docs/module-inventory.mdView source ↗
English source · 121 min
Complete source inventory
Generated by python3 scripts/testing/source_inventory.py --write. CI checks exact contents.
This lists every checked-in source module in these roots, including files with no recorded hits. A responsibility or suite listing does not mean 100% coverage. See testing for measured coverage and unverified paths.
Rust commerce and transport
| Module | Responsibility |
|---|---|
| src/accounts/address_restore.rs | Atomic restoration of the owning customer's address aggregate; geography, references and immutable order snapshots remain guarded. |
| src/accounts/address_store.rs | Tenant-owned address persistence, optimistic revisions and atomic default assignment. |
| src/accounts/addresses.rs | Store API address book uses independent customer sessions, never merchant credentials. |
| src/accounts/browser.rs | Host-only customer cookies adapt the existing tenant session ledger without granting merchant authority. |
| src/accounts/contacts.rs | Customer-editable contact fields; identity, price group and privileges remain server-owned. |
| src/accounts/demo.rs | Public synthetic customer fixture for newly provisioned demo shops; never fills real customer addresses. |
| src/accounts/metadata.rs | Standard customer read fields and indexed order metrics are derived from authoritative records. |
| src/accounts/mod.rs | Independent customer sessions, profile/password management and owning-account order history. |
| src/accounts/order_snapshot.rs | Checkout-owned immutable customer and address records; future account edits cannot rewrite an order. |
| src/accounts/orders.rs | Customer-owned order reads and receipts share one tenant/identity predicate and a public projection. |
| src/accounts/payment_preference.rs | Optional last-used payment preference is written after purchase commit, without holding cart/unit/product locks. |
| src/accounts/profile.rs | Typed customer-owned profile updates; price groups, email and merchant roles cannot be self-assigned. |
| src/agent.rs | Persistent grounded conversations and tenant-scoped semantic knowledge HTTP adapters. |
| src/agent_runs/authority.rs | Saved runs retain an upper authority bound; every continuation rechecks credential, membership and private stage admission. |
| src/agent_runs/checkpoint.rs | Bounded journal of prepared context and completed inference calls; ambiguous calls require explicit continuation. |
| src/agent_runs/context.rs | Bounded presentation context is saved with the task; it never supplies identity, rights or trusted object facts. |
| src/agent_runs/contract.rs | HTTP/MCP share revision-bound run controls and safe progress; checkpoints and credentials are never exported. |
| src/agent_runs/controls.rs | Live-only agent stop and existing-key admission; no control becomes a sandbox release or credential snapshot. |
| src/agent_runs/flow_proposals.rs | Scheduled Flow results become native reviewable tasks; only personal approval supplies execution authority. |
| src/agent_runs/navigation.rs | Model navigation names native views, never URLs or authority. Admission rechecks current rights and tenant-owned records. |
| src/agent_runs/scenarios/catalogue.rs | A bounded native channel sample seeds editable fictional profiles; it never reads customer data or invokes inference. |
| src/agent_runs/scenarios/evidence.rs | Scenario evidence uses the release owner's configuration projection, never orders or inventory. |
| src/agent_runs/scenarios/journey.rs | Each fictional customer has an independent durable provider journal and an authoritative native journey. |
| src/agent_runs/scenarios/mod.rs | Fictional shopper cohorts reuse native task authority, checkpoints and private commerce operations. |
| src/agent_runs/scenarios/shopper.rs | A closed shopper adapter uses native carts and exact reviewed totals; no model-supplied authority or payment mode. |
| src/agent_runs/scenarios/source.rs | A customer test can reference only its actor's completed, applied native proposal in this sandbox. |
| src/agent_runs/translation.rs | Translation child work reuses native draft storage, original authority and the existing task scheduler. |
| src/agent_runs/view.rs | A reviewed grid view contains only native filter criteria; current domain and PII rights are checked before persistence. |
| src/agent_runs/work.rs | Approved work uses the existing task lease; each native write is fenced against cancellation and recorded before advancing. |
| src/agent_runs/work_plan.rs | Reviewed work binds bounded native configuration commands and managed app saves before any worker effect. |
| src/agent_runs/worker.rs | Database claims resume only completed checkpoints; unknown model outcomes are never automatically charged again. |
| src/agent_runs.rs | Durable continuation extends native tasks; leases fence checkpoints and publication, never approved writes. |
| src/apps/approval.rs | Operator service authority is bound to immutable package content, never to a merchant-chosen ID. |
| src/apps/asset_surfaces.rs | App file uploads reuse the product asset parser/store and require the current package plus either callback consent or a surface grant. |
| src/apps/business_capability/mod.rs | Versioned merchant intent and frozen, executable pure-decision examples in the canonical app package. |
| src/apps/business_capability/snapshot.rs | Frozen synthetic snapshots convert into the existing read-only WIT contract; no live data, SQL or credentials are read. |
| src/apps/business_capability/tests.rs | Acceptance examples exercise the same Wasm module as checkout, including changed inputs and failed-contract admission. |
| src/apps/cart_contributions.rs | Generic app contributions: configure a cart, bind package/data revisions and persist audited pricing inputs. |
| src/apps/commerce_hooks.rs | Typed pure commerce hooks share the compiled sandbox cache and receive explicit immutable snapshots, never SQL or credentials. |
| src/apps/compatibility.rs | Explicit read adapter for persisted v0.5 engraving carts; completed order snapshots remain unchanged. |
| src/apps/configuration_events.rs | Configuration mutations publish minimized identifiers through the native outbox/Flows; no cart capability or shopper text is disclosed. |
| src/apps/configuration_examples.rs | Frozen configuration cases use the same field validation and bounded guest as real cart configuration. |
| src/apps/configuration_inputs.rs | Structured cart configuration uses the canonical field validator and declared bounded integer guest arguments. |
| src/apps/configuration_orders.rs | Paginated app-specific immutable purchase projections; filtering happens before LIMIT and never exposes buyer PII. |
| src/apps/configuration_selection.rs | Reusable input-only selections resolve current package/library revisions before one native cart mutation. |
| src/apps/configuration_summary.rs | Immutable public configuration labels accompany accepted inputs; no current package lookup is needed on a receipt. |
| src/apps/consent.rs | Package approval binds all requested permissions to a reviewed digest; current actor rights apply before every installation path. |
| src/apps/core_callbacks.rs | Narrow app callbacks delegate to the existing commerce owners and project PII only with separate consent. |
| src/apps/core_documents.rs | Dedicated bounded order-document upload requires exact app capabilities, current actor rights and native receipt ownership. |
| src/apps/core_exchange.rs | Generic channel/product projections and imported sales delegate to native owners with explicit app capabilities. |
| src/apps/core_extensions.rs | Namespaced core-object extension contracts; native records, rights and app storage keep their owners. |
| src/apps/credentials.rs | App keys reuse the core integration-key store, current creator rights, expiry and immutable package digest. |
| src/apps/data.rs | Shared managed app records: typed writes, optimistic revisions, bounded reads and local RLS context. |
| src/apps/discovery.rs | Search all installed app capabilities with current rights; data reads reuse their exact admitted native action. |
| src/apps/distribution.rs | Signed publisher namespaces and tenant-local dependency/version gates. Operator service access still requires its separate exact digest pin. |
| src/apps/editor_contract.rs | Editor mounts, enumerated fields and tenant-owned core references; no app alters core tables. |
| src/apps/editor_tests.rs | Assistant fixture contracts exercise real validation, not only the client-side builder. |
| src/apps/egress.rs | Bounded origin clients pin resolved addresses for each connection and never use ambient HTTP proxies. |
| src/apps/event_contract.rs | Explicit event filters, bounded batches and signed public HTTPS delivery extend the existing leased outbox, not a second queue. |
| src/apps/event_projection.rs | Least-privilege event subscriptions and payload projections; merchant identity never implies app access. |
| src/apps/events.rs | Durable at-least-once app events, retry leases and stable event idempotency keys. |
| src/apps/evidence.rs | Private provenance-bearing app exports feed merchant retrieval and durable app events; never public PDP answers. |
| src/apps/evidence_routes.rs | Scoped merchant-only evidence retrieval; sources never enter public product answers. |
| src/apps/extension_filter.rs | Exact app-field predicates validated against current packages and applied before native pagination. |
| src/apps/extension_projection.rs | Bounded native-object read projection from existing app models, references and current package permissions. |
| src/apps/field_values.rs | Exact app field values reuse commerce money, rich content and tenant-owned assets; no HTML or float decimal coercion. |
| src/apps/form_layout.rs | Bounded twelve-column form geometry, presentation flags and tab order shared by every native app surface. |
| src/apps/gateway.rs | One permission-aware action gateway serves HTTP, UI and MCP; service egress is operator configured. |
| src/apps/hosted.rs | Persist hosted-app dependencies through the existing package installer; no private renderer or parallel registry. |
| src/apps/input_schema.rs | Bounded recursive action-input contract. Untyped managed fields still receive depth/size budgets. |
| src/apps/input_schema_tests.rs | Adversarial schema cases exercise bounded inputs, nullable unions, escaped JSON pointers and output values. |
| src/apps/job_callbacks.rs | Long-job service callbacks disclose input only after current actor consent, package and lease checks. Late callbacks cannot commit. |
| src/apps/job_evidence.rs | Native job completion and authenticated private record evidence share one transaction and current creator/package fences. |
| src/apps/job_import.rs | Reviewed job records use current creator rights and a locked live package; private targets never become app credentials. |
| src/apps/jobs.rs | Durable long actions piggyback on the existing outbox. Apps claim a fenced lease; unknown side effects are never retried automatically. |
| src/apps/manifest.rs | Strict package contract; identifiers and limits are checked before logical model registration. |
| src/apps/manifest_validation.rs | Package capability, schema and action validation; no executable behavior is inferred from names. |
| src/apps/mod.rs | Versioned app packages: managed data, UI slots, agent tools and isolated service calls. |
| src/apps/native_data.rs | App record translations use configured shop languages and field-level main-language inheritance. |
| src/apps/native_lifecycle/compile.rs | Compile bounded app-local state graphs into the native machine; conflicts and stranded paths fail closed. |
| src/apps/native_lifecycle/storage.rs | Capture accepted definitions in existing operational JSON under native package locks; no app-specific tables. |
| src/apps/native_lifecycle/tests.rs | Contract and native-boundary negative controls; operational tests exercise the actual owners separately. |
| src/apps/native_lifecycle.rs | Versioned declarative native lifecycles; packages narrow native admission and never execute effects. |
| src/apps/native_view_tests.rs | Native schema security regressions: bindings, public writes, allowlists, bounded blocks and legacy digests. |
| src/apps/native_views.rs | Bounded native view definitions; every data binding resolves to the same authorized app action gateway. |
| src/apps/observability.rs | Bounded metadata-only app telemetry, storage usage and explicitly approved cursor-based event replay. |
| src/apps/ontology.rs | Namespaced graph views over current authorized app records; no duplicated source or public-claim authority. |
| src/apps/package_fence.rs | Shared package fence prevents native record or document writes racing contract upgrades. |
| src/apps/planning.rs | Registered managed app actions join the same preview/approve transaction as core changes. |
| src/apps/planning_contracts.rs | Current authorized managed-save models accompany proposals; no records, secrets or new authority. |
| src/apps/presentation.rs | Optional passive app artwork and localized summaries; omitted metadata preserves published legacy digests. |
| src/apps/publication.rs | Optional server-enforced publication window and channel projection for public app records. |
| src/apps/record_history.rs | Bounded app-record history, current entity rights and restoration through the normal managed save path. |
| src/apps/record_import.rs | Private source-record intake reuses an installed app's declared native save action, schema, rights and package fence. |
| src/apps/record_lifecycle.rs | Generic app-owned record lifecycle contracts. Status vocabulary and transitions belong to the app Manifest. |
| src/apps/records.rs | One fixed PostgreSQL record store; every operation retains tenant/app/model identity and original wire values. |
| src/apps/registry.rs | Atomic installation and additive schema upgrades; immutable version digests preserve history. |
| src/apps/relations.rs | Shared relation projections are maintained transactionally by app_record_project; wire values remain bounded ordered arrays. |
| src/apps/routes.rs | Tenant-scoped package lifecycle, generated data endpoints and a shared action adapter. |
| src/apps/runtime.rs | Generic pure-Wasm contribution executor; the installed package supplies all business predicates. |
| src/apps/schedules.rs | Durable UTC cron ticks emit namespaced outbox events; replicas lock due rows and staging never runs them. |
| src/apps/schema_changes.rs | Explicit, transactional field evolution. No raw migration SQL; bounded recovery snapshots precede data changes and every converted value is validated. |
| src/apps/schema_upgrade.rs | Apply a checked migration under tenant/app package fences with bounded recovery history and optimistic record revisions. |
| src/apps/secrets.rs | Digest-bound per-shop app secret rotation reuses platform authenticated encryption; no plaintext read endpoint. |
| src/apps/service_limits.rs | Shared network-app admission: per-app and aggregate tenant bulkheads plus replica-wide fenced leases. |
| src/apps/service_policy.rs | Operator-owned private origins permit isolated service networking without relaxing public egress. |
| src/apps/settings.rs | Declared app settings reuse the digest-bound encrypted secret owner; secret values never have a browser read path. |
| src/apps/storage.rs | Existing aggregate app row/byte budget; shared record triggers maintain it without per-app DDL or recounts. |
| src/apps/submissions.rs | Public append-only intake uses declared schemas, existing cart admission, quotas, records and outbox. |
| src/apps/surface_grants.rs | Short-lived UI grants bind a package, surface, actor and concrete editor object on the server. |
| src/apps/surface_registry.rs | Current-authority app surface projection shared by storefronts and native visual composition. |
| src/apps/surface_tests.rs | Contract counterexamples reject cross-scope UI actions, unsafe URLs and mutating GET routes. |
| src/apps/surfaces.rs | App-owned UI surfaces and namespaced HTTP routes reuse the authorized action gateway. |
| src/apps/tool_contract.rs | Installed app tools share native wire metadata and validate declared results without disclosing provider payloads. |
| src/apps/ui_bundles.rs | Operator-pinned, bounded self-contained UI bundles use the same actor/context grant as app actions. |
| src/apps/ui_documents.rs | Secret-free, operator-pinned guest code in a response-enforced opaque sandbox, never srcdoc. |
| src/apps/ui_logic.rs | Declarative UI code-behind validates a bounded AST; calls retain surface grants and server domain authorization. |
| src/apps/ui_logic_tests.rs | UI programs must keep static types, same-model saves, surface allowlists and acyclic ownership before install or preview. |
| src/apps/ui_logic_types.rs | Static UI expression types prevent control coercion and invoking save with a different model; runtime still validates actual values. |
| src/apps/ui_object_key_tests.rs | Object-expression keys accept API casing without prototype or path injection. |
| src/apps/upgrade_review.rs | Probe the actual transactional installer and roll it back; return admission metadata, never app record contents. |
| src/apps/webhook_scope.rs | Scope signed app ingress from its route before identity, tenant lifecycle and forced-RLS admission. |
| src/apps/webhooks.rs | Operator-signed incoming events: tenant-bound HMAC, five-minute freshness and atomic replay receipts. |
| src/assets/app_files.rs | Scoped app access to the existing asset store. Binary callbacks are explicit and private; publishing still uses the native asset lifecycle. |
| src/assets/caption_source.rs | Image evidence uses owned assets or DNS-pinned public HTTPS; decoded thumbnails strip metadata before inference. |
| src/assets/captions.rs | Caption proposals use central inference and current shop languages; only the owning native editor can save them. |
| src/assets/design_references.rs | Bounded reference capture uses the shared public-only DNS-pinned egress client; partial failures remain visible. |
| src/assets/download.rs | Public attachments honor sales-channel visibility; downloads require a paid, owned order snapshot. |
| src/assets/image_jobs.rs | Durable image jobs: tenant admission, revision-bound private previews and explicit publication, without automatic paid retries. |
| src/assets/image_provider.rs | Optional OpenAI Images adapter; bounded responses and decoded PNG output, no remote user URLs or leaked provider errors. |
| src/assets/import.rs | Immutable imported product images reuse the native asset table, product lock, byte validation and publication lifecycle. |
| src/assets/ingestion.rs | Shared bounded multipart parser for product uploads and scoped app uploads; file validation/persistence stays in the asset owner. |
| src/assets/mod.rs | Product attachments and paid digital downloads: bounded binary persistence and tenant/account ACL. |
| src/assets/model_format.rs | Bounded self-contained GLB 2 admission; remote resources and runtime decoder downloads are forbidden. |
| src/assets/model_media.rs | Model media references reuse owned immutable product assets, current product CAS and parent variant links. |
| src/assets/rich.rs | Safe structured rich content, never executable HTML. Same schema for merchant API and frontend. |
| src/assets/rich_document.rs | Allow-listed editor JSON with bounded depth and content; HTML/handlers/styles cannot enter the renderer. |
| src/assets/upload.rs | File admission, immutable bytes and explicit publishing; binary content never enters merchant list responses. |
| src/auth/abuse.rs | Database-backed account and trusted peer-prefix throttles shared by replicas; reserve before password hashing. |
| src/auth/broker.rs | Optional trusted identity exchange: signatures bind route, audience, expiry and one-use nonce. |
| src/auth/broker_credentials.rs | Explicit password setup/recovery or existing-password verification from a trusted, verified-email broker. |
| src/auth/broker_inference.rs | Trusted server-to-server inference inherits operator settings without disclosing any provider credentials. |
| src/auth/broker_recovery.rs | Verified-mail recovery discovers only the canonical account's active memberships; it never provisions a shop. |
| src/auth/broker_session.rs | A freshly verified external identity may request its existing personal session; MFA remains mandatory. |
| src/auth/browser.rs | Browser transport for the existing personal-session ledger: host-only HttpOnly cookies, exact origins and CSRF. |
| src/auth/credentials.rs | Argon2 password operations run off the asynchronous request executor. |
| src/auth/dto.rs | Stable typed authentication envelopes; field validation remains in the shared credential owner. |
| src/auth/handoff.rs | One-time personal-session handoff to the Studio; no passwords or bearer tokens in links. |
| src/auth/identity.rs | Resolve the current credential and membership once; bootstrap and sandbox checks share the same boundary. |
| src/auth/integrations.rs | Explicit-lifetime API/MCP keys are bounded to one workspace and intersect their creator's current membership. |
| src/auth/invitations.rs | Single-use, expiring invitations. Acceptance verifies an existing account password. |
| src/auth/members.rs | Workspace member visibility and immediately effective role/revocation changes. |
| src/auth/mfa.rs | Personal MFA enrollment and one-use sign-in challenges share the native session and encryption owners. |
| src/auth/middleware.rs | Resolve sessions from PostgreSQL on every request: role changes/revocation work across replicas. |
| src/auth/mod.rs | Personal merchant accounts, tenant memberships, scoped sessions and role enforcement. |
| src/auth/permissions.rs | Fine-grained workspace overrides. Owners retain control; delegates cannot grant rights they lack. |
| src/auth/provision.rs | Reusable synthetic shop provisioning for initial signup and additional shops owned by the same merchant. |
| src/auth/recovery_entry.rs | Publish only the operator-configured verified identity recovery entry; browsers cannot choose a broker. |
| src/auth/registration.rs | Create an isolated merchant workspace from synthetic template data. |
| src/auth/roles.rs | Tenant-owned roles: current grants, revisioned edits, dependency-checked removal and shared history. |
| src/auth/route_policy.rs | Rights are registered beside each API method. Missing registrations always deny access. |
| src/auth/routes.rs | Identity, recovery and personal-security routes share canonical authentication admission. |
| src/auth/sessions.rs | Login/logout and personal workspace discovery. Only hashed opaque tokens persist. |
| src/auth/totp.rs | RFC 6238 authenticator codes, bounded clock drift and constant-time comparison. |
| src/automation_rules/comparison.rs | Original comparison primitives plus literal wildcard/zip operators; no regex or executable expressions. |
| src/automation_rules/containers.rs | Source line wrappers, quantified goods and all-line containers retain one selected line scope. |
| src/automation_rules/evaluation.rs | Evaluate native rule scopes from authoritative JSON facts with precise line/container selection. |
| src/automation_rules/fields.rs | Source custom fields retain typed equality and selection intersection; purchase prices use private server facts. |
| src/automation_rules/mod.rs | Source-named rule registry and checked evaluation; absent required facts are errors, including under NOT. |
| src/automation_rules/tests.rs | Regression cases cover missing authority under NOT, original quantifiers, dates, metadata types and registry bounds. |
| src/automation_rules/time.rs | Calendar comparisons use an explicit server clock, IANA zones and the original exclusive date-range end. |
| src/automation_rules/validation.rs | Bounded source payload validation against exported field/operator metadata and nested condition scopes. |
| src/b2b/access.rs | Re-resolves active customer sessions, company policy and unit membership at every procurement boundary. |
| src/b2b/approval.rs | Revision-bound purchasing approval inbox; approvers must be active peers and cannot approve themselves. |
| src/b2b/catalog.rs | Private unit catalog scope is derived from the current employee/cart, never caller criteria; indexed before pagination. |
| src/b2b/contract.rs | Native B2B operation catalogue and bounded request schema shared by HTTP, MCP and UCP adapters. |
| src/b2b/gateway.rs | One native command contract for Store API, merchant API and MCP; actor identity never comes from arguments. |
| src/b2b/lists.rs | Reusable private/shared procurement lists; applying them reuses native cart admission and pricing. |
| src/b2b/mod.rs | Native modular company procurement; protocol-specific EDI adapters remain in their app packages. |
| src/b2b/model.rs | Bounded typed native company, purchasing-unit and employee policies. Money is currency-bound minor units. |
| src/b2b/onboarding.rs | Atomic company setup delegates to the same company/unit/member writers; foreign customers roll back the whole setup. |
| src/b2b/orders.rs | Explicit unit-wide order permission reuses the customer-safe order projection; no email-based ownership. |
| src/b2b/organization.rs | Merchant-managed firms, unit hierarchies, employee grants and tenant-bound catalogs with optimistic revisions. |
| src/b2b/purchase.rs | Serializes unit spending and binds an approved purchase to the authoritative native checkout quote. |
| src/b2b/quick_order.rs | Bounded SKU bulk entry resolves native products then uses the ordinary cart's permissions, quantities and prices. |
| src/b2b/quote_contract.rs | Accepted offer prices feed the existing currency/tax calculator; checkout consumes the offer atomically. |
| src/b2b/quote_lifecycle.rs | App-owned RFQ preparation states reuse native quote CAS, ownership, history and outbox; only native offer/accept moves money. |
| src/b2b/quotes.rs | RFQ lifecycle binds merchant offers to a specific company buyer, cart, currency, expiry and revision. |
| src/b2b/requisition.rs | Explicit integration permission imports requisitions into native lists; it never impersonates checkout buyers. |
| src/b2b/settings.rs | B2B feature switches live in shared commerce settings; disabling never relaxes existing financial policy. |
| src/b2b/staging.rs | Clone and publish purchasing configuration only; employees, orders, approvals and spending remain live-only. |
| src/bin/automation_rules.rs | JSON batch transport for comparisons with original Shopware rule classes; not a production authority endpoint. |
| src/bin/connectors.rs | Independent Rust standard-app service; no provider code executes in commerce request workers. |
| src/bin/context.rs | Bounded ports of original language-chain, rule priority and quantity selection. |
| src/bin/delivery.rs | Batch proportional-tax fixture transport for the original-PHP comparator. |
| src/bin/money_boundary.rs | Batch transport for comparing the actual legacy-to-integer checkout boundary against original Shopware totals. |
| src/bin/price.rs | Batch price fixture transport for the original-PHP differential comparator. |
| src/bin/rules.rs | Batch original-PHP numeric-rule comparison transport. |
| src/bin/verified_kernel/dispatch/access.rs | Generated conformance driver; invokes the same production policy functions as the commerce server. |
| src/bin/verified_kernel/dispatch/agents.rs | Generated conformance driver; invokes the same production policy functions as the commerce server. |
| src/bin/verified_kernel/dispatch/apps.rs | Generated conformance driver; invokes the same production policy functions as the commerce server. |
| src/bin/verified_kernel/dispatch/automation.rs | Generated conformance driver; invokes the same production policy functions as the commerce server. |
| src/bin/verified_kernel/dispatch/commerce.rs | Generated conformance driver; invokes the same production policy functions as the commerce server. |
| src/bin/verified_kernel/dispatch/fulfillment.rs | Generated conformance driver; invokes the same production policy functions as the commerce server. |
| src/bin/verified_kernel/dispatch/intelligence.rs | Generated conformance driver; invokes the same production policy functions as the commerce server. |
| src/bin/verified_kernel/dispatch.rs | Generated domain dispatcher; each bounded module calls the original production policies. |
| src/bin/verified_kernel.rs | Generated input/output driver; production policies are dispatched by the generated module. |
| src/bootstrap.rs | Startup, additive migrations, persisted extensions and outbox worker. |
| src/brand_redirect.rs | Move browser pages to the configured domain while retaining integration and checkout endpoints. |
| src/capabilities/admission.rs | MCP discovery applies current merchant permissions through the same capability owners as invocation. |
| src/capabilities/catalog.rs | Shared catalogue composes native capabilities and cognitive contracts without duplicating authorization. |
| src/capabilities/contract.rs | Shared wire description for native operations and installed app actions; hints never grant execution rights. |
| src/capabilities/core_catalog.rs | Public HTTP/MCP capability catalogue, separate from authorization and dispatch. |
| src/capabilities/dispatch.rs | Closed native domain routing selected once by the operation registry; inactive futures stay boxed. |
| src/capabilities/registry.rs | One immutable native operation record for dispatch, schemas, MCP discovery and bounded agent reads. |
| src/capabilities/schema.rs | Native operation input contracts; transports consume this owner instead of maintaining their own schemas. |
| src/capabilities.rs | Shared HTTP/MCP capability dispatch and tool authorization. |
| src/cart_model.rs | Persisted cart, item and customer-context types. |
| src/cart_mutation.rs | Optimistic cart mutations and quantity normalization. |
| src/cart_price.rs | Authoritative quantity pricing and localized checkout quote assembly. |
| src/cart_routes.rs | Store API cart and order route adapters. |
| src/cart_storage.rs | Cart creation, loading and input validation. |
| src/catalog_model.rs | Tenant product model and database hydration. |
| src/catalog_page.rs | Bounded tenant-scoped catalog reads. A cursor is a product ID, never an offset. |
| src/catalog_routes.rs | Health and localized catalogue HTTP routes. |
| src/categories/admin.rs | Revision-bound category writes, bounded translations and serialized cycle-safe tree moves. |
| src/categories/graph_query.rs | Saved category predicates select only current confirmed public source claims; no inference at browse time. |
| src/categories/mod.rs | Tenant-scoped category tree, localized navigation and product assignment boundaries. |
| src/categories/navigation.rs | Public navigation is localized and restricted to the selected channel's active category ancestry. |
| src/channel_metrics/reads.rs | One persisted diagnostic read shared by operator overview, shop dossiers and infrastructure. |
| src/channel_metrics.rs | Bounded, lossy diagnostic counters. Never use this buffer for business events. |
| src/checkout_handoff.rs | Single-use checkout transfer for independent storefronts; no app-specific catalog or checkout rules. |
| src/checkout_page.rs | The existing checkout may be framed only by its registered tenant/channel storefront. |
| src/checkout_products.rs | Localized immutable checkout SKU snapshots read under the purchase transaction's locks. |
| src/checkout_review.rs | Bind the reviewed revision and exact total for every checkout transport. |
| src/cognition/advisor.rs | Buyer-admitted initial catalog/evidence context and bounded native response revalidation; no extra truth store. |
| src/cognition/autonomy.rs | Price-only optional autonomy, atomic unique-SKU daily quotas and a non-compounding day baseline. |
| src/cognition/behavior/capture.rs | Cart-locked writes serialize with withdrawal; customer association is derived from authenticated native identity. |
| src/cognition/behavior/geography.rs | Optional trusted ingress geography. Ordinary country headers never establish visitor location. |
| src/cognition/behavior/input.rs | Minimal behavioral envelope: no URLs, search text, raw user agents, IPs or caller customer identities. |
| src/cognition/behavior/journey.rs | Private journey drilldown uses the same current receipt, tenant predicates and bounded event projection. |
| src/cognition/behavior/mod.rs | Native behavior analytics projects the existing event ledger into private shop knowledge. |
| src/cognition/behavior/report.rs | Indexed channel report and a derived semantic graph; observations never imply causation or model learning. |
| src/cognition/claim_batches.rs | Bounded public claim intake/compilation shares current channel admission and source-bound evidence, without per-SKU HTTP round trips. |
| src/cognition/context.rs | Bounded localized catalog retrieval before inference; full catalog size never expands the prompt. |
| src/cognition/contracts.rs | Evidence APIs and MCP contracts dispatch into one authorized owner; the claim compiler rejects free prose. |
| src/cognition/evidence.rs | Source-bound claim lifecycle on the existing knowledge relation ledger; no model text becomes a confirmed fact automatically. |
| src/cognition/experiments/mod.rs | Controlled experiments use the existing storefront layout consumer and authoritative payment ledger. |
| src/cognition/experiments/model.rs | Preregistered fixed-horizon experiment parameters and conservative bounded-outcome inference. |
| src/cognition/experiments/report.rs | Delayed final experiment readout is derived from the existing live capture/refund ledger, never demo rewards. |
| src/cognition/extraction.rs | API/MCP/flow source extraction shares provider admission and quote checks; candidates require merchant review. |
| src/cognition/generations.rs | Restart-safe model-change intake: short locked cursor batches reuse the canonical embedding queue. |
| src/cognition/guardrails.rs | Merchant-owned guardrails in commerce settings; native currency amounts bind preview and execution. |
| src/cognition/indexing.rs | Durable bounded embedding jobs; short claims and revision fences keep provider latency outside PostgreSQL. |
| src/cognition/mod.rs | Evidence-based shop memory: event receipts, observed pairs, reviewable hypotheses and bounded context. |
| src/cognition/preferences.rs | Consent-bound private cart preference graph: typed bounded input, export, erasure and native advisor context. |
| src/cognition/projection.rs | Exactly-once local observation projection; associations retain order/event evidence and simulation labels. |
| src/cognition/recommendations.rs | Merchant-approved associations are consumed by the public shop without exposing order counts or identities. |
| src/cognition/routes.rs | Merchant memory endpoints and revision-bound experiment/dismissal decisions. |
| src/cognition/signed.rs | Public Ed25519 attestations bind exact native facts and channel context for five minutes; signatures do not guarantee source truth. |
| src/cognition/stream.rs | Compatible SSE transport waits on the same persisted run; detached request handling retains native tenant scope. |
| src/cognition/tools.rs | Bounded agent read rounds use the same capability dispatcher and current actor rights; never execute writes. |
| src/commerce/app_adjustments.rs | Apply admitted integer app adjustments through native pricing/tax calculation; extensions cannot replace quote JSON. |
| src/commerce/catalog.rs | SKU loading with parent translation fallback. |
| src/commerce/catalog_intake/csv.rs | Bounded UTF-8 CSV parser accepts quoted delimiters, escaped quotes and multiline fields; no formula evaluation or silent row loss. |
| src/commerce/catalog_intake/mod.rs | Merchant catalogue intake prepares bounded drafts; approved saves reuse native products, history and outbox in a private stage. |
