Panel, server routes, and delivery — without a black box.
A verifiable catalog of the technical surface: Studio capabilities, stable API v1, internal routes, SDK, integrations, operational topology, and delivery options.
Checked against the manifest and source · 2026-08-09
The UI, server logic, and background processes share domain contracts. This is not a set of screens or a shared SaaS: every buyer runs an isolated installation.
01Studio
Operations panel
Catalog, orders, requests, reviews, content, email, analytics, audit, and sessions.
02Gateway
API and integrations
Versioned /api/v1, OpenAPI 3.1, API keys, scopes, and a TypeScript SDK.
03Runtime
Background processing
Worker, outbox, retries, retention, health/readiness, and operational probes.
04Delivery
Delivery package
Source archive or image, migrations, Compose, runbooks, SDK, SBOM, and release documents as agreed in the contract.
02 / COMPLETE INVENTORY
Find a capability. Verify its contract.
Included means the capability ships in the self-hosted platform. Demo status means the same flow is available with synthetic data; the demo does not accept real data or money.
⌕
01
Panel capabilities
94
01Access, navigation and edit safetyTOTP access, localization, themes, responsive behavior, loading states, and unsaved-change protection.7 features
ACC-SHL-001
Studio navigation and workspace summaries
includedin demo
DetailsCollapse↓
Purpose
“Studio navigation and workspace summaries” completes one operation in “Access, navigation and edit safety” while keeping UI, server rules, and audit on the same contract.
Interface
Desktop navigation · Mobile drawer · Per-section counts
What changes
activeSection · sectionSummaries
Contract
GET workspace snapshot
How to verify it
All nine platform sections remain reachable and report counts from persisted state.
“Six-locale localization” completes one operation in “Access, navigation and edit safety” while keeping UI, server rules, and audit on the same contract.
Interface
Locale switcher · Localized dates, numbers and labels
What changes
locale
Contract
Localized errors and CSV headings
How to verify it
Every Studio label, error, audit value and export heading switches without reload loss.
Demo boundary
Locale changes never alter identity or authorization.
“Workspace load, refresh and retry” completes one operation in “Access, navigation and edit safety” while keeping UI, server rules, and audit on the same contract.
Interface
Loading · Load error · Retry · Refresh
What changes
workspace load state · request id · latency
Contract
GET /api/admin/catalog, /api/admin/content and /api/admin/operations
How to verify it
Retry and refresh recover without discarding a dirty draft silently.
“Dirty-state counters and discard protection” completes one operation in “Access, navigation and edit safety” while keeping UI, server rules, and audit on the same contract.
Interface
Dirty badges · Save all · Discard dialog · beforeunload guard
What changes
draft baselines · dirty record ids
Contract
The capability uses the section contract without a dedicated public endpoint.
How to verify it
Navigation, refresh and exit require confirmation whenever an unsaved draft exists.
Demo boundary
The guard is browser-local and reveals no persisted data.
“Token plus TOTP access” completes one operation in “Access, navigation and edit safety” while keeping UI, server rules, and audit on the same contract.
Interface
Demo access screen · Token and one-time-code walkthrough
What changes
sandbox access challenge · demo operator session
Contract
POST /api/admin/session · DELETE /api/admin/session
How to verify it
The walkthrough creates an isolated admin session and rate-limits failed attempts.
Demo boundary
The complete token plus one-time-code flow uses disclosed synthetic sandbox credentials. Production keeps the same flow but requires a private per-installation TOTP secret; the hosted demo never requests or accepts it.
“Responsive and accessible interaction system” completes one operation in “Access, navigation and edit safety” while keeping UI, server rules, and audit on the same contract.
“Server catalog filters, facets and pagination” completes one operation in “Catalog, SKUs and fulfillment” while keeping UI, server rules, and audit on the same contract.
Interface
Search · Status filter · Category filter · Brand filter · Load more
“Product CRUD and lifecycle status” completes one operation in “Catalog, SKUs and fulfillment” while keeping UI, server rules, and audit on the same contract.
Complete product identity and merchandising fields
includedin demo
DetailsCollapse↓
Purpose
“Complete product identity and merchandising fields” completes one operation in “Catalog, SKUs and fulfillment” while keeping UI, server rules, and audit on the same contract.
