SDK quick-starts

Current package contracts for themes and apps. Published JavaScript SDKs, CLIs, scaffolds, and test tools are not present in this branch.

Theme SDK: JSON Contract

Real current theme package contract.

The current theme package contract is a portable JSON bundle, not a published CLI.
Schema version: 2026-05-json-contract.
Required bundle areas include package metadata, settings schema/data, templates, sections, blocks, locales, and renderer manifest.
Upload uses POST /v1/themes/packages/upload with UploadThemePackageSchema from @letbuyy/theme-engine.
Section definitions can declare accepts_app_blocks so installed app blocks can render inside storefront theme slots.

{
  "schema_version": "2026-05-json-contract",
  "package": { "slug": "example-theme", "version": "1.0.0" },
  "config": { "settings_schema": { "settings": {} } },
  "templates": {},
  "sections": {},
  "blocks": {},
  "locales": {},
  "renderer": { "engine": "json-contract" }
}

App SDK: Bridge Contract

Real current contracts, without pretending a package exists.

Admin embed surfaces are normalized from app installation config, app extensions, and app_url.
Default app bridge capabilities are api.fetch, toast, and resize.
Optional navigation.redirect is accepted when configured.
Storefront app blocks can render inline or iframe blocks with heading, body, CTA label, CTA href, and iframe_url fields.
Built-for-LetBuyy quality gate checks exist for performance, reviews, installs, app blocks, and privacy URL readiness.

POST /v1/app-store/bridge/fetch
Authorization: Bearer <app_token>

{
  "method": "GET",
  "path": "/products",
  "store_id": "site_id"
}

Theme Bundle Areas

Portable JSON-contract bundle areas currently validated by @letbuyy/theme-engine.

Contract	Current shape	Notes	Source
package	slug, name, site_types, status, pricing_type, price, currency, version, version_number, release_status, compatibility_range.	Slug is lowercase kebab-case and release_status defaults to published.	packages/theme-engine/src/theme-bundle.ts:140
config.settings_schema	schema_version plus grouped settings fields using text, textarea, richtext, color, image, select, toggle, range, number, url, or radio.	Each setting group has label, description, and field definitions.	packages/theme-engine/src/theme-bundle.ts:36 + :57
config.settings_data	current settings object and named preset setting objects.	settings_data defaults to empty current and presets objects.	packages/theme-engine/src/theme-bundle.ts:62 + :172
templates	Template sections, section order, template section blocks, block order, and disabled flags.	Template order and block_order must reference existing local IDs.	packages/theme-engine/src/theme-bundle.ts:67 + :81
sections	Section type, name, renderer_key, settings_schema, defaults, block_types, accepts_app_blocks, presets, and enabled_on templates.	Section map keys must match section.type; block_types must reference existing block definitions.	packages/theme-engine/src/theme-bundle.ts:120 + :192
blocks	Block type, name, description, settings_schema, and defaults.	Block map keys must match block.type.	packages/theme-engine/src/theme-bundle.ts:112 + :212
locales	Locale dictionaries are JSON records; translation keys can be resolved through theme bundle localization helpers.	Default locale is en and translation references use the t: prefix.	packages/theme-engine/src/theme-bundle.ts:138 + :273
renderer	engine=json-contract, renderer_version=1.0.0, liquid_ready flag, and typed asset manifest.	The upload route accepts submission_mode marketplace or private_install.	packages/theme-engine/src/theme-bundle.ts:157 + :255

App Bridge Capabilities

Capabilities normalized by @letbuyy/app-engine. This is not a published SDK package.

Contract	Current shape	Notes	Source
api.fetch	Default app bridge capability. The current route is POST /v1/app-store/bridge/fetch and only proxies scoped GET reads.	Write-capable bridge calls remain [SKIP — NEEDS BACKEND/SDK].	packages/app-engine/src/index.ts:190 + services/api-gateway/src/routes/app-store.ts:781
toast	Default app bridge capability listed by app-engine.	There is no published browser app SDK package in this branch.	packages/app-engine/src/index.ts:190
resize	Default app bridge capability listed by app-engine.	Runtime behavior for resize is not exposed as a standalone gateway route.	packages/app-engine/src/index.ts:190
navigation.redirect	Optional capability accepted by app bridge capability normalization when configured.	It is not part of the default capability list.	packages/app-engine/src/index.ts:251
admin embed surface	Embed URL is resolved from install config, extension config, extension target, or app_url; localhost is only allowed when configured for local development.	Capabilities can be supplied through admin embed config, extension config, or install bridge_capabilities.	packages/app-engine/src/index.ts:270

Theme Validation Rules

Rule-level JSON-contract constraints enforced by @letbuyy/theme-engine today.