| src/commerce/catalog_intake/prepare.rs | Native CSV parsing and read-only model extraction use existing inference admission and DNS-pinned public egress. |
| src/commerce/catalog_intake/save.rs | One explicit sandbox-only product creation delegates to native CAS/history/outbox; stable IDs reconcile retries without overwrites. |
| src/commerce/catalog_intake/schema.rs | One catalogue-intake contract is shared by HTTP, MCP and explicit UI review; it cannot publish or overwrite products. |
| src/commerce/configuration.rs | Tenant checkout configuration loading. |
| src/commerce/content_text.rs | Shared field-level content fallback for metadata and configurable object names. |
| src/commerce/context_routes.rs | Public method discovery and revision-checked checkout context changes. |
| src/commerce/customer_groups.rs | Tenant-owned translated customer groups preserve exact rule IDs and select an explicit existing price/tax presentation basis. |
| src/commerce/delivery.rs | Shipping costs, proportional taxes and calendar delivery windows. |
| src/commerce/delivery_split.rs | Provider-neutral partial-package allocation; quantities and fiscal order snapshots remain conserved. |
| src/commerce/detail.rs | Product family, context prices, gallery, properties and review aggregates. |
| src/commerce/external_order_input.rs | Provider-neutral paid-order snapshots: exact minor units and explicit source tax; no repricing or guessed VAT. |
| src/commerce/external_orders.rs | Generic authorized external order intake reuses native stock, customer snapshots, documents, history and outbox. |
| src/commerce/fulfillment.rs | Revision-checked payment and delivery state transitions. |
| src/commerce/geography.rs | Bundled MIT country catalogue, tenant-owned overrides and typed region admission. |
| src/commerce/group_usage.rs | Removing a customer group rejects live customer, price and native/source-rule dependencies under the settings lock. |
| src/commerce/international_capabilities.rs | International configuration and translation MCP tools call the exact same scoped native handlers as HTTP. |
| src/commerce/inventory.rs | All-checkout allocation ledger; release is idempotent and always uses persisted quantities, never edited order JSON. |
| src/commerce/method_text.rs | Shared translated names and descriptions with field-wise shop-main-language inheritance. |
| src/commerce/method_usage.rs | Tenant-scoped dependency preflight and authoritative deletion guards; order snapshots remain immutable. |
| src/commerce/mod.rs | Native catalogue and checkout domains; pricing ports remain in the library. |
| src/commerce/order_fields.rs | Standard order read fields are projected from the authoritative quote/payment, never maintained twice. |
| src/commerce/order_machine.rs | Declarative order workflow schema. Extensions add states, never executable effects or payment truth. |
| src/commerce/order_mutation.rs | Shared operational order writes: one replay ledger, immutable quote, audit, cart projection and outbox. |
| src/commerce/order_workflow.rs | One server-derived action catalogue drives UI, HTTP and MCP; built-in business guards cannot be bypassed. |
| src/commerce/product_admin.rs | Central product list and identity/association writes; all persistence is tenant scoped. |
| src/commerce/product_channels.rs | Per-product channel visibility overrides remain indexed even when an open catalog contains millions of products. |
| src/commerce/product_create.rs | Product creation accepts validated stable import IDs; the shared domain save handler retains pricing, ownership and history checks. |
| src/commerce/product_edit.rs | Revision-bound multilingual product metadata: specifications, SEO, cross-selling and free shipping. |
| src/commerce/product_fields.rs | Native product fields preserve stock unless an explicit absolute quantity passes aggregate CAS. |
| src/commerce/product_input.rs | Admit native product edits and expand explicit category-only changes through the same revisioned editor. |
| src/commerce/product_languages.rs | Enabled content languages, NULL field inheritance and stable global language registration. |
| src/commerce/product_metadata.rs | Typed product edit payload and multilingual metadata including exact currency prices. |
| src/commerce/product_preparation.rs | Opt-in bounded catalogue preparation projection. Existing products, translations and image jobs remain the owners. |
| src/commerce/review_import.rs | Native historical review admission preserves source provenance, explicit moderation and unverified customer identity. |
| src/commerce/review_moderation.rs | Merchant authorization and review publication. |
| src/commerce/reviews.rs | Customer review submission with server-derived purchase verification. |
| src/commerce/selection.rs | Recover a quote after configuration changes without losing items or silently committing new choices. |
| src/commerce/settings_defaults.rs | Backward-compatible enrichment of existing configuration with bundled translated method labels. |
| src/commerce/settings_mutation.rs | Optimistic settings persistence and audit event. |
| src/commerce/settings_patch.rs | Transport-only sparse JSON differences: stable record IDs, explicit nulls, and deletion distinct from inheritance. |
| src/commerce/settings_release.rs | Selective staging units for channel settings; all final aggregates and method dependencies use native validators. |
| src/commerce/settings_routes.rs | Tenant configuration and operational read model. |
| src/commerce/settings_scope.rs | Scoped checkout configuration: basis row lock orders all override writes and authoritative checkout reads. |
| src/commerce/settings_validation.rs | Configuration validation and required availability invariants. |
| src/commerce/tax.rs | Destination tax-class resolution and net-preserving price conversion. |
| src/commerce/tax_context.rs | Tax conditions consume private authoritative pre-tax cart facts without a recursive quote. |
| src/commerce/tax_rules.rs | Priority-based destination rules; current tax law is merchant configuration, not bundled tax advice. |
| src/commerce/types.rs | Checkout selection and configuration data contracts. |
| src/concierge.rs | Read-only storefront shopping advisor. |
| src/context.rs | Bounded behavioral ports of Shopware 6.7.14.2 context and product-cart selection. |
| src/currencies/capabilities.rs | Currency MCP operations reuse the native HTTP handlers and existing settings/catalog permissions. |
| src/currencies/jobs.rs | Bounded restart-safe fixed-price materialization with frozen FX, product locks and atomic checkpoints across replicas. |
| src/currencies/mod.rs | Tenant currency configuration, channel contexts and durable price generation; no FX network calls in checkout. |
| src/currencies/model.rs | Explicit currency scales and rational exchange-rate settings, inherited by sales-channel overrides. |
| src/currencies/pricing.rs | Exact rational minor-unit FX conversion at the isolated legacy calculator boundary; fixed prices are explicit decimal strings. |
| src/currencies/rates.rs | Bounded ECB reference-rate retrieval with exact decimal parsing; refresh runs outside checkout and never invents rates. |
| src/currencies/routes.rs | Native currency discovery, revision-safe selection and authenticated FX/price job operations. |
| src/currencies/tests.rs | Currency conversion adversaries and immutable source-price semantics, independent of live rate providers. |
| src/customer.rs | Customer credential verification and context rotation. |
| src/demo_catalog.rs | Public synthetic fashion template; provisioning copies only this versioned fixture into a new tenant. |
| src/developer/agent_connection.rs | Credential-free local coding-agent connection shared by native editors. |
| src/developer/archive.rs | Recoverable App Studio project deletion; installed packages and app records retain their independent lifecycle. |
| src/developer/builds.rs | Immutable development versions are validated before storage; installation targets only private environments. |
| src/developer/design_context.rs | Editor context is validated against the supplied Manifest; references are untrusted evidence, never authority. |
| src/developer/drafts.rs | Actor-private, optimistic mutable autosaves; these never install or alter a published package. |
| src/developer/generation.rs | Structured provider output becomes a reviewable immutable manifest; it cannot write files or call shell tools. |
| src/developer/generation_bindings.rs | Complete only deterministic native model/asset bindings; original validation and explicit consent remain authoritative. |
| src/developer/generation_brief.rs | Compile a bounded new-app brief into the existing native Manifest; no model-authored wiring or new executor. |
| src/developer/generation_contract.rs | Generated revisions preserve existing storage and access boundaries; destructive changes require manual schema review. |
| src/developer/generation_edits.rs | Bounded RFC 6902 edits modify the canonical Manifest; this is model wire adaptation, not an app runtime. |
| src/developer/generation_fields.rs | Guided field alternatives express native cross-field rules before inference; native admission remains authoritative. |
| src/developer/mod.rs | Prompt-generated declarative apps and native coding-agent handoff, never unsandboxed model code. |
| src/developer/preview.rs | F5 runs the shared native app runtime in an actor-private expiring staging clone; no build/version/release is created. |
| src/developer/routes.rs | Developer HTTP transport and coding-agent task export; explicit staging precedes live release. |
| src/documents/content.rs | Validate enabled-language source content and rebuild hash-bound chunks without inherited fabricated translations. |
| src/documents/guidance.rs | Explicit merchant preferences reuse versioned private sources; quoted guidance never expands native authority. |
| src/documents/ingestion.rs | Typed API and bounded upload write source hashes, chunks and graph relations atomically. |
| src/documents/lifecycle.rs | Revision-bound source detail, editing, archive/restore and publication; edits require a new public review. |
| src/documents/mod.rs | Source-bound knowledge ingestion, retrieval and product questions share tenant/product visibility. |
| src/documents/parser.rs | PDF extraction executes in a killable child process without inherited commerce credentials. |
| src/documents/preview.rs | No-provider retrieval preview shares product-question scope and locale rules; merchant sources never enter customer previews. |
| src/documents/product_knowledge.rs | Product-centred canonical facts and tenant-filtered graph evidence, independent of the overview's truncated sample. |
| src/documents/questions.rs | Product-specific read-only advice with authoritative price/specification snapshot and validated source citations. |
| src/documents/retrieval.rs | Bounded lexical/vector source retrieval; public questions use only explicitly published documents. |
| src/documents/tools.rs | Knowledge workspace/source MCP tools delegate to the same authorized HTTP operations and schemas. |
| src/documents/workspace.rs | Permission-filtered knowledge census, cursor source inventory and activity; totals never masquerade as sampled graph counts. |
| src/experience.rs | Persisted storefront layout policy and observed synthetic rewards. |
| src/extensions.rs | Merchant catalogue and Wasm extension activation/state. |
| src/failure.rs | Stable safe error details shared by HTTP, MCP and agent streams; legacy constructors retain their wire message. |
| src/foundation.rs | Application dependencies, error responses and request context helpers. |
| src/history/capability.rs | HTTP/MCP parity for history; per-entity read/write scopes are checked again at invocation time. |
| src/history/mod.rs | Uniform tenant-scoped history from transactional database snapshots; restoration delegates to existing domain validators. |
| src/history/product.rs | Rebuild a product edit from an audited snapshot; stock stays current and all associations/media pass normal admission. |
| src/history/restore.rs | Restore snapshots by replaying validated entity edits; financial effects and publication are never copied from historical state. |
| src/history/routes.rs | History summaries are bounded and permission-filtered; full snapshots and restore targets stay inside the owning shop. |
| src/http_limits.rs | Bounded HTTP payloads and streaming responses for native settings and services. |
| src/knowledge/embeddings.rs | Bounded batched embeddings: Ollama and OpenAI-compatible self-hosted endpoints, model-defined dimensions. |
| src/knowledge/relations.rs | Keep knowledge provenance and relations in the same transaction as canonical commerce data. |
| src/knowledge/rerank.rs | Optional TEI cross-encoder reranking on at most 24 tenant-hydrated texts; malformed or unavailable providers retain fused ordering. |
| src/knowledge/search.rs | Hybrid exact/lexical + dense RRF; hydrate current tenant rows and retrieve only connected evidence. |
| src/knowledge/vector_cache.rs | Bounded, short-lived collection geometry cache; only successful verification is cached. |
| src/knowledge/vector_namespace.rs | Explicit, additive Qdrant namespace migration and alias-aware projection deletion. |
| src/knowledge/vectors.rs | Private Qdrant adapter: tenant/model filters, deterministic identities and durable PostgreSQL index queue. |
| src/knowledge.rs | Transactional PostgreSQL knowledge relations and separately indexed Qdrant retrieval. |
| src/legal/buyer_consent.rs | Required contact data for explicit registered marketing segments; shared by protocol review and locked native checkout. |
| src/legal/capabilities.rs | MCP legal tools delegate to the same ownership/permission-checked HTTP domain handlers. |
| src/legal/checkout.rs | Explicit document/digital acknowledgement and immutable order policy snapshots; transport-neutral checkout guard. |
| src/legal/consent.rs | Cart/channel-bound affirmative choices; stale/expired policy receipts never authorize processing. |
| src/legal/continuation.rs | Capability-bound consent continuation: successive carts share one revocable receipt, never copied grants. |
| src/legal/mod.rs | Connected legal/privacy boundary: configuration, consent, checkout snapshots and durable requests. |
| src/legal/model.rs | Bounded multilingual legal configuration; policy changes invalidate optional-purpose consent. |
| src/legal/product.rs | Explicit product safety/sector facts, with market-language fallback; no inference of certifications. |
| src/legal/requests.rs | Durable withdrawal/data-rights intake, tenant-scoped operator review and customer-held receipt access. |
| src/lib.rs | Reusable pricing, context, sandbox, graph and inference modules. |
| src/localization.rs | Shop locale resolution, translated catalog hydration and non-mutating merchant quote. |
| src/main.rs | Process lifetime only. See docs/source-map.md for domain responsibilities. |
| src/marketing/app_flows.rs | App flow dispatch uses the same permission/schema gateway as HTTP/MCP, with a stable job key. |
| src/marketing/catalog.rs | Native condition metadata, app action/event discovery and source-compatible condition import. |
| src/marketing/channel_access.rs | Single admission boundary for Store API, UCP/MCP and hosted storefronts; previews cannot purchase. |
| src/marketing/channel_config.rs | Shared transactional channel validation for merchant edits, history restoration and selective release. |
| src/marketing/channel_preview.rs | One-use preview handoff becomes a host-only cookie, bound to current session, membership and channel revision. |
| src/marketing/channels.rs | Sales channels share a merchant tenant but bind independent catalog visibility, locale and cart identity. |
| src/marketing/condition_gateway.rs | Shared rule admission and authoritative context for tax and other native consumers. |
| src/marketing/coupons.rs | Revision-safe coupon selection for shared storefront/POS carts; pricing remains in promotions. |
| src/marketing/customer_facts.rs | Customer rule authority is loaded by tenant and stable customer ID, with aggregate history and calendar age. |
| src/marketing/dependencies.rs | Inspect tenant-owned definition references and durable uses before configuration deletion. |
| src/marketing/facts.rs | Assemble private server-owned rule context once per quote/event; never publish customer facts in cart responses. |
| src/marketing/flow_access.rs | Every queued flow step rehydrates current membership; stored definitions never preserve revoked privileges. |
| src/marketing/flow_actions.rs | Native action schema and permissions use original Core names; no arbitrary SQL, shell or unguarded payment transitions. |
| src/marketing/flow_mutations.rs | Local flow mutations journal the effect in the same transaction; customer authority changes revoke existing sessions. |
| src/marketing/flow_policy.rs | All configuration entry points require the publishing actor's native action rights; queued work rechecks them. |
| src/marketing/flow_text.rs | Shop-language validation and main-language fallback for both simple flows and graphical action nodes. |
| src/marketing/flows.rs | Durable order-event flows: conditions, shop notes and AI proposals; no unapproved model mutations. |
| src/marketing/gateway.rs | MCP automation tools call the same tenant-bound handlers and validators as HTTP; no separate mutation semantics. |
| src/marketing/jobs.rs | Read bounded tenant flow execution summaries without reloading rule/channel configuration on each Studio refresh. |
| src/marketing/lifecycle.rs | Revision-bound deletion and reference admission share HTTP/MCP authorization and tenant locks. |
| src/marketing/line_facts.rs | Rule line facts use immutable priced lines plus current tenant product metadata; protected values override metadata. |
| src/marketing/metadata.rs | Authorized revision-bound source facts for products, customers and orders; secrets and pricing authority are excluded. |
| src/marketing/mod.rs | Native rule conditions, coupons, durable flows and headless/storefront sales-channel boundaries. |
| src/marketing/pipeline.rs | A bounded acyclic flow graph models source-style true/false branches, ordered actions, delays and stop nodes. |
| src/marketing/pipeline_runtime.rs | Durable sequence execution records each action before dispatch, persists delay cursors and reports uncertain effects. |
| src/marketing/pipeline_tests.rs | Flow graph and source action schema regression tests reject unsafe graphs before any event dispatch. |
| src/marketing/promotion_import.rs | Imported promotions use the ordinary revisioned owner and retain immutable provenance until a merchant reviews activation. |
| src/marketing/promotions.rs | Server-authoritative coupons and automatic campaigns, with deterministic discounts and atomic usage limits. |
| src/marketing/routes.rs | Typed configuration CRUD, rule preview and revision-bound coupon edits. |
| src/marketing/rule_fields.rs | Typed rule fields share the original comparison operators and server-derived checkout/event facts. |
| src/marketing/rule_history.rs | Side-effect-free rule comparison on bounded, tenant-owned frozen Flow order inputs. |
| src/marketing/rule_match.rs | Evaluate typed rule trees against server-owned cart, customer and event facts. |
| src/marketing/rule_snapshot.rs | Resolve only referenced tenant rule IDs with indexed batched reads; freeze active definitions and revisions into the event snapshot. |
| src/marketing/rule_tests.rs | Regression cases for native rule facts and original container boundaries. |
| src/marketing/rules.rs | Bounded Shopware-style boolean/numeric rule AST. Unknown operators/conditions fail closed. |
| src/marketing/work_template.rs | Bounded copies of reviewed native work: event values replace explicit scalar fields, never executable text. |
| src/marketing/work_template_source.rs | Templates reference actor-private task evidence; configuration/history/release never copy its inputs. |
| src/mcp/protocol.rs | JSON-RPC envelope errors differ from actionable domain/tool failures; no transport invents authorization. |
| src/mcp/transport.rs | MCP visibility and shared read-scope memoization, independent of internal planning tools. |
| src/mcp.rs | Typed MCP schemas and JSON-RPC transport. |
| src/migrations/identity_checksums.rs | Explicit source-hash pairs for the reviewed identity-only migration source update. |
| src/migrations/recent_schema.rs | Later additive migrations retain the same ordered ledger and checksum contract. |
| src/migrations/schema.rs | Append-only ordered migration source catalogue; deployed checksums are never rewritten. |
| src/migrations.rs | Versioned setup is separate from serving; no catalog-wide startup repair. |
| src/observability.rs | Server-generated request correlation and safe structured events, without tokens, query strings or bodies. |
| src/operations/addresses.rs | Merchant/MCP address operations use identical customer ownership and revision checks to the Store API. |
| src/operations/company_logo.rs | Tenant-owned logo uploads: bounded decoding, metadata stripping, immutable PNG storage and linked public delivery. |
| src/operations/company_model.rs | Company profile admission, sparse channel inheritance and structured-address print projection. |
| src/operations/company_public.rs | Explicit public legal/brand projection; bank account, domestic tax ID and unlinked uploads remain private. |
| src/operations/creation_schema.rs | Domain-owned MCP schemas for safe CRM creation choices and explicitly reviewed manual orders. |
| src/operations/customer_create.rs | Admin CRM creation uses native contacts/address storage, history and outbox; it never issues customer credentials. |
| src/operations/customer_lookup.rs | Fast customer-only lookup for native identity bindings: tenant-scoped, indexed and bounded; no guest-order union. |
| src/operations/customers.rs | Tenant-scoped paged CRM and revision-checked merchant changes; credentials never leave storage. |
| src/operations/delivery_booking.rs | Provider-neutral package admission freezes allocation before a paid carrier effect; approved apps reconcile only their own intent. |
| src/operations/grid_plan.rs | Read-only filter planning through the central provider and fleet leases; execution remains native list APIs. |
| src/operations/grid_schema.rs | One allowlisted list-filter schema for model plans and MCP; no model-supplied SQL or tenant identity. |
| src/operations/guest_customers.rs | Merchant-only guest contact projection; order snapshots never create account authority. |
| src/operations/imports/assets.rs | Reviewed source image intake resolves its native product and delegates immutable binary storage and media edits to their existing owners. |
| src/operations/imports/categories.rs | Source-neutral category intake preserves stable hierarchy and uses the revisioned native category owner privately. |
| src/operations/imports/coupons.rs | Generic coupon import delegates a reviewed native promotion definition, without pretending original usage is a new purchase. |
| src/operations/imports/customers.rs | Historical CRM import reuses native validation and addresses, without credentials or ordinary new-customer events. |
| src/operations/imports/historical_orders.rs | Immutable native historical orders preserve exact amounts and provenance without purchase, stock, account or payment effects. |
| src/operations/imports/inspect.rs | Read-only native import reconciliation compares mapped current values, never a successful replay flag. |
| src/operations/imports/inspect_history.rs | Operational history comparison reads actual CRM/address/order/review values with paired current PII rights. |
| src/operations/imports/inspect_media.rs | Current immutable image bytes and the independently editable native media association are both inspected. |
| src/operations/imports/inspect_product.rs | Explicit catalogue-only preview: whitelist current mapped/native fields, bound text/media, reuse native money formatting. |
| src/operations/imports/mod.rs | Generic source-record admission; adapters own source formats, native domain owners retain every write. |
| src/operations/imports/products.rs | Private native product intake delegates all catalogue validation, history and selected release to the existing owner. |
| src/operations/imports/relations.rs | Canonical import references resolve to tenant-bound native IDs; the existing product owner validates every relation. |
| src/operations/imports/reviews.rs | Versioned generic review records resolve native product identity and preserve source claims outside native purchase authority. |
| src/operations/list_criteria.rs | Bounded native order/customer filter and sort contracts, reused by HTTP, MCP and reviewed grid plans. |
| src/operations/manual_order_admission.rs | Private admin-cart admission and locked final checkout guards; shared pricing and order effects stay native. |
| src/operations/manual_orders.rs | Actor-private manual-order quotes reuse native cart, legal, pricing, inventory and checkout; no second order ledger. |
| src/operations/master_data.rs | Revisioned tenant company basis and sparse channel overrides, serialized with receipt issuance. |
| src/operations/mod.rs | Merchant CRM and fulfillment APIs, shared verbatim with MCP operations capabilities. |
| src/operations/order_documents.rs | Immutable private carrier documents belong to the existing order receipt store, never product assets. |
| src/operations/order_list.rs | Parameter-bound global order filters and stable tuple cursors; query text never becomes SQL. |
| src/operations/orders.rs | Bounded order search, token-redacted detail and append-only operational notes. |
| src/operations/receipt_instructions.rs | Four-language invoice recipient footer from the immutable native receipt snapshot; cancellations never request payment. |
| src/operations/receipt_pdf.rs | Minimal paginated PDF serializer with WinAnsi Helvetica; snapshot retains complete Unicode originals. |
| src/operations/receipt_text.rs | Four-language document labels and authoritative snapshot-to-print projection. |
| src/operations/receipts.rs | Idempotent immutable invoices/delivery notes with transactional per-shop number ranges. |
| src/operations/redacted_reads.rs | Explicit non-PII domain read views for separately scoped app callbacks; never elevate an identity. |
| src/operations/routes.rs | HTTP/MCP rights for merchant CRM, fulfillment and company settings. |
| src/operations/workflow.rs | Revision-bound workflow configuration used by installed apps and selective sandbox releases. |
| src/order_checkout.rs | Atomic checkout, stock locks, extension policy and idempotency. |
| src/order_routes.rs | Merchant order read adapter. |
| src/outbox/control.rs | Tenant-authorized quarantine inspection and explicit retry; delivered or retired events cannot be replayed here. |
| src/outbox/retention.rs | Bounded retirement of duplicate delivered payloads; provenance IDs and unsettled app/flow work survive. |
| src/outbox.rs | Durable outbox and audit projection worker. |
| src/payments/accounts.rs | Merchant-authorized onboarding bridge; only authenticated provider responses establish account bindings. |
| src/payments/app_commands.rs | App/Flow/MCP payment actions enqueue core jobs; provider-bound attempts prevent cross-app command authority. |
| src/payments/capture_admission.rs | Serialized native capture budgets; uncertain capture jobs reserve the remaining authorization. |
| src/payments/capture_configuration.rs | Capture timing is versioned shop/channel configuration; every attempt freezes its admitted provider intent. |
| src/payments/catalog.rs | Native payment operation descriptions, composed by the canonical operation registry. |
| src/payments/contract.rs | Versioned app-owned payment methods; declarations never grant financial authority. |
| src/payments/details.rs | Native payment-only history projection and optional owned provider observation; no financial command is executed. |
| src/payments/details_model.rs | Typed, PII-free provider transaction details; these observations never mutate native payment state. |
| src/payments/details_tests.rs | Transaction observations reject untyped and foreign evidence without touching payment state. |
| src/payments/diagnostics.rs | Safe, provider-neutral operational hints. These never authorize a financial transition. |
| src/payments/funding.rs | Account-authorized funding choice, immutable consent and saved-instrument admission; cart possession is insufficient. |
| src/payments/generic_receipts.rs | Provider-neutral receipt admission and atomic allocation; verified evidence owns ledger transitions. |
| src/payments/instructions.rs | Customer-capability and compound merchant access to typed recipient instructions; reads never settle an invoice. |
| src/payments/instructions_state.rs | Immutable recipient evidence in the existing payment context, native invoice snapshots and one scoped outbox event. |
| src/payments/instruments.rs | Customer-owned saved instruments expose only redacted metadata; immediate revocation and provider cleanup share payment jobs. |
| src/payments/merchant.rs | Shared merchant payment operation bridge; HTTP, MCP and Flows retain native rights and durable jobs. |
| src/payments/mod.rs | Provider-independent payment ledger and durable workers; the PayPal adapter supports explicit Sandbox/Live environments. |
| src/payments/operations.rs | Durable idempotent payment commands, customer context binding and serial refund admission. |
| src/payments/provider.rs | Payment provider identity, tenant account configuration and immutable wire context. |
| src/payments/provider_configuration.rs | Pure startup validation of the native provider origin; no live credentials or provider calls. |
| src/payments/provider_webhooks.rs | Version-pinned HMAC notifications enqueue reconciliation; external event payloads never write monetary state. |
| src/payments/receipt_guard.rs | Bind integer provider receipt amounts and status to the formally checked exact-match predicate. |
| src/payments/refund_allocation.rs | Refunds select an owned capture and reserve its remaining amount before a provider call. |
| src/payments/refund_receipts.rs | Exactly-once provider refund admission, including refunds initiated outside Studio. |
| src/payments/registry.rs | Installed payment registry and immutable account/version snapshots; no remote calls inside checkout SQL. |
| src/payments/remote.rs | Dedicated payment RPC, pinned service version and operator-owned egress; never ordinary app-action receipts. |
| src/payments/return_urls.rs | Provider return/cancel URLs preserve the tenant and sales channel; navigation is never payment evidence. |
| src/payments/routes.rs | Customer payment status/capture and merchant refund operations share the durable command API. |
| src/payments/sessions.rs | Customer-bound, short-lived provider UI sessions; iframe messages are never ledger receipts. |
| src/payments/settlements.rs | Immutable capture receipts and exact cumulative settlement for native partial/multiple captures. |
| src/payments/state.rs | One monotonic provider-neutral ledger state machine; evidence validation and authorization stay in receipt adapters. |
| src/payments/storage.rs | Transactional provider receipts and order state updates; external responses cannot invent amounts or tenants. |
| src/payments/worker.rs | Leased payment jobs; network runs after claim commit, fenced receipts prevent duplicate local effects. |
| src/performance/access_snapshot.rs | One fresh, server-owned admission read shared by domain, identity, availability, channel and proxy middleware. |
| src/performance/admission.rs | Bounded instance/tenant concurrency, durable UTC-day AI quotas, and low-cardinality latency telemetry. |
| src/performance/authority.rs | Connect separately admitted SQL roles within one process budget; rotate authenticated transaction scopes. |
| src/performance/cache.rs | Bounded weighted LRU for immutable decoded read models; no network I/O under its mutex. |
| src/performance/cluster_lease.rs | Cluster-wide tenant resource leases. DB serialization protects admission; cancellation releases the fenced lease. |
| src/performance/delivery.rs | Native static bypass and bounded HTTP compression; credentials, streams and already encoded bodies stay intact. |
| src/performance/invalidation.rs | Commit-only outbox notifications eagerly evict replica caches; authoritative version probes survive missed events. |
| src/performance/languages.rs | Global language registry is versioned in the same transaction as every registry mutation. |
| src/performance/mod.rs | Shared read-context caching with authoritative versions; mutations and checkout locks stay outside memoization. |
| src/performance/pool.rs | Explicit per-process database budgets and bounded queue waits; invalid deployment values fail fast. |
| src/performance/row_security.rs | Bind each borrowed PostgreSQL connection to task scope, and reject unsafe strict-runtime roles. |
| src/performance/settings.rs | One MVCC snapshot validates base/override UUIDs; warm reads avoid transmitting or decoding JSON. |
| src/planner/admission.rs | Every initial or repaired model proposal traverses the same native read-only admission. |
| src/planner/repair.rs | One checkpointed correction of rejected output; original evidence, budget and native review remain authoritative. |
| src/planner.rs | Grounded model planning: durable input snapshots share native proposal validation and explicit apply. |
| src/platform/ai.rs | Operator-only inference administration: optimistic revision, encrypted write-only keys and audit without secrets. |
| src/platform/auth.rs | Independent platform authorization: live personal sessions, current grants, no integration/bootstrap escalation. |
| src/platform/bootstrap.rs | Offline first-operator setup: migration-only process, supplied strong credentials, password proof for existing accounts. |
| src/platform/infrastructure.rs | Live control-plane telemetry: database probes and pool/cache diagnostics, explicit process-only scope. |
| src/platform/lifecycle.rs | Audited, reversible lifecycle; preserved commerce records and current revision prevent accidental overwrites. |
| src/platform/metrics.rs | Aggregate-only control-plane reads: real tenants, bounded pages, explicit currencies and simulated/confirmed amounts. |
| src/platform/mod.rs | Global SaaS control plane: operator-only aggregate statistics and audited shop provisioning. |
| src/platform/provision.rs | Operator shop creation commits ownership, settings and audit atomically; never issues another user's credentials. |
| src/platform/quotas.rs | Operator-only per-shop daily interactive AI limits, optimistic revisions and durable audit. |
| src/platform/resources.rs | Linux container resource readings; unavailable fields stay null on other hosts and the first CPU sample. |
| src/platform/shop_detail.rs | Operator shop dossier: registration, business identity, access roster, channels and measured HTTP activity. |
| src/pos/config.rs | POS presentation/location configuration lives on the existing channel, not in a second settings store. |
| src/pos/customer.rs | Cashier-only customer lookup/card resolution and revision-checked account attachment; never issues customer credentials. |
| src/pos/discount.rs | Audited cashier discounts use exact minor units and the existing native tax allocator in both quote and commit. |
| src/pos/gateway.rs | HTTP/MCP POS operations construct a trusted cashier context, then call existing commerce owners. |
| src/pos/input.rs | Strict input envelope shared by HTTP and MCP cashier commands. |
| src/pos/mod.rs | Authenticated POS adapters reuse the native catalog/cart/checkout/receipt and durable event owners. |