Interface
Full product card
What changes
categoryId · brandId · brand · name · description · priceValue · href · status · defaultVariantId
Contract
catalog.product.create · catalog.product.update · GET /api/admin/catalog/products/:id
How to verify it
Every platform product field round-trips and is represented in public catalog projection where appropriate.
Demo boundary
Links are validated as relative or allow-listed demo URLs.
“Product and catalog translations” completes one operation in “Catalog, SKUs and fulfillment” while keeping UI, server rules, and audit on the same contract.
“Product and variant images” completes one operation in “Catalog, SKUs and fulfillment” while keeping UI, server rules, and audit on the same contract.
Interface
Upload controls · Preview · Alt text · Gallery editor
“Shared product labels and legacy swatches” completes one operation in “Catalog, SKUs and fulfillment” while keeping UI, server rules, and audit on the same contract.
“Product-level universal attributes” completes one operation in “Catalog, SKUs and fulfillment” while keeping UI, server rules, and audit on the same contract.
Interface
Typed product attribute editor
What changes
product attribute values · immutable order snapshots
Contract
catalog.product.update · Catalog and order projections
How to verify it
Required and typed attributes validate and category changes retain only compatible values.
Demo boundary
Values are validated against the current category schema.
“Catalog validation and edit readiness” completes one operation in “Catalog, SKUs and fulfillment” while keeping UI, server rules, and audit on the same contract.
Interface
Inline errors · Readiness summary · Guided empty state
What changes
validation issues · dirty baselines
Contract
Structured validation errors
How to verify it
Client and server reject the same duplicate SKU, invalid schema, price, stock and reserve cases.
“Category CRUD and ordering” completes one operation in “Catalog, SKUs and fulfillment” while keeping UI, server rules, and audit on the same contract.
“Category attribute schemas and option libraries” completes one operation in “Catalog, SKUs and fulfillment” while keeping UI, server rules, and audit on the same contract.
“Storefront filter configuration” completes one operation in “Catalog, SKUs and fulfillment” while keeping UI, server rules, and audit on the same contract.
“Pickup locations, time slots and courier delivery” completes one operation in “Catalog, SKUs and fulfillment” while keeping UI, server rules, and audit on the same contract.
03Orders and fulfillment operationsReservation-aware statuses, search, archive, priorities, bulk actions, exports, and idempotent creation.10 features
ACC-ORD-001
Active and archived order flows
includedin demo
DetailsCollapse↓
Purpose
“Active and archived order flows” completes one operation in “Orders and fulfillment operations” while keeping UI, server rules, and audit on the same contract.
“Server order search, filters and cursor history” completes one operation in “Orders and fulfillment operations” while keeping UI, server rules, and audit on the same contract.
Interface
Query · Flow · Status · Load more
What changes
order filters · history cursor
Contract
GET /api/admin/operations/history?resource=orders
How to verify it
Stable cursor pages honor flow, status and query without duplicates.
“Inventory-aware order status transitions” completes one operation in “Orders and fulfillment operations” while keeping UI, server rules, and audit on the same contract.
Interface
Contextual transition actions
What changes
new · processing · completed · delivered · cancelled
The exact platform enum is accepted; new/processing reserve units, completed/delivered deduct stock and release reserve, cancelled releases reserve, and every inverse transition restores the corresponding inventory effect.
Demo boundary
A status change is atomic and fails with a structured conflict when its stock/reserve effect would violate an inventory invariant.
“Priority, deadline and support notes” completes one operation in “Orders and fulfillment operations” while keeping UI, server rules, and audit on the same contract.
“Complete customer and fulfillment details” completes one operation in “Orders and fulfillment operations” while keeping UI, server rules, and audit on the same contract.
“Order items and immutable attribute snapshots” completes one operation in “Orders and fulfillment operations” while keeping UI, server rules, and audit on the same contract.
Interface
Line-item list
What changes
order items · variant id · quantity · price · attribute snapshots
Contract
Order response
How to verify it
Changing a product schema after order creation does not change the order's displayed item attributes.
Demo boundary
Order snapshots contain only synthetic catalog data.
