src/operations

This folder owns the Rust modules listed below. Each source begins with its responsibility contract. The crate currently shares internal types/imports through a facade; APIs, MCP and UCP delegate to shared domain operations.

• addresses.rs: Merchant/MCP address operations use identical customer ownership and revision checks to the Store API.
• company_logo.rs: Tenant-owned logo uploads: bounded decoding, metadata stripping, immutable PNG storage and linked public delivery.
• company_model.rs: Company profile admission, sparse channel inheritance and structured-address print projection.
• company_public.rs: Explicit public legal/brand projection; bank account, domestic tax ID and unlinked uploads remain private.
• customers.rs: Tenant-scoped paged CRM and revision-checked merchant changes; credentials never leave storage.
• master_data.rs: Revisioned tenant company basis and sparse channel overrides, serialized with receipt issuance.
• mod.rs: Merchant CRM and fulfillment APIs, shared verbatim with MCP operations capabilities.
• orders.rs: Bounded order search, token-redacted detail and append-only operational notes.
• receipt_pdf.rs: Minimal paginated PDF serializer with WinAnsi Helvetica; snapshot retains complete Unicode originals.
• receipt_text.rs: Four-language document labels and authoritative snapshot-to-print projection.
• receipts.rs: Idempotent immutable invoices/delivery notes with transactional per-shop number ranges.
• workflow.rs: Revision-bound workflow configuration used by installed apps and selective sandbox releases.

The source inventory is checked in CI. The behavioral map identifies integration suites, and testing describes actual coverage and limits. Every file is limited to 320 lines; main.rs to 120.

Company profiles live in company_model.rs (admission/inheritance), master_data.rs (transactional scopes), company_logo.rs (immutable validated bytes) and company_public.rs (explicit public projection). receipts.rs consumes the same channel resolver. See company settings.

Customer saves accept configured group IDs under the checkout-settings lock, revoke sessions and expose immutable order identity. Validated customer history restoration preserves current identity/login/purchase metadata. See entity history.