English source · 4 min

src/apps

This folder owns the Rust modules listed below. Each source begins with its responsibility contract. The crate currently shares internal types/imports through a facade; APIs, MCP and UCP delegate to shared domain operations.

• cart_contributions.rs: Generic app contributions: configure a cart, bind package/data revisions and persist audited pricing inputs.
• compatibility.rs: Explicit read adapter for persisted v0.5 engraving carts; completed order snapshots remain unchanged.
• data.rs: Shared app records: typed writes, optimistic revisions, bounded reads and local RLS context.
• editor_contract.rs: Editor mounts, enumerated fields and tenant-owned core references; no app alters core tables.
• editor_tests.rs: Assistant fixture contracts exercise real validation, not only the client-side builder.
• events.rs: Durable at-least-once app events, retry leases and stable event idempotency keys.
• evidence.rs: Private provenance-bearing app exports feed merchant retrieval and durable app events; never public PDP answers.
• evidence_routes.rs: Scoped merchant-only evidence retrieval; sources never enter public product answers.
• gateway.rs: One permission-aware action gateway serves HTTP, UI and MCP; service egress is operator configured.
• service_policy.rs: Exact operator-owned transport admission; the extracted predicate rejects unsafe URLs and unapproved HTTP origins.
• manifest.rs: Strict package contract; identifiers and limits are checked before model registration.
• manifest_validation.rs: Package capability, schema and action validation; no executable behavior is inferred from names.
• mod.rs: Versioned app packages: managed data, UI slots, agent tools and isolated service calls.
• native_data.rs: App record translations use configured shop languages and field-level main-language inheritance.
• native_view_tests.rs: Native schema security regressions: bindings, public writes, allowlists, bounded blocks and legacy digests.
• native_views.rs: Bounded native view definitions; every data binding resolves to the same authorized app action gateway.
• planning.rs: Registered managed app actions join the same preview/approve transaction as core changes.
• presentation.rs: Optional passive app artwork and localized summaries; omitted metadata preserves published legacy digests.
• registry.rs: Atomic installation and additive schema upgrades; immutable version digests preserve history.
• records.rs: One fixed shared store with tenant/app/model identity, field projection, typed model registration and scoped preview resets; no per-installation DDL.
• routes.rs: Tenant-scoped package lifecycle, generated data endpoints and a shared action adapter.
• runtime.rs: Generic pure-Wasm contribution executor; the installed package supplies all business predicates.
• schedules.rs: Durable UTC cron ticks emit namespaced outbox events; replicas lock due rows and staging never runs them.
• service_limits.rs: Non-queuing per-process bulkheads isolate slow apps without holding database connections.
• surface_tests.rs: Contract counterexamples reject cross-scope UI actions, unsafe URLs and mutating GET routes.
• surfaces.rs: App-owned UI surfaces and namespaced HTTP routes reuse the authorized action gateway.
• webhooks.rs: Operator-signed incoming events: tenant-bound HMAC, five-minute freshness and atomic replay receipts.

The source inventory is checked in CI. The behavioral map identifies integration suites, and testing describes actual coverage and limits. Every file is limited to 320 lines; main.rs to 120.

• editor_contract.rs, editor_tests.rs: owned core references, context/choice/privacy validation and direct-route scope checks.
• schedules.rs: transactional UTC emit ticks, persistent clock receipts and private-stage exclusion.
• webhooks.rs: exact-byte HMAC verification, typed ingress and durable replay receipts.
• native_views.rs, native_data.rs, native_view_tests.rs: bounded native binding contracts, action handlers and validation cases.
• presentation.rs: declared artwork and local category fallbacks.

Guided app contracts.

• settings.rs: bounded, localized package setting declarations and live personal-administrator configuration. Values reuse secrets.rs authenticated encryption, digest/CAS fence and metadata outbox. Secret values have no browser GET path; private approved service actions receive _appSettings server-side. No public settings exposure, sandbox credential copy or credential rollback.

• Installation admission now limits new package IDs to 128 per tenant and declared indexes to 64 per package. Existing-package updates remain possible at the package-count limit; tenant/app rows and byte quotas continue unchanged. These caps are not a production-scale benchmark.

• input_schema.rs, input_schema_tests.rs: bounded input/output schemas, nullable unions and escaped field pointers. This is an explicit subset, not a general JSON Schema engine.

• tool_contract.rs: current authorized app discovery through the shared native tool description and optional result validation. Result-contract failures do not undo an already performed effect and are not automatically retried.

• business_capability/: canonical localized merchant intent and bounded synthetic decision cases. Existing WIT isolation executes them before build/installation; no new executor, live-data reader, approval ledger or pricing implementation.

• upgrade_review.rs: Rollback-only actual installation admission and minimized migration metadata.