Nuvaka › Developer docs › Programs

Programs: installable apps in the store

Extensions run inside Nuvaka General App. Programs are separate apps installed on the user's device: Windows, macOS, Linux and Android packages. They appear on the store's "Programs" shelf, are downloaded and verified by the app, and are installed with the operating system's own installer.

Who can publish#

• For now, program publishing is open only to approved program publishers: the official Nuvaka account and developers approved by the Nuvaka team. To apply, write to support.
• You must have accepted the current Publisher Agreement; otherwise publishing requests return 428 agreement_required (see Publishing).
• A program id has the form <your-username>.<name> (e.g. nuvaka.monitor-switcher) and never changes.
• Every version is reviewed by Nuvaka. There is no automatic publishing.

Package types#

A version can have packages for several platforms; if you offer both msi and exe for the same OS, updates use the kind the user installed. A package can be up to 2 GB. The server does a light file-type check (MZ, OLE, PK, ELF, deb archive, dmg).

Publishing flow#

1. Create the program: POST /api/programs/dev { id, name, summary:{tr,en}, description:{tr,en}, category, loginMode, oauthClientId?, homepage? }. loginMode: required (does not work without Sign in with Nuvaka; the store shows a badge), optional, none. For sign-in see Sign in with Nuvaka.
2. Draft version: POST /api/programs/dev/{id}/versions { version, notesTr, notesEn }. Release notes are bilingual (each ≤ 2000). A new version must be greater than the published ones.
3. Upload packages (chunked upload below).
4. Media: POST /api/programs/dev/{id}/media?kind=icon|screenshot|video (raw body). Icon square, 64–1024 px; up to 8 screenshots; video up to 20 MB.
5. Submit for review: POST …/versions/{v}/submit (at least one package). You get a notification when it is approved or rejected.
6. After release you can pull a bad version with POST …/versions/{v}/yank: existing installs keep working, but it gets no new installs or updates.

All publisher endpoints are called with your session token or a developer token (nvd_…).

Chunked upload#

PUT /api/programs/dev/{id}/versions/{v}/packages/{platform}?fileName=App-1.2.0.msi&offset=0&total=73400320&minOsVersion=10.0
Content-Type: application/octet-stream
<up to 48 MB of raw bytes>

• Send chunks in order; offset must be the end of the previous chunk. If the order breaks you get 409 { expected }; continue from there.
• Intermediate replies are { done:false, received }; the last chunk returns { done:true, sha256, size }. The server computes the hash itself.
• The file name must end with the platform's extension. Uploading to the same platform again replaces the previous file; on draft or rejected versions you can delete it with DELETE …/packages/{platform}.

Signature and verification#

For every approved package the server produces and signs a package record:

{"fileName":"App-1.2.0.msi","id":"example.app","issuedAt":"…","kind":"program-package",
 "minOsVersion":"10.0","platform":"windows-msi","sha256":"…","size":73400320,"version":"1.2.0"}

• The signature is Ed25519 over the UTF-8 bytes of this text; the key is the same as for extension packages and is pinned in the app (GET /api/ext/v1/signing-key).
• Before installing, Nuvaka General App: verifies the signature; checks that kind, id, version and platform in the record match the requested program; compares the downloaded file's size and SHA-256 with the record. If anything differs the file is deleted and nothing is installed. The hash is computed once more right before the installer starts.
• The operating system's own signature (Windows Authenticode, macOS notarization, APK signing) is your responsibility. Unsigned packages show OS warnings to users and are taken into account in review.

On the user's side#

• A Programs shelf in the store plus search, category and sort (most installed, newest, top rated, recently updated). By default only programs for the user's device are listed; if there is no package, it says which platforms it is available for.
• Downloads go to the download folder from the user's device settings. Users who report an install count towards "installs".
• Updates: the app checks installed programs; notes of every version after the installed one are shown in the user's language. If a blocked version is installed, the user is warned.
• "Install on this device too": programs installed on the user's other devices but not on this one are suggested.
• Writing a review requires having installed the program on at least one device. As the publisher you can reply to reviews (POST /api/programs/{id}/reviews/{reviewId}/reply).
• Users can report problems (malware, privacy, not working, spam, suggestion); reports go to the Nuvaka team.

Version states#

draft → review → published or rejected. After release: yanked (pulled by the publisher) or blocked (blocked by Nuvaka). Draft and rejected versions can be edited and take packages.

Nuvaka Apps API v1 · last updated 2026-09-28