Contract	Current shape	Notes	Source
Package metadata	slug must be lowercase kebab-case; site_types, status, pricing_type, currency, version, version_number, release_status, and compatibility_range are schema validated.	Defaults exist for author_name, site_types, status, pricing_type, price, currency, version_number, release_status, and compatibility_range.	packages/theme-engine/src/theme-bundle.ts:140
Template order references	Each template order entry must reference an existing section ID in that template.	Invalid entries produce a custom issue at template.order.	packages/theme-engine/src/theme-bundle.ts:81
Template block order references	Each section block_order entry must reference an existing block ID under that template section.	Invalid entries produce a custom issue at sections.<sectionId>.block_order.	packages/theme-engine/src/theme-bundle.ts:98
Section key/type match	Each section definition map key must match the section.type value.	A mismatched key/type pair is rejected during ThemePackageBundleSchema superRefine.	packages/theme-engine/src/theme-bundle.ts:191
Block key/type match	Each block definition map key must match the block.type value.	A mismatched block definition key/type pair is rejected during bundle validation.	packages/theme-engine/src/theme-bundle.ts:212
Section block type references	Every section.block_types entry must reference an existing block definition.	Missing block definitions are reported against sections.<sectionType>.block_types.	packages/theme-engine/src/theme-bundle.ts:201
Template section definitions	Every template section type must reference an existing section definition in the bundle.	Missing section definitions are reported against templates.<templateKey>.sections.<sectionId>.type.	packages/theme-engine/src/theme-bundle.ts:222
Template block definitions	Every template block type must reference an existing block definition in the bundle.	Missing block definitions are reported against templates.<templateKey>.sections.<sectionId>.blocks.<blockId>.type.	packages/theme-engine/src/theme-bundle.ts:233
Allowed blocks per section	When a section definition declares block_types, template blocks inside that section must use one of those types.	The constraint is skipped only when the section definition has an empty block_types list.	packages/theme-engine/src/theme-bundle.ts:243
Validation issue formatting	validateThemeBundle returns { ok, bundle?, issues } and formats Zod issues as path-prefixed strings.	This is the current machine-readable validation result shape; no CLI wrapper exists yet.	packages/theme-engine/src/theme-bundle.ts:450
Locale lookup	Locales normalize underscores to dashes, prefer exact normalized locale, lowercase variant, language, then en.	Translation strings use the t: prefix and resolve dotted dictionary paths.	packages/theme-engine/src/theme-bundle.ts:282 + :339

Theme Upload Gateway Contract

Current package upload modes, review behavior, persistence result, and install boundary.

Contract	Current shape	Notes	Source
Upload body schema	POST /v1/themes/packages/upload validates a strict body with bundle and submission_mode; submission_mode is marketplace or private_install and defaults to marketplace.	Invalid JSON-contract bundles are rejected by UploadThemePackageSchema before route persistence runs.	services/api-gateway/src/routes/themes.ts:467 + packages/theme-engine/src/theme-bundle.ts:255
Merchant auth boundary	The upload route is protected by authMiddleware and resolves the custom merchant user before persistence.	Theme package upload is not a public unauthenticated package registry endpoint.	services/api-gateway/src/routes/themes.ts:40 + :467
Persistence adapter	SchemaRegistryExecutionAdapter parses the theme bundle, builds persistence payloads, and writes theme package/version records through the schema registry path.	The portal documents this as gateway-backed upload, not a local CLI package flow.	services/api-gateway/src/execution/schema-registry-execution.adapter.ts:230
Marketplace submission mode	marketplace mode is the default; the adapter treats it as review-required, forcing package and version status to draft before review.	Marketplace upload does not immediately mean public/installable listing approval.	services/api-gateway/src/routes/themes.ts:478 + services/api-gateway/src/execution/schema-registry-execution.adapter.ts:236
Private install mode	private_install mode returns the persisted upload with review_record: null.	This is a real upload mode, but no public Theme CLI or private install SDK wrapper exists yet.	services/api-gateway/src/routes/themes.ts:491
Review record	Marketplace uploads create a marketplace review record with automated checks bundle_schema_validation and theme_package_persistence.	Review metadata includes schema_manifest_version and renderer_version from the upload result.	services/api-gateway/src/routes/themes.ts:495 + :506
Theme submitted event	Marketplace uploads emit theme.submitted with idempotencyKey theme.submitted:<theme_package_id>:<theme_version_id>.	The event payload carries package/version identifiers and the optional review record id.	services/api-gateway/src/routes/themes.ts:85 + :527
Upload response fields	The schema registry upload response includes theme, package, version, schema_manifest_version, renderer_version, and installable.	installable is derived from active package status plus published version status.	services/api-gateway/src/execution/schema-registry-execution.adapter.ts:395
Install route separation	Applying a theme still uses POST /v1/themes/:slug/install with InstallThemeSchema and ThemeExecutionAdapter.installTheme.	Do not document package upload as the same operation as applying a theme to a store.	services/api-gateway/src/routes/themes.ts:565

