Apps, versions, installations, and scopes

An account may create a developer organization. The organization owns an app; an app owns immutable semantic versions; an approved version can be published and installed by a store owner or authorized admin.

Every installation binds one app version, environment, tenant/store, markets, granted scopes, legal consent, capability ceiling, quotas, Origins, redirect URIs, and Webhook purposes. Revoking an installation immediately denies new token use, Webhook delivery, inventory commands, and fulfillment execution while preserving audit history.

High-risk scopes require platform approval. A merchant can grant less than the platform ceiling, never more. Cost, risk, payout approval, platform administration, and secret-reading scopes are not available to ordinary third-party applications.

Manifest extensions are declarative external-service connections. Ayalink does not execute uploaded JavaScript, CSS, HTML, containers, or arbitrary code in the platform process. Store decoration accepts controlled blocks only. Inventory and fulfillment use public APIs, durable intents, and signed events.

Use expectedVersion for state transitions and a 16–128 character high-entropy idempotency key for writes. A 409 means the version or idempotent intent conflicts; do not silently overwrite it.