update

doc/core-apps/ai_admin/features.md

@@ -0,0 +1,7 @@
+- ai_admin
+	- admin chat turns prompts or JSON bulk input into proposal cards; AI never executes directly
+	- routes: POST /ai/admin/plan, POST /ai/admin/execute (admin-only)
+	- cards carry tool name, args, missing fields (editable in UI), preview text
+	- execute validates args against tool JSON-schema, runs the tool, writes an audit-log entry
+	- depends on: core, auth, catalog, orders, ai_core
+	- room for growth: more tools (mail templates, bulk import, category mutation), undo history, approval levels, per-tool permissions, dry-run mode

doc/core-apps/ai_admin/specs.md

@@ -0,0 +1,4 @@
+- __init__.py (router, on_load)
+- planner.py (prompt/JSON → list of action cards)
+- tool_defs.py (JSON-schema per tool for argument validation)
+- manifest.yaml

doc/core-apps/ai_core/features.md

@@ -0,0 +1,7 @@
+- ai_core
+	- RAG infrastructure: LLMProvider interface + Ollama implementation, pgvector-backed document store, tool registry
+	- routes: POST /ai/query; admin: POST /ai/reindex, GET /ai/tools
+	- events subscribe: product.*, category.*, core.settings_updated (triggers embedding updates)
+	- depends on: core, catalog
+	- tools are proposals only — never executed directly; ai_admin turns them into confirmation cards
+	- room for growth: re-ranking, source citations, streaming responses, alternative LLM providers (OpenAI-compatible, Anthropic), chunking strategies, evaluation harness

doc/core-apps/ai_core/specs.md

@@ -0,0 +1,7 @@
+- __init__.py (router, on_load, tool registry)
+- models.py (AiDocument with pgvector column)
+- indexer.py (embed + upsert documents)
+- ollama_client.py (LLMProvider implementation)
+- tools.py (Tool base + registry)
+- reindex.py (full rebuild of embeddings)
+- manifest.yaml

doc/core-apps/ai_shop/features.md

@@ -0,0 +1,6 @@
+- ai_shop
+	- natural-language product search for customers; hybrid of embedding similarity and keyword boost
+	- routes: POST /ai/shop/search
+	- shop-aware system prompt (currency, user locale)
+	- depends on: core, catalog, ai_core
+	- room for growth: conversational follow-ups, session memory, filter parsing (price, size, color), spell correction, personalized ranking

doc/core-apps/ai_shop/specs.md

@@ -0,0 +1,2 @@
+- __init__.py (router, on_load)
+- manifest.yaml

doc/core-apps/auth/features.md

@@ -0,0 +1,7 @@
+- auth
+	- registration, login, refresh, logout, password change, own profile
+	- routes: POST /register, /login, /refresh, /logout, /change-password; GET/PUT /me
+	- events emit: user.registered, user.logged_in
+	- depends on: core
+	- seeds: admin@example.com + demo customer
+	- room for growth: OAuth/SSO, API-tokens for third-party apps, 2FA, refresh-token rotation, impersonation, B2B company accounts

doc/core-apps/auth/specs.md

@@ -0,0 +1,3 @@
+- __init__.py (router, on_load)
+- models.py (User, RefreshToken)
+- manifest.yaml

doc/core-apps/cart/features.md

@@ -0,0 +1,5 @@
+- cart
+	- per-user shopping cart, read/write items
+	- routes: GET /cart, POST /cart/items, PUT /cart/items/{id}, DELETE /cart/items/{id}
+	- depends on: core, auth, catalog
+	- room for growth: guest cart (session-based), merge guest cart into user cart on login, saved carts / wishlists, price snapshotting at add-time

doc/core-apps/cart/specs.md

@@ -0,0 +1,3 @@
+- __init__.py (router, on_load)
+- models.py (Cart, CartItem)
+- manifest.yaml

