# Publishing to Ember Registry

`POST /v1/applets/:id/releases` accepts the signed `.ember-applet` bytes. Authenticate with `Authorization: Bearer <publisher-token>` and supply JSON release metadata in `X-Ember-Release`.

Required metadata: `id`, `version`, `name`, `description`, and `publisher`. Optional metadata: `size`, `permissions`, `categories`, and `changelog`.

The registry stores package bytes by SHA-256 and returns an immutable `packageUrl` plus `sha256`. Ember downloads that URL, checks its digest, and validates the applet signature before allowing installation.

For the reference server, set `EMBER_PUBLISH_TOKEN` and run `npm run registry:dev`. Put it behind HTTPS before making it public.