src/operations

This folder owns the Rust modules listed below. Each source begins with its responsibility contract. The crate currently shares internal types/imports through a facade; APIs, MCP and UCP delegate to shared domain operations.

addresses.rs: Merchant/MCP address operations use identical customer ownership and revision checks to the Store API.
company_logo.rs: Tenant-owned logo uploads: bounded decoding, metadata stripping, immutable PNG storage and linked public delivery.
company_model.rs: Company profile admission, sparse channel inheritance and structured-address print projection.
company_public.rs: Explicit public legal/brand projection; bank account, domestic tax ID and unlinked uploads remain private.
customers.rs: Tenant-scoped paged CRM and revision-checked merchant changes; credentials never leave storage.
master_data.rs: Revisioned tenant company basis and sparse channel overrides, serialized with receipt issuance.
mod.rs: Merchant CRM and fulfillment APIs, shared verbatim with MCP operations capabilities.
orders.rs: Bounded order search, token-redacted detail and append-only operational notes.
receipt_pdf.rs: Minimal paginated PDF serializer with WinAnsi Helvetica; snapshot retains complete Unicode originals.
receipt_text.rs: Four-language document labels and authoritative snapshot-to-print projection.
receipts.rs: Idempotent immutable invoices/delivery notes with transactional per-shop number ranges.
workflow.rs: Revision-bound workflow configuration used by installed apps and selective sandbox releases.

The source inventory is checked in CI. The behavioral map identifies integration suites, and testing describes actual coverage and limits. Every file is limited to 320 lines; main.rs to 120.

Company profiles live in company_model.rs (admission/inheritance), master_data.rs (transactional scopes), company_logo.rs (immutable validated bytes) and company_public.rs (explicit public projection). receipts.rs consumes the same channel resolver. See company settings.

Customer saves accept configured group IDs under the checkout-settings lock, revoke sessions and expose immutable order identity. Validated customer history restoration preserves current identity/login/purchase metadata. See entity history.

Grid reads and model plans

list_criteria.rs owns bounded order/customer filters and allowlisted sort fields; order_list.rs binds values and stable tenant-local cursors. The default customer email path preserves branch limits; additional sorts share the native contact union. grid_schema.rs owns supported HTTP/MCP/model field metadata and admission. grid_plan.rs uses central inference/leases and emits read-only suggestions with current assistant/domain/PII admission. No model SQL or alternate ledger is accepted. See the grid contract.