Theme Upload Examples

Request and response shapes from @letbuyy/theme-engine and the gateway upload route.

POST /v1/themes/packages/upload
Content-Type: application/json

{
  "submission_mode": "marketplace",
  "bundle": {
    "schema_version": "2026-05-json-contract",
    "package": {
      "slug": "example-theme",
      "name": "Example Theme",
      "site_types": ["store"],
      "version": "1.0.0",
      "pricing_type": "free",
      "price": 0,
      "currency": "INR"
    },
    "config": {
      "settings_schema": {
        "schema_version": "2026-05-json-contract",
        "settings": {}
      },
      "settings_data": {
        "current": {},
        "presets": {}
      }
    },
    "templates": {},
    "sections": {},
    "blocks": {},
    "locales": {},
    "renderer": {
      "engine": "json-contract",
      "renderer_version": "1.0.0",
      "liquid_ready": false,
      "assets": {}
    }
  }
}

{
  "data": {
    "theme": { "id": "theme_id" },
    "package": { "id": "theme_package_id", "slug": "example-theme" },
    "schema_manifest_version": "2026-05-json-contract",
    "renderer_version": "1.0.0",
    "review_record": {
      "submission_type": "theme",
      "resource_id": "theme_package_id"
    }
  }
}

{
  "sections": {
    "product-main": {
      "type": "product-main",
      "name": "Product main",
      "renderer_key": "product-main",
      "accepts_app_blocks": true,
      "block_types": []
    }
  }
}

App Bridge Examples

Current bridge request and response envelope from the app-store route.

POST /v1/app-store/bridge/fetch
Authorization: Bearer <app_token>
Content-Type: application/json

{
  "method": "GET",
  "path": "/products",
  "store_id": "site_id"
}

{
  "data": {
    "ok": true,
    "status": 200,
    "data": {},
    "error": null
  }
}

SDK Gaps

Capabilities intentionally blocked instead of described as built.

Capability	Current status	Blocked until	Source
OpenAPI export	[SKIP — NEEDS BACKEND/SDK] Gateway routes are mounted under /v1, but no generated OpenAPI document is checked in for this branch.	Gateway schema/export tooling lands and publishes an artifact the portal can consume network-free.	services/api-gateway/src/index.ts:161 + apps/developer-portal/CODEX_WS10_LEDGER.md
Published App SDK package	PARTIAL: @letbuyy/api-client exports createLetbuyyAppSdk for scoped app API reads and app-owned metadata writes; no dedicated @letbuyy/app-sdk browser bridge package exists yet.	A package-owned SDK exports bridge fetch, session, toast, resize, and navigation helpers.	packages/typescript/api-client/src/index.ts
Theme CLI scaffolder	[SKIP — NEEDS BACKEND/SDK] Theme bundle validation exists as JSON-contract schemas, but no CLI generator or packager is present.	Theme tooling can scaffold, validate, package, and upload a bundle from local source.	packages/theme-engine/src/theme-bundle.ts:117 + apps/developer-portal/CODEX_WS10_LEDGER.md
Webhook test sender UI	[SKIP — NEEDS BACKEND/SDK] Webhook dispatch exists behind service/internal flows; no public developer test-delivery endpoint or UI exists.	A developer-owned test sender can sign and dispatch sample events without touching production merchant data.	services/webhook-service/src/index.ts + apps/developer-portal/CODEX_WS10_LEDGER.md
Credential rotation console	PARTIAL: backend app submission and API-key rotation routes exist with show-once credentials and hash-only persistence; dashboard inventory/revoke UI is not present.	The dashboard shell receives an authenticated adapter for list/revoke and key history views.	services/api-gateway/src/routes/app-store/developer-routes.ts
Write-capable app bridge	[SKIP — NEEDS BACKEND/SDK] The current app bridge accepts method=GET only and maps reads to approved first path segments.	Bridge authorization, CSRF/idempotency, scopes, and mutation route policy are implemented for write paths.	services/api-gateway/src/routes/app-store.ts:781

Published JavaScript App SDK package

[SKIP — NEEDS SDK/CLI] A minimal createLetbuyyAppSdk wrapper exists in @letbuyy/api-client, but no dedicated @letbuyy/app-sdk browser bridge package exists in this branch.