“Order summary and risk indicators” completes one operation in “Orders and fulfillment operations” while keeping UI, server rules, and audit on the same contract.
Interface
Command statistics · Urgent and overdue highlights
What changes
status/priority/deadline counts · visible revenue
Contract
The capability uses the section contract without a dedicated public endpoint.
How to verify it
Counts and revenue recalculate after every visible mutation.
“Server-filtered order export” completes one operation in “Orders and fulfillment operations” while keeping UI, server rules, and audit on the same contract.
Interface
CSV export
What changes
current order filters
Contract
POST /api/admin/operations/export
How to verify it
Export applies the same flow, status and query as the visible list and records an audit event.
“Idempotent API order creation and reservation” completes one operation in “Orders and fulfillment operations” while keeping UI, server rules, and audit on the same contract.
Interface
API Lab order example
What changes
idempotency record · order · variant reserve
Contract
POST /api/demo/v1/orders
How to verify it
A repeated key and identical body replays; a conflicting body fails; successful creation updates orders, stock reserve and audit.
Demo boundary
Only session-owned synthetic orders are created; no payment or notification leaves the sandbox.
04Subscriptions and customer requestsDouble opt-in, unsubscribe, request triage, bulk statuses, outbox-backed replies, and exports.8 features
ACC-COM-001
Newsletter subscription records
includedin demo
DetailsCollapse↓
Purpose
“Newsletter subscription records” completes one operation in “Subscriptions and customer requests” while keeping UI, server rules, and audit on the same contract.
Interface
Subscription list and detail
What changes
contact identity · source · status · consent and confirmation timestamps
Contract
contact.update · GET/PATCH /api/admin/operations
How to verify it
Pending, confirmed and unsubscribed states preserve consent and lifecycle metadata.
“Feedback request records” completes one operation in “Subscriptions and customer requests” while keeping UI, server rules, and audit on the same contract.
“Contact search, filters and cursor history” completes one operation in “Subscriptions and customer requests” while keeping UI, server rules, and audit on the same contract.
Interface
Search · Status · Load more
What changes
section/status/query filters · history cursor
Contract
GET /api/admin/operations/history?resource=contactRequests
How to verify it
Newsletter and feedback history pages remain separate and stable under concurrent status updates.
“Single and bulk contact status actions” completes one operation in “Subscriptions and customer requests” while keeping UI, server rules, and audit on the same contract.
Interface
Select shown · Take in work · Return to new · Archive/unsubscribe
“Confirmed subscribers and feedback CSV exports” completes one operation in “Subscriptions and customer requests” while keeping UI, server rules, and audit on the same contract.
Interface
Export confirmed · Export feedback
What changes
current contact filters
Contract
POST /api/admin/operations/export
How to verify it
Newsletter export includes confirmed recipients only; feedback export honors current filters.
Demo boundary
Exports are rate-limited and contain reserved-domain addresses only.
“Idempotent feedback reply” completes one operation in “Subscriptions and customer requests” while keeping UI, server rules, and audit on the same contract.
Interface
Subject · Message · Queue feedback
What changes
reply subject · reply body · idempotency record · outbox item
Contract
contact.reply · POST /api/admin/operations
How to verify it
A replay returns the same outbox item and does not duplicate it; successful reply marks the request processed.
Demo boundary
Reply is rendered and queued internally but never delivered externally.
“Double opt-in and unsubscribe effects” completes one operation in “Subscriptions and customer requests” while keeping UI, server rules, and audit on the same contract.
“Durable reply outbox state” completes one operation in “Subscriptions and customer requests” while keeping UI, server rules, and audit on the same contract.
“Review search, status filters and cursor history” completes one operation in “Reviews and moderation” while keeping UI, server rules, and audit on the same contract.
Interface
Search · Type · Status · Load more
What changes
type/status/query filters · history cursor
Contract
GET /api/admin/operations/history?resource=reviews
How to verify it
History is stable and totals reflect all matching synthetic reviews.
“Review readiness and summary metrics” completes one operation in “Reviews and moderation” while keeping UI, server rules, and audit on the same contract.
