memba_appstore_v3 state

SetRegistrationFee

SetRegistrationFee sets the flat listing fee in ugnot (0..MaxRegistrationFee). Zero is allowed (a fee waiver). Owner only.

SetTreasury

SetTreasury repoints the fee recipient. Must be non-empty (an empty treasury would fail-close RegisterApp). Owner only. Keep this in sync with memba\_market\_config.GetTreasury().

AddCurator

AddCurator grants the curate role (approve pending listings). Owner only.

RemoveCurator

RemoveCurator revokes the curate role. Owner only.

Pause

Pause is the kill switch: while paused, RegisterApp aborts (reads stay available). Owner only.

TransferOwnership

TransferOwnership stages a new owner; it takes effect only after AcceptOwnership is called BY that address (2-step, so a typo can't brick admin). A later call replaces the staged address; CancelOwnershipTransfer withdraws it.

CancelOwnershipTransfer

CancelOwnershipTransfer withdraws a staged handoff. Owner only.

GetPendingOwner

AcceptOwnership

AcceptOwnership completes the handoff. Only the staged pendingOwner may call it. The former owner's curator grant is revoked atomically; the successor can curate immediately and may explicitly re-appoint the former owner later.

boolStr

DefaultRegistrationFee

MaxRegistrationFee

MaxNameLen

MaxTaglineLen

MaxDescrLen

MaxCategoryLen

MaxURLLen

MaxPkgPathLen

MaxCIDLen

MaxReasonLen

MaxScreenshots

MaxResubmits

FlagHideThreshold

StatusPending

Listing lifecycle states.

StatusLive

Listing lifecycle states.

StatusRejected

Listing lifecycle states.

StatusDelisted

Listing lifecycle states.

Listing

Listing is one app. PkgPath (the realm/package path) is the unique key.

owner

pendingOwner

treasury

registrationFee

paused

seedingSealed

curators

// address string -> bool

listings

// pkgPath -> \*Listing

flaggedBy

// pkgPath + "\\x00" + addr -> bool (one flag per addr)

statusIndex

publisherIndex

liveCount

pendingCount

rejectedCount

delistedCount

nextId

init.44

seedAuthority

seedAuthority makes the publisher the owner, the fee recipient and the first curator. It runs once at package load; there is no other way to obtain owner.

caller

assertOwner

assertNotPaused

RegisterApp

RegisterApp lists a new app. The caller pays EXACTLY registrationFee ugnot with the call; the whole fee is forwarded to the treasury (no custody). The listing starts \`pending\`.

ApproveApp

ApproveApp flips a pending (or previously-live) listing live. Curator-only.

RejectApp

RejectApp declines a pending submission, recording a reason and granting a one-time free resubmit credit. Curator-only; only a pending app can be rejected.

EditListing

EditListing lets the publisher update a listing that is NOT live/delisted — i.e. a pending or rejected one — and resets it to \`pending\` for (re-)review. Editing a live listing is structurally forbidden so a Verified badge can never be bait-and-switched. Bounded by MaxResubmits so a reject→edit loop can't grief the queue.

DelistApp

DelistApp removes a listing from public view. The publisher or a curator may do it.

RestoreApp

RestoreApp brings a delisted app back to \`pending\` (re-curation required). Curator-only.

FlagApp

FlagApp lets any user flag a publicly-listed (live OR pending) listing once. At FlagHideThreshold distinct flags the listing drops from the public lists (isVisible), giving the public Unverified/pending tab a community safety valve; a curator can then Delist/Reject.

MaxClearBatch

MaxClearBatch bounds how many per-address flag marks one ClearFlags call removes, so a mega-brigade (thousands of sybil flags) cannot gas-lock the reset — the curator just calls ClearFlags repeatedly until the count reaches zero.

ClearFlags

ClearFlags resets a listing's community-flag state after curator review. Curator-only. Without it a flag-hidden listing stays hidden FOREVER: FlagCount never decrements and survives every status transition, so FlagHideThreshold (5) sybil addresses could permanently disappear any live app. Clearing also deletes the per-address dedupe marks — the community can re-flag if the concern is real, and every clear is an emitted event, so a curator whitewashing a bad listing is publicly visible on-chain.

SeedListing

SeedListing imports a listing verbatim (Id, CreatedAt, FlagCount, Status, Publisher) during a v2→v3 migration. Owner-only, NON-payable (never reads OriginSend / moves funds), dedupe-guarded. After the migration the owner calls FinalizeSeed, permanently sealing this entrypoint — without that latch it would be a standing backdoor to forge fee-free listings with arbitrary publisher.