| src/pos/schema.rs | Strict protocol schemas for the same POS operations used by HTTP and MCP. |
| src/pos/settlement.rs | Exact cash admission and order annotation execute in the existing checkout transaction. |
| src/pos/workspace_gateway.rs | Cashier workspace commands delegate to CRM, native discounts and immutable receipt projection. |
| src/prelude.rs | Shared dependency names for native domain modules; no process setup or business rules. |
| src/proposal_apply.rs | Transactional application of approved, revision-bound proposals. |
| src/proposal_model.rs | Typed proposals and validation before persistence or execution. |
| src/proposal_routes.rs | HTTP proposal creation, approval and task listing. |
| src/request_context.rs | Trusted request identity lives in extensions; HTTP headers carry transport inputs only. |
| src/routes.rs | HTTP transport registry; domain behavior lives in dedicated modules. |
| src/rule_comparison.rs | Behavioral port of Shopware 6.7.14.2 RuleComparison::numeric and FloatComparator's exact epsilon boundaries. |
| src/runtime_config.rs | Immutable process configuration, validated once at startup. Mutable shop/provider settings remain in PostgreSQL. |
| src/sandbox_cache.rs | Bounded tenant-policy compilation cache. Prepare outside commerce locks; verify the digest under the lock. |
| src/security_headers.rs | Common browser defenses on successful responses and errors, including reverse-proxy HTTPS deployments. |
| src/seed.rs | Idempotent synthetic template catalogue initialization. |
| src/shop_domains/frontend_bindings.rs | Revisioned aliases point to an existing tenant-owned Experience; origin selection remains operator-only. |
| src/shop_domains/frontend_editor.rs | Operator-owned editor navigation for hosted frontends; no private editor or identity implementation. |
| src/shop_domains/frontend_transport.rs | Stream generic hosted frontend responses and admit only explicitly allowlisted opaque shopper cookies. |
| src/shop_domains/frontends.rs | Generic operator-allowlisted frontend mounts. Host scope is derived from storage, never client headers. |
| src/shop_domains.rs | Resolve configured shop subdomains before authentication; reject unknown hosts and conflicting scopes. |
| src/staging/access.rs | Selective publication checks every selected domain's current rights before writing any live row. |
| src/staging/assets.rs | Binary assets are immutable, staged independently through metadata/digest units; paid entitlements never clone. |
| src/staging/categories.rs | Category release units and dependency-ordered tree publication; stock is never part of a catalog release. |
| src/staging/clone.rs | Clone only catalog/configuration into a private tenant; customer/order/payment state is excluded. |
| src/staging/company.rs | Selective company identity release copies only linked immutable logo bytes and validates the final company aggregate. |
| src/staging/documents.rs | Knowledge documents/chunks clone and publish with their source provenance; publication visibility is a reviewed unit. |
| src/staging/final_config.rs | Validate the final published channel/automation aggregate and initialize native POS defaults. |
| src/staging/mod.rs | Private cloned shops, scope admission and selective atomic release of reviewed changes. |
| src/staging/products.rs | Selected products publish before their image assets and in native parent-before-variant order, without copying stock. |
| src/staging/release.rs | Selected units publish in one transaction with staged digests and live baseline conflict checks. |
| src/staging/snapshot.rs | Fixed publishable units: product content/translations, settings, experience and app packages. |
| src/storefront_pages.rs | Deep-link HTML transport for stable SKU URLs with optional localized SEO slugs. |
| src/studio/facts.rs | Consolidate dashboard reads without unbounded pool fan-out; preserve the existing API and currency/learning semantics. |
| src/studio/personal/model.rs | Bounded personal layouts contain references, never delegated rights or executable agent instructions. |
| src/studio/personal.rs | Actor-private workspace preferences; HTTP and MCP share CAS, bounds and the current membership. |
| src/studio/reports/config.rs | One bounded report definition for HTTP, MCP and private workspace presentation preferences. |
| src/studio/reports/period.rs | Calendar periods are resolved once in the requested IANA timezone, with exclusive ends and bounded buckets. |
| src/studio/reports/traffic.rs | Reporting reuses the behavior owner's exact receipt/expiry predicate and inherited policy resolver; no new tracking store. |
| src/studio/reports.rs | Shared native commerce reports for Studio, workspace, API and agent reads; no second analytics ledger. |
| src/studio/revenue.rs | Merchant turnover remains separated by invoice currency; historical values are never repriced with today's FX. |
| src/studio/work.rs | Bounded current-right work items come from native rows; no inferred revenue, customer data or parallel task store. |
| src/studio.rs | Verified merchant overview facts consumed by the chat and activity views. |
| src/translations/apply.rs | Apply at most 50 reviewed drafts per request; stale products become conflicts rather than being overwritten. |
| src/translations/fields.rs | Translate only human-readable text; preserve identifiers, URLs, rich structure and source specification keys. |
| src/translations/mod.rs | Tenant-scoped, resumable AI translation drafts; applying is revision checked and emits native product events. |
| src/translations/routes.rs | Authorized translation job creation, progress, paginated drafts and resume/cancel controls. |
| src/translations/selection.rs | Explicit product selection is bounded, unique and tenant-owned before any translation is queued. |
| src/translations/worker.rs | One leased product per step: keyset traversal, bounded inference and resumable provider errors. |
| src/ucp/cart.rs | UCP cart transfer adapts the native cart and single-use browser handoff; supplier totals and return URLs are never trusted. |
| src/ucp/consent.rs | Explicit UCP consent reuses native cart-bound privacy receipts; source documents never define consent policy or authority. |
| src/ucp/document.rs | Project the native checkout and current purchasing constraints into UCP; never authorize a purchase. |
| src/ucp/messages.rs | Human-readable UCP purchasing messages follow the native checkout locale; stable codes remain language-independent. |
| src/ucp/mod.rs | UCP transport adapters reuse native cart, B2B, pricing, approval and checkout owners. |
| src/ucp/negotiation.rs | UCP B2B commands route to native RFQ/CAS/approval owners; a checkout token alone never identifies an employee. |
| src/ucp/profile.rs | Discover the versioned B2B extension and intersect opt-in platform profiles through bounded public HTTPS. |
| src/ucp/readiness.rs | Merchant readiness reports native implementation and current channel configuration, never external programme approval or settlement. |
| src/work_signal.rs | One dedicated LISTEN connection per worker process. Commit notifications are hints; polling repairs lost hints. |
| src/workers.rs | Independently deployable worker roles; leases and durable receipts coordinate replicas. |
Compiler-enforced domain crates
| Module | Responsibility |
|---|---|
| crates/apps/src/component_runtime/abi.rs | Exact, operator-configured WIT namespace compatibility with the same bounded host. |
| crates/apps/src/component_runtime.rs | WIT-typed read-only commerce guest. Snapshots are prepared by domain owners; no WASI, HTTP, DB or merchant credentials reach components. |
| crates/apps/src/lib.rs | Isolated app component execution; no HTTP, SQL or inference authority. |
| crates/apps/src/sandbox/configuration.rs | Bounded integer configuration arguments share the existing no-import Wasmtime engine and resource budgets. |
| crates/apps/src/sandbox.rs | Pure Wasmtime guest execution with bounded resources and no host imports. |
| crates/apps/src/sandbox_engine.rs | One bounded Wasmtime engine per process, with independent fuel and wall-clock interruption. |
| crates/cognition/src/inference/budget.rs | Durable conservative model allocations use existing agent keys and the live shop stop switch. |
| crates/cognition/src/inference/error.rs | Typed admission failures survive provider adapters; HTTP status never depends on parsing message text. |
| crates/cognition/src/inference/protocol.rs | Self-hosted chat-completions adapter and opt-in provider prompt caching; neither caches private commerce responses. |
| crates/cognition/src/inference/request.rs | One provider request owns native wire translation, bounded model admission and network egress. |
| crates/cognition/src/inference/schema.rs | Provider wire adaptation for strict fixed-object schemas; dynamic JSON is encoded only on the model wire and restored before domain validation. |
| crates/cognition/src/inference/settings.rs | Shared operator settings; AES-GCM secrets are never part of merchant/operator read responses. |
| crates/cognition/src/inference/tests.rs | Provider response contracts, strict schemas and truncation rejection. |
| crates/cognition/src/inference/tools/request.rs | Provider-native messages and correlated tool results, including opaque reasoning continuation. |
| crates/cognition/src/inference/tools/response.rs | Fail-closed normalization of bounded calls; malformed, truncated or unknown operations never execute. |
| crates/cognition/src/inference/tools/tests.rs | Native wire and injection negative cases exercise the same parser used before dispatch. |
| crates/cognition/src/inference/tools.rs | Native provider read-tool transport; normalization grants no execution authority. |
| crates/cognition/src/inference.rs | Provider adapters. Credentials stay on the server; domain validation is separate. |
| crates/cognition/src/lib.rs | Provider protocol adapters and prompt evidence; no commerce write capability. |
| crates/cognition/src/prompts.rs | Versioned system-prompt provenance; no prompt text or private context is exposed in evidence. |
| crates/commerce/src/discount.rs | Integer-cent proportional discount allocation; cumulative rounding conserves the exact basket discount. |
| crates/commerce/src/discount_boundaries.rs | Discount conservation at signed limits and against an independent prefix-rounding oracle. |
| crates/commerce/src/lib.rs | Commerce amounts and deterministic calculation contracts; no transport or inference dependencies. |
| crates/commerce/src/money.rs | Exact signed minor-unit amounts with explicit currency scale; legacy Shopware float pricing stays isolated. |
| crates/commerce/src/pricing.rs | Behavioral port of Shopware 6.7.14.2 quantity calculators. |
| crates/kernel/src/contract_tests.rs | Executable u64 edge/sequence regressions against independent u128 arithmetic, complementing universal Lean proofs. |
| crates/kernel/src/lib.rs | Pure extracted admission policies, without transport or database dependencies. |
| crates/kernel/src/verified_kernel/access.rs | Extracted access policies; pure bool/u64 decisions used by native consumers. |
| crates/kernel/src/verified_kernel/agents.rs | Planning-only ingress and private continuation admission; identity and time are verified by native adapters. |
| crates/kernel/src/verified_kernel/apps.rs | Extracted apps policies; pure bool/u64 decisions used by native consumers. |
| crates/kernel/src/verified_kernel/automation.rs | Extracted automation policies; pure bool/u64 decisions used by native consumers. |
| crates/kernel/src/verified_kernel/commerce.rs | Extracted commerce policies; pure bool/u64 decisions used by native consumers. |
| crates/kernel/src/verified_kernel/fulfillment.rs | Extracted fulfillment policies; pure bool/u64 decisions used by native consumers. |
| crates/kernel/src/verified_kernel/intelligence.rs | Extracted intelligence policies; pure bool/u64 decisions used by native consumers. |
| crates/kernel/src/verified_kernel.rs | Public facade for the closed, domain-owned Rust policies extracted to Lean. |
| crates/runtime/src/database_scope/provision.rs | Migration-only authority rollout commands; role passwords never pass through command arguments or output. |
| crates/runtime/src/database_scope.rs | Role-bound database scope tickets; private signing material never enters requests or app contexts. |
| crates/runtime/src/http_json.rs | Bound untrusted provider JSON before allocation/deserialization; connection pooling remains with each existing service owner. |
| crates/runtime/src/lib.rs | Shared scoped database and bounded network infrastructure. |
| crates/runtime/src/network_policy.rs | Shared DNS destination classification for app HTTP egress and approved SMTP providers. |
| crates/runtime/src/scoped_pool.rs | The commerce database executor: transaction-local tenant scope, including direct queries and cancelled streams. |
| crates/runtime/src/tenant_scope.rs | Database lease context: unknown tasks fail closed; trusted workers explicitly retain their scope. |
| crates/runtime/src/trace.rs | Private task-local correlation IDs; tracing never authorizes an operation or records payloads. |
Studio, storefront, platform and shared frontend
| Module | Responsibility |
|---|---|
| frontend/src/admin/agents/AgentsView.tsx | AgentsView renders verified shop state and typed user actions. |
| frontend/src/admin/apps/AppAccess.tsx | Explicit consent for digest-bound server callback keys; plaintext is shown once and never persisted in the browser. |
| frontend/src/admin/apps/AppActivity.tsx | API-backed per-app call metadata, storage budgets and explicitly approved durable replay. |
| frontend/src/admin/apps/AppArtwork.tsx | Passive app artwork with independent failed-image fallbacks and deterministic local category covers. |
| frontend/src/admin/apps/AppConfiguredOrders.tsx | Immutable app purchase cards reuse native order navigation and preserve source-currency and rule snapshots. |
| frontend/src/admin/apps/AppConsent.tsx | Review the actual package and permission changes before installation; consent is enforced by the API. |
| frontend/src/admin/apps/AppDetails.tsx | AppDetails: Installed app details, activation, version, data and isolated interface. |
| frontend/src/admin/apps/AppEntity.tsx | Managed entity editor renders fields from the installed app contract. |
| frontend/src/admin/apps/AppInterfaces.tsx | Open registered native/isolated admin surfaces through the existing permission-filtered registry. |
| frontend/src/admin/apps/AppJobArtifact.tsx | Completed app exports read the existing tenant asset owner; private files never acquire a public URL. |
| frontend/src/admin/apps/AppJobs.tsx | Long actions use the same app/outbox contract, with progress and explicit uncertain-outcome review. |
| frontend/src/admin/apps/AppLibrary.tsx | Searchable installed/discovery app cards with category/status filters and real lifecycle actions. |
| frontend/src/admin/apps/AppPackageImport.tsx | Import a bounded manifest through the same server review and approval as built-in apps. |
| frontend/src/admin/apps/AppSecrets.tsx | Metadata-only credentials screen; rotation sends plaintext once to the encrypted server store. |
| frontend/src/admin/apps/AppSettings.tsx | Installed settings use the existing encrypted secret owner; secret inputs are write-only and cleared after save. |
| frontend/src/admin/apps/AppUpgradeReport.tsx | Display only native admission metadata; a report is never an installation permission. |
| frontend/src/admin/apps/AppsManager.tsx | Installed package workspace: lifecycle, generated entities and shared agent actions. |
| frontend/src/admin/apps/ConnectorPanel.tsx | Native app workspace: OAuth, provider settings, durable jobs and private sources. |
| frontend/src/admin/apps/IntegrationDirectory.tsx | Ten explicit service routes reuse native app consent or the documented HTTP setup; no fake connected state. |
| frontend/src/admin/apps/PaymentManager.tsx | Native payment balances and observed financial jobs, shared with the order detail controls. |
| frontend/src/admin/apps/ProviderAccount.tsx | Shared installed-provider onboarding and channel connection controls for merchant Apps and App Studio. |
| frontend/src/admin/apps/ServiceIntegrationPanel.tsx | Revisioned encrypted connection forms and bounded operations on the existing app action gateway. |
| frontend/src/admin/apps/app-settings.css | Installed-app configuration remains usable outside the developer workbench. |
| frontend/src/admin/apps/app-types.ts | Installed package metadata used by app administration views. |
| frontend/src/admin/apps/connector-descriptors.ts | Shared connector presentation registry; settings and capabilities are owned by each app package. |
| frontend/src/admin/apps/integration-directory-text.ts | Service catalogue capability boundaries in all supported Studio languages. |
| frontend/src/admin/apps/library-model.ts | Shared app discovery metadata, safe artwork sources and localized search independent of rendering. |
| frontend/src/admin/apps/service-integration-text.ts | Shared connector controls; provider-specific descriptions and field choices stay in app packages. |
| frontend/src/admin/apps/service-integrations.ts | Installed provider UI capabilities come from their app packages, not an alternate commerce registry. |
| frontend/src/admin/apps/upgrade-i18n.ts | Upgrade admission vocabulary shared by installed package consent and App Studio. |
| frontend/src/admin/assistant/CopilotNavigation.tsx | Suggested navigation stays explicit, using the shared native route. |
| frontend/src/admin/assistant/MessageText.tsx | MessageText keeps merchant interaction separate from workspace orchestration. |
| frontend/src/admin/assistant/ProposalCard.tsx | ProposalCard keeps merchant interaction separate from workspace orchestration. |
| frontend/src/admin/assistant/SettingsDialog.tsx | SettingsDialog keeps merchant interaction separate from workspace orchestration. |
| frontend/src/admin/assistant/WorkspaceCopilot.tsx | Contextual drawer reuses the existing scoped conversation, permissions and proposal execution without unmounting editors. |
| frontend/src/admin/assistant/copilot-navigation.ts | Only registered native destinations survive model/replay admission. Entity editors recheck current server access. |
| frontend/src/admin/assistant/useCopilotDock.ts | One actor/shop-scoped assistant dock. Hiding never discards a conversation or starts a model call. |
| frontend/src/admin/automation/AutomationDefinitions.tsx | Searchable, explicitly editable definitions with visible active state and version. |
| frontend/src/admin/automation/AutomationDelete.tsx | One confirmation and a server recheck; stale versions and used definitions never disappear silently. |
| frontend/src/admin/automation/AutomationEditor.tsx | AutomationEditor: focused form view with explicit typed inputs and callbacks. |
| frontend/src/admin/automation/AutomationView.tsx | Typed merchant rule/campaign/flow/channel forms with exact JSON available for advanced review. |
| frontend/src/admin/automation/CustomFieldCondition.tsx | Typed custom field conditions support text, numeric, Boolean and date values using original field payload names. |
| frontend/src/admin/automation/FlowActionFields.tsx | Focused source action forms expose only supported native parameters; app service dispatch stays in the app gateway. |
| frontend/src/admin/automation/FlowBuilder.tsx | Graphical event → condition tree → action pipeline, including installed app actions. |
| frontend/src/admin/automation/FlowCanvas.tsx | Branching flow canvas edits the actual server graph, including true/false edges, reusable actions and durable delays. |
| frontend/src/admin/automation/FlowExecution.tsx | Actual persisted execution traces show branch decisions, confirmed steps and the scheduled continuation. |
| frontend/src/admin/automation/FlowInputs.tsx | Schema-derived flow parameters; runtime-bound event fields are intentionally supplied by the server. |
| frontend/src/admin/automation/FlowProposalReview.tsx | Flow review observes the original native task, including approval made in another Studio view. |
| frontend/src/admin/automation/FlowTopology.tsx | Readable connected overview of the persisted graph; selecting a node opens its matching editor card. |
| frontend/src/admin/automation/JsonField.tsx | JSON editing retains incomplete input and invalidates the actual payload instead of silently saving the last valid value. |
| frontend/src/admin/automation/PromotionSchedule.tsx | Campaign scheduling uses ISO instants in the API and local times in the editor. |
| frontend/src/admin/automation/RuleBuilder.tsx | Visual recursive rule tree: AND/OR/NOT groups, typed facts and editable leaf conditions. |
| frontend/src/admin/automation/RuleHistory.tsx | Bounded read-only comparison; stale responses cannot cross a rule or workspace. |
| frontend/src/admin/automation/SourceRuleFields.tsx | Original metadata drives typed condition inputs, including nested source scopes; unsupported runtimes stay visibly disabled. |
| frontend/src/admin/automation/WorkTemplateEditor.tsx | Bounded field-to-event mapping over the original native operations, never a second executor. |
| frontend/src/admin/automation/automation-types.ts | Automation editor contracts; content languages come from the selected shop. |
| frontend/src/admin/automation/goal-template.ts | Explicit personal goal handoff into an inactive native Flow draft; no URL, persistence or new scheduler. |
| frontend/src/admin/automation/lifecycle-i18n.ts | Shared lifecycle, starting-process and dependency vocabulary for every automation editor. |
| frontend/src/admin/automation/pipeline-types.ts | Stable graph data mirrors the Rust pipeline contract, with explicit true/false edges and persistent node identifiers. |
| frontend/src/admin/automation/rule-history-i18n.ts | Frozen rule comparison copy; the sample and decision boundary remain explicit. |
| frontend/src/admin/automation/rule-history.css | Contained comparison controls/results inside the existing rule editor. |
| frontend/src/admin/automation/source-rules.ts | Convert source condition nodes for the graphical editor without losing original payload fields. |
| frontend/src/admin/automation/useAutomationAccess.ts | Current native automation grants, cleared immediately when the workspace changes. |
| frontend/src/admin/automation/useAutomationLanguages.ts | Load the current shop's content-language context and ignore replies after the workspace changes. |
| frontend/src/admin/automation/work-template-i18n.ts | Reviewed-work Flow vocabulary in every Studio interface language. |
| frontend/src/admin/automation/work-template.ts | Keep only a protected task reference in Flow configuration; operation inputs stay in actor-private evidence. |
| frontend/src/admin/b2b/B2BWorkspace.tsx | Tenant-scoped company workspace; canonical API operations are also exposed through MCP. |
| frontend/src/admin/b2b/CompanyCreate.tsx | Guided company creation is one atomic native API command; the main-language name is always visible. |
| frontend/src/admin/b2b/CustomerPicker.tsx | B2B reuses the shared native customer picker; purchasing policy stays in its domain owner. |
| frontend/src/admin/b2b/Members.tsx | Grants reference actual customer identities, never email guesses; pauses retain historical purchases. |
| frontend/src/admin/b2b/Quotes.tsx | Native RFQ inbox and merchant offers use the same versioned contract as buyer API/MCP operations. |
| frontend/src/admin/b2b/UnitCatalog.tsx | Search the canonical merchant catalog; unit permissions persist through the native revision-bound catalog API. |
| frontend/src/admin/b2b/UnitEditor.tsx | Purchasing unit policies, hierarchy, catalogs and customer grants share current revision checks. |
| frontend/src/admin/b2b/UnitMethods.tsx | Unit allowlists reference the existing translated shipping/payment owner; empty means inherited availability. |
| frontend/src/admin/b2b/experience-i18n.ts | Guided company purchasing and shared settings copy in all bundled interface languages. |
| frontend/src/admin/b2b/reference.ts | Native organization IDs require a lowercase letter first and at most 32 characters. |
| frontend/src/admin/catalog/AiImageStudio.tsx | Optional image-provider jobs create private previews; applying a reviewed image is explicit and revision checked. |
| frontend/src/admin/catalog/CanvasCommerceEditor.tsx | Canvas handoff reuses native product/category editors without unmounting or copying the page designer. |
| frontend/src/admin/catalog/CatalogDirectory.tsx | Product columns and native catalog criteria over the shared grid; media/price/content stay domain-owned. |
| frontend/src/admin/catalog/CatalogIntake.tsx | Merchant source chooser and explicit staged creation reuse native product, media and environment owners. |
| frontend/src/admin/catalog/CatalogIntakeReview.tsx | Editable catalogue review is distinct from native creation and later publication; AI images reuse the product editor's job workflow. |
| frontend/src/admin/catalog/CatalogIntakeSource.tsx | Source-specific input remains a compact part of the existing reviewed catalogue intake. |
| frontend/src/admin/catalog/CatalogPreparation.tsx | One paged native projection connects saved content and durable image jobs to their existing editors. |
| frontend/src/admin/catalog/CategoriesWorkspace.tsx | Localized category tree editor; parent moves and revisions are validated in the API. |
| frontend/src/admin/catalog/CategoryFactQuery.tsx | One saved predicate on current public evidence; reuses category CAS and the editor's selected content language. |
| frontend/src/admin/catalog/MediaDropzone.tsx | Accessible multi-file upload with drag/drop, visible progress and the same validated asset API as attachments. |
| frontend/src/admin/catalog/PairFields.tsx | Native map editing uses explicit row creation and collision-safe rename on blur, never whitespace keys or overwritten siblings. |
| frontend/src/admin/catalog/ProductAssets.tsx | Bounded upload and explicit digest-bound publication of attachments and paid files. |
| frontend/src/admin/catalog/ProductAssignments.tsx | Searchable product category paths and explicit channel choices share the native revisioned aggregate save. |
| frontend/src/admin/catalog/ProductCurrencyPrices.tsx | Exact per-currency decimals live in the same revisioned product draft, including variants. |
| frontend/src/admin/catalog/ProductDataView.tsx | Central catalog workspace uses shared server-paged grids, existing product editing and hierarchical categories. |
| frontend/src/admin/catalog/ProductEditor.tsx | Revision-aware product aggregate editor: one save, translation tabs and product-scoped linked capabilities. |
| frontend/src/admin/catalog/ProductEditorActions.tsx | Product mutation actions share the workspace write grant; read-only users can still inspect all product tabs. |
| frontend/src/admin/catalog/ProductEditorExtras.tsx | Permission-filtered extension slots retain the current product context. |
| frontend/src/admin/catalog/ProductEditorHeader.tsx | Compact product identity, current save state and shared language context stay above every section. |
| frontend/src/admin/catalog/ProductEditorNav.tsx | Grouped product and installed-app sections share keyboard navigation and one compact mobile selector. |
| frontend/src/admin/catalog/ProductGallery.tsx | Local gallery drag ordering edits the same product draft; arrows remain available in the image inspector. |
| frontend/src/admin/catalog/ProductGeneral.tsx | Product basics and full content remain primary; optional identifiers and shipping flags share one expandable native-draft section. |
| frontend/src/admin/catalog/ProductLocalizedContent.tsx | Consistent main-language inheritance for product rich documents. |
| frontend/src/admin/catalog/ProductMediaWorkspace.tsx | One product-media workspace: cover, ordered gallery, multilingual image metadata, drag/drop and optional reviewed AI drafts. |
| frontend/src/admin/catalog/ProductModelCard.tsx | A model edits the same localized product media item; material choices come from the loaded GLB. |
| frontend/src/admin/catalog/ProductModels.tsx | Native GLB upload, parent reuse and material binding stay inside the existing revisioned product draft. |
| frontend/src/admin/catalog/ProductPanels.tsx | Native commerce, media, translated SEO/specifications and category panels for one editable product. |
| frontend/src/admin/catalog/ProductPriceTiers.tsx | Native rule-bound price tiers edit the existing revisioned product aggregate. |
| frontend/src/admin/catalog/ProductPricing.tsx | Grouped native pricing inputs preserve stock-safe aggregate saves and optional price contracts. |
| frontend/src/admin/catalog/ProductSeo.tsx | Single-language optional SEO edits share effective fields and encoded paths with the storefront; previewing never mutates the product draft. |
| frontend/src/admin/catalog/ProductSpecifications.tsx | Visible localized details, language-independent properties and unit-labelled dimensions edit the same native product aggregate. |
| frontend/src/admin/catalog/ProductTextFields.tsx | Product text uses the shared single-language editor and field inheritance; product number stays language independent. |
| frontend/src/admin/catalog/ProductVariants.tsx | Native variant family browser with cursor pagination, explicit editing and a bounded creation wizard. |
| frontend/src/admin/catalog/ReferencePriceFields.tsx | Native reference-unit inputs feed the same server-calculated unit price displayed on product pages. |
| frontend/src/admin/catalog/RelatedProductRow.tsx | A selected product resolves through the native merchant read; missing/forbidden records remain explicitly removable without losing the selection. |
| frontend/src/admin/catalog/RelatedProducts.tsx | Ordered recommendations retain selected native records across cursor-paginated searches, content-language changes and read-only inspection. |
| frontend/src/admin/catalog/ReviewModeration.tsx | Product-scoped review publication; authoritative authorization stays in the API. |
| frontend/src/admin/catalog/TaxClassSelect.tsx | Assign a product to an actual tenant tax class; legacy standard/reduced mapping remains explicit. |
| frontend/src/admin/catalog/VariantGenerator.tsx | Reviewable, bounded batch creation uses saved parent data and keeps successful rows on partial failure. |
| frontend/src/admin/catalog/catalog-intake-model.ts | Review state carries stable native IDs; source changes discard the entire prior proposal, never overwrite existing products. |
| frontend/src/admin/catalog/catalog-model.ts | Editable native product aggregate and defaults shared by creation, detail and variant workflows. |
| frontend/src/admin/catalog/media-model.ts | Pure gallery operations preserve order, explicit alt translations and upload bounds without fabricating language values. |
| frontend/src/admin/catalog/preparation-i18n.ts | Preparation vocabulary describes persisted native progress, never an invented publication approval. |
| frontend/src/admin/catalog/product-assignment-i18n.ts | Product category/channel assignment guidance in every supported Studio interface language. |
| frontend/src/admin/catalog/product-assignment-model.ts | Bounded category paths and current product-channel choices preserve native IDs and language inheritance. |
| frontend/src/admin/catalog/product-content-i18n.ts | Product content guidance and optional identity grouping use the shared four-language interface contract. |
| frontend/src/admin/catalog/product-content-model.ts | Product rich content resolves its own language keys and preserves explicit blanks and legacy text on translation. |
| frontend/src/admin/catalog/product-editor-i18n.ts | Product workspace guidance shares the interface locale, never the product's content language. |
| frontend/src/admin/catalog/product-media-i18n.ts | Gallery ordering guidance shares interface locales without changing product image translations. |
| frontend/src/admin/catalog/product-pricing-i18n.ts | Interface guidance for native product prices, optional conditions and availability. |
| frontend/src/admin/catalog/product-seo-i18n.ts | Product search-preview labels and automatic SEO guidance in all Studio interface languages. |
| frontend/src/admin/catalog/product-specification-i18n.ts | Four-language specification guidance, safe key editing and explicit draft-row actions. |
| frontend/src/admin/catalog/related-products-i18n.ts | Related-product selection and current-state guidance in all Studio interface languages. |
| frontend/src/admin/catalog/useImageJob.ts | Restore and reconcile native image jobs across request/locale changes; only explicit merchant actions create provider work. |
| frontend/src/admin/catalog/variant-family.ts | Cursor-based family lookup for duplicate review, bounded independently of the 50-row creation limit. |
| frontend/src/admin/catalog/variant-i18n.ts | Guided variant creation and editing vocabulary; content still follows shop language inheritance. |
| frontend/src/admin/catalog/variant-model.ts | Bounded option combinations and metadata-free child payloads shared by the guided variant creator. |
| frontend/src/admin/channels/AgenticChannels.tsx | One merchant entry for inbound shops and native agent checkout; technical support never masquerades as external approval. |
| frontend/src/admin/channels/ChannelActions.tsx | Lifecycle actions use shared dependency deletion and one-use preview admission. |
| frontend/src/admin/channels/ChannelCatalog.tsx | Catalog/language controls share the channel schema and content-language fallback. |
| frontend/src/admin/channels/ChannelConnections.tsx | Uses the existing tenant-owned frontend registry, not a parallel domain or Experience store. |
| frontend/src/admin/channels/ChannelEditor.tsx | Guided channel creation/editing reuses the native revisioned API and shared content-language inheritance. |
| frontend/src/admin/channels/ChannelLaunch.tsx | Successful native channel creation ends in a clear next action; no provider is connected implicitly. |
| frontend/src/admin/channels/ChannelProducts.tsx | Search-based channel product assignment, preserving selected IDs across server-filtered result pages. |
| frontend/src/admin/channels/ChannelReview.tsx | A readable summary of the exact native channel draft before its revisioned save. |
| frontend/src/admin/channels/ChannelSettings.tsx | Channel settings embed existing revision-aware identity and checkout editors with the channel selected. |
| frontend/src/admin/channels/ChannelType.tsx | Channel kind and POS presentation editor use the existing channel/content-language contract. |
| frontend/src/admin/channels/ChannelVisibility.tsx | Public/private audience settings only apply to storefront and headless channel entry points. |
| frontend/src/admin/channels/SalesChannelsWorkspace.tsx | Discover and create channels separately from rules; shared settings and independent SaaS shops remain explicit. |
| frontend/src/admin/channels/agentic-channel-i18n.ts | Inward catalogue intake and protocol readiness use clear four-language merchant copy. |
| frontend/src/admin/channels/channel-i18n.ts | Sales-channel onboarding and inherited settings vocabulary in all interface languages. |
| frontend/src/admin/channels/channel-model.ts | Existing sales-channel contract and safe storefront URLs; independent tenants remain a separate concept. |
| frontend/src/admin/channels/connection-i18n.ts | Domain lifecycle copy in every supported Studio language. |
| frontend/src/admin/customers/CustomerCreate.tsx | Native CRM creation with explicit address defaults, inline validation and unsaved-change recovery. |
| frontend/src/admin/customers/CustomerDirectory.tsx | Registered and guest contacts share native directory filters and permission-aware grid controls. |
| frontend/src/admin/customers/CustomersManager.tsx | CRM list and editable customer profile with linked order history. |