doc/core-apps/catalog/features.md

@@ -0,0 +1,7 @@
+- catalog
+	- products and categories, DE/EN i18n fields, image upload (local storage today)
+	- public routes (read from redis): GET /products, /products/{id}, /categories
+	- admin routes: POST/PUT/DELETE /admin/products, /admin/categories, image upload endpoint
+	- events emit: product.created, product.updated, product.deleted, category.created, category.updated, category.deleted
+	- depends on: core, auth
+	- room for growth: product variants, attributes/tags, SEO slugs, pluggable image storage (S3), stock reservations, price lists (B2B)

doc/core-apps/catalog/specs.md

@@ -0,0 +1,4 @@
+- __init__.py (router, on_load)
+- models.py (Product, Category)
+- projector.py (redis sync on product/category events)
+- manifest.yaml

doc/core-apps/checkout/features.md

@@ -0,0 +1,6 @@
+- checkout
+	- validate cart, take address + payment selection, produce order via payment provider
+	- routes: POST /checkout/preview, POST /checkout/confirm
+	- events emit: checkout.confirmed
+	- depends on: core, auth, catalog, cart, payment
+	- room for growth: coupon slot, shipping-method slot, tax plug-in point, address book, guest checkout, order-draft persistence

doc/core-apps/checkout/specs.md

@@ -0,0 +1,2 @@
+- __init__.py (router, on_load)
+- manifest.yaml

doc/core-apps/features.md

@@ -0,0 +1,6 @@
+- core-apps
+	- shipped with the system, required for a functional shop
+	- same mechanics as any other app (manifest.yaml, router, migrations, events, DI) — no special status in the loader
+	- typically declared `required: true` in manifest so they cannot be switched off
+	- distinct from custom-apps (optional / third-party, not shipped)
+	- cover: auth, product catalog, cart, checkout, payment, orders, mail, shipment (planned), plus the AI layer (ai_core, ai_shop, ai_admin)

doc/core-apps/mail/features.md

@@ -0,0 +1,6 @@
+- mail
+	- MailProvider service registered via DI; SMTP implementation (Mailhog in dev, real SMTP in prod)
+	- Jinja2 templates with DE/EN i18n
+	- no public routes — used by other apps (e.g. orders) through DI
+	- depends on: core
+	- room for growth: outbound queue with retries, provider abstraction (SendGrid, Postmark, SES), richer transactional templates, bounce/complaint handling

doc/core-apps/mail/specs.md

@@ -0,0 +1,2 @@
+- __init__.py (on_load, MailProvider, SMTP implementation)
+- manifest.yaml

doc/core-apps/orders/features.md

@@ -0,0 +1,7 @@
+- orders
+	- customer-facing order list + detail, admin-side management with status transitions
+	- routes: GET /orders, GET /orders/{id}; admin: GET /admin/orders, PUT /admin/orders/{id}/status
+	- events subscribe: checkout.confirmed (create order, trigger confirmation mail)
+	- events emit: order.created, order.status_changed
+	- depends on: core, auth, catalog, mail
+	- room for growth: returns, partial fulfillment, cancellations, invoice PDFs, shipment tracking, export (CSV/ERP)

doc/core-apps/orders/specs.md

@@ -0,0 +1,3 @@
+- __init__.py (router, on_load, event subscribers)
+- models.py (Order, OrderItem, OrderStatusHistory)
+- manifest.yaml

doc/core-apps/payment/features.md

@@ -0,0 +1,5 @@
+- payment
+	- PaymentProvider interface + DummyPayment (always "paid") for dev
+	- routes: GET /payment/methods
+	- depends on: core
+	- room for growth: real providers as separate apps (Stripe, Mollie, Klarna, PayPal), refund API, webhook handling, 3DS/SCA flow, split payments

doc/core-apps/payment/specs.md

@@ -0,0 +1,2 @@
+- __init__.py (router, on_load, DummyPayment provider)
+- manifest.yaml

doc/core-apps/specs.md

@@ -0,0 +1,11 @@
+- auth
+- catalog
+- cart
+- checkout
+- payment
+- orders
+- mail
+- ai_core
+- ai_shop
+- ai_admin
+- shipment (planned, not implemented)