FinalizeSeed

FinalizeSeed permanently seals SeedListing (one-way latch). Owner-only.

GetRegistrationFee

GetRegistrationFee returns the current flat listing fee in ugnot.

GetTreasury

GetOwner

AppCount

AppCount returns the total number of registered listings (any status).

IsCurator

IsCurator reports whether an address may approve/reject listings (the curator-dashboard gate).

GetCuratorsJSON

GetCuratorsJSON returns a JSON array of curator addresses (small, bounded).

GetStatsJSON

GetStatsJSON returns per-status counts (served from O(1) counters) for the store header.

isCurator

mustGet

validStatus

validateListingFields

validateListingFields checks the length + appURL-scheme invariants shared by RegisterApp and EditListing. The appURL scheme allowlist (http/https/leading-slash/empty) is the on-chain defense behind the frontend AppLink — it blocks javascript:/data:/other-scheme phishing URLs.

validateAppURL

validateAppURL enforces the scheme allowlist: empty, http://, https://, or a leading-slash in-app path. Anything else (javascript:, data:, ftp:, mailto:, …) aborts. A leading-slash path must NOT be protocol-relative (\`//host\` or \`/\\host\`) — browsers navigate those off-site, which would defeat the allowlist.

parseScreenshots

parseScreenshots splits a comma-separated CID list, enforcing ≤MaxScreenshots and per-CID length. Blank entries are dropped. Empty input → nil.

statusKey

pubKey

idInUse

idInUse reports whether \`id\` is already present in the status index under ANY status (every listing — registered or seeded — is in exactly one statusIndex entry). Used to reject a duplicate SeedListing id before it silently collides on the composite key.

zeroPad

zeroPad renders id as a fixed-width 20-digit string so lexical avl order == numeric order.

adjustCounter

indexInsert

indexInsert adds a brand-new listing to the status + publisher indexes and bumps its status counter. (publisherIndex never changes afterward — Publisher + Id are immutable.)

changeStatus

changeStatus moves a listing between statuses, keeping statusIndex + counters exact, and persists the listing. Every status transition MUST go through here.

validatePkgPath

validatePkgPath normalizes + sanity-checks a realm/package path.

hasPrefix

itoa

itoa64

IsPaused

IsSeedingSealed

GovernanceListing

Scalars only: no persistent Listing pointer or screenshot slice escapes.

GetGovernanceListing

HasGovernanceFlag

DefaultPageSize

// default JSON window

MaxPageLimit

// hard cap on any JSON read window (read-DoS guard)

clampLimit

jsonEscape

jsonEscape escapes a string for embedding in a JSON string literal — every listing text field is attacker-supplied, so this is the only thing between a malicious name/tagline/reason/CID and a broken/injected JSON payload on the read path.

screenshotsJSON

screenshotsJSON renders a CID slice as a JSON string array body (each element escaped).

listingJSON

listingJSON renders one listing. \`full\` adds the (large) description + the screenshot gallery — omitted from list windows so a bounded page stays small. rejectReason is short and always included (the My-Submissions view needs it in list windows).

windowByPrefix

windowByPrefix iterates a composite-key index (statusIndex or publisherIndex) over the prefix range \[prefix+"\\x00", prefix+"\\x01") — a true O(offset+limit) window ordered by zero-padded id. When flagFilter is set, flag-hidden listings are excluded (the public live/pending lists).

ListLiveJSON

ListLiveJSON returns a bounded JSON array of the visible (live, un-flag-hidden) listings — the Verified tab. Bounded by scanning only the "live" index slice.

ListByStatusJSON

ListByStatusJSON returns a bounded window of listings in \`status\`. Public tabs (live, pending) exclude flag-hidden listings; rejected/delisted are returned raw (used by curator/owner views). An unknown status returns an empty array — the client passes a fixed enum, never free text.

ListByPublisherJSON

ListByPublisherJSON returns a bounded window of a publisher's listings across ALL statuses (the My-Submissions view) — no flag filter, since a publisher sees their own flagged/rejected.

GetListingJSON

GetListingJSON returns a single listing (any status) with its full detail (descr + screenshots), or the JSON literal \`null\` if the package path is not registered.

RenderMaxRows

RenderMaxRows bounds the Render() output so a large catalog can never make the realm render-DoS (mirrors the feed's live-only bounded render).

Render

Render shows the live catalog (bounded) — a read-only trust surface for gnoweb. The frontend reads structured data via the getters, not this markdown.

moreNote

esc

esc neutralizes the markdown/table metachars that could break the table or inject layout from an attacker-supplied listing field.