Interface
Readiness pills · Character count · Summary cards
What changes
quality result · status/type/photo/rating counts
Contract
The capability uses the section contract without a dedicated public endpoint.
How to verify it
Readiness and all summary counts update as drafts and saved reviews change.
“Moderation and bulk review actions” completes one operation in “Reviews and moderation” while keeping UI, server rules, and audit on the same contract.
06Content and marketing placementsStructured text, placements, CTAs, media, batch saves, and published-only delivery.8 features
ACC-CNT-001
Public content groups and scopes
includedin demo
DetailsCollapse↓
Purpose
“Public content groups and scopes” completes one operation in “Content and marketing placements” while keeping UI, server rules, and audit on the same contract.
“Content search and filters” completes one operation in “Content and marketing placements” while keeping UI, server rules, and audit on the same contract.
Interface
Search · Group/scope · Status · Reset
What changes
query · scope · status
Contract
GET /api/admin/content
How to verify it
Counts and visible text/marketing rows honor all active filters.
“Text entry CRUD and positioning” completes one operation in “Content and marketing placements” while keeping UI, server rules, and audit on the same contract.
“Atomic text batch save and dirty overview” completes one operation in “Content and marketing placements” while keeping UI, server rules, and audit on the same contract.
Interface
Dirty count · Save texts · Content quality overview
Marketing placement, variant, layout and CTA fields
includedin demo
DetailsCollapse↓
Purpose
“Marketing placement, variant, layout and CTA fields” completes one operation in “Content and marketing placements” while keeping UI, server rules, and audit on the same contract.
“Marketing batch save and media upload” completes one operation in “Content and marketing placements” while keeping UI, server rules, and audit on the same contract.
“Published-only public content projection” completes one operation in “Content and marketing placements” while keeping UI, server rules, and audit on the same contract.
Interface
API Lab content response
What changes
content and marketing status
Contract
GET /api/demo/v1/content
How to verify it
Public content returns published text and marketing only and supports scope filtering.
Demo boundary
Draft and archived values never leave the admin projection.
07Email campaigns and outboxSMTP diagnostics, audiences, safe previews, idempotent enqueue, worker processing, and attempt history.12 features
ACC-EML-001
Email configuration diagnostics
includedin demo
DetailsCollapse↓
Purpose
“Email configuration diagnostics” completes one operation in “Email campaigns and outbox” while keeping UI, server rules, and audit on the same contract.
Interface
Four diagnostics cards
What changes
notifications/configuration/from/admin recipient/HELO/TLS state
Contract
GET operations snapshot
How to verify it
Diagnostics explain why campaign enqueue is enabled or disabled without exposing secrets.
Demo boundary
Only normalized sandbox configuration is exposed; no credentials or raw transport errors.
“Subscriber and customer audience search” completes one operation in “Email campaigns and outbox” while keeping UI, server rules, and audit on the same contract.
Interface
Audience switch · Search · Pagination
What changes
audience · recipient search · recipient page
Contract
GET /api/admin/email-campaigns
How to verify it
Search totals and pages are stable for subscribers and customers separately.
“Selected or all-recipient campaign mode” completes one operation in “Email campaigns and outbox” while keeping UI, server rules, and audit on the same contract.
Interface
Selected · All found · Select visible · 500 selection limit
What changes
selection mode · selected ids · audience snapshot
Contract
email.campaign.enqueue · POST /api/admin/email-campaigns
How to verify it
Selected mode preserves exact IDs; all mode snapshots the matching audience at enqueue time.
Demo boundary
Recipient IDs are session-owned and addresses never leave the sandbox.
“Server-rendered email preview” completes one operation in “Email campaigns and outbox” while keeping UI, server rules, and audit on the same contract.
Interface
Desktop/mobile preview · Placeholder and readiness state
“Explicit audience confirmation” completes one operation in “Email campaigns and outbox” while keeping UI, server rules, and audit on the same contract.
Interface
Confirmation checkbox and recipient count
What changes
confirmed draft fingerprint
Contract
The capability uses the section contract without a dedicated public endpoint.
How to verify it
Changing content, audience or selection clears confirmation before enqueue.
Demo boundary
Confirmation is tied to the exact current draft and selection.
