Software Releases Packages And Manifests

Canonical Package Rules

Canonical packages must not contain:

license keys
bootstrap tokens
package tokens
site secrets
customer names
customer emails
customer domains
install UUIDs
personalized .awecommerce/license.php payloads
old personalized markers
stable public package URLs

Plugin Package Structure

example-plugin/
  example-plugin.php
  vendor/
    awecommerce-client/
  .awecommerce/
    product.json
  readme.txt

Theme Package Structure

example-theme/
  style.css
  functions.php
  vendor/
    awecommerce-client/
  .awecommerce/
    product.json

Plugin Header

<?php
/**
 * Plugin Name: Example Plugin
 * Version: 1.2.3
 * Update URI: https://store.example.com/awecommerce/example-plugin
 */

Theme Header

/*
Theme Name: Example Theme
Version: 1.2.3
Update URI: https://store.example.com/awecommerce/example-theme
*/

Manifest Path

wp-content/uploads/awecommerce/manifests/{product-slug}/{channel}/manifest.json
wp-content/uploads/awecommerce/manifests/{product-slug}/{channel}/version.txt

Manifest Must Not Include

license keys
bootstrap tokens
site secrets
package tokens
customer data
direct stable public package URLs

Example Manifest Fields

{
  "schema": 1,
  "product_slug": "example-plugin",
  "software_kind": "wordpress_plugin",
  "channel": "stable",
  "latest_version": "1.2.3",
  "release_id": 55,
  "requires_wordpress": "6.4",
  "requires_php": "8.2",
  "rollout_percentage": 100,
  "rollout_salt": "example-plugin-1.2.3",
  "paused": false,
  "ttl": 3600,
  "update_check_url": "https://store.example.com/wp-json/awecommerce/v1/updates/check"
}

Personalized Payload

Bootstrap token payload:

[
    'schema' => 1,
    'mode' => 'bootstrap_token',
    'product_slug' => 'example-plugin',
    'bootstrap_token' => 'awc_bt_...',
    'license_fingerprint' => '...',
    'build_id' => '...',
    'token_expires_at' => '2026-12-01 00:00:00',
]

Full key payload:

[
    'schema' => 1,
    'mode' => 'full_license_key',
    'product_slug' => 'example-plugin',
    'license_key' => 'cf4287722dd983e4c61d88353906134d',
    'license_fingerprint' => '...',
    'build_id' => '...',
]

Prefer bootstrap tokens for normal first-install packages.

Package Token Download

GET /wp-json/awecommerce/v1/packages/{token}

The package download response sets:

Content-Type
Content-Disposition
Content-Length
X-Content-Type-Options: nosniff
Cache-Control: no-store, private

Build Verification Script Example

tmp="$(mktemp -d)"
unzip -q example-plugin.zip -d "$tmp"
find "$tmp" -name '.awecommerce' -maxdepth 4 -print
grep -R "awc_bt_" "$tmp" && echo "Found bootstrap token in canonical package"
grep -R "license_key" "$tmp" && echo "Review possible key material"
rm -rf "$tmp"