| frontend/src/admin/customers/GuestContact.tsx | Read-only checkout snapshots distinguish guest contacts from authenticated customer accounts. |
| frontend/src/admin/dashboard/OverviewView.tsx | OverviewView renders verified shop state and typed user actions. |
| frontend/src/admin/developer/AppActionAccess.tsx | Team permissions and MCP visibility are independent from public storefront reads and AI grounding. |
| frontend/src/admin/developer/AppAgentDrawer.tsx | Contextual agent drawer retains the shared proposal workflow and draft while the native dialog manages focus. |
| frontend/src/admin/developer/AppAgentPanel.tsx | Coding agents receive the current Manifest IR and authoritative schema; imported edits round-trip to the canvas. |
| frontend/src/admin/developer/AppAssistant.tsx | Guided app kinds create normal editable manifests; all changes follow private-stage versioning. |
| frontend/src/admin/developer/AppAutomation.tsx | Editable triggers are declared alongside UI and actions; secrets remain operator-managed. |
| frontend/src/admin/developer/AppBrief.tsx | A plain merchant brief opens an empty ordinary draft in the existing contextual agent. |
| frontend/src/admin/developer/AppCanvas.tsx | Accessible click-to-add canvas with selectable blocks and keyboard-accessible ordering controls. |
| frontend/src/admin/developer/AppCanvasAgent.tsx | The persistent right dock describes the selected native definition and reuses the existing agent proposal pipeline. |
| frontend/src/admin/developer/AppCapabilityChecks.tsx | Frozen pure-decision expectations remain advanced, read-only metadata; no fake execution result is inferred. |
| frontend/src/admin/developer/AppCapabilityEditor.tsx | Merchant ideas, requirements and explicit agent handoff edit the canonical versioned Manifest without executing changes. |
| frontend/src/admin/developer/AppCodeBuffer.ts | Invalid local expressions block apply and mode changes until corrected; multiple editors report independently. |
| frontend/src/admin/developer/AppConfigurationExamples.tsx | Configuration example cards expose frozen inputs and expected guest results without computing business rules in the browser. |
| frontend/src/admin/developer/AppConnections.tsx | Route, tool, grounding and Flow Builder switches modify the shared executable manifest directly. |
| frontend/src/admin/developer/AppContextBinding.tsx | Native UI bindings connect the open host object to an indexed app field, never to a global JS context. |
| frontend/src/admin/developer/AppControlProperties.tsx | DataField and one-level container references are edited against the current typed model rather than free text. |
| frontend/src/admin/developer/AppControlThumbnail.tsx | Lightweight control illustrations communicate structure; no sample data or runtime is executed. |
| frontend/src/admin/developer/AppCreationSummary.tsx | Draft summary mirrors chosen locations without changing publication state or generated permissions. |
| frontend/src/admin/developer/AppCurrentIdentity.tsx | Current app identity and save state stay visible across the editor's sections. |
| frontend/src/admin/developer/AppDataEditor.tsx | Managed app models expose typed fields and opt-in public reads; removal cleans dependent bindings. |
| frontend/src/admin/developer/AppDesignPreview.tsx | Schema-based, non-interactive design illustration. Never fetches data or executes app actions. |
| frontend/src/admin/developer/AppDesignWorkspace.tsx | One Manifest drives the shared scene overview, direct editor, contextual agent and proposal comparison. |
| frontend/src/admin/developer/AppDiagnostics.tsx | Declared package diagnostics link to their real editors; counts never claim a successful runtime test or installed secret. |
| frontend/src/admin/developer/AppDraftEntry.tsx | Description and pattern entry share draft replacement confirmation before starting the existing workbench. |
| frontend/src/admin/developer/AppEditorNavigation.tsx | Consistent navigation between visual definitions, provider contracts and immutable versions. |
| frontend/src/admin/developer/AppElementActions.tsx | Element actions mutate the same native block list, preserving undo, schema limits and bounded handler ownership. |
| frontend/src/admin/developer/AppEvents.tsx | Edits the validated subscription/filter/batch contract; delivery uses the existing leased outbox. |
| frontend/src/admin/developer/AppExpressionEditor.tsx | Expressions use typed source text and known form/control references, with a separate JSON editor for agent object ASTs. |
| frontend/src/admin/developer/AppFieldOptions.tsx | Core references and typed choice fields remain owned app data with a single content-language editor. |
| frontend/src/admin/developer/AppFlowNavigation.ts | Editor-only navigation connects UI behavior to the existing Flow Builder, without another executor. |
| frontend/src/admin/developer/AppFormFields.tsx | Form captions edit the same model fields rendered by the native form and data-model editor. |
| frontend/src/admin/developer/AppGeometry.tsx | F4 presentation properties use one content language; layout values remain bounded grid units. |
| frontend/src/admin/developer/AppGridCanvas.tsx | Drag/drop, snapping, resize and multi-selection share the published app geometry contract. |
| frontend/src/admin/developer/AppInspector.tsx | One content language edits app/view/block metadata; changing bindings updates the actual manifest. |
| frontend/src/admin/developer/AppInstructionEditor.tsx | Block instructions expose schema-aware targets; nested branches are edited recursively under the server's bounded AST contract. |
| frontend/src/admin/developer/AppLibrary.tsx | Saved app cards with explicit editing and recoverable project removal, independent of installed package/data lifecycle. |
| frontend/src/admin/developer/AppLogicEditor.tsx | A code-behind dialog edits one AST through visual blocks, BASIC syntax or agent JSON, then returns it to the manifest compiler. |
| frontend/src/admin/developer/AppLogicTopology.tsx | The existing Flow Builder topology displays the bounded UI AST; no separate flow is persisted or executed. |
| frontend/src/admin/developer/AppMenuEditor.tsx | Menu and injection sites are the existing surfaces, with explicit action allowlists and live role scopes. |
| frontend/src/admin/developer/AppModelDiagram.tsx | Relationships use the same typed field.references contract as the form editor; no separate diagram state or database model. |
| frontend/src/admin/developer/AppModules.tsx | Pure server modules edit the same WIT component contract consumed by quotes and checkout; no browser eval or live service code. |
| frontend/src/admin/developer/AppNativeLifecycles.tsx | Visual native lifecycle contract editor; execution remains in native order/RFQ owners and accepted snapshots. |
| frontend/src/admin/developer/AppOntology.tsx | Optional graph mappings edit the canonical manifest; native authorized record lists own the projection. |
| frontend/src/admin/developer/AppPanelSizing.tsx | Local panel widths contain presentation only; pointer and keyboard resizing never change the Manifest. |
| frontend/src/admin/developer/AppPayments.tsx | Visual payment contracts use the same manifest as coding agents; onboarding uses the protected API. |
| frontend/src/admin/developer/AppPlacementOverview.tsx | App scenes project one current Manifest using the native design renderer, without record reads or executable actions. |
| frontend/src/admin/developer/AppPlacementPicker.tsx | Illustrated placement selection projects the existing registry; it never grants runtime access. |
| frontend/src/admin/developer/AppProposalReview.tsx | AI generation is an explicit reviewed proposal, with conflict protection and no automatic canvas replacement. |
| frontend/src/admin/developer/AppProposalTest.tsx | Proposed versions run in the existing actor-private native preview; diagnostic repair returns to the same composer. |
| frontend/src/admin/developer/AppRecipes.tsx | Keyboard-accessible recipe entry points use the existing draft replacement and release controls. |
| frontend/src/admin/developer/AppSchemaMigrations.tsx | Migration plans are explicit versioned agent-readable data, validated by the shared server compiler before any DDL. |
| frontend/src/admin/developer/AppSettingsEditor.tsx | Versioned setting declarations share the native Manifest; no credential value enters a draft. |
| frontend/src/admin/developer/AppStudioIntro.tsx | App Studio heading and new-app entry share the localized workbench language. |
| frontend/src/admin/developer/AppStudioStatus.tsx | Shared status footer keeps validation, persistence and execution feedback beside the designer. |
| frontend/src/admin/developer/AppUpgradeCheck.tsx | Explicitly inspect an immutable build in its owned stage, with response fencing on account/environment changes. |
| frontend/src/admin/developer/AppVersions.tsx | Saved version inspection, digest-approved stage install and conflict-aware package-only live release. |
| frontend/src/admin/developer/AppViewTabs.tsx | Native view navigation and creation are separate from workspace orchestration. |
| frontend/src/admin/developer/AppWorkflowEditor.tsx | Visual status edges use the exact app manifest contract enforced by native record storage. |
| frontend/src/admin/developer/CoreExtensionBinding.tsx | One understandable native-object selection; relationships, uniqueness and scopes compile together. |
| frontend/src/admin/developer/DeveloperView.tsx | Visual App Studio orchestrates modular editors over the same executable schema used by coding agents. |
| frontend/src/admin/developer/DeveloperWorkspace.tsx | Dedicated app and API workspaces retain App Studio state while switching the developer console. |
| frontend/src/admin/developer/SandboxContextPicker.tsx | Bounded server search selects an owned object for testing editor-bound apps in a private sandbox. |
| frontend/src/admin/developer/SandboxPreview.tsx | Preview resolves the installed registry first; a newer staged package cannot masquerade as an older build. |
| frontend/src/admin/developer/api/AgentBudgetFields.tsx | Explicit delegation limits; empty or invalid fields never create unbounded agent authority. |
| frontend/src/admin/developer/api/AgentControls.tsx | Personal current-rights stop control; operational revisions cannot be published from a sandbox. |
| frontend/src/admin/developer/api/ApiExplorer.tsx | Source-derived static route explorer, runtime app discovery and isolated same-origin read tests. |
| frontend/src/admin/developer/api/IntegrationKeys.tsx | Personal, expiring, least-privilege integration keys; plaintext stays in component memory and is never reloaded. |
| frontend/src/admin/developer/api/agent-control-i18n.ts | Agent delegation and live stop controls share explicit four-language operational vocabulary. |
| frontend/src/admin/developer/api/api-i18n.ts | Four-language developer API console vocabulary; no credentials are persisted in UI storage. |
| frontend/src/admin/developer/app-connections.css | Broken manifest references stay next to a direct repair action. |
| frontend/src/admin/developer/app-connections.ts | Draft-only connection hints reference the canonical Manifest; Rust still validates and authorizes save/install/runtime. |
| frontend/src/admin/developer/app-diagnostic-i18n.ts | Actionable package review vocabulary distinguishes declarations, runtime checks and publication. |
| frontend/src/admin/developer/app-model-actions.ts | Native model actions and extension scopes compile once for manual and agent-generated views. |
| frontend/src/admin/developer/app-model.ts | Pure schema edits preserve unsupported extension properties; compilation binds native UI to real actions. |
| frontend/src/admin/developer/app-proposal.ts | Bounded semantic review summaries compare the exact current and proposed manifests. |
| frontend/src/admin/developer/app-recipes.ts | Load app-owned patterns; Studio only clones and compiles the canonical plugin Manifest. |
| frontend/src/admin/developer/app-validation.ts | Draft validation surfaces bounded manifest errors; authoritative installation remains in Rust. |
| frontend/src/admin/developer/app-version.ts | Suggest a free forward version when copying history; immutable and archived builds retain their identity. |
| frontend/src/admin/developer/app-visuals.ts | Presentation-only symbols for native controls; behavior still belongs to the shared runtime. |
| frontend/src/admin/developer/asset-actions.ts | Native asset editors use the existing asset owner; generated actions remain explicit capabilities in the package. |
| frontend/src/admin/developer/assistant-model.ts | Assistants compile to the public manifest contract, with no hidden runtime or provider code. |
| frontend/src/admin/developer/assistant-placements.ts | Multiple assistant placements remain ordinary independent views/models in one immutable package. |
| frontend/src/admin/developer/basic-code.ts | Small BASIC-style surface syntax compiles into the same bounded AST as visual and agent edits; no JavaScript execution. |
| frontend/src/admin/developer/brief-i18n.ts | Typed merchant vocabulary for description-led app creation; no extra agent or execution path. |
| frontend/src/admin/developer/control-model.ts | Pure control construction and bounded code-behind discovery keep visual edits and agent manifests identical. |
| frontend/src/admin/developer/core-extension-model.ts | Visual extension bindings compile into the canonical model and current native action scopes. |
| frontend/src/admin/developer/model-workspace.ts | Form wizard emits the standard manifest IR; the ordinary compiler supplies all actions, APIs and permission allowlists. |
| frontend/src/admin/developer/start-described-app.ts | A merchant brief begins in an owned private stage and uses the existing reviewed app agent. |
| frontend/src/admin/developer/useAppPreview.ts | F5/hot reload uses the existing native runtime in an actor-private staging environment, never an immutable build. |
| frontend/src/admin/developer/useAppStudio.ts | Tenant-scoped build lifecycle; immutable saved snapshots gate sandbox previews and selected app-only releases. |
| frontend/src/admin/developer/useDesignerKeys.ts | Designer keyboard shortcuts leave native input and rich-editor undo behavior intact. |
| frontend/src/admin/developer/useDraftStorage.ts | Actor-private server autosaves serialize writes and preserve optimistic revisions across app switches. |
| frontend/src/admin/environments/EnvironmentManager.tsx | Private environment creation and digest-bound selective release. |
| frontend/src/admin/environments/ReleaseScenarios.tsx | Actor-private saved scenario evidence sits beside native release diffs without becoming an approval gate. |
| frontend/src/admin/environments/ReleaseShopPreview.tsx | Explicit native sandbox preview rechecks the saved run; it never attests a historical render. |
| frontend/src/admin/environments/release-preview-i18n.ts | Native preview controls distinguish current rendering from saved API test evidence. |
| frontend/src/admin/environments/release-preview.css | Native shop preview stays contained in the release review at both viewport sizes. |
| frontend/src/admin/environments/release-tests-i18n.ts | Release review vocabulary keeps simulated commerce evidence distinct from publication approval. |
| frontend/src/admin/environments/release-tests.css | Existing release workbench typography with bounded, responsive test controls. |
| frontend/src/admin/intelligence/EvidenceReview.tsx | Review source-bound candidates through shared HTTP/MCP contracts; changed sources block publication. |
| frontend/src/admin/intelligence/ExperimentStudio.tsx | Immutable experiment designs and lifecycle controls share the core HTTP/MCP owner and current settings rights. |
| frontend/src/admin/intelligence/ExternalKnowledge.tsx | Private connected-app evidence browser shows active-source provenance without exposing it to shoppers. |
| frontend/src/admin/intelligence/GuardrailProductCard.tsx | Currency-aware editing of one native product corridor, with honest product/configuration links. |
| frontend/src/admin/intelligence/GuardrailProductSearch.tsx | Bounded native catalogue search, not the sampled dashboard; stale replies never replace current results. |
| frontend/src/admin/intelligence/GuardrailSettings.tsx | Merchant AI boundaries use canonical settings revisions, native catalogue lookup and the shared assistant. |
| frontend/src/admin/intelligence/KnowledgeExplorer.tsx | Product-centred evidence inspector reads canonical facts and graph relationships beyond overview sampling. |
| frontend/src/admin/intelligence/KnowledgeFacts.tsx | Canonical catalogue facts shown alongside graph evidence; prices and inventory come from current product state. |
| frontend/src/admin/intelligence/KnowledgeNavigation.tsx | Stable grouped navigation replaces clipped horizontal tabs; a labelled selector serves narrow workspaces. |
| frontend/src/admin/intelligence/KnowledgeOverview.tsx | Whole-shop knowledge census, operational next steps and provenance activity; examples never masquerade as learned facts. |
| frontend/src/admin/intelligence/KnowledgePreview.tsx | No-model evidence preview makes customer/private retrieval boundaries and missing facts inspectable. |
| frontend/src/admin/intelligence/KnowledgeSources.tsx | Searchable cursor source library, guarded lifecycle decisions and single-language source editing. |
| frontend/src/admin/intelligence/KnowledgeView.tsx | Unified knowledge workspace connects sources, product evidence, observations and no-model retrieval previews. |
| frontend/src/admin/intelligence/MemoryView.tsx | Durable co-purchase evidence and revision-bound merchant decisions, with simulation labels and explicit confirmation. |
| frontend/src/admin/intelligence/MerchantSourceIntake.tsx | Conversation intake reuses the real private versioned source editor and existing upload API. |
| frontend/src/admin/intelligence/SourceEditor.tsx | Single-language source editor with inherited fields, product lookup and private-first API/file ingestion. |
| frontend/src/admin/intelligence/behavior/BehaviorGraph.tsx | A derived graph connects coarse browsers to native products and existing semantic product relations. |
| frontend/src/admin/intelligence/behavior/BehaviorJourney.tsx | Authorized journey timeline links to native product, customer and order views, through permission-bound native CRM references. |
| frontend/src/admin/intelligence/behavior/BehaviorView.tsx | Behavioral workspace makes consent, channel/window, guest journeys and semantic projections inspectable. |
| frontend/src/admin/intelligence/behavior/types.ts | Bounded private read models; aggregate users and customer identities have separate rights. |
| frontend/src/admin/intelligence/guardrail-model.ts | Native policy shape and currency conversion only; admission remains in the Rust commerce owner. |
| frontend/src/admin/intelligence/knowledge-types.ts | Typed knowledge read models preserve source ownership, revisions, sampling and privacy boundaries. |
| frontend/src/admin/legal/ConsumerRequests.tsx | Permission-scoped consumer request queue and optimistic, recorded review actions. |
| frontend/src/admin/legal/LegalServices.tsx | Purpose inventory and provider disclosures edited in the selected content language. |
| frontend/src/admin/legal/LegalSettings.tsx | Central revisioned legal workspace, inherited channel settings, source-backed sector guidance and request review. |
| frontend/src/admin/legal/ProductCompliance.tsx | Product-owned multilingual regulatory facts; collected evidence never claims automatic product certification. |
| frontend/src/admin/orders/OrderCreate.tsx | Manual orders remain actor-private drafts until explicit native quote review and idempotent completion. |
| frontend/src/admin/orders/OrderDetail.tsx | Order workspace: server actions, exact-once commands, provider progress and visible event history. |
| frontend/src/admin/orders/OrderDirectory.tsx | Native server-paged order directory supplies the reusable grid with fulfillment columns and current rights. |
| frontend/src/admin/orders/OrderPaymentDelivery.tsx | Payment jobs are observed until confirmation. Delivery actions share the server state machine. |
| frontend/src/admin/orders/OrderProductPicker.tsx | Bounded, debounced native product/SKU lookup; prices are only committed through the reviewed checkout quote. |
| frontend/src/admin/orders/OrderReview.tsx | Reviewed native quote and explicit customer-authorisation acknowledgements precede the idempotent order command. |
| frontend/src/admin/orders/OrderWorkflow.tsx | Server-owned transitions: one source for permitted actions, labels and business guards. |
| frontend/src/admin/orders/OrdersManager.tsx | Order operations and native detail navigation; the shared grid owns only list presentation. |
| frontend/src/admin/orders/ReceiptPanel.tsx | Seller configuration and version-bound receipt creation/download. |
| frontend/src/admin/orders/ShipmentSplit.tsx | Explicit subset editor uses server admission, parent command fencing and immutable order quantities. |
| frontend/src/admin/orders/shipments.css | Package allocation stays compact on desktop and touch-friendly on narrow order workspaces. |
| frontend/src/admin/orders/useOrderCreation.ts | Draft controller loads admitted choices, fences async reads and keeps review state separate from the editable input. |
| frontend/src/admin/payments/PaymentActions.tsx | Shared native order/provider controls; an accepted job is observed before another financial action. |
| frontend/src/admin/payments/PaymentDetails.tsx | Read-only transaction observation and native financial history, shared across Studio views. |
| frontend/src/admin/payments/payment-actions.css | Native payment action grouping, shared by order details and payment administration. |
| frontend/src/admin/payments/payment-amount.ts | Exact decimal merchant input; reject overprecision instead of rounding financial commands. |
| frontend/src/admin/payments/payment-command.ts | Shared frozen merchant payment request identity; retries preserve the original exact payload. |
| frontend/src/admin/payments/payment-details.css | Responsive, read-only payment receipt and history disclosure. |
| frontend/src/admin/pos/POSWorkspace.tsx | Native Studio register; all reads and writes use authenticated, tenant-scoped shared commerce operations. |
| frontend/src/admin/pos/ReceiptPrinter.tsx | OS-installed receipt printers receive the issued immutable invoice projection; no USB access, credentials or duplicate ledger. |
| frontend/src/admin/pos/Register.tsx | Register composition: persisted sale, catalog, customer and assistant tools share native transport. |
| frontend/src/admin/pos/RegisterAdjustments.tsx | Currency/coupons forward to the shared commerce owners; no local price calculation. |
| frontend/src/admin/pos/RegisterAssistant.tsx | In-register advice reuses the existing grounded merchant assistant; no task apply or money mutation is exposed. |
| frontend/src/admin/pos/RegisterCart.tsx | Large quantity controls and shared app surface; every edit carries the current native cart revision. |
| frontend/src/admin/pos/RegisterCatalog.tsx | Bounded product pages and keyboard-wedge scanner input; feedback uses the authoritative cart. |
| frontend/src/admin/pos/RegisterCheckout.tsx | Touch checkout retains explicit payment/consent choices; cash input uses integer currency units. |
| frontend/src/admin/pos/RegisterCheckoutOptions.tsx | Payment/contact options sit in the scrolling tool pane; final tender and completion stay visible. |
| frontend/src/admin/pos/RegisterCustomer.tsx | Customer-number card scanner and bounded CRM search; attaching a customer stays tenant/actor/revision checked. |
| frontend/src/admin/pos/RegisterDiscount.tsx | Discretionary discounts send exact integer requests, never alter browser totals; shared pricing supplies tax and audit. |
| frontend/src/admin/pos/RegisterReceipt.tsx | Receipt creation and PDF download reuse merchant documents and immutable order revision/idempotency. |
| frontend/src/admin/pos/cashier-i18n.ts | Dedicated cashier vocabulary; EN/DE/FR/ES share the Studio locale, no duplicated language inputs. |
| frontend/src/admin/pos/cashier.css | Full register focus and shared touch tools: airy neutral surfaces, blue action emphasis and bounded panes. |
| frontend/src/admin/pos/pos-i18n.ts | POS vocabulary: one shared four-language catalogue, with the Studio locale. |
| frontend/src/admin/pos/pos-model.ts | Small POS view models and exact decimal input conversion; server quotes own all calculations. |
| frontend/src/admin/pos/pos-receipt.css | Completion, held sale and variant surfaces for the register. |
| frontend/src/admin/pos/pos-responsive.css | Responsive register breakpoints and reduced-motion behavior. |
| frontend/src/admin/pos/pos.css | POS layout, product cards and touch checkout, using shared Veyndo tokens. |
| frontend/src/admin/pos/useCashierFocus.ts | URL-preserved register focus uses the existing authenticated Studio; re-login overlays remain outside its shell. |
| frontend/src/admin/pos/useRegister.ts | Register commands share authenticated Studio transport and persist only the cart capability locally. |
| frontend/src/admin/pos/useRegisterViewport.ts | Size the register pane from its actual header position, including translated toolbars and tablet wraps. |
| frontend/src/admin/preview/PreviewDialog.tsx | PreviewDialog keeps merchant interaction separate from workspace orchestration. |
| frontend/src/admin/preview/PreviewPanel.tsx | PreviewPanel renders verified shop state and typed user actions. |
| frontend/src/admin/reports/ReportBoard.tsx | Shared configurable reporting canvas; late data is fenced by request identity, filters and current rights. |
| frontend/src/admin/reports/ReportCard.tsx | Charts and ranked tables consume only the server snapshot, with explicit monetary and observation semantics. |
| frontend/src/admin/reports/ReportChart.tsx | Accessible SVG plots retain every native bucket; keyboard focus reveals the exact bucket value. |
| frontend/src/admin/reports/ReportFilters.tsx | One filter bar controls the same native report query in Shop today and personal areas. |
| frontend/src/admin/reports/TodayReports.tsx | Shop-today presentation is saved in the existing actor-private revisioned workspace, never in shop configuration. |
| frontend/src/admin/reports/export.ts | Export only the already authorized aggregate snapshot; escape spreadsheet formulas in merchant labels. |
| frontend/src/admin/reports/model.ts | Saved report definitions contain presentation/filter choices only; the server remains the source of every value. |
| frontend/src/admin/reports/report-i18n.ts | Studio report vocabulary; amounts, names and dates come from the native report snapshot. |
| frontend/src/admin/reports/reports.css | Report workspace extends Studio tokens with readable charts, restrained controls and explicit reordering. |
| frontend/src/admin/scenarios/ScenarioComparison.tsx | Matching test inputs and changed observed snapshots are separate evidence. |
| frontend/src/admin/scenarios/ScenarioEvidence.tsx | Configuration freshness is independent of whether a fictional purchase succeeded. |
| frontend/src/admin/scenarios/ScenarioHistory.tsx | Distinguishable saved-run and comparison selection for the customer lab. |
| frontend/src/admin/scenarios/ScenarioLaunch.tsx | Shared customer-test entry; installing/saving a draft remains the owning workspace's action. |
| frontend/src/admin/scenarios/ScenarioProfiles.tsx | Editable fictional customers share the channel's actual languages, countries and currency. |
| frontend/src/admin/scenarios/ScenarioReport.tsx | Native findings stay separate from simulated customer reasoning. |
| frontend/src/admin/scenarios/ScenarioSource.tsx | Explicit source attribution; removing it does not change or undo the approved proposal. |
| frontend/src/admin/scenarios/ScenarioStudio.tsx | A compact private customer lab on the existing Studio scope and durable run controls. |
| frontend/src/admin/scenarios/ScenarioSuggestions.tsx | Catalogue-derived drafts are previewed before adoption; native commerce still decides actual prices and purchases. |
| frontend/src/admin/scenarios/scenario-access.ts | Keep every scenario entry aligned with the native compound admission. |
| frontend/src/admin/scenarios/scenario-history.ts | Saved-test labels and reload links share the existing Studio URL without storing briefs or customer data. |
| frontend/src/admin/scenarios/scenario-i18n.ts | Simulator vocabulary distinguishes actual native outcomes from fictional customer reasoning. |
| frontend/src/admin/scenarios/scenario-types.ts | Safe public projections; cart tokens and provider checkpoints are never part of this contract. |
| frontend/src/admin/scenarios/scenarios.css | Private customer lab: compact profiles, scoped progress and evidence comparison. |
| frontend/src/admin/scenarios/useScenarioNavigation.ts | Scope-fenced entry from native design, app and migration workspaces. |
| frontend/src/admin/settings/B2BSettings.tsx | B2B controls edit the shared revisioned settings aggregate; no separate policy store or checkout engine. |
| frontend/src/admin/settings/CaptureModeSettings.tsx | Capture timing uses the installed provider declaration and the existing versioned settings draft. |
| frontend/src/admin/settings/CommerceSettings.tsx | One revisioned international settings aggregate: drafts survive navigation between countries, taxes, methods and languages. |
| frontend/src/admin/settings/CompanyField.tsx | One factual field with visible channel inheritance, an explicit reset and searchable geographic selection. |
| frontend/src/admin/settings/CompanyLogo.tsx | Private logo preview and bounded upload; attaching/removing is a draft change until the profile is saved. |
| frontend/src/admin/settings/CompanyTranslations.tsx | Brand and legal text use one content-language selector and independent language/channel inheritance. |
| frontend/src/admin/settings/CountriesSettings.tsx | Delivery-country selection and editable catalogue definitions, including tenant-owned subdivisions. |
| frontend/src/admin/settings/CountryDefinition.tsx | Country metadata and subdivision editing with multilingual names; custom definitions cannot invent ISO assignment. |
| frontend/src/admin/settings/CurrencySettings.tsx | Shop currency registry and inherited channel availability. Actions use saved revisions and native job APIs. |
| frontend/src/admin/settings/CustomerGroupsSettings.tsx | Customer groups share the translation/inheritance editor and revisioned settings aggregate. |
| frontend/src/admin/settings/DestinationRuleEditor.tsx | Geographical tax rule editor: country, subdivisions, postcode constraints, date window and persisted Rule Builder condition. |
| frontend/src/admin/settings/LanguageSettings.tsx | Shop main language and enabled locales with resumable provider-backed bulk product translation drafts. |
| frontend/src/admin/settings/MasterDataSettings.tsx | Structured company profile with single-language content, inherited channel scopes, logo drafts and revision-bound saves. |
| frontend/src/admin/settings/MethodRemoval.tsx | Dependency preflight is advisory; aggregate save repeats it under the checkout configuration lock. |
| frontend/src/admin/settings/MethodSettings.tsx | Master/detail shipping and payment configuration, translated content and searchable country availability. |
| frontend/src/admin/settings/SettingsSaveBar.tsx | Consistent settings save feedback, dirty state and permission-aware controls. |
| frontend/src/admin/settings/SettingsWorkspace.tsx | Independent settings workspace: grouped navigation, explicit dirty-draft guards and native API forms. |
| frontend/src/admin/settings/TaxSettings.tsx | Editable tax classes and explicit fallback/country rates with destination rules using native Rule Builder references. |
| frontend/src/admin/settings/TranslationJobs.tsx | Start catalogue translations, poll durable progress, review paginated drafts and apply bounded revision-checked batches. |
| frontend/src/admin/settings/company-types.ts | Typed company metadata and sparse per-channel inheritance contract; statutory facts are never auto-translated. |
| frontend/src/admin/settings/useCompanyContext.ts | Load enabled content languages, countries and channel choices without overwriting an edited draft on locale refresh. |
| frontend/src/admin/settings/useSettingsDraft.ts | Revisioned settings drafts survive locale refreshes, reject late loads and keep failed saves editable. |
| frontend/src/admin/setup/SetupBanner.tsx | Keeps the setup return path visible while the merchant works in the actual native views. |
| frontend/src/admin/setup/SetupBasics.tsx | A focused first company form reuses native fields, geography, revisioned settings and the shared save bar. |
| frontend/src/admin/setup/SetupEntry.tsx | Route the first eligible live-shop visit to the optional welcome, preserving ordinary workspace navigation. |
| frontend/src/admin/setup/SetupProvider.tsx | Personal, revisioned setup progress reuses the existing workspace store and session fences. |
| frontend/src/admin/setup/SetupWelcome.tsx | A short, optional welcome demonstrates the actual setup path before asking for any work. |
| frontend/src/admin/setup/SetupWizard.tsx | Guided review links native setup owners and the existing agent without duplicating configuration or publication. |
| frontend/src/admin/setup/setup-i18n.ts | Shared EN/DE/FR/ES vocabulary for the welcome, guided steps and continuation rail. |
| frontend/src/admin/setup/setup-model.ts | Setup records contain personal guidance only; native settings remain the source of truth. |
| frontend/src/admin/setup/setup-responsive.css | Structural adaptation of the setup path for narrow administration viewports. |
| frontend/src/admin/setup/setup.css | A compact, responsive setup workspace extends the existing Studio colour and type system. |
| frontend/src/admin/setup/step-i18n.ts | Concrete outcomes for each setup step in every supported interface language. |
| frontend/src/admin/setup/useSetupFacts.ts | Read only current native setup data; unavailable sources never become successful checks. |
| frontend/src/admin/shell/AgentRunCard.tsx | Saved native run progress and explicit continuation share the conversation's permission-scoped request owner. |
| frontend/src/admin/shell/Merchant.tsx | Studio composition root: layout, scoped controller and modular workspace views. |
| frontend/src/admin/shell/StudioComposer.tsx | StudioComposer: focused Studio view; state and commands come from the session-scoped controller. |
| frontend/src/admin/shell/StudioContext.ts | Typed, local Studio context; never shared across a different mounted Studio. |
| frontend/src/admin/shell/StudioConversation.tsx | StudioConversation: focused Studio view; state and commands come from the session-scoped controller. |
| frontend/src/admin/shell/StudioHeader.tsx | StudioHeader: focused Studio view; state and commands come from the session-scoped controller. |
| frontend/src/admin/shell/StudioRoutes.tsx | StudioRoutes: focused Studio view; state and commands come from the session-scoped controller. |
| frontend/src/admin/shell/StudioSidebar.tsx | StudioSidebar: focused Studio view; state and commands come from the session-scoped controller. |
| frontend/src/admin/shell/StudioSignIn.tsx | Dedicated login page and blocking reauthentication dialog preserve mounted private editors. |
| frontend/src/admin/shell/navigation.ts | Typed built-in Studio navigation and locale-specific labels. |
| frontend/src/admin/shell/permissions.ts | Presentation admission mirrors named server rights. API/domain checks remain authoritative. |
| frontend/src/admin/shell/requests.ts | Authenticated Studio transport; staging changes only the tenant, never the principal. |
| frontend/src/admin/shell/resume-browser-session.ts | Explicit same-account resume reads the existing ledger, without adopting ambient identity or replaying writes. |