GET /api/admin/email-campaigns?mode=status · POST /api/admin/email-campaigns operation=process
How to verify it
Monitor displays persisted failure and retry metadata; retry resolves each campaign with exact independent counters, while a repeated terminal process is a mutation-free no-op.
Demo boundary
The first worker pass records a deterministic internal interruption; the visible retry reaches a terminal state without external delivery.
“Durable outbox history and retry presentation” completes one operation in “Email campaigns and outbox” while keeping UI, server rules, and audit on the same contract.
“Unsubscribe exclusion and worker behavior” completes one operation in “Email campaigns and outbox” while keeping UI, server rules, and audit on the same contract.
Campaign status projection · RFC one-click unsubscribe · Sandbox worker process
How to verify it
Recipients unsubscribed before retry become skipped, each campaign reaches an exact terminal state, and one campaign cannot consume another campaign's outbox rows.
Demo boundary
The deterministic worker changes only session-owned outbox records and never connects to SMTP.
08Sales and inventory analyticsSales metrics and trends, inventory, commercial breakdowns, readiness indicators, and exports.7 features
ACC-ANA-001
Sales and stock focus switch
includedin demo
DetailsCollapse↓
Purpose
“Sales and stock focus switch” completes one operation in “Sales and inventory analytics” while keeping UI, server rules, and audit on the same contract.
Interface
Sales/stock switch
What changes
analytics focus
Contract
The capability uses the section contract without a dedicated public endpoint.
How to verify it
Each focus renders its complete independent metric and chart set.
“Derived analytics integrity” completes one operation in “Sales and inventory analytics” while keeping UI, server rules, and audit on the same contract.
Interface
Live metrics
What changes
orders/products/content/reviews/subscriptions
Contract
Workspace snapshot
How to verify it
Every relevant mutation changes the affected selector and UI metric without manual synchronization.
Demo boundary
Analytics are calculated from current synthetic state and never hard-coded separately.
“Sales series and commercial breakdowns” completes one operation in “Sales and inventory analytics” while keeping UI, server rules, and audit on the same contract.
Interface
Sales chart and six breakdown panels
What changes
dated sales series · order/revenue status · fulfillment/payment · category revenue · top products
Contract
Analytics projection
How to verify it
Charts preserve labels, currency/count formatting and usable empty states.
Stock, content, review and subscription breakdowns
includedin demo
DetailsCollapse↓
Purpose
“Stock, content, review and subscription breakdowns” completes one operation in “Sales and inventory analytics” while keeping UI, server rules, and audit on the same contract.
Interface
Eight stock and readiness panels
What changes
category stock/value · variant status · availability/risk · content/review/subscription status
Contract
Analytics projection
How to verify it
Every platform breakdown is present, labeled and has a tested empty state.
Demo boundary
All breakdowns derive from the same session state.
“Sales, dynamics and stock exports” completes one operation in “Sales and inventory analytics” while keeping UI, server rules, and audit on the same contract.
09Audit and administrative sessionsTyped mutation logs, filters, pagination, session revocation, optimistic concurrency, and limits.8 features
ACC-AUD-001
Typed audit event for every mutation
includedin demo
DetailsCollapse↓
Purpose
“Typed audit event for every mutation” completes one operation in “Audit and administrative sessions” while keeping UI, server rules, and audit on the same contract.
Interface
Audit event list
What changes
action · entityType · entityId · actor · createdAt
Contract
Operations snapshot/history
How to verify it
Every state-changing command emits one typed event on success and none on rejection; read-only campaign preview remains unaudited.
Demo boundary
No credentials, raw mail bodies or upload bytes enter audit payloads.
“Structured bounded audit payload” completes one operation in “Audit and administrative sessions” while keeping UI, server rules, and audit on the same contract.
Interface
Localized payload detail
What changes
bounded before/after/domain metadata
Contract
Audit history
How to verify it
Payload schemaVersion, outcome, entity IDs, changed fields and bounded before/after summaries describe each meaningful successful change; rejected mutations emit no event.
Demo boundary
Sensitive and long-content fields are redacted into compact metadata and the serialized demo payload is hard-capped at 8 KiB.
“Audit query and entity filter” completes one operation in “Audit and administrative sessions” while keeping UI, server rules, and audit on the same contract.
