The App Package standard

Every listing on The Solo Market ships as one zip with the same five things inside. Standardising the package is what lets a non-technical buyer run any tool the same way, and what lets an AI assistant set it up unattended. This page is the spec, with a worked example you can copy.

Two kinds of package

Most tools here are source you hand over: a zip the buyer unpacks and runs. If that is what you are selling, the structure below is the contract and the rest of this page is for you.

A native app is different. There is no entry command and no setup file, because opening it and dragging it where it belongs is the setup. Pick Installer as the setup method and upload the app itself.

Installers

Today that means a .dmgfor macOS, up to 500 MB, and it has to be signed with a Developer ID and notarized by Apple, with the ticket stapled to the file. If you already ship it from your own site without Gatekeeper warning people off, it is almost certainly already both.

You can check the exact file you are about to upload:

# is it signed, and by whom?
codesign -dv --verbose=4 YourApp.dmg

# would Gatekeeper let someone open it?
spctl -a -t open --context context:primary-signature -v YourApp.dmg

# is Apple's notarization ticket stapled to this exact file?
xcrun stapler validate YourApp.dmg

Notarization means Apple scanned the file and found no known malware. It is not a judgement about whether the app is any good, so a human still reviews every listing, and you still owe buyers a working tool, a real support address and the refund policy.

The structure

For a source package, your zip must contain exactly this, and stay under 200 MB:

my-tool.zip
├── manifest.json     # name, version, runtime, entry command, network calls
├── README.md         # what it does, screenshots, how to use it
├── SETUP.md          # exact run steps — must work one of the two ways below
├── LICENSE.md        # the licence the buyer owns it under
└── src/              # your actual code

manifest.json

A short, machine-readable description of the tool: its name and version, the runtime it needs, the single command that starts it, and — most importantly — an honest list of every network call it makes and every dependency it pulls in. Reviewers and buyers both read this to know what the tool touches.

{
  "name": "CSV Cleaner",
  "version": "1.0.0",
  "runtime": "node",
  "entry": "npm install && npm start",
  "network": [
    "none"
  ],
  "dependencies": [
    "papaparse"
  ]
}

If your tool makes no network calls, say so ("network": ["none"]). If it calls an API, list the host. Undisclosed network activity is the fastest way to fail review.

README.md

The buyer-facing description: what the tool does, what it looks like (screenshots welcome), and how to use it once it's running. This is the document a buyer opens first after unzipping.

SETUP.md — the important one

This file is the difference between a tool that runs in five minutes and a refund. It must let a buyer get from a fresh download to a running tool by satisfying at least one of these two paths:

• One command. A single command such as npm install && npm start, or a double-clickable binary. Name any prerequisite (like Node.js or Python) and where to get it.
• AI-assisted. Written so a buyer can open the folder in an assistant like Claude Code or Cursor, say “set this up and run it”, and have it work. This is what makes non-technical buyers possible — write the steps for a careful assistant to follow.

Most tools support both with the same file. Here's a template:

# Setup

## What you need
- Node.js 20 or newer (https://nodejs.org)

## Run it (one command)
1. Unzip this folder.
2. Open a terminal in the folder.
3. Run:

    npm install && npm start

The tool opens at http://localhost:3000.

## Prefer an AI assistant?
Open this folder in Claude Code or Cursor and say
"set this up and run it". Everything above is written
so the assistant can follow it step by step.

LICENSE.md

The terms the buyer owns your tool under. Buyers get a personal, perpetual right to use what they bought; you keep ownership of your code. If you don't have a licence of your own, a simple personal-use licence consistent with the marketplace Terms is enough — the key point is that the file is present and its terms don't contradict “buy once, own forever”.

src/

Your actual code, readable. No obfuscation, no minified-only bundles — buyers and their AI assistants must be able to see what they run. Prefer shipping source over a compiled binary where you can: unsigned binaries trigger security warnings on macOS and Windows, which reads as untrustworthy even when it isn't.

Pre-submit checklist

• All five items present, zip under 200 MB.
• manifest.json lists the real runtime, entry command and every network call.
• You followed your own SETUP.md on a clean setup and it worked.
• Source is readable; nothing is obfuscated.
• LICENSE.md is present and consistent with the Terms.

With the package built, head back to Get your project live to fill in the listing, or read Trust & safety to see exactly how it'll be reviewed.