NNuvaka General AppDeveloper docs
TRDownload

Nuvaka › Developer docs › Publishing and review

Publishing and review

Every Nuvaka user with a verified email can publish extensions. Uploads are scanned automatically; some versions wait for an administrator's approval.

Preparation

  1. Account: your email must be verified and the account must not be frozen or banned.
  2. Developer token: in the app, Profile › Developer › Developer tokens › enter a name › Create token. The token starts with nvd_, is shown once, is valid for 1 year and only works on publisher endpoints (upload, listing, validation). Revoke it in the same place. Use the NUVAKA_TOKEN environment variable in CI.
  3. Publisher signing key (recommended): create one with nuvaka-ext keys create and add the printed public key (base64, 44 characters) under Profile › Developer › Publisher signing keys.
npx nuvaka-ext login --token nvd_xxxxxxxx
npx nuvaka-ext keys create
npx nuvaka-ext publish --changelog "New: repository list setting"

Publisher keys

From the moment you add a public key to your account, every upload must be signed with one of those keys. The signed data is the raw 32-byte SHA-256 digest of the package (Ed25519). So even if your account or token is compromised, no version can be published without the key.

  • Keys can only be added and removed with an app session, not with a developer token.
  • Back up the private key. If you lose it, remove the old key in the app and add a new one.
  • You can add several keys (e.g. one for your laptop and one for CI).

Upload flow

  1. Package and manifest rules

    Size, file types, paths, manifest schema, ID prefix, version greater than the previous one. Error → rejected.

  2. Automatic scan

    Forbidden code patterns and permission/usage matching (list). The scan is best effort; the real boundary is the permission check at run time.

  3. Review or publish

    A version waits in review for an administrator when it is:

    • the publisher's first extension;
    • any new version asking for a critical permission (nuvaka.mail, nuvaka.cloud: write, nuvaka.connections: secrets);
    • any new version of a "Nuvaka verified" extension.

    Everything else goes straight to published with trust level community.

Response: { id, version, status: "published" | "review" | "rejected", scan: { errors: [], warnings: [] } }. nuvaka-ext publish prints it in readable form; use --json for the raw output. To run the same checks without publishing, use nuvaka-ext lint --remote.

Signatures and integrity

For every published version the server signs a release record (ID, version, package SHA-256, size, trust level, permissions, net hosts, minAppVersion). The app only installs packages carrying this signature and checks the server's key against the key built into the app.

The Nuvaka verified badge

An administrator can review an extension and mark it "Nuvaka verified" (verified). The badge shows in the Store and in the extension's info bar, and users can filter the Store to verified extensions only. Every later version of a verified extension also goes to the review queue; until it is approved, users stay on the previous approved version.

Updates

  • Every upload must have a higher version than the previous one.
  • Per extension, the user chooses Automatic, Ask or Off for updates. With automatic, versions that do not change permissions install by themselves.
  • If a new version widens the permission set or the net hosts, automatic updating stops; the old version keeps running until the user approves the new permissions. Asking for permissions in a separate, well-explained version scares users less.
  • The previous package is kept on the device; the user can go back.

Yanking versions and hiding from the Store

  • Yank: if you yank a broken version, it gets no new installs and users on it go back to the previous one.
  • Unlist: you can hide your extension from the Store and show it again; installed users are not affected.

These are done through the publisher endpoints (/api/ext/v1/dev/…).

Blocking

An administrator can block a malicious or rule-breaking extension, or a single version of it. The app applies the block list at start and whenever it changes: it stops the blocked extension immediately and shows the user why. A blocked version cannot be downloaded and cannot get an extension token. Users can report an extension in the Store for malware, privacy, broken, spam or other reasons.

Store page

The Store card is built from the manifest's name, description, icon, storeCategory and permissions; the detail page shows version history and change notes (--changelog), permissions with their reasons, dangerous pair warnings, ratings and publisher info (username, number of extensions, member since). After installing, users can give 1–5 stars and a review; the publisher can reply.

Nuvaka Apps API v1 · last updated 2026-09-27