Interface
Search · Object filter · Reset
What changes
query · entity type
Contract
GET /api/admin/operations/history?resource=auditEvents
How to verify it
Entity and query filters are server-compatible and totals remain accurate.
“Audit summary and cursor pagination” completes one operation in “Audit and administrative sessions” while keeping UI, server rules, and audit on the same contract.
Interface
Four summary cards · Entity insights · Load more
What changes
total/entity/latest summaries · history cursor
Contract
GET /api/admin/operations/history
How to verify it
Stable pages, totals, truncation state and latest-event card agree after mutations.
“Administrative session inventory” completes one operation in “Audit and administrative sessions” while keeping UI, server rules, and audit on the same contract.
“Revoke other or all administrative sessions” completes one operation in “Audit and administrative sessions” while keeping UI, server rules, and audit on the same contract.
Interface
Revoke others · Revoke all · Danger confirmation
What changes
active/revoked session state · independent HttpOnly access marker
Others preserves current access; all sets the deny marker; both emit redacted audit events; only the documented demo token plus TOTP restores access.
Demo boundary
Revoke all preserves the isolated workspace data but sets an independent HttpOnly deny marker, gates every admin route and redirects /demo to a fixed-credential re-entry screen.
“Optimistic concurrency and conflict recovery” completes one operation in “Audit and administrative sessions” while keeping UI, server rules, and audit on the same contract.
Interface
Conflict notice · Reload and retry
What changes
D1 workspace revision · domain drafts
Contract
D1 compare-and-swap revision and 409 envelope
How to verify it
A stale write cannot silently overwrite a newer value and the UI preserves the user's draft for retry.
“Origin, payload, rate and capacity controls” completes one operation in “Audit and administrative sessions” while keeping UI, server rules, and audit on the same contract.
Interface
Limit feedback
What changes
rate buckets · workspace mutation count · expiry
Contract
Exact-origin writes · Strict JSON · 429 and Retry-After
How to verify it
Cross-origin, oversized, malformed and over-budget requests fail before business mutation.
Demo boundary
Per-network and per-workspace budgets, TTL and cleanup prevent public abuse.
10Public API v1 and API LabOpenAPI 3.1, scoped API keys, a CORS allow-list, uniform errors, rate limits, and a TypeScript SDK.10 features
ACC-API-001
Discovery, health and OpenAPI 3.1
includedin demo
DetailsCollapse↓
Purpose
“Discovery, health and OpenAPI 3.1” completes one operation in “Public API v1 and API Lab” while keeping UI, server rules, and audit on the same contract.
Interface
API Lab links
What changes
API version and sandbox capability summary
Contract
GET /api/demo/v1 · GET /api/demo/v1/health · GET /api/demo/v1/openapi.json
How to verify it
Discovery links every route and OpenAPI exactly matches implemented methods, schemas and security.
Demo boundary
Health exposes no internal binding identifiers or migration versions.
“Scoped ephemeral API keys” completes one operation in “Public API v1 and API Lab” while keeping UI, server rules, and audit on the same contract.
Interface
API Lab key/scopes · Create/revoke/delete · One-time secret reveal
What changes
one-time API key secret · SHA-256 digest · id · scopes · lastUsedAt · revokedAt
Contract
Authorization Bearer · X-API-Key
How to verify it
A custom secret is returned once; missing, conflicting, cross-session, revoked and insufficient-scope keys fail closed without revealing key material.
Demo boundary
Custom keys are disposable, synthetic, session-bound, revocable and stored only as SHA-256 digests; the bundled tokens are public sandbox credentials with no production authority.
“Exact CORS allow-list and preflight” completes one operation in “Public API v1 and API Lab” while keeping UI, server rules, and audit on the same contract.
Interface
CORS example
What changes
demo CORS allow-list
Contract
OPTIONS and protected v1 responses
How to verify it
Only exact configured HTTPS demo origins receive matching CORS headers and Vary metadata.
Demo boundary
No wildcard or credentialed cross-origin access is allowed.
“Public idempotent order contract” completes one operation in “Public API v1 and API Lab” while keeping UI, server rules, and audit on the same contract.
