Marketplace publishing

Applies to Marketplace Apps. External SDK Connections do not use this path — they register a webhook under Business Tools.

Default packages are metadata (hosting: runtime). hosting: managed is not supported.

Lifecycle

qefro app init → edit entities/workflows/ui → qefro app validate
  → qefro app package → publish → Marketplace/catalog
  → tenant install → Qefro Runtime

CLI commands (current)

qefro app init <id> [--name NAME]
qefro app validate [dir]
qefro app package [dir]
qefro app install <name> [--version V] [--settings JSON]
qefro create-app <id> [--name NAME] [--hosting runtime|external]
                                                    [--endpoint URL] [--minimal]
qefro dev [dir]
qefro publish [dir]                 # alias of solution publish
qefro solution build <dir>
qefro solution publish <dir>
qefro solution install <name> [--version V] [--settings JSON]
qefro solution list
qefro register --endpoint URL [--solution ID]

Only platform admins can publish (QEFRO_PUBLISHER_ID ∈ QEFRO_PLATFORM_ADMIN_IDS). Tenants install.

Versioning

Concept	Owner
Published solution version (manifest.version)	Publisher
Installed version per tenant	solution-service
Upgrade	upgrade_for_tenant / install with newer version
Rollback	Follow platform install version history (use supported install APIs — do not invent CLI flags)

On upgrade, solution-service re-registers with the runtime plane and best-effort refreshes marketing + organization capability sync.

Manifest essentials

id, name, version, hosting (runtime for metadata apps), entities / flows / events, permissions, capabilities, optional ui, triggers, conversation_slots. SDK-hosted packages also set endpoint, tools, Dockerfile.

See managed-marketplace-app.md and Solution packaging.

Secrets & settings

• Signing secret — only for SDK /qefro processes
• Install settings — brand and business config from manifest.settings
• Internal bearers — platform ↔ storage-service (QEFRO_INTERNAL_BEARER, …)

Do not put long-lived customer ERP credentials in manifest defaults; use install settings or secret injection mechanisms provided by the platform.

Catalog UX

Portal Marketplace / Solutions UI installs published packages into workspaces. Deep UI docs: solutions/marketplace, solutions/installation.