Registry API and compatible clients

Tabs-native /v1 is not the VS Code gallery API. Read the registry's /v1/registry capabilities and /v1/openapi.json reference. Search, versions, and raw downloads are discovery/inspection interfaces, not installation authority.

On the Exchange, use the browsable API reference to inspect operations, parameters, limits, and response descriptions. It is generated from the same OpenAPI contract served by the registry; use the JSON contract for client generation.

Public browsing/download require no account. Private instances require an allowed GitHub account or an expiring read token. Clients send credentials only in Authorization headers to the exact configured HTTPS registry origin; never follow redirects with credentials.

Trust configuration

Configure TABS_EXCHANGE_ORIGIN, TABS_EXCHANGE_TRUST_ROOT_PATH, TABS_EXCHANGE_TRUST_ROOT_SHA256, and TABS_EXCHANGE_TRUST_ID independently of the catalog. An operator must distribute the initial root out of band. Root rotation follows TUF; do not replace the trust identity on routine key rotation.

Private registry authentication and signed integrity are separate requirements. Store desktop read tokens using OS-backed secure storage through the host registry connection settings. Never expose them to packaged extension code. A token is not a signing key.

With a scoped read token in TABS_EXCHANGE_TOKEN, use tabsext search dashboard --registry https://your-registry.example to browse private listings. Catalog output is only a discovery hint; this CLI does not bypass the desktop's signed installer.

Compatible forks may use the documented public format/API and independently configured trust root. Marketplace access is free for individuals, OSS, and commercial clients, subject to abuse controls. No ratings, federation, or Open VSX VSIX interoperability is promised.