memba_appstore_v1 state

SetRegistrationFee

SetRegistrationFee sets the flat listing fee in ugnot (0..MaxRegistrationFee). Zero is allowed (a fee waiver). Owner only.

SetTreasury

SetTreasury repoints the fee recipient. Must be non-empty (an empty treasury would fail-close RegisterApp). Owner only. Keep this in sync with memba\_market\_config.GetTreasury().

AddCurator

AddCurator grants the curate role (approve pending listings). Owner only.

RemoveCurator

RemoveCurator revokes the curate role. Owner only.

Pause

Pause is the kill switch: while paused, RegisterApp aborts (reads stay available). Owner only.

TransferOwnership

TransferOwnership stages a new owner; it takes effect only after AcceptOwnership is called BY that address (2-step, so a typo can't brick admin).

AcceptOwnership

AcceptOwnership completes the handoff. Only the staged pendingOwner may call it.

boolStr

AdminAddress

AdminAddress is the samcrew-core 2-of-2 multisig (same as the fee spine's admin/ treasury). It is the initial owner AND the initial treasury.

DefaultRegistrationFee

MaxRegistrationFee

MaxNameLen

MaxTaglineLen

MaxDescrLen

MaxURLLen

MaxPkgPathLen

MaxCIDLen

FlagHideThreshold

StatusPending

StatusPending / StatusLive / StatusDelisted are the listing lifecycle states.

StatusLive

StatusPending / StatusLive / StatusDelisted are the listing lifecycle states.

StatusDelisted

StatusPending / StatusLive / StatusDelisted are the listing lifecycle states.

Listing

Listing is one app. PkgPath (the realm/package path) is the unique key.

owner

pendingOwner

treasury

registrationFee

paused

curators

// address string -> bool

listings

// pkgPath -> \*Listing

flaggedBy

// pkgPath + "\\x00" + addr -> bool (one flag per addr)

nextId

init.31

caller

assertOwner

assertNotPaused

RegisterApp

RegisterApp lists a new app. The caller pays EXACTLY registrationFee ugnot with the call; the whole fee is forwarded to the treasury (no custody). The listing starts \`pending\` and is not shown live until a curator approves it.

ApproveApp

ApproveApp flips a pending listing live. Curator-only.

DelistApp

DelistApp removes a listing from public view. The publisher or a curator may do it.

RestoreApp

RestoreApp brings a delisted app back to \`pending\` (re-curation required before it shows live again). Curator-only — this is the reverse of DelistApp, so a mistaken or contested delist is recoverable.

FlagApp

FlagApp lets any user flag a LIVE listing once. At FlagHideThreshold distinct flags the listing stops appearing live; a curator then DelistApp's it or leaves it for review (a delisted app can be brought back with RestoreApp).

isVisible

isVisible reports whether a listing shows in the live list.

GetRegistrationFee

GetRegistrationFee returns the current flat listing fee in ugnot.

GetTreasury

GetOwner

AppCount

AppCount returns the total number of registered listings (any status).

GetStatsJSON

GetStatsJSON returns a small stats object for a status header.

isCurator

mustGet

validatePkgPath

validatePkgPath normalizes + sanity-checks a realm/package path.

hasPrefix

itoa

itoa64

DefaultPageSize

// default JSON window

MaxPageLimit

// hard cap on any JSON read window (read-DoS guard)

clampLimit

jsonEscape

jsonEscape escapes a string for embedding in a JSON string literal — every listing text field is attacker-supplied, so this is the only thing between a malicious name/tagline and a broken/injected JSON payload on the read path.

listingJSON

listingJSON renders one listing. \`full\` adds the (large) description — omitted from list windows so a bounded page stays small.

ListLiveJSON

ListLiveJSON returns a bounded JSON array of the visible (live, un-hidden) listings: skip \`offset\`, take up to clamped \`limit\`. Iteration stops as soon as the window is filled, so the scan is bounded by offset+limit regardless of catalog size.

GetListingJSON

GetListingJSON returns a single listing (any status) with its description, or the JSON literal \`null\` if the package path is not registered.

RenderMaxRows

RenderMaxRows bounds the Render() output so a large catalog can never make the realm render-DoS (mirrors the feed's live-only bounded render).

Render

Render shows the live catalog (bounded) — a read-only trust surface for gnoweb. The frontend reads structured data via the getters, not this markdown.

moreNote

esc

esc neutralizes the markdown/table metachars that could break the table or inject layout from an attacker-supplied listing field.