Theme CLI scaffolder

[SKIP — NEEDS BACKEND/SDK] The theme contract exists as Zod schemas, but no CLI generator or packager is present.

OpenAPI export

[SKIP — NEEDS BACKEND/SDK] Hono routes exist, but no generated OpenAPI document is checked in for the gateway.

Webhook test sender UI

[SKIP — NEEDS BACKEND/SDK] Dispatch routes are internal and there is no public test delivery endpoint.

Live dashboard data

[SKIP — NEEDS BACKEND/SDK] Developer profile, submitted apps, review records, installs, and charges have routes, but this D0 app has no authenticated API adapter yet.

Write-capable app bridge

[SKIP — NEEDS BACKEND/SDK] bridge/fetch only supports scoped GET requests today.

{ "schema_version": "2026-05-json-contract", "package": { "slug": "example-theme", "version": "1.0.0" }, "config": { "settings_schema": { "settings": {} } }, "templates": {}, "sections": {}, "blocks": {}, "locales": {}, "renderer": { "engine": "json-contract" } }

Contract

Current shape

Notes

Source

package

slug, name, site_types, status, pricing_type, price, currency, version, version_number, release_status, compatibility_range.

Slug is lowercase kebab-case and release_status defaults to published.

packages/theme-engine/src/theme-bundle.ts:140

config.settings_schema

schema_version plus grouped settings fields using text, textarea, richtext, color, image, select, toggle, range, number, url, or radio.

Each setting group has label, description, and field definitions.

packages/theme-engine/src/theme-bundle.ts:36 + :57

config.settings_data

current settings object and named preset setting objects.

settings_data defaults to empty current and presets objects.

packages/theme-engine/src/theme-bundle.ts:62 + :172

templates

Template sections, section order, template section blocks, block order, and disabled flags.

Template order and block_order must reference existing local IDs.

packages/theme-engine/src/theme-bundle.ts:67 + :81

sections

Section type, name, renderer_key, settings_schema, defaults, block_types, accepts_app_blocks, presets, and enabled_on templates.

Section map keys must match section.type; block_types must reference existing block definitions.

packages/theme-engine/src/theme-bundle.ts:120 + :192

blocks

Block type, name, description, settings_schema, and defaults.

Block map keys must match block.type.

packages/theme-engine/src/theme-bundle.ts:112 + :212

locales

Locale dictionaries are JSON records; translation keys can be resolved through theme bundle localization helpers.

Default locale is en and translation references use the t: prefix.

packages/theme-engine/src/theme-bundle.ts:138 + :273

renderer

engine=json-contract, renderer_version=1.0.0, liquid_ready flag, and typed asset manifest.

The upload route accepts submission_mode marketplace or private_install.

packages/theme-engine/src/theme-bundle.ts:157 + :255

Contract

Current shape

Notes

Source

api.fetch

Default app bridge capability. The current route is POST /v1/app-store/bridge/fetch and only proxies scoped GET reads.

Write-capable bridge calls remain [SKIP — NEEDS BACKEND/SDK].

packages/app-engine/src/index.ts:190 + services/api-gateway/src/routes/app-store.ts:781

toast

Default app bridge capability listed by app-engine.

There is no published browser app SDK package in this branch.

packages/app-engine/src/index.ts:190

resize

Default app bridge capability listed by app-engine.

Runtime behavior for resize is not exposed as a standalone gateway route.

packages/app-engine/src/index.ts:190

navigation.redirect

Optional capability accepted by app bridge capability normalization when configured.

It is not part of the default capability list.

packages/app-engine/src/index.ts:251

admin embed surface

Embed URL is resolved from install config, extension config, extension target, or app_url; localhost is only allowed when configured for local development.

Capabilities can be supplied through admin embed config, extension config, or install bridge_capabilities.

packages/app-engine/src/index.ts:270

Contract

Current shape

Notes

Source

Package metadata

slug must be lowercase kebab-case; site_types, status, pricing_type, currency, version, version_number, release_status, and compatibility_range are schema validated.

