View .md

Packaging and publishing plugins

Export a FeatherPanel plugin as an .fpa package, keep files out of it with .featherexport, install it from a file or URL, and how marketplace listings and updates work.

On this page

The .fpa format

A FeatherPanel package (.fpa) is a zip archive of the plugin folder, encrypted with a fixed password that the panel knows. The files sit at the root of the archive: conf.yml, the entry class and the plugin folders, not a folder around them.

When the panel installs a package it checks every entry before extracting: absolute paths, .. segments and symlinks are refused.

Export a plugin

  1. Turn on developer mode in the admin settings.
  2. Open Admin > Plugins, select the plugin and choose Export.
  3. The browser downloads <identifier>.fpa.

To keep files out of the package, add a .featherexport file to the plugin root. Each line is a pattern passed to zip -x; blank lines and text after # are ignored. The .featherexport file itself is always excluded.

# .featherexport
node_modules/*
src/*
*.log
.git/*

Build your frontend before exporting, so that only the compiled HTML, JavaScript and CSS under Frontend/Components/ end up in the package.

Install a package

In Admin > Plugins an admin with admin.plugins.manage can install from:

  • an uploaded .fpa file,
  • a URL that points to an .fpa file,
  • the online marketplace.

The panel extracts the package, runs its migrations and calls its install hook. The steps are listed on Lifecycle and events. Installing a package whose identifier is already installed is treated as an update: settings are kept and pluginUpdate() runs.

Marketplace listings

The marketplace in Admin > Plugins and Admin > FeatherCloud reads its listings from FeatherCloud, run by MythicalSystems. Plugin listings are managed there, outside the panel; the panel has no upload or publish feature.

What the panel uses from a listing:

Listing dataEffect in the panel
Latest version and downloadShown as the version to install; an update is offered when it is newer than the installed one.
Minimum and maximum panel versionInstall is blocked when the panel version is outside the range.
DependenciesChecked before install. Missing plugin dependencies that are also in the install queue are allowed.
ChangelogShown on the plugin’s page.
Verified flagShown on the listing.
Premium flag and store linkPaid plugins link to their store page on my.mythicalsystems.org.

Before you share a plugin

  • conf.yml passes validation (see Manifest) and the version is bumped.
  • The plugin installs on a clean panel: migrations use IF NOT EXISTS and the install hook does not assume data that is not there.
  • pluginUpdate() handles upgrades from earlier versions.
  • pluginUninstall() removes what the plugin created.
  • No secrets, .env files or build folders in the package.

Frequently asked questions

Is the .fpa password a form of protection?

No. Every package uses the same password, which is part of the panel's source code. Treat an .fpa file as a plain archive that anyone can open.

Why is the Export button missing?

Export only works with developer mode turned on. Without it the panel answers DEVELOPER_MODE_REQUIRED.