| frontend/src/admin/shell/studio-types.ts | studio types: Studio layout, session/workspace controller, authenticated transport and lazy workspace navigation. |
| frontend/src/admin/shell/useAgentWorkspaceContext.ts | Preserve the originating editor selection as a bounded hint, fenced to the current account/shop/stage. |
| frontend/src/admin/shell/useChatTurns.ts | Durable chat commands reuse native conversations; late responses cannot cross an account/shop/stage boundary. |
| frontend/src/admin/shell/useDesignHandoff.ts | Ephemeral design navigation survives route remounts without putting reference URLs in browser storage or another identity. |
| frontend/src/admin/shell/useEntityNavigation.ts | Linked entity navigation keeps native editors, browser deep links and back paths in the same tenant scope. |
| frontend/src/admin/shell/useServerHealth.ts | Public server health is independent of the personal Studio session. |
| frontend/src/admin/shell/useStudioAccess.ts | Central Studio identity boundary: initial login, expiry suspension and same-account resume. |
| frontend/src/admin/shell/useStudioController.ts | Studio session/controller: authentication context, tenant/staging state and chat commands. |
| frontend/src/admin/shell/useStudioEnvironment.ts | Remember only the selected environment ID per live shop/tab; native requests still revalidate access. |
| frontend/src/admin/shell/useStudioPermissions.ts | Recheck current server grants; discard previously loaded views when a live role changes. |
| frontend/src/admin/shell/useStudioSession.ts | Revalidate visible Studio sessions and route authenticated failures to the active controller. |
| frontend/src/admin/shell/useStudioTheme.ts | Persist only the presentation theme; account, agent context and commerce state never enter this preference. |
| frontend/src/admin/shell/useTaskExecution.ts | Observe the original task worker; an accepted command is not a completed write. |
| frontend/src/admin/styles/agentic-channels.css | Inbound catalogue setup keeps actions, permission state and external approval readable at every width. |
| frontend/src/admin/styles/api-console.css | Responsive developer key management and bounded API explorer using Studio theme tokens. |
| frontend/src/admin/styles/app-agent-drawer.css | Contextual AI dialog presentation; native dialog owns modal focus and the editing canvas remains mounted. |
| frontend/src/admin/styles/app-artwork.css | Category cover and app icon artwork, with local deterministic fallbacks. |
| frontend/src/admin/styles/app-assistant.css | Guided extension workspace: restrained colour, clear choices and responsive setup. |
| frontend/src/admin/styles/app-brief.css | Description-led entry keeps one clear request above the optional visual app patterns. |
| frontend/src/admin/styles/app-building.css | Modern recipe cards and structural AI review reuse Studio colors and responsive interaction rules. |
| frontend/src/admin/styles/app-canvas-responsive.css | Shared app canvas keeps its native controls reachable at narrow and short viewport sizes. |
| frontend/src/admin/styles/app-canvas-workspace.css | Scene overview and direct editing share the Studio canvas; tools never compete with the preview. |
| frontend/src/admin/styles/app-capability.css | Merchant-friendly idea brief, explicit next steps and optional bounded rule checks share Studio tokens. |
| frontend/src/admin/styles/app-catalog.css | App library/detail presentation: bounded cards, passive artwork, accessible filters and theme-aware forms. |
| frontend/src/admin/styles/app-creation.css | Guided app creation: bounded reading width, illustrated native placements and a private draft summary. |
| frontend/src/admin/styles/app-detail.css | Scoped app detail hierarchy, permission disclosure, data and integration forms. |
| frontend/src/admin/styles/app-library.css | App callback consent follows the same card and field rhythm as app configuration. |
| frontend/src/admin/styles/app-studio-inspector.css | App Studio binding indicators, empty canvas and properties inspector. |
| frontend/src/admin/styles/app-studio-panels.css | App Studio model, connection, agent and version panels. |
| frontend/src/admin/styles/app-studio-preview.css | Passive schema previews and semantic navigation. No alternative app runtime. |
| frontend/src/admin/styles/app-studio-responsive.css | Responsive App Studio layouts and reduced-motion settings. |
| frontend/src/admin/styles/app-studio.css | App Studio: restrained light canvas, compact control density and responsive palette/inspector workspaces. |
| frontend/src/admin/styles/app-workspace.css | App Studio panel sizing, visible insertions and shared automation presentation. |
| frontend/src/admin/styles/assistant-layout.css | One reading column connects merchant context, conversation and intake in full Studio and the copilot. |
| frontend/src/admin/styles/automation-lifecycle.css | Configuration workspace: readable definitions, clear selection and contextual actions. |
| frontend/src/admin/styles/automation.css | Actual graph nodes and original rule forms use the Studio theme and independent responsive columns. |
| frontend/src/admin/styles/b2b-settings.css | Revisioned B2B settings cards, accessible switches and responsive spacing. |
| frontend/src/admin/styles/behavior.css | Consent-bound insights use the existing Studio tokens and a responsive, inspectable visual hierarchy. |
| frontend/src/admin/styles/canvas-commerce-editor.css | Shared native commerce handoff spacing loads with its Canvas editor in every workspace. |
| frontend/src/admin/styles/catalog-editor.css | Visual editor and category workspace responsive styles. |
| frontend/src/admin/styles/catalog-intake.css | Catalogue setup uses the Studio palette, native modal focus containment and bounded review cards. |
| frontend/src/admin/styles/catalog-preparation.css | Readiness uses the shared paged grid; compact step controls route to native editors. |
| frontend/src/admin/styles/catalog.css | Light, precise catalog workspace with accessible tables, focused detail panels and visual authoring. |
| frontend/src/admin/styles/commerce-manager.css | commerce manager: Studio visual system and merchant operational layouts. |
| frontend/src/admin/styles/company-settings.css | Company editor: structured addresses, visible scope inheritance and compact upload controls. |
| frontend/src/admin/styles/creation.css | Shared native creation workspaces: readable fields, predictable actions and responsive review. |
| frontend/src/admin/styles/forms.css | Studio-owned form primitives load at the composition root, independent of lazy workspace history. |
| frontend/src/admin/styles/guardrails.css | Native pricing policy workbench: merchant units, bounded product lookup and shared Studio tokens. |
| frontend/src/admin/styles/international-details.css | Destination rates, translation jobs and responsive international workbench layout. |
| frontend/src/admin/styles/international.css | International commerce workbench: compact master/detail records, calm colour and clear field hierarchy. |
| frontend/src/admin/styles/knowledge-evidence.css | Product evidence, retrieval excerpts, observed pairs and responsive knowledge layouts. |
| frontend/src/admin/styles/knowledge-sources.css | Knowledge source library/editor layouts: single-language forms and lifecycle controls. |
| frontend/src/admin/styles/knowledge.css | Unified knowledge workspace: evidence-first hierarchy, accessible cards and theme-aware responsive layouts. |
| frontend/src/admin/styles/legal-settings.css | Light legal workspace: compact readiness, sector chips, linked sources and single-language editors. |
| frontend/src/admin/styles/media-workspace.css | Gallery workspace: airy tiles, focused image inspector and accessible upload surfaces using Studio theme tokens. |
| frontend/src/admin/styles/operations.css | Operational screens share the studio's light surface and clear focus states. |
| frontend/src/admin/styles/product-assignments.css | Product assignments use compact searchable choices, native checkboxes and the Studio theme. |
| frontend/src/admin/styles/product-content.css | Product content keeps a compact vertical rhythm and uses the incumbent Studio surfaces and native disclosures. |
| frontend/src/admin/styles/product-models.css | Model preview and settings extend the incumbent gallery without turning GLB files into image covers. |
| frontend/src/admin/styles/product-pricing.css | Product pricing follows the native save path with grouped basics and optional conditions. |
| frontend/src/admin/styles/product-seo.css | Product SEO uses one readable field column and a responsive search-preview area on existing Studio theme surfaces. |
| frontend/src/admin/styles/product-specifications.css | Product facts use compact labelled groups, explicit add rows and a native definition-list preview within the existing editor surface. |
| frontend/src/admin/styles/product-workspace.css | Product-only layout: compact identity, grouped sections and a fluid editing surface. |
| frontend/src/admin/styles/provider-account.css | Shared provider onboarding layout works independently of the lazy-loaded visual App Studio. |
| frontend/src/admin/styles/related-products.css | Ordered product choices use retained compact rows, visible move/remove controls and bounded native search results. |
| frontend/src/admin/styles/sales-channels.css | Sales-channel cards, onboarding and scoped settings use the same responsive, accessible Studio design. |
| frontend/src/admin/styles/service-integrations.css | Compact, responsive provider setup and explicit operation feedback. |
| frontend/src/admin/styles/settings.css | Independent settings navigation, grouped native forms and save feedback in Studio theme tokens. |
| frontend/src/admin/styles/studio/01-studio.css | studio: studio styles. Source order is preserved by the entry stylesheet. |
| frontend/src/admin/styles/studio/02-workspace-switch.css | studio: workspace-switch styles. Source order is preserved by the entry stylesheet. |
| frontend/src/admin/styles/studio/03-welcome-symbol.css | studio: welcome-symbol styles. Source order is preserved by the entry stylesheet. |
| frontend/src/admin/styles/studio/04-review-product-div.css | studio: review-product-div styles. Source order is preserved by the entry stylesheet. |
| frontend/src/admin/styles/studio/05-page-intro-p.css | studio: page-intro-p styles. Source order is preserved by the entry stylesheet. |
| frontend/src/admin/styles/studio/06-knowledge-stats-strong.css | studio: knowledge-stats-strong styles. Source order is preserved by the entry stylesheet. |
| frontend/src/admin/styles/studio/07-connection-card.css | studio: connection-card styles. Source order is preserved by the entry stylesheet. |
| frontend/src/admin/styles/studio/08-responsive.css | studio: responsive styles. Source order is preserved by the entry stylesheet. |
| frontend/src/admin/styles/studio/09-responsive.css | studio: responsive styles. Source order is preserved by the entry stylesheet. |
| frontend/src/admin/styles/studio/10-studio-mobile-preview-button.css | studio: studio-mobile-preview-button styles. Source order is preserved by the entry stylesheet. |
| frontend/src/admin/styles/studio-sign-in.css | Dedicated access surface: responsive Veyndo login and native modal reauthentication. |
| frontend/src/admin/styles/studio.css | Ordered studio stylesheet entry; domain rules live in the adjacent folder. |
| frontend/src/admin/styles/team-roles.css | Native team roles and readable scopes share Studio surfaces and responsive form rhythm. |
| frontend/src/admin/styles/team-workspace.css | Account, shop creation and team access share a clear action and form hierarchy. |
| frontend/src/admin/styles/variants.css | Variant family and review table share the catalog's responsive theme and focus treatment. |
| frontend/src/admin/styles/workspace-copilot.css | The conversation is a sibling of native editors; expanding it never remounts their drafts. |
| frontend/src/admin/styles/workspace-polish.css | Consistent Studio density, readable hierarchy and independently scrollable navigation across workspaces. |
| frontend/src/admin/team/AccessManager.tsx | Fine-grained team overrides, revocable invitations and personal session inventory. |
| frontend/src/admin/team/CreateWorkspace.tsx | Visible native shop creation keeps identifiers editable and submits only through its account owner. |
| frontend/src/admin/team/PermissionPicker.tsx | One readable, searchable permission selector; technical IDs always remain visible beside the label. |
| frontend/src/admin/team/PersonalAccountForm.tsx | PersonalAccountForm: focused account-form view with explicit typed inputs and callbacks. |
| frontend/src/admin/team/RolesManager.tsx | Tenant role editor uses the canonical roles API, shared translation editor, audit and dependency confirmation. |
| frontend/src/admin/team/UsersManager.tsx | Users Manager: Personal accounts, memberships, roles, invitations and scoped developer access.. |
| frontend/src/admin/team/permission-groups.ts | Permission grouping is presentation only; grants still come from the canonical server scope registry. |
| frontend/src/admin/team/permission-i18n.ts | Role interface vocabulary uses the shared permission label catalogue. |
| frontend/src/admin/team/permission-labels.ts | Shared readable labels and exact permission identifiers for Studio, app actions and API keys. |
| frontend/src/admin/team/permission-picker.css | Shared readable permission groups replace flat scope walls in roles and API credentials. |
| frontend/src/admin/team/workspace-create-i18n.ts | Shop creation guidance uses the current Studio interface language. |
| frontend/src/admin/workspace/AgentViewDirectory.tsx | Composition mounts existing domain directories, filters and native entity editors without a second renderer. |
| frontend/src/admin/workspace/AgentWorkSurface.tsx | Reviewed composition binds real native views to the current Studio scope and private workspace preferences. |
| frontend/src/admin/workspace/GeneratedWorkspace.tsx | OpenUI presents admitted model compositions. Native bindings own every record, action and permission. |
| frontend/src/admin/workspace/PersonalWorkspace.tsx | Personal entry point on the existing shell; requests and linked views retain current scope and rights. |
| frontend/src/admin/workspace/WorkSuggestions.tsx | Actual permission-filtered work links open native owners; late responses cannot survive a scope change. |
| frontend/src/admin/workspace/WorkspaceGoals.tsx | Goals reference the existing proposal owner; no parallel worker, executor or approval queue. |
| frontend/src/admin/workspace/WorkspacePinBridge.tsx | The shared grid pins criteria in the existing actor-private workspace; rows and credentials are never copied. |
| frontend/src/admin/workspace/WorkspaceTask.tsx | Personal goals open the native proposal review and apply owner; no second approval/execution path. |
| frontend/src/admin/workspace/composition-i18n.ts | Host-owned composition controls never repeat model claims about completed commerce actions. |
| frontend/src/admin/workspace/composition.css | Composed native work surfaces retain a large canvas, ordinary controls and contained responsive overflow. |
| frontend/src/admin/workspace/pin-workspace-view.ts | Native grids and composed views share actor-private layout CAS; records and personal criteria never persist. |
| frontend/src/admin/workspace/workspace-i18n.ts | Personal workspace vocabulary; UI language never changes saved content language. |
| frontend/src/admin/workspace/workspace-model.ts | Layouts are private presentation preferences, never roles or delegated permissions. |
| frontend/src/admin/workspace/workspace.css | Personal workspace: stable shell, accessible rearrangement and scoped cards. |
| frontend/src/application/ApplicationRouter.tsx | Select independent lazy applications; contain failed imports and reset boundaries on navigation. |
| frontend/src/main.tsx | Browser bootstrap only; application selection and error recovery live in application/. |
| frontend/src/platform/AdminHub.tsx | Public service directory. Links select a login surface without granting operator or merchant permissions. |
| frontend/src/platform/HTTPResponses.tsx | Exact HTTP outcomes; historical undifferentiated totals never become fabricated success rates. |
| frontend/src/platform/PlatformAI.tsx | Central inference editor; write-only secrets, optimistic revisions and explicit environment fallback. |
| frontend/src/platform/PlatformConsole.tsx | Independent platform control plane: personal operator access, bounded statistics and audited shop creation. |
| frontend/src/platform/PlatformDashboard.tsx | Aggregate statistics from PostgreSQL; recorded orders and confirmed money remain visibly separate. |
| frontend/src/platform/PlatformInfrastructure.tsx | Real infrastructure probes, bounded lifetime traffic and process-local resource counters. |
| frontend/src/platform/PlatformLanguage.tsx | Locale selector shared by operator sign-in and the workspace. |
| frontend/src/platform/PlatformShopDetail.tsx | Connected shop dossier and reversible lifecycle controls; confirmations are explicit and revision guarded. |
| frontend/src/platform/PlatformShops.tsx | Searchable shop directory and server-validated provisioning form. |
| frontend/src/platform/PlatformSidebar.tsx | Stable operator navigation and profile; business state remains in the console owner. |
| frontend/src/platform/PlatformSignIn.tsx | Personal sign-in verifies the current operator grant before retaining a browser session. |
| frontend/src/platform/platform-api.ts | Tenant-independent operator API using the same HttpOnly browser boundary as Studio. |
| frontend/src/platform/styles/platform/01-platform-console.css | platform: platform-console styles. Source order is preserved by the entry stylesheet. |
| frontend/src/platform/styles/platform/02-platform-shop-stats-span.css | platform: platform-shop-stats-span styles. Source order is preserved by the entry stylesheet. |
| frontend/src/platform/styles/platform/03-control.css | Service hub and operational editors share the same accessible light workspace. |
| frontend/src/platform/styles/platform.css | Ordered platform stylesheet entry; domain rules live in the adjacent folder. |
| frontend/src/shared/agents/AgentComposer.tsx | Shared agent entry: domain adapters retain all API, model, permission and approval behavior. |
| frontend/src/shared/agents/AgentTaskTransfer.tsx | Explicit coding-agent task download/copy and domain-validated result import; no tokens or background execution. |
| frontend/src/shared/agents/agent-i18n.ts | The same human and coding-agent language across native workspaces. |
| frontend/src/shared/agents/agents.css | Compact shared composer, sized by its host rather than hardcoded to one editor. |
| frontend/src/shared/agents/reference-images.ts | Bounded local screenshot preparation; only reduced raster data reaches the existing vision API. |
| frontend/src/shared/api/account-types.ts | Native personal account response shared by merchant and platform authentication. |
| frontend/src/shared/api/agent-stream.ts | Decode bounded UTF-8 SSE chat frames; only a completed native result reaches the existing Studio state owner. |
| frontend/src/shared/api/browser-session.ts | Native browser credentials stay HttpOnly; JavaScript carries only an anti-CSRF proof and a public mode marker. |
| frontend/src/shared/api/configuration-types.ts | Accepted configuration snapshots carry frozen public labels, selected values and their original source currency. |
| frontend/src/shared/api/customer-session.ts | Customer transport shares the native ledger; each tenant and browser tab has its own session fence. |
| frontend/src/shared/api/download.ts | Authenticated binary download, never placing session credentials in a URL. |
| frontend/src/shared/api/merchant-session.ts | Private merchant-session rejection signals shared by all JSON transports. |
| frontend/src/shared/api/request-json.ts | Coalesce simultaneous identical core reads with complete identity; no persisted response cache. |
| frontend/src/shared/api/shop-api.ts | shop api: Typed commerce contracts, merchant/store transports and binary download helper. |
| frontend/src/shared/api/shop-scope.ts | Canonical shop hosts; Studio identity remains on the shared origin. Reserved service hosts never become tenant IDs. |
| frontend/src/shared/api/types.ts | Common JSON/multipart request contract for app surfaces and merchant operations. |
| frontend/src/shared/api/vite-env.d.ts | Typed public build configuration; browser-visible values never contain server credentials. |
| frontend/src/shared/apps/AppFrame.tsx | Opaque-origin app UI. Its SDK can invoke only this app's declared, server-authorized actions. |
| frontend/src/shared/apps/AppSlot.tsx | Generic registered product configuration slot. App packages own labels, input names and business rules. |
| frontend/src/shared/apps/AppSurfaces.tsx | One registry read per workspace; app bundles load only when their surface is mounted. |
| frontend/src/shared/apps/ConfigurationFields.tsx | Manifest-owned configuration controls and public library choices; no client price or authorization decisions. |
| frontend/src/shared/apps/ConfigurationForm.tsx | Shared product configuration form: declared input fields use the existing cart, revision and app gateway. |
| frontend/src/shared/apps/ConfigurationLibrary.tsx | Bounded keyset library selection retains the chosen record while navigating actual server pages. |
| frontend/src/shared/apps/ConfigurationSummary.tsx | Checkout, receipts and Studio render the same frozen configuration, without fetching a newer app or private library. |
| frontend/src/shared/apps/CoreExtensions.tsx | Native object fields reuse managed forms, current app actions and the shop's content-language scope. |
| frontend/src/shared/apps/PrivateFormInbox.tsx | Host composition of the app-owned private response panel, with a neutral SDK contract. |
| frontend/src/shared/apps/PublicFormBlock.tsx | Host composition of the registered forms app; apps depend on this contract, not each other's code. |
| frontend/src/shared/apps/configuration-summary.css | Compact read-only configuration details fit checkout, confirmation and native order layouts. |
| frontend/src/shared/apps/configuration-types.ts | Shared configuration projection; the Manifest, storefront and Studio use the same declared input contract. |
| frontend/src/shared/apps/form-contract.ts | Public form block contract shared through the host, never by importing another app's implementation. |
| frontend/src/shared/apps/native/NativeAppView.tsx | The same React renderer powers design preview, private sandbox, released admin modules and storefront surfaces. |
| frontend/src/shared/apps/native/NativeAssetField.tsx | Searchable tenant-owned files with private image preview and contextual multipart upload; no raw asset IDs need to be typed. |
| frontend/src/shared/apps/native/NativeBlocks.tsx | All native controls render from the same validated manifest, including one-level containers and code-behind buttons. |
| frontend/src/shared/apps/native/NativeControl.tsx | Typed VB-style controls read app records; edits stay local until an explicitly bound gateway action runs. |
| frontend/src/shared/apps/native/NativeDataBlock.tsx | One bounded keyset page per mounted data block; action requests remain tenant- and permission-scoped. |
| frontend/src/shared/apps/native/NativeField.tsx | One typed field editor for native forms; rich text uses the product editor and configured language inheritance. |
| frontend/src/shared/apps/native/NativeRecordForm.tsx | Native managed-record form retains revisions and inherited translations; it never executes schema code. |
| frontend/src/shared/apps/native/NativeRelationField.tsx | Related records load only through actions already granted to the current surface; no merchant-token side route. |
| frontend/src/shared/apps/native/NativeRuntime.tsx | Native controls share one local execution context; form records and gateway calls remain scoped by their existing owners. |
| frontend/src/shared/apps/native/form-submit.ts | Hide the fallback submit only for a visible top-level button that explicitly validates and saves this form. |
| frontend/src/shared/apps/native/geometry.ts | The twelve-column layout is the same manifest geometry for the designer and published renderer. |
| frontend/src/shared/apps/native/logic.ts | Bounded AST interpreter; no eval, globals, arbitrary URLs or implicit gateway permissions. |
| frontend/src/shared/apps/native/record-workflow.ts | Pure form projections of an app-owned workflow; the server remains authoritative. |
| frontend/src/shared/apps/native/types.ts | The versioned Manifest is the shared intermediate representation for visual and agent edits. |
| frontend/src/shared/apps/useSurfaceGateway.ts | Bind native and isolated UI actions to the same short-lived server grant; credentials stay in the host. |
| frontend/src/shared/auth/AccountSecurity.tsx | Personal MFA settings use native revision checks and never become staged shop content. |
| frontend/src/shared/auth/AuthenticationChallenge.tsx | A pending second factor never enters merchant or operator session storage. |
| frontend/src/shared/auth/RecoveryLink.tsx | Recovery uses the trusted server-selected identity entry, preserving the current editor in its original tab. |
| frontend/src/shared/b2b/b2b.css | Shared responsive B2B workspaces: quiet surfaces, separated labels, connected entity cards. |
| frontend/src/shared/b2b/quote-types.ts | Canonical procurement quote wire contract shared by buyer and merchant clients. |
| frontend/src/shared/b2b/types.ts | Native B2B wire types shared by the company editor and customer purchasing portal. |
| frontend/src/shared/canvas/ReferenceInputs.tsx | Shared bounded screenshot/URL inputs never render reference HTML or save a design without proposal review. |
| frontend/src/shared/canvas/VisualCanvas.tsx | Shared overview owns only bounded preview mounting, zoom and pointer/keyboard navigation; adapters own every edit. |
| frontend/src/shared/canvas/canvas-i18n.ts | Shared visual-workspace controls use the Studio interface language, independently of content. |
| frontend/src/shared/canvas/canvas.css | The common Studio canvas separates navigation from real bounded scene previews. |
| frontend/src/shared/content/RichDescription.tsx | Safe rich blocks with native image/video rendering; no HTML interpretation or script execution. |
| frontend/src/shared/content/editor/EditorBuffer.ts | Unsaved Markdown source participates in the aggregate's save/navigation guard without becoming product content. |
| frontend/src/shared/content/editor/MarkdownSource.tsx | Live Markdown buffer updates the same structured product document; no raw HTML is rendered or persisted. |
| frontend/src/shared/content/editor/RichEditor.tsx | Actual Tiptap WYSIWYG editor with structured safe content, media, formatting and per-language drafts. |
| frontend/src/shared/content/editor/RichToolbar.tsx | Compact, accessible editing controls shared by every rich-text field; extra formatting stays in one menu. |
| frontend/src/shared/content/editor/editor-document.ts | Canonical transport drops editor-only null attributes; description headings remain within the native H2/H3 contract. |
| frontend/src/shared/content/editor/editor-i18n.ts | Four-language controls for visual/Markdown editing without changing content-language inheritance. |
| frontend/src/shared/content/editor/markdown-content.ts | Markdown admission shares the public rich-document node/URL boundary; rich-only features never silently disappear. |
| frontend/src/shared/content/editor/rich-conversion.ts | Lossless import of legacy blocks into structured WYSIWYG content, preserving inline emphasis. |
| frontend/src/shared/content/product-seo.ts | Shared SEO field fallback and encoded product paths keep Studio previews and native storefront presentation consistent. |
| frontend/src/shared/content/product-specifications.ts | Match the native field-level specification merge; explicit blanks survive and no unrelated English fallback is invented. |
| frontend/src/shared/content/rich-document.tsx | Safe structured editor rendering. Only known nodes/marks produce elements; URLs are never executable. |
| frontend/src/shared/customer/AddressBook.tsx | Tenant-owned address cards, defaults and revision-aware CRUD shared by account and CRM. |
| frontend/src/shared/customer/AddressCard.tsx | Human-readable address used in order snapshots and address books. |
| frontend/src/shared/customer/AddressFields.tsx | Structured accessible address editor; no hidden JSON or storefront-only duplicate model. |
| frontend/src/shared/customer/CustomerFields.tsx | Contact fields mirror the account API while access, identity and pricing remain separate. |
| frontend/src/shared/customer/CustomerPicker.tsx | Debounced, bounded native customer search with cancellation fencing and explicit selection. |
| frontend/src/shared/customer/GoogleAddressSearch.tsx | Opt-in Places widget fills editable address fields, rejects unsupported destinations and ignores stale replies. |
| frontend/src/shared/customer/customer-picker.css | Shared bounded CRM search and selected identity; loaded independently of its B2B or order consumer. |
| frontend/src/shared/customer/customer-types.ts | Shared customer/address contracts; merchant and customer sessions use distinct request adapters. |
| frontend/src/shared/customer/google-address.ts | Google Places adapter: lazy public browser key, bounded loader and international address mapping. |
| frontend/src/shared/geography/CountryPicker.tsx | Locale-aware world catalogue adapter for the shared searchable entity picker. |
| frontend/src/shared/geography/EntityPicker.tsx | Accessible searchable country/region combobox; chips and group actions replace checkbox walls. |
| frontend/src/shared/geography/TranslationFields.tsx | Shared single-language fields for configurable object content; per-field null restores main-language inheritance. |
| frontend/src/shared/geography/geography-types.ts | World catalogue and tenant destination tax contracts; no inferred tax law. |
| frontend/src/shared/geography/geography.css | Shared country and region search: Studio and checkout use the same accessible controls. |
| frontend/src/shared/geography/useCountryCatalogue.ts | Request-scoped geography loading; stale requests cannot move country definitions across shops or sandboxes. |
| frontend/src/shared/grid/AgenticGrid.tsx | Shared domain-independent grid shell: server criteria, sortable/draggable columns, bounded pages and reviewed AI filters. |
| frontend/src/shared/grid/ExtensionFilter.tsx | Manual exact-value app filters use the same native server predicate as MCP and reviewed agent plans. |
| frontend/src/shared/grid/GridAgent.tsx | Read-only model planning over domain-owned criteria; explicit review precedes any list query. |
| frontend/src/shared/grid/GridColumns.tsx | Accessible column ordering/visibility controls provide keyboard and touch alternatives to drag headers. |
| frontend/src/shared/grid/extension-columns.tsx | Permission-filtered native extension metadata supplies optional columns and exact indexed filters. |
| frontend/src/shared/grid/grid-controls.css | Reusable blue Studio grid surfaces, restrained motion, contained overflow and light/dark tokens. |
| frontend/src/shared/grid/grid-i18n.ts | Typed four-language shared grid vocabulary; commerce content keeps its existing inheritance contract. |
| frontend/src/shared/grid/grid.css | Reusable grid table, result feedback and responsive presentation. |
| frontend/src/shared/grid/pinned-view.ts | Ephemeral presentation handoff; persisted views exclude free search/person criteria and never copy rows. |
| frontend/src/shared/grid/preferences.ts | Layout preferences contain column IDs only, scoped to current origin/shop/environment; never customer rows or search text. |
| frontend/src/shared/grid/types.ts | Shared read-only grid contracts; domains own rows, permissions and server query semantics. |
| frontend/src/shared/grid/useGridAccess.ts | Current Studio rights only control presentation; each native list/model operation rechecks server authority. |
| frontend/src/shared/grid/useGridPage.ts | Debounced server paging with generation fences: old searches and revoked reads never retain stale rows. |
| frontend/src/shared/grid/workspace-view.ts | Validated presentation bindings reuse native directories; model output never contains data or authority. |
| frontend/src/shared/history/EntityHistory.tsx | On-demand entity history, field comparisons and explicitly confirmed revision-checked restoration. |
| frontend/src/shared/history/history-model.ts | Bounded structural changes for database snapshots; no HTML from historical content is executed. |
| frontend/src/shared/history/history.css | Shared history deliberately stays secondary to editing and loads only when opened. |
| frontend/src/shared/i18n/ContentLanguage.tsx | One content-language selection per editor, distinct from interface language; no writes on selection or fallback. |
| frontend/src/shared/i18n/ContentLanguagePicker.tsx | Compact shared language switcher with explicit main-language context; selection never changes persisted content. |
| frontend/src/shared/i18n/LocalizedField.tsx | Single visible field for the editor's language, with main-language preview and explicit restore-to-inheritance. |
| frontend/src/shared/i18n/account-i18n.ts | Customer account vocabulary: one complete EN/DE/FR/ES contract for authentication and purchase care. |
| frontend/src/shared/i18n/admin-creation-i18n.ts | Shared settings navigation and native customer/manual-order creation vocabulary: EN/DE/FR/ES. |
| frontend/src/shared/i18n/agent-errors-i18n.ts | Actionable agent admission failures distinguish a deliberate stop from missing rights or transient load. |
| frontend/src/shared/i18n/agent-runs-i18n.ts | Durable run states and explicit ambiguous-call continuation, in the shared interface language. |
| frontend/src/shared/i18n/agent-workspace-i18n.ts | Contextual merchant work, private source intake and real editor handoffs share plain translated labels. |
| frontend/src/shared/i18n/app-access-i18n.ts | Explicit app callback consent and short-lived key management vocabulary. |
| frontend/src/shared/i18n/app-assistant-i18n.ts | App assistants and extension permissions use the same EN/DE/FR/ES vocabulary. |
| frontend/src/shared/i18n/app-building-i18n.ts | Shared translated app recipes and reviewed AI changes; no alternate app schema. |
| frontend/src/shared/i18n/app-capability-i18n.ts | Merchant intent and executable decision examples use the shared four-language Studio vocabulary. |
| frontend/src/shared/i18n/app-creation-i18n.ts | Guided creation vocabulary: placement groups, private draft guidance and optional technical controls. |
| frontend/src/shared/i18n/app-events-i18n.ts | Subscription/filter/delivery vocabulary shared by Studio and coding agents. |
| frontend/src/shared/i18n/app-i18n.ts | App and evidence UI vocabulary, shared by store, merchant and payment components. |
| frontend/src/shared/i18n/app-intent-i18n.ts | Plain-language app ideas and next steps supplement the existing versioned capability contract. |
| frontend/src/shared/i18n/app-library-i18n.ts | App library vocabulary and built-in summaries; no inferred connection or payment readiness. |
| frontend/src/shared/i18n/app-logic-i18n.ts | Designer controls, code-behind and debugger vocabulary ships in every bundled interface language. |
| frontend/src/shared/i18n/app-ontology-i18n.ts | Native app graph mapping controls share the Studio vocabulary and four interface languages. |
| frontend/src/shared/i18n/app-operations-i18n.ts | App operational vocabulary shared by installed apps and developer diagnostics; EN/DE/FR/ES. |