Defaults exist for author_name, site_types, status, pricing_type, price, currency, version_number, release_status, and compatibility_range.

packages/theme-engine/src/theme-bundle.ts:140

Template order references

Each template order entry must reference an existing section ID in that template.

Invalid entries produce a custom issue at template.order.

packages/theme-engine/src/theme-bundle.ts:81

Template block order references

Each section block_order entry must reference an existing block ID under that template section.

Invalid entries produce a custom issue at sections.<sectionId>.block_order.

packages/theme-engine/src/theme-bundle.ts:98

Section key/type match

Each section definition map key must match the section.type value.

A mismatched key/type pair is rejected during ThemePackageBundleSchema superRefine.

packages/theme-engine/src/theme-bundle.ts:191

Block key/type match

Each block definition map key must match the block.type value.

A mismatched block definition key/type pair is rejected during bundle validation.

packages/theme-engine/src/theme-bundle.ts:212

Section block type references

Every section.block_types entry must reference an existing block definition.

Missing block definitions are reported against sections.<sectionType>.block_types.

packages/theme-engine/src/theme-bundle.ts:201

Template section definitions

Every template section type must reference an existing section definition in the bundle.

Missing section definitions are reported against templates.<templateKey>.sections.<sectionId>.type.

packages/theme-engine/src/theme-bundle.ts:222

Template block definitions

Every template block type must reference an existing block definition in the bundle.

Missing block definitions are reported against templates.<templateKey>.sections.<sectionId>.blocks.<blockId>.type.

packages/theme-engine/src/theme-bundle.ts:233

Allowed blocks per section

When a section definition declares block_types, template blocks inside that section must use one of those types.

The constraint is skipped only when the section definition has an empty block_types list.

packages/theme-engine/src/theme-bundle.ts:243

Validation issue formatting

validateThemeBundle returns { ok, bundle?, issues } and formats Zod issues as path-prefixed strings.

This is the current machine-readable validation result shape; no CLI wrapper exists yet.

packages/theme-engine/src/theme-bundle.ts:450

Locale lookup

Locales normalize underscores to dashes, prefer exact normalized locale, lowercase variant, language, then en.

Translation strings use the t: prefix and resolve dotted dictionary paths.

packages/theme-engine/src/theme-bundle.ts:282 + :339

Contract

Current shape

Notes

Source

Upload body schema

POST /v1/themes/packages/upload validates a strict body with bundle and submission_mode; submission_mode is marketplace or private_install and defaults to marketplace.

Invalid JSON-contract bundles are rejected by UploadThemePackageSchema before route persistence runs.

services/api-gateway/src/routes/themes.ts:467 + packages/theme-engine/src/theme-bundle.ts:255

Merchant auth boundary

The upload route is protected by authMiddleware and resolves the custom merchant user before persistence.

Theme package upload is not a public unauthenticated package registry endpoint.

services/api-gateway/src/routes/themes.ts:40 + :467

Persistence adapter

SchemaRegistryExecutionAdapter parses the theme bundle, builds persistence payloads, and writes theme package/version records through the schema registry path.

The portal documents this as gateway-backed upload, not a local CLI package flow.

services/api-gateway/src/execution/schema-registry-execution.adapter.ts:230

Marketplace submission mode

marketplace mode is the default; the adapter treats it as review-required, forcing package and version status to draft before review.

Marketplace upload does not immediately mean public/installable listing approval.

services/api-gateway/src/routes/themes.ts:478 + services/api-gateway/src/execution/schema-registry-execution.adapter.ts:236

Private install mode

private_install mode returns the persisted upload with review_record: null.

This is a real upload mode, but no public Theme CLI or private install SDK wrapper exists yet.

services/api-gateway/src/routes/themes.ts:491

Review record

Marketplace uploads create a marketplace review record with automated checks bundle_schema_validation and theme_package_persistence.

Review metadata includes schema_manifest_version and renderer_version from the upload result.

services/api-gateway/src/routes/themes.ts:495 + :506

Theme submitted event

Marketplace uploads emit theme.submitted with idempotencyKey theme.submitted:<theme_package_id>:<theme_version_id>.

The event payload carries package/version identifiers and the optional review record id.

services/api-gateway/src/routes/themes.ts:85 + :527

Upload response fields

The schema registry upload response includes theme, package, version, schema_manifest_version, renderer_version, and installable.

installable is derived from active package status plus published version status.

services/api-gateway/src/execution/schema-registry-execution.adapter.ts:395

Install route separation

Applying a theme still uses POST /v1/themes/:slug/install with InstallThemeSchema and ThemeExecutionAdapter.installTheme.