Interface
Editable API Lab POST
What changes
order idempotency and reservation
Contract
POST /api/demo/v1/orders · DELETE /api/demo/v1/workspace
How to verify it
The customer order payload, API key scope and Idempotency-Key contract match platform v1; the hosted demo rejects real-like PII and can delete/reset either cookie or header workspaces.
Demo boundary
Only clearly synthetic contact data is accepted; no payment, mail, webhook or customer session is touched.
“Uniform errors, request and rate headers” completes one operation in “Public API v1 and API Lab” while keeping UI, server rules, and audit on the same contract.
“Real-network API Lab” completes one operation in “Public API v1 and API Lab” while keeping UI, server rules, and audit on the same contract.
Interface
GET resource/query editor · POST order body and Idempotency-Key editor · Bearer/X-API-Key switch · Run · Status/duration/request-id/rate-limit/body · Open created order in Studio
What changes
editable query/body/token/idempotency key · live response trace · created order handoff
Contract
GET catalog/content/search · POST orders · GET discovery/health/OpenAPI
How to verify it
Lab executes real same-origin requests; the order template comes from live catalog data, POST persists the canonical order, and its handoff opens the Studio Orders section.
Demo boundary
Endpoint selection is allow-listed; arbitrary external URLs cannot be requested.
“Dependency-free TypeScript SDK examples” completes one operation in “Public API v1 and API Lab” while keeping UI, server rules, and audit on the same contract.
Interface
Copyable typed examples
What changes
No domain state is mutated; verify a read model or system signal.
Contract
Kept aligned with the OpenAPI 3.1 contract and compile-tested
How to verify it
SDK examples compile and exercise catalog, content, search and idempotent order creation.
Demo boundary
Examples use the ephemeral demo key and reserved data.
POST/api/analytics/eventsIngest allow-listed first-party events after explicit consent without IP, User-Agent, or a full referrer.DetailsCollapse↓
Purpose
Ingest allow-listed first-party events after explicit consent without IP, User-Agent, or a full referrer.
Access and scope
Server surface for the optional storefront; enabled and adapted per project.
Parameters and body
There are no path parameters. Query/body fields remain an internal handler contract and are not part of stable OpenAPI v1.
Success response
Ingest allow-listed first-party events after explicit consent without IP, User-Agent, or a full referrer. The exact status/body is defined by the current release handler.
Errors
Failure statuses and error bodies may evolve with this internal surface; external clients should use /api/v1 or a dedicated adapter.
Important boundary
The inventory proves the path and methods exist without turning an internal endpoint into an external compatibility promise.
04Internal Studio surfaceNot an external API: requires an admin session and may evolve with the release UI.22 routes
GET/api/admin/analytics/trafficPrivacy-first traffic aggregates for 7, 30, or 90 days and the matching previous period.DetailsCollapse↓
Purpose
Privacy-first traffic aggregates for 7, 30, or 90 days and the matching previous period.
Access and scope
Not an external API: requires an admin session and may evolve with the release UI.
Parameters and body
There are no path parameters. Query/body fields remain an internal handler contract and are not part of stable OpenAPI v1.
Success response
Privacy-first traffic aggregates for 7, 30, or 90 days and the matching previous period. The exact status/body is defined by the current release handler.
Errors
Failure statuses and error bodies may evolve with this internal surface; external clients should use /api/v1 or a dedicated adapter.
Important boundary
The inventory proves the path and methods exist without turning an internal endpoint into an external compatibility promise.
The public API is separated from internal Studio routes. It is versioned, exposed as OpenAPI 3.1, and accompanied by a dependency-free TypeScript client.
OperationScopeLimitPurposeDemo
GET/api/v1public—Discover the API version, authentication, and resources./api/demo/v1DetailsCollapse↓
Purpose
Discover the API version, authentication, and resources.
Access and scope
Public operation: no API key or scope is required.
Parameters and body
No parameters or request body are declared.
Success response
200 · Discover the API version, authentication, and resources.
Errors
OpenAPI declares no operation-specific error responses for this operation.
