Publishing to the Marketplace
1. Create a developer account
- Sign up at
carphacom.com/developer/register. - Verify your email.
- Connect a Stripe Express account if you'll sell paid items (free items skip this step).
- Read and accept the publisher agreement.
2. Generate a signing key
npx carphacom-cli keygen --out ~/.carphacom/dev-key.ed25519
Upload the public half to your developer profile. Keep the private half safe â it signs every release. If lost, you can rotate via the developer portal but old releases remain verified by the previous public key.
3. Submit a new item
In the developer portal, click Submit item:
- Upload the signed ZIP (
my-plugin-1.0.0.zip+.sig). - Fill in the listing: title, description (Markdown), keywords, screenshots, supported languages, category, pricing.
- Click Submit for review.
4. Review workflow
Submissions land in a queue. Review covers:
- Manifest validation â schema, semver, ID uniqueness.
- Signature verification.
- Static security scan â dependency vulnerabilities, dangerous patterns
(
eval,child_processwithout sandbox). - Functional smoke test â installer + uninstaller run on a sandbox CarphaCom instance.
- Listing review â descriptions accurate, screenshots real, no broken links.
Most reviews complete within 2 business days. You'll receive email + dashboard notifications.
States: submitted â in_review â (approved | rejected | changes_requested) â published.
5. Versioning
Use strict semver:
- Patch (
1.0.0 â 1.0.1): bug fixes, no schema or API changes. Auto-update is enabled by default. - Minor (
1.0.0 â 1.1.0): new features, backwards compatible. Auto-update enabled. - Major (
1.0.0 â 2.0.0): breaking changes. Auto-update disabled by default â merchants must approve.
Bump version in manifest.json and package.json together. Submit each version as a new
release through Developer Portal â My Items â [item] â New version.
6. Earnings
Free items: zero fee, zero payout.
Paid items: 90% to you, 10% platform fee. Payouts run weekly via Stripe to the connected account. Track in Developer Portal â Earnings with breakdown by item, date, and country.
7. Support obligations
Listed items must:
- Respond to merchant tickets within 48 hours.
- Patch critical security issues within 7 days of report.
- Maintain an issue tracker (GitHub URL in listing).
Items that consistently fail support SLAs are unlisted.