Skip to main content
This page describes the end-to-end flow of publishing your pack to the evoX Market: which pack types can be published today, how to prepare them with the CLI, and which security gates the server runs your pack through.

​
What can be published today

Data-only packs — open

Ready profiles, action packs, icon packs and sound packs use the real moderation flow and can be published.

Executable plugin — closed

Public executable plugin upload is currently in the 503 PLUGIN_UPLOAD_NOT_READY state. For details see Distribution status.
There is no separate publisher application. Anyone who is signed in can upload and submit to moderation; the only gate is moderation. Only the pack owner can submit a pack to moderation. The “Verified” badge exists only on official wraithesports content.

​
Prerequisites

​
Step 1 — Prepare the pack with the CLI

@evoxapp/plugin-cli (evox-plugin) validates the project, produces a bundle and packages an .evoxpack with the evox-archive-v1 policy.
publish-check is a local parity check; it does not replace moderation, a production scanner, signing or revocation. Passing it does not prove the pack is public-ready.
For the detailed command table, see the Developer CLI page.
The CLI pack output is an executable pack carrying packageType: plugin. Because executable upload is closed, this pack gets 503 PLUGIN_UPLOAD_NOT_READY in Step 2 today. The data-only packs that can be published today are produced by the desktop app: Publish your own pack.

​
Step 2 — Upload

The validated .evoxpack file is uploaded as multipart to the POST /packages/upload endpoint. The upload is accepted from any authenticated (signed-in) session; no separate publisher approval is needed. The server first writes the file to secure quarantine, then scans it within the same request. If the scan passes, the upload response returns a draft (draft) version; if not, an error code is returned and no draft is created. The draft is not published yet: it is submitted separately with the Moderation submission step below.

​
Step 3 — Server security pipeline

Every uploaded pack goes through the following gates. This flow is server-authoritative; no client field can change the result.
1

Quarantine

The file is SHA-256 hashed and written to an immutable private quarantine area. If the storage write fails, the draft is not created (fail-closed).
2

Static scan

Archive policy (zip bomb / path traversal / size), magic-byte match, SVG active content, secret leakage, forbidden extension and legacy identifier checks are performed.
3

Draft record

If the scan passes, the pack is recorded as a draft version atomically bound to the scan evidence (policyVersion, scanDigest, findings).
4

Moderation submission

The pack owner submits the version to moderation with POST /submissions. The server verifies scanStatus: passed and scanDigest === fileHash again.
5

Approval

A moderator reviews the scan evidence and approves/rejects. Approval publishes the pack on the Market.

​
Main content rejected by the scan

  • Secret leakage: private keys, API tokens, JWTs or real credential values in config.
  • Magic-byte mismatch: files whose extension does not match their real content type.
  • Active SVG: SVG containing scripts, event handlers or external references.
  • Forbidden extension (data-only): .exe, .dll, .js, .bat and similar executable/active files.
  • Legacy identifier: use of old StreamDock UUIDs.
  • Local path leakage: absolute file paths inside the manifest or profile.

​
Upload error codes

When uploading a new version to an existing product, these codes can also be returned:

​
Moderation submission error codes

EXECUTABLE_PUBLISHER_APPROVAL_REQUIRED and PLUGIN_ID_ALREADY_CLAIMED are not upload or submission errors; they are returned from the request to claim an executable plugin identity. Because executable upload is closed, this step does not open a publication path today.
A static scan, a local sandbox smoke or a working T1 example is not public-ready on its own. The 503 gate cannot be bypassed with a client fallback, a metadata-only upload or a generic “passed” result.