| frontend/src/shared/i18n/app-preview-i18n.ts | Non-executing design preview vocabulary, separate from merchant content. |
| frontend/src/shared/i18n/app-settings-i18n.ts | App setting declarations contain labels and types only; values belong to the encrypted server store. |
| frontend/src/shared/i18n/app-studio-i18n.ts | App Studio and native runtime vocabulary; every key ships EN/DE/FR/ES. |
| frontend/src/shared/i18n/app-upgrade-errors-i18n.ts | Native upgrade failures retain specific guidance across consent, Studio and API transports. |
| frontend/src/shared/i18n/app-workflow-i18n.ts | Workflow labels shared by the visual editor; status values and labels belong to each app. |
| frontend/src/shared/i18n/app-workspace-i18n.ts | Shared EN/DE/FR/ES guidance for app design, settings and bounded automation. |
| frontend/src/shared/i18n/automation-fields.ts | Localized labels for original rule and native flow parameter fields. |
| frontend/src/shared/i18n/automation-i18n.ts | Four-language automation editor vocabulary keeps source identifiers stable and user labels readable. |
| frontend/src/shared/i18n/automation-labels.ts | Source-named rule labels are localized independently from their stable integration identifiers. |
| frontend/src/shared/i18n/b2b-events-i18n.ts | Native B2B event labels shared by the existing Flow Builder. |
| frontend/src/shared/i18n/b2b-i18n.ts | B2B interface catalogue; content names use the shop language editor and per-field inheritance. |
| frontend/src/shared/i18n/b2b-quotes-i18n.ts | Negotiation vocabulary, separate from merchant content translations. |
| frontend/src/shared/i18n/behavior-i18n.ts | Typed EN/DE/FR/ES vocabulary for native consent-bound visitor behavior and semantic reports. |
| frontend/src/shared/i18n/catalog-i18n.ts | Complete four-language catalog workspace vocabulary, separate from commerce data translations. |
| frontend/src/shared/i18n/catalog-intake-errors.ts | Catalogue intake diagnostics retain source-line metadata while all transport clients show actionable localized guidance. |
| frontend/src/shared/i18n/catalog-intake-i18n.ts | Merchant-only catalogue setup copy; shopper recommendation prompts remain separate. |
| frontend/src/shared/i18n/checkout-i18n.ts | Checkout vocabulary: the same purchase and payment states in every supported UI language. |
| frontend/src/shared/i18n/cognitive-events-i18n.ts | Typed labels shared by the knowledge timeline and the native Flow Builder event catalogue. |
| frontend/src/shared/i18n/company-i18n.ts | Company identity, field inheritance and legal storefront vocabulary in four interface languages. |
| frontend/src/shared/i18n/configuration-errors-i18n.ts | Actionable configuration recovery uses safe diagnostics; material input values and guest details are never displayed as errors. |
| frontend/src/shared/i18n/connected-i18n.ts | Four-language vocabulary for connected apps, consent and visual automation. |
| frontend/src/shared/i18n/content-editors.css | Shared translated fields and content-language context own their styles on every direct editor entry. |
| frontend/src/shared/i18n/content-language.ts | Resolve editable translation keys without merging distinct regional locales or fabricating inherited values. |
| frontend/src/shared/i18n/control-i18n.ts | Complete vocabulary for the platform control plane and service hub. Technical provider/service IDs stay stable. |
| frontend/src/shared/i18n/core-extension-i18n.ts | Interface vocabulary for native app model extensions; merchant labels keep their own language scope. |
| frontend/src/shared/i18n/crm-i18n.ts | Complete CRM/history vocabulary shared by settings, customer account and entity editors. |
| frontend/src/shared/i18n/currency-i18n.ts | Complete currency settings vocabulary, shared by storefront and channel editors. |
| frontend/src/shared/i18n/customer-i18n.ts | Account and address labels share four complete locales across storefront and studio. |
| frontend/src/shared/i18n/errors-i18n.ts | Localized request guidance across all transports; original diagnostics remain available to developer tools. |
| frontend/src/shared/i18n/experience-ui-i18n.ts | Shared four-language interaction vocabulary for contextual Studio help and storefront discovery. |
| frontend/src/shared/i18n/experiment-i18n.ts | Controlled-experiment vocabulary distinguishes observed cash from causal and margin claims. |
| frontend/src/shared/i18n/graph-navigation-i18n.ts | Saved fact navigation vocabulary; content terms use the editor's shared language inheritance. |
| frontend/src/shared/i18n/guardrail-i18n.ts | Typed four-language merchant AI policy vocabulary. |
| frontend/src/shared/i18n/guardrail-workspace-i18n.ts | Task-oriented vocabulary for native AI pricing boundaries and their connected Studio owners. |
| frontend/src/shared/i18n/i18n.tsx | i18n: Four-language locale context, UI dictionaries and translated API errors. |
| frontend/src/shared/i18n/international-i18n.ts | International settings vocabulary. Every key requires English, German, French and Spanish. |
| frontend/src/shared/i18n/knowledge-i18n.ts | Knowledge workspace vocabulary: sources, evidence and capabilities without fabricated learning claims. |
| frontend/src/shared/i18n/legal-i18n.ts | Complete EN/DE/FR/ES legal workspace and storefront vocabulary; documents use shop content languages. |
| frontend/src/shared/i18n/locales/de.ts | Merchant interface strings: de. |
| frontend/src/shared/i18n/locales/en.ts | Merchant interface strings: en. |
| frontend/src/shared/i18n/locales/es.ts | Merchant interface strings: es. |
| frontend/src/shared/i18n/locales/fr.ts | Merchant interface strings: fr. |
| frontend/src/shared/i18n/locales/shop-de.ts | Storefront and operational interface strings: de. |
| frontend/src/shared/i18n/locales/shop-en.ts | Storefront and operational interface strings: en. |
| frontend/src/shared/i18n/locales/shop-es.ts | Storefront and operational interface strings: es. |
| frontend/src/shared/i18n/locales/shop-fr.ts | Storefront and operational interface strings: fr. |
| frontend/src/shared/i18n/native-lifecycle-i18n.ts | Shared native lifecycle editor vocabulary; state labels remain merchant content. |
| frontend/src/shared/i18n/operations-i18n.ts | Operational commerce labels in all supported languages. |
| frontend/src/shared/i18n/payment-details-i18n.ts | Read-only payment transaction and fee vocabulary for every Studio language. |
| frontend/src/shared/i18n/payment-diagnostic-i18n.ts | Exact public diagnostic codes only. Raw provider errors never become UI copy. |
| frontend/src/shared/i18n/payment-errors-i18n.ts | Recoverable merchant payment guidance; immutable provider diagnostics remain server-side. |
| frontend/src/shared/i18n/payment-events-i18n.ts | Payment lifecycle and saved-method event labels share the existing native Flow vocabulary. |
| frontend/src/shared/i18n/payment-ledger-i18n.ts | Merchant payment balances and capture allocation vocabulary in every Studio language. |
| frontend/src/shared/i18n/payment-provider-i18n.ts | Payment contract editor and account onboarding vocabulary. |
| frontend/src/shared/i18n/platform-i18n.ts | Operator console translations. Every visible control has an explicit translation in all supported locales. |
| frontend/src/shared/i18n/preference-i18n.ts | Consent-bound private shopping-memory controls use typed interface text, separate from merchant product facts. |
| frontend/src/shared/i18n/product-legal-i18n.ts | Product safety and sector facts in EN/DE/FR/ES; values follow the shared content-language inheritance. |
| frontend/src/shared/i18n/security-i18n.ts | Account-security vocabulary is shared by merchant and operator authentication. |
| frontend/src/shared/i18n/shipment-i18n.ts | Native package allocation vocabulary; content/product labels retain the order's selected language. |
| frontend/src/shared/i18n/shop-i18n.ts | Shared shop text hook; dictionaries live in focused locale files. |
| frontend/src/shared/i18n/studio-ui-i18n.ts | Studio navigation and settings guidance in all four supported interface languages. |
| frontend/src/shared/i18n/workbench-i18n.ts | Complete four-language vocabulary for environments, developer tools and knowledge ingestion. |
| frontend/src/shared/i18n/workflow-state-text.ts | Native workflow captions reuse their domain vocabulary; package IDs and merchant labels stay unchanged. |
| frontend/src/shared/i18n/workspace-i18n.ts | Settings scopes, dependency confirmation and media workspace vocabulary in every supported interface language. |
| frontend/src/shared/legal/ExternalVideo.tsx | Optional external video is not contacted until the same shop privacy choice allows it. |
| frontend/src/shared/legal/consent-store.ts | Live consent registry starts denied; only validated server receipts unlock integrations. No legacy grant is trusted. |
| frontend/src/shared/legal/legal-types.ts | Channel-scoped legal policy, explicit optional purposes and durable consumer requests. |
| frontend/src/shared/legal/requirements.ts | Source-backed requirement catalogue; operational applicability is reviewed, never inferred as legal certification. |
| frontend/src/shared/media/MediaCaptionEditor.tsx | Shared localized caption edits and explicit AI proposal review; native owners retain persistence and publication. |
| frontend/src/shared/media/ModelViewer.tsx | On-demand, self-hosted model-viewer with bounded native GLB sources, accessible controls and recoverable loading. |
| frontend/src/shared/media/caption-i18n.ts | Interface copy for shared caption editing; content languages come from the actual shop context. |
| frontend/src/shared/media/captions.css | Compact caption tools inherit their editor's palette and fit narrow property panels. |
| frontend/src/shared/media/model-decoder-disabled.ts | Admission forbids meshopt-compressed GLB; avoid instantiating an unused WebAssembly decoder under the existing CSP. |
| frontend/src/shared/media/model-errors-i18n.ts | Native 3D admission errors explain conversion, ownership and material recovery in every interface language. |
| frontend/src/shared/media/model-i18n.ts | Shared four-language controls for native 3D media; product descriptions use shop content languages. |
| frontend/src/shared/media/model-source.ts | Private model previews reuse explicit browser-session transport; temporary preview bytes stay in a revocable blob, with no credential in the URL. |
| frontend/src/shared/media/model-viewer.css | A quiet product stage reserves its dimensions before the optional 3D engine loads. |
| frontend/src/shared/media/product-media.ts | One media contract keeps 3D files out of image-only thumbnails and commerce summaries. |
| frontend/src/shared/money/fx-draft.ts | Draft-only FX preview matches the server rational/half-up boundary; checkout always uses its server quote. |
| frontend/src/shared/operations/index.ts | Generated native operation input contracts; do not edit. |
| frontend/src/shared/operations/inputs-0.ts | Generated native operation input contracts; do not edit. |
| frontend/src/shared/operations/inputs-1.ts | Generated native operation input contracts; do not edit. |
| frontend/src/shared/operations/inputs-10.ts | Generated native operation input contracts; do not edit. |
| frontend/src/shared/operations/inputs-11.ts | Generated native operation input contracts; do not edit. |
| frontend/src/shared/operations/inputs-12.ts | Generated native operation input contracts; do not edit. |
| frontend/src/shared/operations/inputs-13.ts | Generated native operation input contracts; do not edit. |
| frontend/src/shared/operations/inputs-14.ts | Generated native operation input contracts; do not edit. |
| frontend/src/shared/operations/inputs-15.ts | Generated native operation input contracts; do not edit. |
| frontend/src/shared/operations/inputs-16.ts | Generated native operation input contracts; do not edit. |
| frontend/src/shared/operations/inputs-2.ts | Generated native operation input contracts; do not edit. |
| frontend/src/shared/operations/inputs-3.ts | Generated native operation input contracts; do not edit. |
| frontend/src/shared/operations/inputs-4.ts | Generated native operation input contracts; do not edit. |
| frontend/src/shared/operations/inputs-5.ts | Generated native operation input contracts; do not edit. |
| frontend/src/shared/operations/inputs-6.ts | Generated native operation input contracts; do not edit. |
| frontend/src/shared/operations/inputs-7.ts | Generated native operation input contracts; do not edit. |
| frontend/src/shared/operations/inputs-8.ts | Generated native operation input contracts; do not edit. |
| frontend/src/shared/operations/inputs-9.ts | Generated native operation input contracts; do not edit. |
| frontend/src/shared/operations/value.ts | Generated native operation input contracts; do not edit. |
| frontend/src/shared/styles/app-surfaces.css | app surfaces: Shared customer, app and workbench styles; application workspaces must not import each other.. |
| frontend/src/shared/styles/apps.css | apps: Shared customer, app and workbench styles; application workspaces must not import each other.. |
| frontend/src/shared/styles/currencies.css | Currency cards use the Studio form grid, keyboard targets and responsive layouts. |
| frontend/src/shared/styles/customers.css | Shared light account/address workspace, responsive and keyboard-accessible. |
| frontend/src/shared/styles/markdown-editor.css | Shared visual/Markdown product editor treatment using existing Studio theme tokens. |
| frontend/src/shared/styles/native-app.css | Native app layouts share commerce design tokens; tables/forms remain bounded and responsive. |
| frontend/src/shared/styles/workbench.css | Merchant workbench uses the studio's light-blue design tokens and responsive review panels. |
| frontend/src/shared/ui/Brand.tsx | Shared Veyndo identity; product branding is independent of tenant-owned company logos and session keys. |
| frontend/src/shared/ui/ConfirmDialog.tsx | Shared modal confirmation with focus containment, Escape, focus restoration and an explicit destructive action. |
| frontend/src/shared/ui/Icon.tsx | Icon: Presentational icons and catalogue artwork with explicit inputs.. |
| frontend/src/shared/ui/ProductArt.tsx | Product Art: Presentational icons and catalogue artwork with explicit inputs.. |
| frontend/src/shared/ui/WorkspaceBoundary.tsx | Contain a workspace render failure and let the user retry without losing the application shell. |
| frontend/src/shared/ui/brand.css | Shared Veyndo brand palette and vector sizing; light UI text uses the contrast-safe blue. |
| frontend/src/shared/ui/confirm-dialog.css | Modal surface shared by settings, media and future destructive actions. |
| frontend/src/shared/ui/useUnsavedWorkspace.ts | Native dirty state protects reloads and informs an optional embedded host without owning editor data. |
| frontend/src/storefront/account/AccountDownloads.tsx | Paid download entitlements are fetched by the server and retrieved with customer headers, never URL tokens. |
| frontend/src/storefront/account/AccountOrderDetail.tsx | Purchase detail uses immutable addresses, current fulfillment, issued PDFs and paid order entitlements. |
| frontend/src/storefront/account/AccountOrderList.tsx | Clickable purchase cards show the live server status and lead to a protected order detail. |
| frontend/src/storefront/account/AccountOverview.tsx | Account home connects recent purchases and default addresses to their dedicated management views. |
| frontend/src/storefront/account/AccountProfile.tsx | Focused profile and password forms report persistence and keep account identity outside editable contact data. |
| frontend/src/storefront/account/CompanyLists.tsx | Owned/shared order lists use one content-language editor, native cart CAS and shared deletion confirmation. |
| frontend/src/storefront/account/CompanyOrders.tsx | Explicit unit-history permission shares the existing customer order detail component. |
| frontend/src/storefront/account/CompanyPurchasing.tsx | Customer-company context, approvals and order lists use the same native cart and current employee grants. |
| frontend/src/storefront/account/CompanyQuotes.tsx | Buyer negotiations bind an offer to its original cart; the shared checkout remains authoritative. |
| frontend/src/storefront/account/CustomerAccount.tsx | Responsive customer workspace separates authentication, address care and protected purchase details. |
| frontend/src/storefront/account/CustomerSignIn.tsx | Distinct sign-in and registration forms with correct autofill and an authenticated, rotated cart context. |
| frontend/src/storefront/account/SavedPaymentMethods.tsx | Customers can revoke their saved methods without affecting completed purchases or historical receipts. |
| frontend/src/storefront/account/ShoppingPreferences.tsx | Optional cart-private memory uses native consent, revisioned graph storage and explicit AI-sharing preference. |
| frontend/src/storefront/account/account-fields.css | Account form controls have explicit label spacing, consistent actions and shared address-editor integration. |
| frontend/src/storefront/account/account-polish.css | Brand-aware account presentation with a separate orientation panel and bounded, scrollable forms. |
| frontend/src/storefront/account/account-purchases.css | Purchase cards, fulfillment, documents and financial detail use one readable account layout. |
| frontend/src/storefront/account/account-types.ts | Shopper-only account responses deliberately exclude cart/session credentials and internal order activity. |
| frontend/src/storefront/account/account.css | Customer workspace: quiet fashion palette, clear purchase cards and an accessible mobile sheet. |
| frontend/src/storefront/account/useCustomerAccount.ts | Tenant-scoped account loading and mutation lifecycle; expired sessions clear private data and reopen sign-in. |
| frontend/src/storefront/catalog/CrossSelling.tsx | Merchant-selected recommendations use native channel/buyer-aware detail reads and the existing product tile; hidden or removed products never become ID links. |
| frontend/src/storefront/catalog/ImagePlaceholder.tsx | Honest empty-media state for newly created products; never invent a product photograph. |
| frontend/src/storefront/catalog/MemoryRecommendations.tsx | Public consumer of merchant-approved learned associations, hydrated with current product state. |
| frontend/src/storefront/catalog/ProductAttachments.tsx | Public attachment list follows the active storefront tenant and channel; private downloads are never listed. |
| frontend/src/storefront/catalog/ProductGallery.tsx | Shared native product gallery; selection changes only local presentation state. |
| frontend/src/storefront/catalog/ProductPage.tsx | Product family, gallery, context pricing and moderated customer reviews. |
| frontend/src/storefront/catalog/ProductPurchase.tsx | ProductPurchase: focused pdp-purchase view with explicit typed inputs and callbacks. |
| frontend/src/storefront/catalog/ProductQuestion.tsx | Read-only product questions cite only tenant-owned, explicitly published source documents. |
| frontend/src/storefront/catalog/ProductReviews.tsx | ProductReviews: focused pdp-reviews view with explicit typed inputs and callbacks. |
| frontend/src/storefront/catalog/product-url.ts | Stable, collision-free product addresses: SKU identity plus the inherited localized SEO slug. |
| frontend/src/storefront/checkout/CheckoutApproval.tsx | Request approval only after native checkout review, then refresh that exact cart without changing its revision. |
| frontend/src/storefront/checkout/CheckoutDetails.tsx | Address book, guest contact and delivery/payment selection share the authoritative cart context API. |
| frontend/src/storefront/checkout/CheckoutIdentity.tsx | Inline guest/login/registration step rotates the cart on authentication and refreshes owning defaults. |
| frontend/src/storefront/checkout/CheckoutMethods.tsx | Method cards keep delivery and payment discoverable without concealing country restrictions. |
| frontend/src/storefront/checkout/CheckoutPanel.tsx | One-page checkout: server-reviewed selection, explicit purchase and durable provider handoff. |
| frontend/src/storefront/checkout/CheckoutProgress.tsx | Readable checkout progress reflects reviewed server state; it never implies payment confirmation. |
| frontend/src/storefront/checkout/CheckoutPurchase.tsx | Shared explicit purchase button: mobile dock and desktop review use the same form and server-review state. |
| frontend/src/storefront/checkout/CheckoutSummary.tsx | Sticky order review presents authoritative totals and discounts beside the purchase action. |
| frontend/src/storefront/checkout/EmbeddedPayment.tsx | A scoped provider frame receives a short-lived token; messages only trigger server reconciliation. |
| frontend/src/storefront/checkout/OrderCompletion.tsx | Dedicated completion page renders the accepted order snapshot and honest provider state, with no ID-only reads. |
| frontend/src/storefront/checkout/OrderConfetti.tsx | Finite CSS celebration after an accepted order; no timers, libraries or motion for reduced-motion users. |
| frontend/src/storefront/checkout/PaymentInstructions.tsx | Owned recipient instructions stay visible after the private form; their presence never confirms payment. |
| frontend/src/storefront/checkout/PaymentSession.tsx | Provider handoff and bounded durable-status polling; only verified server receipts confirm payment. |
| frontend/src/storefront/checkout/SavedPaymentChoice.tsx | Saved payment consent is an explicit customer choice alongside the selected native method. |
| frontend/src/storefront/checkout/SavedPaymentNotice.tsx | Saved-method progress is independent of the authoritative financial outcome. |
| frontend/src/storefront/checkout/checkout-order.ts | Bind the purchase to the reviewed cart and total; the server remains the pricing authority. |
| frontend/src/storefront/checkout/embedded-checkout.ts | Only the registered embedding storefront receives the shopper cart receipt capability; it verifies with Core. |
| frontend/src/storefront/checkout/payment-return.ts | Parse only the bounded attempt reference; provider-added fragment fields never grant payment authority. |
| frontend/src/storefront/checkout/useSavedPaymentMethods.ts | Account-owned saved-method loading and revocation use the shared Store API and clear stale tenant/session data. |
| frontend/src/storefront/legal/CheckoutLegal.tsx | Current legal-document links and separate non-prechecked digital performance acknowledgement. |
| frontend/src/storefront/legal/ConsumerRequestForm.tsx | Public two-step declaration with immutable downloadable receipt; references never expose order data. |
| frontend/src/storefront/legal/LegalDocument.tsx | Published legal text uses selected content language/main-language inheritance; empty content is visible as missing. |
| frontend/src/storefront/legal/PrivacyProvider.tsx | Unified affirmative consent: server-validated receipt, channel boundaries, expiry and policy revalidation. |
| frontend/src/storefront/legal/ProductSafety.tsx | Explicit PDP safety/sector facts; no generated warning, certification or origin is invented. |
| frontend/src/storefront/shell/BehaviorAnalytics.tsx | Minimal first-party observations reuse the server consent receipt; no fingerprint or persistent analytics identifier. |
| frontend/src/storefront/shell/CatalogNavigation.tsx | Public category navigation uses the same tenant/channel tree as the listing API, with translated names. |
| frontend/src/storefront/shell/ChannelPreview.tsx | Explain the server-authorized, session-bound preview and clear its HttpOnly cookie on exit. |
| frontend/src/storefront/shell/CollectionView.tsx | CollectionView: storefront view composed from the scoped cart/controller. |
| frontend/src/storefront/shell/CompanyLegalPage.tsx | Directly reachable channel legal page; renders only the server's explicit public projection as text. |
| frontend/src/storefront/shell/ConciergeSelection.tsx | Editable suggestions reuse native cards; variants and app inputs stay on the native detail page. |
| frontend/src/storefront/shell/ConciergeView.tsx | ConciergeView: storefront view composed from the scoped cart/controller. |
| frontend/src/storefront/shell/HomeHero.tsx | Shared native home hero for the storefront and visual preview; no commerce commands. |
| frontend/src/storefront/shell/ProductTile.tsx | Single native product card, reused by the storefront and read-only visual preview. |
| frontend/src/storefront/shell/Storefront.tsx | Storefront composition root: cart context, routes, customer account and checkout. |
| frontend/src/storefront/shell/StorefrontContext.ts | Local storefront context, scoped to the mounted tenant and sales channel. |
| frontend/src/storefront/shell/StorefrontCurrency.tsx | Currency switching is a revision-bound server re-quote, scoped to tenant and sales channel. |
| frontend/src/storefront/shell/StorefrontFooter.tsx | Shared native legal footer; preview containers prevent navigation and submission. |
| frontend/src/storefront/shell/StorefrontHeader.tsx | StorefrontHeader: storefront view composed from the scoped cart/controller. |
| frontend/src/storefront/shell/StorefrontHeaderView.tsx | Shared native shop header markup; callers supply authorized commands or a read-only preview. |
| frontend/src/storefront/shell/StorefrontHome.tsx | Native home composition; previews reuse the same presentational hero and catalogue cards. |
| frontend/src/storefront/shell/StorefrontLanguage.tsx | Shop-configured content languages, including custom locales; the interface keeps its supported language vocabulary. |
| frontend/src/storefront/shell/cart-commands.ts | Native cart lifecycle and revision-bound quantity updates; retain original consent capability after purchase. |
| frontend/src/storefront/shell/channel-preview-i18n.ts | Personal preview copy in every supported language; exported through the shared translation catalogue. |
| frontend/src/storefront/shell/storefront-actions-i18n.ts | Shared UI/browser-agent command descriptions and errors follow the active storefront language. |
| frontend/src/storefront/shell/storefront-actions.ts | Shared native storefront commands for UI, apps and WebMCP; never expose capabilities or submit a financial order. |
| frontend/src/storefront/shell/useCatalog.ts | Cursor catalogue loading, debounced filters and stale-response protection. |
| frontend/src/storefront/shell/useCompanyIdentity.ts | Channel-scoped public brand/legal identity; stale responses cannot leak across tenants or languages. |
| frontend/src/storefront/shell/useConsentedExperience.ts | Assign experiments only after current personalization consent; discard stale responses on withdrawal. |
| frontend/src/storefront/shell/usePersonalization.ts | Opt-in behavior signals and stable product ordering; no authoritative prices are changed. |
| frontend/src/storefront/shell/useShopperAdvice.ts | Keep editable recommendations across product navigation within the original buyer/channel context. |
| frontend/src/storefront/shell/useStorefrontActions.ts | Share current native cart commands with UI/browser agents; registration is scoped and removed when the storefront changes. |
| frontend/src/storefront/shell/useStorefrontAnchors.ts | Restore native section navigation after SPA rendering, with cancellation and reduced-motion support. |
| frontend/src/storefront/shell/useStorefrontController.ts | Cart lifecycle, authoritative checkout commands and storefront coordination. |
| frontend/src/storefront/styles/checkout-fields.css | Checkout-owned form layout, independent of previously mounted account/admin stylesheets. |
| frontend/src/storefront/styles/checkout.css | Shared native checkout layout and payment states; recipient instructions have an adjacent owner. |
| frontend/src/storefront/styles/company-identity.css | Public company branding and readable legal identity across storefront channels. |
| frontend/src/storefront/styles/concierge-selection.css | Native product shortlist: responsive cards and reversible selection controls. |
| frontend/src/storefront/styles/cross-selling.css | Merchant-selected product tiles retain the storefront grid and its native responsive breakpoints. |
| frontend/src/storefront/styles/experience-polish.css | Shared storefront interaction layer: stable navigation, editorial surfaces and catalogue-grounded AI discovery. |
| frontend/src/storefront/styles/legal.css | Responsive, equally weighted consent controls and readable legal/customer forms. |
| frontend/src/storefront/styles/order-completion.css | Order receipt page and finite transform-only celebration; honors reduced motion. |
| frontend/src/storefront/styles/payment-instructions.css | Recipient details use the same payment surface, with wrapping for small embedded checkouts. |
| frontend/src/storefront/styles/saved-payments.css | Saved-method choices and account revocation retain the storefront's shared tokens and native form controls. |
| frontend/src/storefront/styles/shop/01--root.css | shop: -root styles. Source order is preserved by the entry stylesheet. |
| frontend/src/storefront/styles/shop/02-shop-product-image.css | shop: shop-product-image styles. Source order is preserved by the entry stylesheet. |
| frontend/src/storefront/styles/shop/03-availability-span.css | shop: availability-span styles. Source order is preserved by the entry stylesheet. |
| frontend/src/storefront/styles/shop/04-shop-stepper.css | shop: shop-stepper styles. Source order is preserved by the entry stylesheet. |
| frontend/src/storefront/styles/shop/05-shop-grid-comparison.css | shop: shop-grid-comparison styles. Source order is preserved by the entry stylesheet. |
| frontend/src/storefront/styles/shop.css | Ordered shop stylesheet entry; domain rules live in the adjacent folder. |
| frontend/src/storefront/styles/storefront-polish.css | Warm editorial surfaces and responsive navigation, catalogue and product pages. |
Independent apps, services and SDK
| Module | Responsibility |
|---|---|
| extensions/apps/algolia/src/provider.rs | Search projections contain explicit catalogue fields only; commerce remains authoritative in Veyndo. |
| extensions/apps/catalog-export/server.py | Independent, language-neutral export example. Only scoped commerce callbacks; no core SQL or hosted Python dependency. |
| extensions/apps/catalog-import/mod.rs | Inbound provider formats belong to this app; reviewed creation and publication remain native Veyndo operations. |
| extensions/apps/catalog-import/shop_mcp.rs | Read-only Shop MCP catalogue connector. Never calls foreign carts, checkout, account, wallet or purchase tools. |
| extensions/apps/catalog-import/shopify_csv.rs | Deterministic Shopify product-export adapter; image-only rows are not products and variant prices/SKUs remain distinct. |
| extensions/apps/contentful/src/provider.rs | Contentful reads a bounded, explicitly paged source into the existing knowledge export path. |
| extensions/apps/edi/service/callbacks.rs | Scoped canonical callbacks retain installed digest, consent, actor rights and native app storage ownership. |
| extensions/apps/edi/service/config.rs | Only operator configuration supplies core callback destinations; documents cannot choose URLs or credentials. |
| extensions/apps/edi/service/document.rs | Protocol-neutral requisitions preserve partner identity and SKUs; commerce prices remain native. |
| extensions/apps/edi/service/edifact.rs | Bounded EDIFACT ORDERS profile with release-aware tokenization and checked message/interchange envelopes. |
| extensions/apps/edi/service/export.rs | Partner-bound outbound messages serialize existing orders/issued receipts; no fiscal numbers, prices or shipping events are invented. |
| extensions/apps/edi/service/export_tests.rs | Outbound negative controls retain native amounts, escapes and explicit unsupported invoice profiles. |
| extensions/apps/edi/service/import.rs | Mapped partner documents create private native requisitions, never orders or a second pricing ledger. |
| extensions/apps/edi/service/main.rs | Independent EDI gateway: app-owned codecs and mappings use the existing permission-aware commerce callback contract. |
| extensions/apps/edi/service/xml.rs | Namespace-aware UBL Order and cXML OrderRequest ingestion without DTDs, external entities or network fetching. |
| extensions/apps/edi/tests/integration.py | Real installed-package -> Rust EDI gateway -> consent-bound callbacks -> buyer-owned requisition -> native checkout; no external network. |
| extensions/apps/email/src/config.rs | Compile-time mail setting types plus bounded runtime validation and write-only credentials. |
| extensions/apps/email/src/email.rs | Email app actions/events retain the published gateway, flow and MCP payload contract. |
| extensions/apps/email/src/payment_templates.rs | Localized recipient instructions use native exact money and escaped template substitution; no mail implies paid status. |
| extensions/apps/email/src/smtp.rs | Pinned SMTP/STARTTLS/TLS with verified hostname, bounded dialogue and no retry after ambiguous DATA. |
| extensions/apps/email/src/templates.rs | Bounded immutable envelopes and non-executable multilingual templates; HTML substitutions are escaped. |
| extensions/apps/email/studio/EmailPanel.tsx | Native email app settings, localized templates, safe previews and durable delivery receipts. |
| extensions/apps/email/studio/EmailProviderFields.tsx | EmailProviderFields: focused connector-settings view with explicit typed inputs and callbacks. |
| extensions/apps/email/studio/EmailTemplateEditor.tsx | One template type and content language at a time, using the installed email app's defaults and overrides. |
| extensions/apps/email/studio/email-i18n.ts | Complete mail workspace vocabulary in English, German, French and Spanish. |
| extensions/apps/email/studio/email-languages.ts | Supported transactional email template languages. |
| extensions/apps/email/studio/email-settings.css | Email-owned provider fields and notification choices retain the shared Studio form controls. |
| extensions/apps/engraving/configuration.wat | Engraving-owned rules: printable input is checked by the host; app defines length and fee. |
| extensions/apps/erp-handoff/service/config.rs | Operator-owned tenant destinations and callback keys; request bodies cannot choose URLs or credentials. |
| extensions/apps/erp-handoff/service/delivery.rs | Authoritative order callback and fixed-destination ERP export: one stable key, no automatic retry after an ambiguous result. |
| extensions/apps/erp-handoff/service/events.rs | Full event batches are validated before the first ERP effect; tenant/app/idempotency identity is exact. |
| extensions/apps/erp-handoff/service/main.rs | Independent ERP adapter process: bounded gateway requests, app-owned receipts and explicit external outcomes. |
| extensions/apps/erp-handoff/service/store.rs | App-private PostgreSQL receipts use forced tenant RLS, short claims and explicit uncertain outcomes after a crash. |
| extensions/apps/erp-handoff/tests/integration.py | Real core -> scoped callback -> Rust ERP adapter -> local ERP -> forced-RLS receipt, replay/restart and ambiguous outcome. |
| extensions/apps/furniture-configurator/configuration.wat | Furniture-owned dimensional validation and surcharge. Core retains money, tax, stock and purchasing approval. |
| extensions/apps/furniture-configurator/tests/workflow.py | Actual app library/dimensions → exact-cart B2B approval → immutable order → saved-input reorder; no paid providers. |
| extensions/apps/gift-message/configuration.wat | Gift-message-owned rules: printable input is checked by the host; app defines length and fee. |
| extensions/apps/gmail/src/actions.rs | App-owned connector capabilities and provider settings; shared host supplies tenant-bound storage. |
| extensions/apps/gmail/src/provider.rs | Read-only Gmail incremental imports preserve high-water cursors, bounded windows and deletion evidence. |
