Developer Guide

Ship your app to the
Vizum App Store

Build a vApp, get it validated automatically, and publish it to customers — most simple apps go live the moment they pass. Here is the whole journey, end to end.

📚 SDK & toolchain docs 🚀 Submit an app
🔨Build 🛡️Validate 📤Submit 🔍Review 🌍Publish 💸Earn

A published vApp is just a .vapp package — a small zip of index.html + assets + a manifest.json. You build it, we check it, and it runs sandboxed in every customer's Vizum desktop.

① Build

🔨

Two ways to build — same installable .vapp

Write a simple app by hand (HTML + JS + a manifest — no build step), or use the sdk-next toolchain (TypeScript, a typed ORM, UI kit, charts, forms, 3D) with the vzm CLI. Either way the output is the same package.

# scaffold, then package into a validated .vapp
vzm new my-app --template vanilla-ts
vzm keygen --publisher acme            # once → vzm-signing.key (keep it secret and backed up)
vzm pack my-app --sign vzm-signing.key # → my-app.vapp, signed

The store refuses a new version that is not signed by its developer, so sign every package you upload. How signing works.

TIP The full SDK (9 @vizum/vapp-* packages), examples, and the typed ORM live in the SDK documentation.

② Validate — automatic, before a human ever looks

The moment you submit, every package runs through an automated pipeline. You get a structured report; nothing privileged reaches customers without passing it.

🛡️

Five checks, all automatic

1
Manifest schemaValid reverse-DNS id, semver version, entry & icon present, well-formed permissions.
2
Permission & risk classificationWhat the app can touch decides its review path (see below).
3
Code vetAny server-side script or computed field is parsed against a strict safe-subset — imports, dunder access, eval/getattr and friends are rejected.
4
Static scanAssets are scanned for hardcoded secrets and risky patterns.
5
Sandbox smokeThe package is loaded in the real opaque-origin sandbox to confirm it boots cleanly.

③ Submit

📤

Upload your package & details

Sign in, accept the developer revenue-share terms, and upload your .vapp with a summary, category, screenshots, and a changelog at /my/vizum-apps/submit. You can preview it running in a sandbox before it goes anywhere.

④ Review — risk-tiered, so simple apps are fast

Your app's permissions decide the path. Most apps ask for nothing privileged and publish automatically; anything powerful gets a human's eyes first.

TIER ZERO Auto-publish

Apps that only use their own private storage / UI — nothing that touches customer data or the platform's powerful capabilities.

✓ Passes the pipeline → published instantly

PRIVILEGED Human review

  • reads/writes Odoo records (orm)
  • outbound network, AI, OAuth, devices
  • native models/fields (schema), server scripts, business actions
Passes the pipeline → queued for a reviewer
A failing package is rejected automatically with the exact reasons — fix them and resubmit. A reviewer approves or rejects privileged apps with feedback you can act on.

⑤ Publish & ⑥ Earn

🌍

Live in the catalog, paid on every sale

Once published, your app appears in the in-desktop Vizum App Store for every customer. Paid apps run on a revenue share — your earnings are tracked per sale and shown in your developer dashboard.

Before you submit — a quick checklist

✓
Reverse-DNS id + semver versione.g. com.acme.invoices and 1.0.0. The id is permanent.
✓
Signed with your keyvzm verify my-app.vapp must say publisher_signed. An unsigned upload is refused.
✓
Only the permissions you actually useFewer permissions = tier-zero = instant publish. Don't over-ask.
✓
No hardcoded secrets or keysUse the platform's secret vault; the static scan will flag anything that looks like a live key.
✓
It boots clean in the sandboxTest it in a desktop first — the smoke check confirms the connect handshake with zero console errors.
✓
An icon, a clear summary & a screenshotThis is what customers see in the catalog.
Security you can rely on: every vApp runs in an opaque-origin sandbox and can never touch a customer's Odoo session directly — all data access goes through the permission-checked bridge, as the user, never beyond the grants they approved.
Vizum App Store — Developer Guide. Build with the Vizum SDK, submit at /my/vizum-apps/submit.