Important boundary
This public operation needs no key. Use the response for capability discovery, never for storing secrets.
import { FoundryClient } from "@foundry/sdk";
const foundry = new FoundryClient({
baseUrl: "https://api.example.com",
apiKey: process.env.FOUNDRY_API_KEY,
timeoutMs: 10_000,
});
const result = await foundry.createOrder(order, {
idempotencyKey: crypto.randomUUID(),
});
The SDK ships in the package and installs from a local directory or release tarball; a public npm publication is not currently claimed.
04 / INTEGRATIONS & STATUS
Shipped, configurable, and not misrepresented.
Production features, safe sandbox workflows, and roadmap items are deliberately separated. Provider or infrastructure configuration is not hidden behind the word supported.
Production
TypeScript SDK
Fetch/URL/Headers/AbortController, typed errors, timeout/cancel, catalog, content, search, and orders.
Production
YooKassa
Hosted checkout, capture/cancel/refund, inbound webhook with provider re-fetch, and receipt fields. SBP/card/pay methods depend on the connected merchant account.
Production
SMTP + S3
Transport diagnostics, outbox/worker/retries, and S3-compatible media lifecycle; the installation owner supplies credentials.
Sandbox
Webhook center + automations
CRUD, pause/resume, test delivery, and manual runs persist in the demo, while external URLs are intentionally never called.
Roadmap
Shared SaaS / RBAC / SSO
Not included in the current single-tenant package; these require a separate tenant-aware baseline and hardening.
STATUS MATRIX
Commercial extensions
Sandbox means testable in Developer Hub without external delivery. Planned is a direction, not a current-version promise.
The baseline is one isolated installation per customer. Web, migrations, and worker roles are separated; PostgreSQL remains the source of truth.
01
Bootstrap
Generates local secrets, admin token, TOTP, and API key; existing configuration is never silently overwritten.
02
Migrate
A separate one-shot role applies immutable PostgreSQL migrations before the application starts.
03
Run
Web serves Studio/API while a dedicated worker processes outbox, retries, and retention.
04
Verify
Liveness, readiness, worker heartbeat, PostgreSQL/TLS, SMTP, and S3 probes are part of acceptance.
Compatibility matrix
Runtime
Node.js 22–24
Containers
Docker + Compose plugin
Data
PostgreSQL; separate database per deployment
Media
S3-compatible storage, optional
Email
SMTP with TLS verification
Cloud
Timeweb Cloud or another Docker/private-network IaaS
06 / SECURITY BOUNDARY
Controls are built in. Certificates are not simulated.
FURAZHIR ships technical controls, but it cannot certify a specific law or standard on its own: compliance depends on the buyer’s data, region, contracts, and operations.
BASELINE
Baseline controls
token + TOTP, server-side sessions, and active-session revocation
CSRF/origin checks, an exact CORS allow-list, and bounded payloads
rate limits, idempotency, and optimistic concurrency
typed audit without secrets or raw binary data
verified provider webhook followed by an authenticated API re-fetch
PostgreSQL TLS, private S3, backup/restore, and rollback as required production-launch checks
BOUNDARY
Honest v1 boundary
single-tenant by deployment, not a shared multi-tenant SaaS
resource RBAC, memberships, SSO/SCIM, HA, and certified compliance are separate work
the public demo uses synthetic data and isolated storage only
a live installation uses the project brand, verified seller details, and reviewed security settings
07 / LICENSE & DELIVERY
Core model. One production installation.
The intended model is perpetual use of the delivered version in one isolated production installation, with 30 days of launch support and updates. Exact contents, rights, and terms are fixed in the license, order, and agreement before payment.
versioned source archive or signed OCI images, as agreed
Compose configuration, migrations, and a secret-free .env.example
bootstrap, health, backup/restore, and rollback runbooks
OpenAPI, TypeScript SDK, and integration examples
license certificate, release notes, SBOM, NOTICE, and checksums
30 days of launch support and core updates
Rights arise from the license and agreed order. This page helps evaluate the package, but does not itself grant a right to receive or copy source code and is not an offer.
VERIFY BEFORE APPLYING
The complete surface is open for an honest evaluation.
Start with the full panel, then verify the operations you need against this page and OpenAPI. Request a technical consultation so delivery, terms, and the agreement are clear before work begins.