Using this archive

Point a bot at it

Edit config/config.php in your Botex install:

'archive' => [
    'url' => 'https://botex.imamin.me',
    'channel' => 'stable',
    'verify_tls' => true,
],

This lives in config/config.php rather than .env on purpose: an archive is allowed to ship executable code into your install, so the decision belongs in a file that gets read during review.

Find and install extensions

php bin/console ext:remote            # everything published here
php bin/console ext:search clock      # search
php bin/console ext:show Clock        # detail, versions, changelog
php bin/console ext:install Clock     # install the newest
php bin/console ext:install Clock --version=1.1.0
php bin/console ext:update Clock      # or --all
php bin/console ext:remove Clock

Add --dry-run to any install or update to print the exact file-by-file plan without writing anything.

Update the core

php bin/console core:check            # is a newer release published
php bin/console core:diff             # core files you have edited
php bin/console core:update           # apply it
php bin/console core:rollback         # undo the last update

What an update will not do

It never writes to config/, .env, storage/, vendor/ or extensions/.
Your extension settings and enabled flags live in storage/, so replacing an extension keeps every override an admin configured.
If you have edited a core file the release also changes, the update stops and lists those files. Nothing is written until you revert them or pass --force, which backs the originals up to storage/backups/ first.

Custom commands belong in an extension rather than in a patched core file: an extension lives in extensions/, which no core update touches, so it survives every upgrade without a conflict.

Publish to this archive

From the machine that serves it:

php hub/bin/hub publish /path/to/MyExtension --changelog="What changed."
php hub/bin/hub publish-core /path/to/botex
php hub/bin/hub list
php hub/bin/hub verify

Signing

TLS proves which host you reached, and the checksum proves the bytes match what that host said to expect. Neither survives the archive itself being compromised. Signing moves that trust to a key that never has to sit on the server:

php hub/bin/hub keygen

Set signing_key in hub/config.php, then paste the public key into each bot's archive.public_key. From then on a bot refuses any package that key did not sign.

API

Endpoint	Returns
`GET /api/v1/ping`	archive name, channels, package count
`GET /api/v1/index`	every package on a channel
`GET /api/v1/search?q=`	search results
`GET /api/v1/package/<slug>`	one package with its releases
`GET /api/v1/package/<slug>/<version>`	one release, with its sha256
`GET /api/v1/download/<slug>/<version>`	the `.botex` file

Every endpoint takes an optional ?channel=. A .botex file is an ordinary zip holding botex.json and a files/ payload, so you can inspect one with any zip tool.