| extensions/apps/google-analytics/src/actions.rs | App-owned connector capabilities and provider settings; shared host supplies tenant-bound storage. |
| extensions/apps/google-analytics/src/provider.rs | Exact bounded GA4 source rows, quota metadata and stale-report tombstones; no invented causal claims. |
| extensions/apps/google-analytics/storefront/ShopAnalytics.tsx | Customer consent and real GA4 ecommerce events; absent apps produce no external script. |
| extensions/apps/hubspot/src/provider.rs | Explicit bounded CRM contact upsert; no subscriptions, bulk customer reads or implicit opt-ins. |
| extensions/apps/klaviyo/src/provider.rs | Klaviyo event ingestion uses a stable unique ID and never enrolls a profile into marketing. |
| extensions/apps/marketplaces/service/amazon.rs | Official amazon listing adapter, isolated inside the marketplace app. |
| extensions/apps/marketplaces/service/config.rs | Operator-only destinations and per-tenant credentials; marketplace records can select aliases, never supply secrets or URLs. |
| extensions/apps/marketplaces/service/core.rs | Scoped canonical callbacks retain installed digest, consent, actor rights and native app storage ownership. |
| extensions/apps/marketplaces/service/ebay.rs | Official ebay listing adapter, isolated inside the marketplace app. |
| extensions/apps/marketplaces/service/intake.rs | Provider order inbox preserves source identity; explicit review delegates purchase effects exactly once to the native importer. |
| extensions/apps/marketplaces/service/jobs.rs | Core-leased jobs: authenticate and validate whole event batches, claim before acknowledgement, and keep unknown writes fenced. |
| extensions/apps/marketplaces/service/kaufland.rs | Official kaufland listing adapter, isolated inside the marketplace app. |
| extensions/apps/marketplaces/service/main.rs | Independent Marketplace Studio service; provider protocols stay in this app, native commerce stays in Core. |
| extensions/apps/marketplaces/service/mapping.rs | Explainable automatic field suggestions and per-channel overrides; mapping is reviewed data, never executable code. |
| extensions/apps/marketplaces/service/providers.rs | Distinct official listing payloads, provider prerequisites and order pages; more providers extend this app-level seam. |
| extensions/apps/marketplaces/service/review.rs | Source-derived SKU, quantity and address suggestions; absent financial facts stay null for explicit review. |
| extensions/apps/marketplaces/service/runtime.rs | Authenticated app actions and indexed native record access. |
| extensions/apps/marketplaces/service/sync.rs | Sync jobs persist ambiguous-write fences and source inbox identity through native revisioned app records, never a second queue. |
| extensions/apps/marketplaces/service/transport.rs | Fixed official origins, bounded provider responses, scoped OAuth and HMAC; no request-supplied egress or blind retries. |
| extensions/apps/marketplaces/studio/ConnectionEditor.tsx | Guided seller connection editor reuses native channel and record revisions. Secrets remain server-only. |
| extensions/apps/marketplaces/studio/MarketplaceOffers.tsx | Connection and offer cards with explicit prepare/submit controls and channel-specific preview. |
| extensions/apps/marketplaces/studio/MarketplacePanel.tsx | App-owned marketplace workspace uses generated entity actions, native job queue and commerce callbacks. |
| extensions/apps/marketplaces/studio/MarketplaceWorkspace.tsx | Channel-scoped entry to the existing app-owned seller UI; installation uses native reviewed consent. |
| extensions/apps/marketplaces/studio/OfferEditor.tsx | Channel-specific offer overrides and explicit data-only attribute mappings. No copied catalog or provider secrets. |
| extensions/apps/marketplaces/studio/OrderAddress.tsx | Marketplace review addresses remain source snapshots; no separate customer directory. |
| extensions/apps/marketplaces/studio/OrderReview.tsx | Source-derived review uses visible addresses, SKU matches and exact amounts; no invented products or taxes. |
| extensions/apps/marketplaces/studio/marketplace-i18n.ts | Marketplace app vocabulary; UI language is independent of inherited content language. |
| extensions/apps/marketplaces/studio/marketplace-model.ts | Native app records and provider policy metadata. IDs never change tenant scope. |
| extensions/apps/marketplaces/studio/marketplace-order-i18n.ts | Source-order review vocabulary in all supported interface languages. |
| extensions/apps/marketplaces/studio/marketplace-setup-i18n.ts | Guided seller setup copy; credentials remain service-side and installation does not imply a live seller connection. |
| extensions/apps/marketplaces/studio/marketplaces.css | App-owned responsive workspace uses Veyndo surface tokens; no global selectors or provider scripts. |
| extensions/apps/marketplaces/tests/integration.py | Installed Marketplace app -> independent Rust service -> fixture seller APIs -> native PostgreSQL order effects. No external credentials or requests. |
| extensions/apps/marketplaces/tests/order_localization.py | Native external-order language, batching, snapshot and stock regressions through the installed app callback. |
| extensions/apps/migration/adapters/contacts.rs | Source address aliases are converted here; the commerce host only receives canonical address fields. |
| extensions/apps/migration/adapters/coupons.rs | Source coupon rules map to native inactive promotions; unsupported conditions stop instead of widening the original discount. |
| extensions/apps/migration/adapters/dates.rs | Historical timestamps retain their real timezone; ambiguous local DST times require explicit source evidence. |
| extensions/apps/migration/adapters/feedback.rs | Source reviews become plain original content with explicit dates; source verification never becomes native purchase proof. |
| extensions/apps/migration/adapters/mod.rs | Source-specific parsing stays app-owned; unknown domains and incomplete records fail explicitly. |
| extensions/apps/migration/adapters/order_lines.rs | Exact canonical history lines preserve source amounts without making native product or purchase claims. |
| extensions/apps/migration/adapters/pages.rs | Source content becomes editable native page blocks; executable embeds and unresolved media fail before import. |
| extensions/apps/migration/adapters/products.rs | Preserve source variant identity, decimal price and known stock; never invent available inventory. |
| extensions/apps/migration/adapters/records.rs | Historical facts remain source claims, without synthesized account, payment, consent or verified-purchase authority. |
| extensions/apps/migration/adapters/relations.rs | Provider relation shapes become explicit source IDs and native option labels, never guessed target IDs. |
| extensions/apps/migration/adapters/shopware6.rs | Shopware 6 catalogue projection preserves identities and refuses unresolved inheritance, prices or options. |
| extensions/apps/migration/adapters/visibility.rs | Source publication/status is distinct from inventory; unsupported direct/search/catalogue visibility must be mapped explicitly. |
| extensions/apps/migration/adapters/woo.rs | A WooCommerce variation snapshot must cover exactly the declared source IDs and concrete attribute combinations. |
| extensions/apps/migration/contract/mod.rs | Versioned source identities and exact historical money shared by migration transport and admission. |
| extensions/apps/migration/contract/money.rs | Decimal source amounts become checked integer minor units without a floating-point intermediate. |
| extensions/apps/migration/service/batch.rs | A reviewed source page is immutable during a job; each native write is replayable and checkpointed in Core. |
| extensions/apps/migration/service/callback_errors.rs | Native callback failures have their own bounded origin/status and localized recovery guidance, never source credentials/body. |
| extensions/apps/migration/service/config.rs | Operator-bound source identities and credentials; action input cannot choose a network destination. |
| extensions/apps/migration/service/core.rs | Bounded callbacks use only configured Core origins and per-tenant revocable app identities. |
| extensions/apps/migration/service/events.rs | The native outbox delivers job IDs; the service claims current Core leases before acknowledging work. |
| extensions/apps/migration/service/export_manifest.rs | Immutable export manifests bind bounded original source pages to their context, counts and exact bytes. |
| extensions/apps/migration/service/export_pack.rs | Streaming source-export packaging writes private immutable files; a manifest appears only after all rows validate. |
| extensions/apps/migration/service/export_readiness.rs | Offline exports must contain expanded original references, not shallow API summaries disguised as complete pages. |
| extensions/apps/migration/service/export_source.rs | Same-origin authenticated export reads verify the pinned manifest and each bounded page before native review. |
| extensions/apps/migration/service/extract.rs | Versioned source pages keep cursors separate from URLs; unsupported plugin domains remain explicit. |
| extensions/apps/migration/service/main.rs | Independent Rust migration entry: bounded streaming source normalization and app gateway service. |
| extensions/apps/migration/service/media.rs | Source media descriptors remain app-owned; review freezes bounded image digests and imports refetch identical bytes without forwarding source credentials. |
| extensions/apps/migration/service/presta.rs | PrestaShop keeps address/country/currency references separate; resolve exact owned records before normalization. |
| extensions/apps/migration/service/receipts.rs | Page evidence lives in the installed app's native private records, separate from bounded technical job retention. |
| extensions/apps/migration/service/reconcile.rs | Read-only native callback comparisons cover every reviewed row, including rows imported before a resumed lease. |
| extensions/apps/migration/service/server.rs | Private gateway authentication binds every source to its configured tenant and bounds concurrent source reads. |
| extensions/apps/migration/service/shopify.rs | Shopify GraphQL preserves scope errors and nested pagination instead of dropping undisclosed records. |
| extensions/apps/migration/service/shopware.rs | Shopware list summaries omit historical positions and addresses; bounded detail reads retain original identity. |
| extensions/apps/migration/service/shopware6.rs | Read-only Shopware Admin OAuth/search intake; currency and language are resolved explicitly before product paging. |
| extensions/apps/migration/service/slices.rs | Variant-expanded source pages are sliced into native-sized immutable batches; changed parent pages cannot shift offsets silently. |
| extensions/apps/migration/service/transport.rs | Shared address classification, pinned DNS, disabled proxies/redirects and bounded streamed source responses. |
| extensions/apps/migration/service/woo.rs | Bounded parallel WooCommerce variant reads use fixed source paths, pinned transport and exact parent-declared IDs. |
| extensions/apps/migration/studio/Agent.tsx | A contextual drawer embeds the existing Studio agent; no second chat, inference runtime or approval store. |
| extensions/apps/migration/studio/CRMDetails.tsx | Original addresses and historical positions stay visible before the merchant approves native intake. |
| extensions/apps/migration/studio/Comparison.tsx | Bounded native comparison summaries expose counts, never private source values. |
| extensions/apps/migration/studio/Connection.tsx | Source credentials are edited in memory and saved through the existing encrypted installed-settings owner. |
| extensions/apps/migration/studio/ExportEvidence.tsx | Exact pinned export scope is visible before any page approval; aggregate counts are not native parity claims. |
| extensions/apps/migration/studio/ExportFields.tsx | Optional immutable export settings reuse the existing encrypted app-settings form and separate credential. |
| extensions/apps/migration/studio/InstallConsent.tsx | Reuse native package consent for migration and its private page-editor destination. |
| extensions/apps/migration/studio/JobHistory.tsx | Native job history remains paged and visibly distinct from a whole-shop completion report. |
| extensions/apps/migration/studio/Jobs.tsx | Saved job controls use native CAS, explicit uncertain-outcome acknowledgement and current action permissions. |
| extensions/apps/migration/studio/LanguageMap.tsx | Explicit source language IDs map to real content locales without relabelling or fabricating translations. |
| extensions/apps/migration/studio/MigrationSteps.tsx | Compact migration step navigation keeps source, reviewed domains and the native design handoff together. |
| extensions/apps/migration/studio/MigrationWorkspace.tsx | App-owned inward migration workflow: native consent, exact reviewed pages, private product targets and durable jobs. |
| extensions/apps/migration/studio/PriceOptions.tsx | One reviewed tax rate and explicit original basis feed the existing native price owner. |
| extensions/apps/migration/studio/ProductComparison.tsx | Current authorized source/target preview; no values enter job history and no inspection performs a write. |
| extensions/apps/migration/studio/ProductDetails.tsx | Merchant-readable variant evidence is displayed before the exact source-page approval. |
| extensions/apps/migration/studio/ReviewPanel.tsx | Exact source review keeps unacknowledged gaps and missing target choices from starting a write. |
| extensions/apps/migration/studio/RunPlans.tsx | Coarse work plans use existing versioned native app records; source rows and job authority stay with their original owners. |
| extensions/apps/migration/studio/RunProgress.tsx | A saved plan walks reviewed pages in dependency order; truncated history never proves completion. |
| extensions/apps/migration/studio/SourceDetails.tsx | Source business evidence stays visible before approval; imported claims never become native purchase or activation authority. |
| extensions/apps/migration/studio/SourceProfile.tsx | Operator profile selection is context only and never a browser-held credential. |
| extensions/apps/migration/studio/Target.tsx | Native private environments can be reused across categories, products and pages; operational records keep their live target. |
| extensions/apps/migration/studio/crm-i18n.ts | Original CRM evidence uses the same Studio locale as the reviewed migration command. |
| extensions/apps/migration/studio/export-i18n.ts | Frozen export controls distinguish immutable artifact evidence from unproved whole-shop cutover. |
| extensions/apps/migration/studio/feedback-i18n.ts | Review and coupon evidence labels share the current Studio interface locale. |
| extensions/apps/migration/studio/i18n.ts | Migration controls use the same four interface locales; source content keeps its own explicit locale. |
| extensions/apps/migration/studio/inspection-i18n.ts | Source inspection is a durable read, distinct from a reviewed native import. |
| extensions/apps/migration/studio/migration.css | App-owned migration workspace: compact stable steps, clear review canvas and contained tables. |
| extensions/apps/migration/studio/model.ts | Review projections retain exact minor units and source IDs; UI never invents native purchase or identity authority. |
| extensions/apps/migration/studio/preview-i18n.ts | Merchant-facing labels for transient source/current-target catalogue review. |
| extensions/apps/migration/studio/price-i18n.ts | Source tax-basis choices are explicit; conversion belongs to the existing native tax calculator. |
| extensions/apps/migration/studio/product-comparison.css | Product comparison stays readable in the existing migration workspace and narrow viewports. |
| extensions/apps/migration/studio/product-i18n.ts | Original product evidence distinguishes private variants and source inventory from active target stock. |
| extensions/apps/migration/studio/run-i18n.ts | Work-plan vocabulary distinguishes saved context from verified migration effects. |
| extensions/apps/migration/studio/run-model.ts | Defensive work-plan projection; metadata cannot select unknown domains or become an import receipt. |
| extensions/apps/migration/studio/run-pages.ts | Durable page intents use native app records/CAS; they never replace current per-page import admission. |
| extensions/apps/migration/studio/run-progress-i18n.ts | Migration vocabulary distinguishes observed comparisons from final cutover. |
| extensions/apps/migration/studio/useCustomerGroups.ts | Current native customer group choices; no source-side group or person can create destination authority. |
| extensions/apps/migration/studio/useJobPages.ts | Poll bounded native keyset pages for one selected run; never infer completion from a truncated first page. |
| extensions/apps/migration/studio/useMigrationDesign.ts | Design continues in the selected native preview and shared agent, without a second publication or inference path. |
| extensions/apps/migration/studio/useMigrationImport.ts | Reviewed native page submission and explicit resume share current shop/rights fences and persisted CAS intents. |
| extensions/apps/migration/studio/useMigrationPackages.ts | Current tenant package state is refetched through native consent owners, never inferred from a saved work plan. |
| extensions/apps/migration/studio/useRunPages.ts | Native page evidence survives technical job archival; every load is fenced by current shop, plan and rights. |
| extensions/apps/migration/studio/useSourceReview.ts | Adopt only the current request's durable source evidence; changing identity or source invalidates pending presentation. |
| extensions/apps/migration/tests/assets.py | Native imported image bytes are immutable, private, replayable and use the original catalogue/release owners. |
| extensions/apps/migration/tests/crm.py | Original addresses and historical line evidence must survive actual Rust normalization without invented identity. |
| extensions/apps/migration/tests/crm.test.tsx | A merchant can inspect original address/line evidence before approving the native CRM command. |
| extensions/apps/migration/tests/crm_sources.py | Protocol-faithful local CRM source responses; synthetic records exercise separate reference resources. |
| extensions/apps/migration/tests/durable_flow.py | A connected eight-domain plan retains page evidence independently of native technical job retention. |
| extensions/apps/migration/tests/export_flow.py | Frozen export -> saved source jobs -> reviewed exact digests -> native private records across every page. |
| extensions/apps/migration/tests/exports.py | Bounded immutable export CLI and actual authenticated HTTP reader; no live source or throughput claim. |
| extensions/apps/migration/tests/exports.test.tsx | Frozen export setup and source evidence remain visible and separately reviewed in the native workflow. |
| extensions/apps/migration/tests/feedback.test.tsx | Review and coupon previews expose the business conditions that the merchant is actually approving. |
| extensions/apps/migration/tests/inspection.test.tsx | Durable inspection results reopen after reload and remain explicit, unapproved source evidence. |
| extensions/apps/migration/tests/job_import.py | Reviewed native job writes are fenced by digests, lease, current actor and cancellation. |
| extensions/apps/migration/tests/job_pages.py | Real native job keyset/correlation pagination must retain old completed jobs and tenant isolation. |
| extensions/apps/migration/tests/native_import.py | Native historical intake must preserve money/identity without purchase effects or account inference. |
| extensions/apps/migration/tests/normalization.py | Exercise the actual Rust migration CLI; literal source fixtures pin money and source identity. |
| extensions/apps/migration/tests/pages.py | Imported pages use the real installed editor, current rights, private storage and replay fences. |
| extensions/apps/migration/tests/pii_projection.py | The settings read model cannot bypass current order and separate personal-data rights. |
| extensions/apps/migration/tests/price_basis.py | Net source prices use the existing native gross calculator and explicit reviewed basis, never nominal copying. |
| extensions/apps/migration/tests/price_basis.test.tsx | Explicit tax basis and warnings remain part of the exact reviewed import command. |
| extensions/apps/migration/tests/product-preview-cases.tsx | Product preview uses current scoped native reads and discards stale responses without writing. |
| extensions/apps/migration/tests/progress.test.tsx | Connected-run regressions cover actual native-record consumption and delayed authorization changes. |
| extensions/apps/migration/tests/provider_crm_flow.py | Four additional provider CRM protocols reach native address books and immutable history, never purchases. |
| extensions/apps/migration/tests/provider_flow.py | Every advertised platform traverses its actual Rust source transport, reviewed job and native private product owner. |
| extensions/apps/migration/tests/publication.py | Selected publication preserves variant dependencies and refuses protected downloads as public product images. |
| extensions/apps/migration/tests/purchase.py | A source-imported private product must survive deliberate native publication and a real simulated buyer checkout. |
| extensions/apps/migration/tests/reconciliation.py | Current native target state, not a source digest/replay, determines mapped-field parity. |
| extensions/apps/migration/tests/reviews_coupons.py | Imported reviews retain source claims without purchase authority; imported coupons require deliberate native activation. |
| extensions/apps/migration/tests/run_flow.py | Saved native plans: shared record CAS/history, separate approval, grouped durable source reads and tenant isolation. |
| extensions/apps/migration/tests/runs.test.tsx | Saved migration plans restore only context; they never approve source pages or assert whole-shop completion. |
| extensions/apps/migration/tests/service_flow.py | Actual Rust HTTP source -> reviewed native job -> scoped callback -> native private product. |
| extensions/apps/migration/tests/studio.test.tsx | Real migration workflow controls require readable source data and explicit import review. |
| extensions/apps/migration/tests/transport.py | Actual source HTTP -> Rust service -> canonical records; authentication and cursor failure controls. |
| extensions/apps/migration/tests/variable_flow.py | Variable source products keep original parent/child identities, visibility and images through native release and checkout. |
| extensions/apps/migration/tests/visibility.py | Original source publication status must never silently become an active target product. |
| extensions/apps/paypal/src/adapter.rs | Legacy PayPal admission/account wiring belongs to the PayPal package, not a second pricing owner. |
| extensions/apps/paypal/src/compatibility.rs | Native PayPal Orders v2 sandbox wire adapter; credentials never enter prompts or browser responses. |
| extensions/apps/paypal/src/receipts.rs | PayPal receipt interpretation; shared payment storage owns order and inventory effects. |
| extensions/apps/paypal/src/webhooks.rs | PayPal verifies webhook signatures before inbox insertion; provider reconciliation confirms monetary state. |
| extensions/apps/product-lab/app.js | A complete guest surface can use any UI framework; this example needs no build or host imports. |
| extensions/apps/product-lab/index.html | Independent app entry; see extensions/README.md for its public contract. |
| extensions/apps/product-lab/server.py | App-owned code, SQLite structures and versioned browser UI; no commerce credentials reach the guest. |
| extensions/apps/service-example/index.html | Independent app entry; see extensions/README.md for its public contract. |
| extensions/apps/service-example/server.py | Standalone app service with its own UI and durable event inbox. Run separately from the core. |
| extensions/apps/site-builder/AppElement.tsx | Placed native app surfaces use the existing public registry, renderer and server-bound read-only preview grants. |
| extensions/apps/site-builder/Renderer.tsx | Shared page renderer: Studio previews and published shops use exactly these registered components. |
| extensions/apps/site-builder/agent_handoff.rs | Coding agents edit the same page schema through credential-free tasks and explicit native review. |
| extensions/apps/site-builder/block_validation.rs | App-owned block admission with bounded field paths; never echo untrusted content in errors. |
| extensions/apps/site-builder/context.rs | Designer context projects native channels, languages and calculated products; no second catalogue or price engine. |
| extensions/apps/site-builder/design_agent.rs | Scoped visual proposals reuse central inference and native revision-bound tasks; models cannot publish or execute. |
| extensions/apps/site-builder/elements.rs | Placed app elements resolve only active, public surfaces of this tenant; app code stays in its own package. |
| extensions/apps/site-builder/model.ts | One app-owned document contract for manual editing, agents, API/MCP and the storefront renderer. |
| extensions/apps/site-builder/planning.rs | App-owned nested page format shared by merchant planning and external coding agents. |
| extensions/apps/site-builder/proposals.rs | Native revision-bound proposal validation and persistence shared by every design agent. |
| extensions/apps/site-builder/references.rs | Site design reuses generic bounded reference capture; page interpretation remains app-owned. |
| extensions/apps/site-builder/server.rs | Standard-shop page contract. App-owned content and theme validation; no HTML, CSS or script evaluation. |
| extensions/apps/site-builder/site.css | Shared, responsive site renderer; merchant design data never becomes arbitrary CSS. |
| extensions/apps/site-builder/storefront/PublishedSite.tsx | One permission-filtered page read supplies routing and the shared theme on every native commerce route. |
| extensions/apps/site-builder/storefront/ShopSite.tsx | Standard-shop routing is an app mount; commerce products, cart, account and checkout keep their original owners. |
| extensions/apps/site-builder/studio/AppearanceControls.tsx | Shared page/channel appearance controls; null values retain native inheritance. |
| extensions/apps/site-builder/studio/BlockPalette.tsx | Built-in and installed-app elements share a visual insertion gallery and one document model. |
| extensions/apps/site-builder/studio/BlockPreview.tsx | Miniature component layouts communicate what each element adds without loading apps or remote images. |
| extensions/apps/site-builder/studio/DesignAgent.tsx | Shop design uses the shared agent workspace and existing native proposal/approval owners. |
| extensions/apps/site-builder/studio/DesignReferences.tsx | Discoverable URL and image reference inputs; no external HTML is rendered in the editor. |
| extensions/apps/site-builder/studio/DesignReview.tsx | Review real proposed page changes and viewport entry points; never infer visual correctness or app execution from a model summary. |
| extensions/apps/site-builder/studio/DesignSetup.tsx | One visible setup path reuses native sandbox admission and explicit per-package consent. |
| extensions/apps/site-builder/studio/DesignerHeader.tsx | Channel, private save and agent entry remain visible above the shared preview. |
| extensions/apps/site-builder/studio/DesignerInspector.tsx | Visible edit, element, agent and history modes share the same native draft and approval path. |
| extensions/apps/site-builder/studio/DesignerPreview.tsx | Preview composes the shared storefront renderer with editor-only gesture controls. |
| extensions/apps/site-builder/studio/DesignerPreviewBar.tsx | Stable preview navigation shares the current editor history across overview and page modes. |
| extensions/apps/site-builder/studio/DesignerView.tsx | Three-panel standard-shop editor inside the native shell; Storyfront retains its separate original editor. |
| extensions/apps/site-builder/studio/EditableSection.tsx | Preview-only controls decorate the actual storefront renderer; the published renderer has no editor UI. |
| extensions/apps/site-builder/studio/ImageProperties.tsx | Shared image metadata controls edit the selected page block through its normal draft owner. |
| extensions/apps/site-builder/studio/NativeCategoryPreview.tsx | Category scenes use the native channel listing and shared product cards, without shopper or payment effects. |
| extensions/apps/site-builder/studio/NativeHomePreview.tsx | Preview composes the actual native header, hero, product cards and footer, without a live cart or commands. |
| extensions/apps/site-builder/studio/NativeProductPreview.tsx | Native gallery and purchase presentation use a scoped read without shopper sessions, analytics or app actions. |
| extensions/apps/site-builder/studio/PageHistory.tsx | Whole-page and section restoration use retained native app revisions; restoration is an editable draft. |
| extensions/apps/site-builder/studio/PageInspector.tsx | Property edits and WYSIWYG content update the same structured page record as agents and MCP. |
| extensions/apps/site-builder/studio/PageTree.tsx | Compact page hierarchy with a graphical creation dialog and stable, permission-bound section ordering. |
| extensions/apps/site-builder/studio/ShopDesigner.tsx | The native shop-design entry binds workspace data and content-language scope to the visual canvas. |
| extensions/apps/site-builder/studio/ShopOverview.tsx | Shared zoomable board mounts at most four native page/product/category previews and retains the domain draft. |
| extensions/apps/site-builder/studio/StorefrontCanvas.tsx | Isolated viewport for native presentational components and the shared app renderer; no cart, analytics or orders run here. |
| extensions/apps/site-builder/studio/canvas.css | Canvas sizing uses real iframe viewports; mobile tools follow the preview rather than obscure it. |
| extensions/apps/site-builder/studio/design-i18n.ts | Complete interface vocabulary for the standard-shop designer, independent of page translations. |
| extensions/apps/site-builder/studio/design-images.ts | Shop references use the same bounded raster/URL preparation as the App Studio agent. |
| extensions/apps/site-builder/studio/designer.css | Native three-panel designer; responsive canvas and independently scrollable properties. |
| extensions/apps/site-builder/studio/editor-i18n.ts | Inspector, history and reference-agent vocabulary. |
| extensions/apps/site-builder/studio/home-draft.ts | Convert the native home to an unsaved app document; retain real locale text and owned product-media selection. |
| extensions/apps/site-builder/studio/inspector.css | Inspector and review panels, separate from the canvas layout. |
| extensions/apps/site-builder/studio/interaction-i18n.ts | Editor gesture and reference guidance stays localized independently of merchant content. |
| extensions/apps/site-builder/studio/interactions.css | These controls decorate only the sandbox canvas. Stable drop gutters avoid shifting the target mid-drag. |
| extensions/apps/site-builder/studio/navigation.css | Compact page hierarchy, section ordering and page-creation cards. |
| extensions/apps/site-builder/studio/overview-i18n.ts | Page overview controls use the same interface locales as the surrounding editor. |
| extensions/apps/site-builder/studio/overview-model.ts | The overview follows the editor's channel inheritance and includes its current unsaved draft. |
| extensions/apps/site-builder/studio/overview.css | Page comparison uses the existing Studio palette and keeps each real viewport contained. |
| extensions/apps/site-builder/studio/palette.css | Graphical insertion gallery for built-in and registered app-owned elements. |
| extensions/apps/site-builder/studio/prepare-page.ts | Agent work starts from a native saved page revision, including a scoped copy of an inherited home. |
| extensions/apps/site-builder/studio/references.css | References are a first-class design starting point in the existing agent rail. |
| extensions/apps/site-builder/studio/review-i18n.ts | Design comparison vocabulary keeps automated structural counts distinct from visual and functional acceptance. |
| extensions/apps/site-builder/studio/setup-i18n.ts | Guided private-editing vocabulary; package consent and publication keep their native owners. |
| extensions/apps/site-builder/studio/setup.css | Compact prerequisite guidance keeps the real storefront visible and the next action clear. |
| extensions/apps/site-builder/studio/useBlockEditing.tsx | Local editor gestures share one bounded document mutation path; drag payloads never contain executable/app data. |
| extensions/apps/site-builder/studio/useCommerceCanvas.ts | Native commerce handoffs keep the open editor mounted and protect unfinished edits before target replacement. |
| extensions/apps/site-builder/studio/useDesignResume.ts | Non-sensitive editor intent survives native sandbox handoff; only a current authorized private preview can resume it. |
| extensions/apps/site-builder/studio/useDesigner.ts | Explicit native saves and scope-safe reads; local undo never bypasses record CAS or staging review. |
| extensions/apps/site-builder/studio/usePointerPlacement.ts | Captured mouse/touch gestures cross the iframe boundary with viewport-aware drop positions and edge scrolling. |
| extensions/apps/site-builder/studio/workspace-i18n.ts | Shared visual workspace vocabulary; interface choices never become untranslated content. |
| extensions/apps/site-builder/studio/workspace.css | Visual workspace panels: one scroll region per rail, stable mode controls and graphical element cards. |
| extensions/apps/site-builder/tests/canvas-cases.tsx | Real sandboxed frame renders native components and sends no preview/cart/order commands. |
| extensions/apps/site-builder/tests/design-reference-cases.tsx | Screenshot bounds and invalid-file recovery use the actual reference input and existing agent payload. |
| extensions/apps/site-builder/tests/designer-cases.tsx | Initial native storefront, automatic home selection and inherited-draft copy regressions. |
| extensions/apps/site-builder/tests/interactions-cases.tsx | Real editor commands: insertion positions, stale/untrusted drags, caps and native undo remain consistent. |
| extensions/apps/site-builder/tests/onboarding-cases.tsx | New-shop setup uses real consent and private handoff, never a live edit or implicit installation. |
| extensions/apps/site-builder/tests/overview-cases.tsx | Overview follows real channel inheritance and preserves the existing editor when moving between pages. |
| extensions/apps/site-builder/tests/pointer-cases.tsx | Mouse/touch placement converts scaled iframe coordinates and excludes clipped/outside targets. |
| extensions/apps/site-builder/tests/published-language-cases.tsx | Published pages use the selected content language even when Studio/store controls use another locale. |
| extensions/apps/site-builder/tests/workspace-cases.tsx | Graphical insertion and shared agent controls exercise the same native editor state. |
| extensions/apps/site-builder/usePageProducts.ts | Resolve explicit selections through the native bounded catalogue, independent of the first catalogue/search page. |
| extensions/apps/site-forms/server.rs | Forms validate answers against a published page's declared fields; inbox entries stay private. |
| extensions/apps/site-forms/storefront/PublishedForm.tsx | Public forms send only append-only, schema-validated requests to the native app inbox. |
| extensions/apps/site-forms/storefront/form-i18n.ts | Public form interface labels; declared field labels remain editable shop-language content. |
