketplace listings

The marketplace in **Admin > Plugins** and **Admin > FeatherCloud** reads its listings from FeatherCloud, run by
MythicalSystems. Plugin listings are managed there, outside the panel; the panel has no upload or publish feature.

What the panel uses from a listing:

| Listing data | Effect in the panel |
| --- | --- |
| Latest version and download | Shown as the version to install; an update is offered when it is newer than the installed one. |
| Minimum and maximum panel version | Install is blocked when the panel version is outside the range. |
| Dependencies | Checked before install. Missing plugin dependencies that are also in the install queue are allowed. |
| Changelog | Shown on the plugin's page. |
| Verified flag | Shown on the listing. |
| Premium flag and store link | Paid plugins link to their store page on my.mythicalsystems.org. |

## Before you share a plugin

- `conf.yml` passes validation (see [Manifest](https://featherpanel.com/docs/plugins/manifest/)) and the version is bumped.
- The plugin installs on a clean panel: migrations use `IF NOT EXISTS` and the install hook does not assume data that
  is not there.
- `pluginUpdate()` handles upgrades from earlier versions.
- `pluginUninstall()` removes what the plugin created.
- No secrets, `.env` files or build folders in the package.

## Related

- [Plugin structure](https://featherpanel.com/docs/plugins/getting-started/)
- [Plugins overview](https://featherpanel.com/docs/plugins/) for installing and managing plugins as an admin

## Frequently asked questions

### Is the .fpa password a form of protection?

No. Every package uses the same password, which is part of the panel's source code. Treat an .fpa file as a plain archive that anyone can open.

### Why is the Export button missing?

Export only works with developer mode turned on. Without it the panel answers DEVELOPER_MODE_REQUIRED.