Do not document package upload as the same operation as applying a theme to a store.

services/api-gateway/src/routes/themes.ts:565

POST /v1/themes/packages/upload Content-Type: application/json { "submission_mode": "marketplace", "bundle": { "schema_version": "2026-05-json-contract", "package": { "slug": "example-theme", "name": "Example Theme", "site_types": ["store"], "version": "1.0.0", "pricing_type": "free", "price": 0, "currency": "INR" }, "config": { "settings_schema": { "schema_version": "2026-05-json-contract", "settings": {} }, "settings_data": { "current": {}, "presets": {} } }, "templates": {}, "sections": {}, "blocks": {}, "locales": {}, "renderer": { "engine": "json-contract", "renderer_version": "1.0.0", "liquid_ready": false, "assets": {} } } }

{ "data": { "theme": { "id": "theme_id" }, "package": { "id": "theme_package_id", "slug": "example-theme" }, "schema_manifest_version": "2026-05-json-contract", "renderer_version": "1.0.0", "review_record": { "submission_type": "theme", "resource_id": "theme_package_id" } } }

{ "sections": { "product-main": { "type": "product-main", "name": "Product main", "renderer_key": "product-main", "accepts_app_blocks": true, "block_types": [] } } }

Capability

Current status

Blocked until

Source

OpenAPI export

[SKIP — NEEDS BACKEND/SDK] Gateway routes are mounted under /v1, but no generated OpenAPI document is checked in for this branch.

Gateway schema/export tooling lands and publishes an artifact the portal can consume network-free.

services/api-gateway/src/index.ts:161 + apps/developer-portal/CODEX_WS10_LEDGER.md

Published App SDK package

PARTIAL: @letbuyy/api-client exports createLetbuyyAppSdk for scoped app API reads and app-owned metadata writes; no dedicated @letbuyy/app-sdk browser bridge package exists yet.

A package-owned SDK exports bridge fetch, session, toast, resize, and navigation helpers.

packages/typescript/api-client/src/index.ts

Theme CLI scaffolder

[SKIP — NEEDS BACKEND/SDK] Theme bundle validation exists as JSON-contract schemas, but no CLI generator or packager is present.

Theme tooling can scaffold, validate, package, and upload a bundle from local source.

packages/theme-engine/src/theme-bundle.ts:117 + apps/developer-portal/CODEX_WS10_LEDGER.md

Webhook test sender UI

[SKIP — NEEDS BACKEND/SDK] Webhook dispatch exists behind service/internal flows; no public developer test-delivery endpoint or UI exists.

A developer-owned test sender can sign and dispatch sample events without touching production merchant data.

services/webhook-service/src/index.ts + apps/developer-portal/CODEX_WS10_LEDGER.md

Credential rotation console

PARTIAL: backend app submission and API-key rotation routes exist with show-once credentials and hash-only persistence; dashboard inventory/revoke UI is not present.

The dashboard shell receives an authenticated adapter for list/revoke and key history views.

services/api-gateway/src/routes/app-store/developer-routes.ts

Write-capable app bridge

[SKIP — NEEDS BACKEND/SDK] The current app bridge accepts method=GET only and maps reads to approved first path segments.

Bridge authorization, CSRF/idempotency, scopes, and mutation route policy are implemented for write paths.

services/api-gateway/src/routes/app-store.ts:781

SDK quick-starts

Theme SDK: JSON Contract

App SDK: Bridge Contract

Theme Bundle Areas

App Bridge Capabilities

Theme Validation Rules

Theme Upload Gateway Contract

Theme Upload Examples

Theme Package Upload Request

Theme Upload Response

Section With App Blocks

App Bridge Examples

Bridge Fetch Request

Bridge Fetch Envelope

SDK Gaps

Published JavaScript App SDK package

Theme CLI scaffolder

OpenAPI export

Webhook test sender UI

Live dashboard data

Write-capable app bridge

SDK quick-starts

Theme SDK: JSON Contract

App SDK: Bridge Contract

Theme Bundle Areas

App Bridge Capabilities

Theme Validation Rules

Theme Upload Gateway Contract

Theme Upload Examples

Theme Package Upload Request

Theme Upload Response

Section With App Blocks

App Bridge Examples

Bridge Fetch Request

Bridge Fetch Envelope

SDK Gaps

Published JavaScript App SDK package

Theme CLI scaffolder

OpenAPI export

Webhook test sender UI

Live dashboard data

Write-capable app bridge