| extensions/apps/site-forms/storefront/forms.css | Form styling belongs to the forms app; shared theme tokens come from its host. |
| extensions/apps/site-forms/studio/FormInbox.tsx | Private response cards use the authorized app action; answer values never become public page content. |
| extensions/apps/site-forms/studio/inbox.css | Response values wrap inside their private app panel; no raw JSON editing surface. |
| extensions/apps/slack/src/actions.rs | App-owned connector capabilities and provider settings; shared host supplies tenant-bound storage. |
| extensions/apps/slack/src/provider.rs | Slack notification execution belongs to the Slack app, admitted by the connector host. |
| extensions/apps/storyfront/studio/StoryfrontConnections.tsx | Shared passive navigation from Apps and Storyfronts to the same authorized original editor. |
| extensions/apps/storyfront/studio/StoryfrontCreate.tsx | Self-service entry retains the current tenant and an eligible native storefront channel; no installation on a read. |
| extensions/apps/storyfront/studio/StoryfrontView.tsx | Discover the actual tenant-bound hosted frontends; keep the optional legacy app connector separate. |
| extensions/apps/storyfront/studio/storyfront-create.ts | Only public workspace/channel identifiers cross to the configured Experience entry; never tokens or customer data. |
| extensions/apps/storyfront/studio/storyfront-i18n.ts | Four-language navigation copy; mounted frontends are connections, not proof of publication. |
| extensions/apps/storyfront/studio/storyfront-model.ts | Passive operator URLs contain no browser credential; the destination editor authorizes its own owner. |
| extensions/apps/storyfront/studio/storyfronts.css | Tenant-bound Experience cards share Studio tokens and keep long hostnames inside mobile columns. |
| extensions/apps/storyfront/ui.html | Independent app entry; see extensions/README.md for its public contract. |
| extensions/apps/vercel/frontend/client.ts | Stateless headless Store API client: every cart token is explicit and no merchant credential is accepted. |
| extensions/apps/vercel/src/provider.rs | Vercel Deploy Hooks accept a deployment request; they do not prove deployment success. |
| extensions/budget-reserve.wat | Keep EUR 100 of the supplied budget unused. Inputs are integer cents. |
| extensions/company-limit.wat | Independent app entry; see extensions/README.md for its public contract. |
| extensions/minimum-order.wat | Business orders must reach EUR 50 and stay inside the supplied budget. |
| extensions/sdk/analytics.d.ts | Independent app entry; see extensions/README.md for its public contract. |
| extensions/sdk/analytics.js | Consent-bound GA4 adapter for native and headless storefronts. Never send customer identities. |
| extensions/sdk/browser.js | Guest SDK: no merchant tokens or raw host API access; the host rechecks every action. |
| extensions/sdk/events.py | Language-neutral wire contract example: validate full batches and public HMAC envelopes before effects. |
| extensions/sdk/rust-events.rs | Language-neutral public event-signature contract for independent Rust app services; no commerce implementation. |
| extensions/sdk/ui_bundle.py | Build self-contained vanilla example UIs from the shared SDK; no remote imports at runtime. |
| extensions/sdk/wit/snapshot-price.component.wat | Typed fixture: calls the real host cart snapshot and returns one percent of its subtotal. |
| extensions/services/connectors/src/actions.rs | Existing standard-app actions and event/export endpoints share validated tenant-bound dispatch. |
| extensions/services/connectors/src/crypto.rs | Authenticated encryption binds config, OAuth verifiers, messages and receipts to tenant and app. |
| extensions/services/connectors/src/error.rs | Sanitized failures distinguish explicit rejection from ambiguous external side effects. |
| extensions/services/connectors/src/events.rs | One bounded event envelope feeds existing durable, idempotent connector queues; no parallel scheduler. |
| extensions/services/connectors/src/exports.rs | Tenant-scoped encrypted knowledge records and bounded monotonic exports preserve importer fences. |
| extensions/services/connectors/src/integrations/settings.rs | Existing encrypted connector configuration remains the single provider credential owner. |
| extensions/services/connectors/src/integrations.rs | API-key app hosting reuses encrypted connector settings, durable jobs and live configuration fences. |
| extensions/services/connectors/src/legacy.rs | Explicit offline SQLite export import: all records are rebound/encrypted atomically; ambiguous jobs stay uncertain. |
| extensions/services/connectors/src/mod.rs | Language-neutral app HTTP contract backed by a Rust-only standard connector runtime. |
| extensions/services/connectors/src/network.rs | Fixed provider endpoints, no redirects, bounded response streaming and loopback-only fixture overrides. |
| extensions/services/connectors/src/oauth.rs | Single-use tenant/app-bound OAuth state, PKCE, encrypted tokens and serialized refresh/disconnect. |
| extensions/services/connectors/src/providers.rs | Provider-specific read imports and notification mapping stay outside the commerce kernel. |
| extensions/services/connectors/src/queue.rs | Atomic idempotent enqueue, fair tenant admission and lease-fenced SKIP LOCKED claims for many workers. |
| extensions/services/connectors/src/server.rs | Authenticated bounded app HTTP service with private OAuth callback and graceful worker lifetime. |
| extensions/services/connectors/src/store.rs | PostgreSQL transactions carry local RLS context; config mutation serializes with in-flight delivery. |
| extensions/services/connectors/src/tests.rs | Actual Rust parsers, encryption and template consumers reject escalation/injection and preserve language behavior. |
| extensions/services/connectors/src/worker.rs | Distributed delivery workers fence settings and leases, retry only proven rejection, and drain on shutdown. |
| extensions/services/connectors/tests/integration_contracts.rs | Provider projections reject arbitrary endpoints and preserve asynchronous acceptance semantics. |
| extensions/services/connectors/tests/integrations.py | Actual provider requests and native action admission using the existing Rust multi-worker fixture. |
| extensions/single-order-cap.wat | Limit any individual business purchase to EUR 250, within its budget. |
Verification tools and fixtures
| Module | Responsibility |
|---|---|
| scripts/account_security.py | Native personal MFA acceptance through HTTP/PostgreSQL; synthetic accounts only, no external services. |
| scripts/admin_creation.py | Native Admin customer/manual-order HTTP+MCP state, isolation, replay and private token regressions. No provider calls. |
| scripts/agent_authorities.py | Real HTTP/PostgreSQL agent-key allocations, two replicas, stop, revocation and restart; local model only. |
| scripts/agentic_commerce.py | Real UCP cart transfer into native checkout: scoped single-use capability and one durable order. |
| scripts/agentic_scenarios.py | Customer agents use the native isolated shop, cart and checkout; only inference is synthetic. |
| scripts/api_catalogue.py | Generate a drift-checked static HTTP route catalogue from the compiled Rust router declarations. |
| scripts/app_assets.py | Actual native scoped file upload, callback read, product/digest/key fences and public-file policy. |
| scripts/app_assistants.py | Real assistant packages: editor context, rights, MCP opt-out, cron, signed webhooks, flows and local service fixtures. |
| scripts/app_callbacks.py | Real app identity, separate PII consent, digest/creator fences and foreign-object tests. No paid services. |
| scripts/app_components.py | Real typed WIT host reads, all four quote hooks and checkout persistence/CAS/tenant negative cases. |
| scripts/app_consent.py | Installation/upgrade consent uses the actual reviewed digest and full permissions; no fixture auto-consent. |
| scripts/app_core_extensions.py | Native app field API/MCP/UI contracts, current rights, fixed storage and selective sandbox release. Synthetic local data only. |
| scripts/app_distribution.py | Real signed publisher packages exercise canonical CLI signing, consent, dependency update/deactivation and tenant containment. |
| scripts/app_events.py | Actual leased delivery: slow-service isolation, bounded batches, minimization, filter/replay and stale lease fencing. |
| scripts/app_export.py | Actual independent export app receives leased events, reads scoped products, uploads a private artifact and completes durable jobs. |
| scripts/app_generation.py | Native AI proposal contract with local model HTTP, real Rust/SQL and no paid model calls. |
| scripts/app_inference.py | Opt-in real local model proposes a registered app operation; approval exercises the same managed writer. |
| scripts/app_jobs.py | Real long-action identity/idempotency/lease/CAS/tenant/quota checks, without external or paid effects. |
| scripts/app_ontology.py | Real native graph mapping contract through two-tenant API, MCP, permissions, references and revisions. |
| scripts/app_preview.py | F5 uses actual native APIs in a personal clone; no version publication, foreign-team access or release. Synthetic only. |
| scripts/app_relations.py | Real composite-FK multi-relations: per-tenant schemas, atomic quotas/revisions, hostile references and cyclic staging clone. |
| scripts/app_schema.py | Real installed-schema evolution, recovery snapshots, rollback on bad conversions and isolation of equal app IDs. |
| scripts/app_secrets.py | Encrypted tenant/app credentials and real incoming webhooks under strict non-owner RLS; synthetic local service only. |
| scripts/app_shared_storage.py | Actual app APIs prove fixed physical storage, concurrent uniqueness, scoped filters and private preview cleanup. |
| scripts/app_storage_migration.py | Replay original 001–100 SQL, then verify populated inactive/preview cyclic app tables consolidate losslessly and atomically. |
| scripts/app_studio.py | Native App Studio exercised through real HTTP/PostgreSQL: shared IR, version isolation, data, routes, MCP and selective release. |
| scripts/app_surfaces.py | Actual app UI registry/API/MCP/data/staging and slow-service isolation against Rust/PostgreSQL. |
| scripts/apps.py | Real PostgreSQL app lifecycle, managed schema/RLS, typed API/MCP, cart and observation tests. |
| scripts/automation.py | Real HTTP/PostgreSQL branching automation, private facts, durable delays and revoked-actor regressions. No providers. |
| scripts/automation_differential.py | Compare actual original Shopware rule classes with native scopes using independent synthetic entities. |
| scripts/automation_lifecycle.py | Tenant-bound default configuration, revision-safe deletion and actual event-flow effects. |
| scripts/automation_registry.py | Rebuild the native rule catalog from pinned PHP reflection and explicitly reviewed scope bindings. |
| scripts/b2b.py | Native company procurement with real isolated PostgreSQL: approval, budgets, catalogs and shared checkout. |
| scripts/b2b_ucp.py | Real UCP -> native B2B RFQ -> merchant counteroffer -> separate approval -> one durable order. |
| scripts/behavior_intelligence.py | Real native event, consent, order, graph, MCP and tenant/PII regression; synthetic buyers only. |
| scripts/benchmark.py | Reproducible local HTTP + PostgreSQL benchmark, with response validation. |
| scripts/branding.py | Keep the public Veyndo identity, shared vector assets and executable package/deployment paths consistent. |
| scripts/browser_sessions.py | Real HTTP personal-cookie transport, current ledger, origin/CSRF/session fences and legacy bearer compatibility. |
| scripts/build_app_ui.py | Export deterministic example HTML and its operator uiDigests entry; never fetch remote resources. |
| scripts/build_site.py | Build marketing pages and the complete Markdown documentation for GitHub Pages. |
| scripts/business_capability.py | Run the app-owned furniture purchasing workflow through the registered HTTP suite. |
| scripts/catalog_management.py | Real HTTP/PostgreSQL catalog creation, categories, multilingual editor, visibility and staging regressions. Synthetic isolated shops only. |
| scripts/channel_management.py | Isolated HTTP regressions for revisioned channels, domain aliases and session-bound private previews; no providers. |
| scripts/check_site.py | Check the generated documentation's links and discovery metadata. |
| scripts/checkout_handoff.py | Exercise actual PostgreSQL checkout transfer, isolation, replay and durable ordering. |
| scripts/checkout_review.py | Real SQL checkout rejects unreviewed changes without orders or stock writes; synthetic fixture only. |
| scripts/cloud_benchmark.py | Bounded private-cloud HTTP load using the existing validated benchmark sampler. |
| scripts/cognitive_experiments.py | Real native consent/layout/payment paths with synthetic live-receipt fixtures, not a measured commerce experiment. |
| scripts/commerce.py | Real HTTP/PG tests for SKUs, moderated reviews, tax/shipping/payment and deliveries. |
| scripts/company_settings.py | Real HTTP company basis/channel inheritance, immutable issuer snapshots, bounded logos and private staging. No external services. |
| scripts/connected_apps.py | Registered connected-app suite: archived OAuth oracle to real Rust knowledge, MCP and Flow consumers. |
| scripts/connector_store_tests.py | Concurrent private state, settings/import fences and encrypted mailbox persistence. |
| scripts/connectors.py | Start the local connector apps with private generated keys; preserve all existing app services. |
| scripts/contention.py | Sell the remaining workshop desks under contention; separate synthetic tenant. |
| scripts/context_differential.py | Compare bounded context/tier/quantity ports with original Shopware methods. |
| scripts/crm_history.py | Real CRM groups/defaults, transaction-coalesced history, validated restore, tenant/role/MCP isolation. |
| scripts/currencies.py | Real tenant/channel multi-currency, precision, immutable order and durable fixed-price tests; no paid providers. |
| scripts/customer_accounts.py | Real registration/address/login/checkout lifecycle, ownership, CAS and immutable financial snapshots. |
| scripts/delivery_differential.py | Compare the original PercentageTaxRuleBuilder with the live Rust port. |
| scripts/demo/fixtures.py | Four-language, provider-free commerce playground definitions; no credentials or real customer data. |
| scripts/developer_documents.py | Local model wire fixtures verify app generation, provenance and document privacy, without paid providers. |
| scripts/differential.py | Independent PHP/Rust differential; fails on any money delta, not averaged error. |
| scripts/durable_agents.py | Actual HTTP/PostgreSQL task continuation, killed Rust workers, current rights and no unapproved mutations; synthetic model only. |
| scripts/edi.py | Registered EDI entry delegates app behavior and fixtures to the plugin owner. |
| scripts/email_tests.py | Registered mail suite: archived differential contracts and the real Rust order/mail journey. |
| scripts/erp_handoff.py | Registered integration entry delegates reference-app behavior to its package-owned verification. |
| scripts/extensions.py | Activate actual Wasm policies and prove their effect on B2B checkout. |
| scripts/fashion_demo.py | Actual default signup, fashion variants/media/localization, isolated checkout and restart; synthetic data only. |
| scripts/formal/axioms.py | Audit owned proof sources and transitive Lean dependencies; no extra axioms are allowed. |
| scripts/formal/conformance.py | Compare compiled Rust production policies with Lean's extracted executable, |
| scripts/formal/extract.py | Fail-closed typed Rust-to-Lean extraction. Trusted boundary: this translator, |
| scripts/formal/layout.py | Keep domain proof imports, theorem inventory and module sizes closed and reviewable. |
| scripts/formal/layout_tests.py | Negative controls for missing claims and Rust facade escapes without editing the real source tree. |
| scripts/formal/modules.py | Explicit production policy modules; no dynamic Rust module resolution is trusted. |
| scripts/formal/mutations.py | Prove the verification gate rejects representative broken policies and stale/disconnected source bindings. |
| scripts/formal/registry.py | Explicit full-source inventory and reviewed adapter locks, not proof coverage claims. |
| scripts/formal/runners.py | Generate conformance drivers from parsed policy signatures, never a second policy implementation. |
| scripts/formal.py | Run extraction, Lean proofs/axiom audit, compiled conformance and complete source-inventory checks. |
| scripts/github_traffic.py | Save one private GitHub snapshot; overlapping traffic windows are never summed. |
| scripts/grid_directory.py | Real native directories and read-only model planning in an isolated PostgreSQL database and loopback provider. |
| scripts/hosting_check.py | Check a deployed experimental SaaS HTTPS origin without credentials or real orders. |
| scripts/hosting_container.py | Smoke-test the built deployment image against an isolated database on the local Compose network. |
| scripts/identity_broker.py | Synthetic broker signatures, durable replay prevention, scoped frontend routing and private Studio handoff; no provider calls. |
| scripts/image_jobs.py | Real image jobs/bytes against a local Images fixture: private review, stale/tenant guards, edit multipart and no paid calls. |
| scripts/integration.py | Exercise the real HTTP -> Rust -> PostgreSQL path. Never contacts a PSP. |
| scripts/intelligence.py | Actual SQL knowledge persistence and optional live local inference integration. |
| scripts/international_commerce.py | International configuration at the real HTTP/PostgreSQL path; all rates and addresses are synthetic fixtures, not tax advice. |
| scripts/knowledge_workspace.py | Actual tenant-scoped knowledge lifecycle, multilingual retrieval, cursor census and selective staging; no model calls. |
| scripts/legal_privacy.py | Real tenant-scoped consent, checkout guards, declarations, MCP and flow consumers; no external providers. |
| scripts/lexical_search.py | Native lexical candidates: real forced-RLS plans, backfill, source edits and isolation. |
| scripts/load.py | Local HTTP latency sample. Does not claim production or Shopware speedup. |
| scripts/managed_search.py | Real PostgreSQL/Qdrant synchronization; synthetic embeddings test transport, not AI quality. |
| scripts/marketing_accounts.py | Real isolated shops: customer authority, limited coupons, event flows, channels and selected releases. No paid models. |
| scripts/marketplaces.py | Registered verification entry; marketplace fixture and assertions remain app-owned. |
| scripts/mcp_stdio.py | Line-delimited MCP stdio bridge for Claude Desktop and other local clients. |
| scripts/merchant_operations.py | Real HTTP/PostgreSQL CRM, receipt, scoped-access and paid-download regressions. No PSP traffic. |
| scripts/merchant_reports.py | Native report aggregation over real checkout/POS/consent flows plus isolated historical fixtures; no external providers. |
| scripts/migrate_connector_state.py | Explicit offline legacy-state migration; decrypted data crosses stdin only, never logs or temporary files. |
| scripts/migration_assistant.py | Registered migration verification; provider fixtures and runtime code remain under the app package. |
| scripts/money_boundary_differential.py | Gate the exact checkout boundary using totals from original Shopware calculators, never a PHP rewrite. |
| scripts/native_lifecycles.py | Native accepted app lifecycles through real HTTP/PostgreSQL/MCP and selected release. Synthetic shops only. |
| scripts/outbox_subscribers.py | Real SQL failure/row-lock isolation, quarantine, explicit retry and cold worker continuation for native outbox cursors. |
| scripts/payment_providers.py | Provider-neutral financial ledger through real HTTP/PostgreSQL and a local private-service fixture. |
| scripts/payments.py | PayPal wire-contract and real Rust/PostgreSQL state tests. Local fixture, never real provider traffic. |
| scripts/platform.py | Real PostgreSQL/HTTP operator control-plane regression; synthetic accounts only, no paid providers. |
| scripts/platform_admin.py | Grant/revoke an existing personal operator offline. Credentials remain in environment; no signup can grant this role. |
| scripts/platform_control.py | Control-plane regressions on the real HTTP/database path; disposable synthetic shops and local model wire fixtures only. |
| scripts/platform_setup.py | Isolated production-mode bootstrap test. Creates/drops only a uniquely named synthetic database. |
| scripts/playground.py | Create an isolated local shop through personal-owner APIs; reruns preserve merchant edits and never call providers. |
| scripts/port.py | Named, reviewable port gates; never marks an untested unit as complete. |
| scripts/pos.py | Real isolated PostgreSQL/HTTP POS sales reuse catalog, checkout, receipts, events and permissions; no PSP or mail calls. |
| scripts/prepare_host.py | Prepare private first-host configuration; no server purchase, SSH, deployment or secret logging. |
| scripts/prepare_vercel.py | Render same-origin Vercel API proxy configuration; no credentials, deployments or account changes. |
| scripts/product_lab.py | Local full-app example lifecycle; private keys and independent code/data, no automatic installation. |
| scripts/product_models.py | Real native product GLB upload, variant materials, isolated preview, CAS, channel admission and selected release. |
| scripts/production_foundations.py | Strict non-owner PostgreSQL runtime, pool isolation, inventory and two-replica invalidation regressions. |
| scripts/protocols.py | Protocol flows exercise the same commerce core; model smoke test is opt-in. |
| scripts/providers.py | Cloud wire-contract tests using local HTTP servers, NOT live cloud inference. |
| scripts/read_performance.py | Two real Rust replicas test coherent read caches; optional matched local HTTP baseline probe. |
| scripts/restart.py | Persist an API snapshot, restart server+DB externally, verify exact state. |
| scripts/rule_catalog.py | Inventory original Shopware conditions without claiming unsupported scopes are implemented. |
| scripts/rule_differential.py | Execute original Shopware numeric comparisons, including epsilon, null and unsupported operator semantics. |
| scripts/rust_connectors.py | Actual Rust/PostgreSQL multi-process notification, OAuth/import and adversarial fixtures; no external accounts. |
| scripts/scalability.py | Real HTTP/PG regression for bounded reads and concurrent cart edits. |
| scripts/security/authenticated_scope.py | Adversarial SQL uses the actual tenant login, not SET ROLE on a privileged fixture session. |
| scripts/security/core_hardening.py | Real replica regressions for auth admission, poison-event isolation, retention and bounded resource leases. |
| scripts/security/tenant_schema.py | Database adversarial checks: reject cross-shop links even when API predicates are accidentally omitted. |
| scripts/security_route_gate.py | Every static commerce Admin API method must have an adjacent explicit permission; new routes fail closed. |
| scripts/services.py | Standalone app process, opaque UI SDK transport, own SQLite inbox and independent durable worker. |
| scripts/settings_scopes.py | Real tenant/channel settings, immutable order dependencies, localized gallery and selective staging regressions. |
| scripts/shipment_workflows.py | Real isolated PostgreSQL/HTTP package conservation, replay, current rights, customer projection and flow effects. |
| scripts/shipping_contract.py | Test-only carrier-neutral service: native jobs, package intent, documents and Flow; no external bookings. |
| scripts/signed_pooler.py | Two authenticated roles, each through a real one-backend transaction pooler. |
| scripts/signed_runtime.py | Repeat the real two-replica runtime path with separately authenticated tenant/system SQL roles. |
| scripts/site_markdown.py | Render every tracked Markdown document with repository-aware links and search. |
| scripts/site_navigation.py | Curated reading paths and shared document navigation; Markdown remains authoritative. |
| scripts/staging.py | Real PG proof: private sandbox, immutable app versions, selective release and conflicts. No paid inference. |
| scripts/startup_recovery.py | An actual Core startup survives a briefly unreachable isolated PostgreSQL endpoint. |
| scripts/storefront_urls.py | Real HTTP product deep links and host isolation in disposable shops. |
| scripts/structure.py | Guard the documented Rust domain split and public extension examples. |
| scripts/studio.py | Actual Studio API, localization and original-kernel consumer checks. |
| scripts/tenant_isolation.py | Adversarial two-shop API/MCP/UCP/object and schema isolation with real personal/customer sessions. |
| scripts/testing/advisor_privacy.py | Concurrent privacy mutations across the real concierge/provider path; no live inference. |
| scripts/testing/advisor_sources.py | Actual channel-admitted advisor context and concurrent native source mutations; synthetic local model only. |
| scripts/testing/agent_flow_work.py | Native product event -> Flow proposal -> personal approval -> original durable work executor. |
| scripts/testing/agent_work.py | An actual reviewed model plan writes two private records once through the native task worker. |
| scripts/testing/agent_work_restart.py | Kill the actual approved-work Rust worker during its second managed save; checkpoint and record commit together. |
| scripts/testing/agent_work_template.py | Repeat completed native work through real outbox/Flow/approval owners; source evidence stays private. |
| scripts/testing/app_approval.py | Use the Rust manifest serializer for operator pins; never invent a second canonical digest. |
| scripts/testing/app_discovery.py | Exercise real app discovery beyond an alphabetical sample and enforce read-only native dispatch. |
| scripts/testing/b2b_checkout_race.py | Force the real customer-share/unit-update checkout interleaving; no business handler is mocked. |
| scripts/testing/catalog_intake_checks.py | Native catalogue intake through HTTP/MCP; real stage saves, exact replay, current rights and selected release, no model calls. |
| scripts/testing/catalog_preparation_checks.py | Durable preparation projection through the native catalogue API/MCP; fixture SQL creates an explicit failed provider result only. |
| scripts/testing/ci_gate.py | Fail-closed required CI result and same-source coverage transfer between runners. |
| scripts/testing/ci_scope.py | Choose prototype CI by the complete Git diff; unknown or sensitive changes retain full verification. |
| scripts/testing/collection_work.py | Exercise one reviewed collection task through native categories, pages and durable translation drafts. |
| scripts/testing/connected_contracts/init.py | OAuth, private retrieval and Slack-flow regression modules using local provider fixtures. |
| scripts/testing/connected_contracts/access.py | OAuth/PKCE, encrypted tenant binding, revision fences, channel tracking and read-only access. |
| scripts/testing/connected_contracts/client.py | Consent-aware native test API and scoped app actions; shared polling and result reporting. |
| scripts/testing/connected_contracts/flows.py | Native order/app events through guarded durable Slack flows, retries and restart uncertainty. |
| scripts/testing/connected_contracts/runtime.py | Lifetime of the archived connector oracle, local providers and real Rust commerce process. |
| scripts/testing/connected_contracts/sources.py | Private Gmail/GA4 import, native graph/MCP/model consumption, refresh and disconnect cleanup. |
| scripts/testing/connected_contracts/wire.py | Synthetic Google, Gmail, Slack and model HTTP responses, including retry and history failures. |
| scripts/testing/consistency_boundaries.py | Real transport/permission regressions for knowledge publication and automation discovery. |
| scripts/testing/copilot_navigation.py | Native planner presentation cannot navigate outside the current tenant or bypass domain rights. |
| scripts/testing/coverage_env.py | Convert trusted cargo-llvm-cov environment output to GitHub's environment-file syntax. |
| scripts/testing/coverage_report.py | Publish separate all-source coverage totals, untested files and enforce reviewed minimums. |
| scripts/testing/database.py | Use the same PostgreSQL fixtures through Docker or an explicitly selected native psql executable. |
| scripts/testing/documentation_hygiene.py | Keep the README an entrance, status canonical, and scoped instructions bounded; negative controls reject former regressions. |
| scripts/testing/extraction.py | Native document-event extraction, review boundary and shared AI quotas; local provider only. |
| scripts/testing/hosted_migration.py | Real pre-055 SQL database upgrades through the native migrator; never rewind one ledger entry on a newer store. |
| scripts/testing/hotpath.py | Real HTTP wire bytes and SQL tracing checks for the existing read-performance suite. |
| scripts/testing/image_context.py | /Dockerfile')] |
| scripts/testing/integration_partitions.py | Disjoint outer integration partitions; nested production-rights repetitions stay intact. |
| scripts/testing/intent_navigation.py | Exercise saved fact categories through native catalog/MCP, source review and selective staging; no models. |
| scripts/testing/inventory_batch.py | Concurrent two-product allocation/release on the actual HTTP path, reused by strict runtime verification. |
| scripts/testing/legacy_customer_ownership.py | Historical guest snapshots never grant account ownership from an unverified email. |
| scripts/testing/mail_contracts/init.py | Mail protocol fixtures and archived/native contract scenarios; local test data only. |
| scripts/testing/mail_contracts/contracts.py | Archived email oracle contracts: protocols, revisions, secrecy, retries and multilingual envelopes. |
| scripts/testing/mail_contracts/fixtures.py | Shared disposable mail servers, synthetic CA and isolated archived connector settings. |
| scripts/testing/mail_contracts/journey.py | Native Rust checkout/outbox/Flow/MCP to Rust mail worker and loopback SMTP acceptance. |
| scripts/testing/mail_contracts/wire.py | Loopback SMTP/TLS and HTTP mail-provider fixtures plus consent-aware test requests. |
| scripts/testing/media_caption_checks.py | Actual caption proposal, ownership, locale persistence and selected page-release regressions; synthetic provider only. |
| scripts/testing/merchant_guidance.py | Explicit versioned merchant guidance reaches actual model input and is withdrawn by the native archive path. |
| scripts/testing/model_fixture.py | Original compact GLB furniture fixture with embedded geometry and two material variants; no external assets. |
| scripts/testing/native_lifecycle_race.py | Force native workflow editing against app installation at the real database boundary. |
| scripts/testing/native_tools.py | Synthetic provider-native wire responses shared by real HTTP integration fixtures; not a model implementation. |
| scripts/testing/operation_contracts.py | Generated native operation input contracts; do not edit. |
| scripts/testing/outbox_cases.py | Disposable real-transaction counterexamples for subscriber migration and commit-order gaps. |
| scripts/testing/parallel_check.py | Owned background verification process group; failures stay fatal and logs survive cleanup. |
| scripts/testing/partition_coverage.py | Transfer same-source raw LLVM/Python profiles; official collectors calculate coverage. |
| scripts/testing/payment_external_refunds.py | Admit provider-initiated refunds through actual HTTP/SQL; malicious receipts leave the ledger untouched. |
| scripts/testing/payment_multiple_captures.py | Adversarial provider-neutral capture snapshots must leave native finance unchanged on rejection. |
| scripts/testing/payment_snapshot.py | Force a committed provider receipt between POS cart admission and its status read. |
| scripts/testing/plugin_ownership.py | Keep app implementation in its package; preserve shared runtimes and exact safety boundaries. |
| scripts/testing/pooler.py | Owned real PgBouncer fixture: one backend, transaction pooling, never a forced privileged user. |
| scripts/testing/prompt_governance.py | Bind prompt versions and admission fixtures without claiming semantic model accuracy. |
| scripts/testing/provider_fleet.py | Configure one encrypted synthetic provider for all test workers, then restore the isolated control-plane row. |
| scripts/testing/reference_connector.py | Archived connector oracle imports for differential tests only; never a serving runtime. |
| scripts/testing/report_history.py | Synthetic historical report fixtures use the same explicit local PostgreSQL test bridge as other native suites. |
| scripts/testing/role_races.py | Force real HTTP delegation to wait behind the same PostgreSQL lifecycle lock as role edits. |
| scripts/testing/rule_history.py | Frozen comparison against real checkout/Flow snapshots; no current-data fallback or effects. |
| scripts/testing/runtime.py | Owned synthetic server lifetime, child checks and loopback readiness for verification. |
| scripts/testing/scenario_source.py | Native task ownership and applied-proposal admission for customer-test references. |
| scripts/testing/shop_setup_checks.py | Personal setup progression exercises the native HTTP/MCP workspace CAS and tenant boundaries. |
| scripts/testing/site_release.py | Actual selective publication resolves page dependencies atomically; no provider calls. |
| scripts/testing/sitecustomize.py | Opt-in subprocess instrumentation for synthetic verification; never loaded by production. |
| scripts/testing/source_inventory.py | Generate/check exact production and verification module inventory; listings are not coverage. |
| scripts/testing/test_ci_gate.py | Negative controls for required-job admission and transferred coverage evidence. |
| scripts/testing/test_ci_scope.py | CI routing regressions exercise real Git renames, missing history and sensitive mixed changes. |
| scripts/testing/test_integration_partitions.py | Prove complete, disjoint outer-suite admission before parallel CI can pass. |
| scripts/testing/test_parallel_check.py | Exercise actual parallel child overlap, failure propagation, owned cleanup and fixture isolation. |
| scripts/testing/test_partition_coverage.py | Reject incomplete, stale or modified partition profiles before combining coverage. |
| scripts/testing/tooling_tests.py | Ordered Studio layout. |
| scripts/testing/workspace_boundaries.py | Enforce reviewed Cargo owners and dependency capabilities, including aliases and unnamed helper crates. |
| scripts/testing/workspace_boundary_tests.py | Mutation controls against real Cargo metadata: aliases, hidden helpers, build scripts and source-owner escapes. |
| scripts/testing/workspace_composition.py | Current-role and foreign-shop admission through the real merchant planner and directory. |
| scripts/transaction_pooler.py | Repeat the real strict-runtime and multi-replica regressions through a one-backend transaction pooler. |
| scripts/translations.py | Durable translation jobs against a local provider fixture, real SQL, native MCP and a cold restart; no paid calls. |
| scripts/users.py | Real multi-user, workspace isolation and role/revocation regression tests. |
| scripts/verify_integration.py | Single integration suite registry, isolated DB by default; never alters an existing shop. |
| scripts/visual_workspace.py | Actual Rust/PostgreSQL workspace, page publication, form privacy and reviewed AI paths; synthetic model only. |
| scripts/workspace_roles.py | Real HTTP/PostgreSQL role edits, current session/key/worker grants and native B2B setup regressions. |