Example: Host-rendered App Home

commercit.json:

{
  "contractVersion": "app-manifest.v1",
  "slug": "inventory-notes",
  "version": "1.0.0",
  "capabilities": [],
  "schemas": [
    {
      "ref": "inventory.home.input.v1",
      "dialect": "app-json-schema.v1",
      "schema": { "type": "object", "properties": {}, "required": [], "additionalProperties": true }
    },
    {
      "ref": "inventory.home.output.v1",
      "dialect": "app-json-schema.v1",
      "schema": { "type": "object", "properties": {}, "required": [], "additionalProperties": true }
    }
  ],
  "handlers": [
    {
      "ref": "home.render",
      "moduleKey": "core",
      "operations": ["admin.extension.render"],
      "entry": "handlers/home.ts",
      "exportName": "renderHome",
      "profile": "render",
      "workerAbiVersion": "app-worker-js.v1",
      "limitsVersion": "app-platform-limits.v1",
      "inputSchemaRef": "inventory.home.input.v1",
      "outputSchemaRef": "inventory.home.output.v1",
      "allowedTargets": ["surface.admin_extension.home"],
      "allowedTriggers": ["surface"],
      "environmentPolicy": ["preview", "test", "production"],
      "timeoutMs": 500,
      "memoryMiB": 64,
      "idempotency": "optional",
      "requestedCapabilities": [],
      "resourceKeys": [],
      "externalServiceKeys": [],
      "secretDeclarationKeys": []
    }
  ],
  "modules": [],
  "resources": [],
  "externalServices": [],
  "secretDeclarations": [],
  "surfaces": {
    "admin_extensions": [{
      "slug": "home",
      "displayName": "Inventory notes",
      "description": "Manage app-owned inventory notes.",
      "handle": "home",
      "target": "admin.app.home",
      "runtime": "host_components",
      "presentation": "full_page",
      "exposure": null,
      "renderHandlerRef": "home.render",
      "entryArtifactRef": null,
      "artifactOriginKey": null,
      "actionRefs": [],
      "dataSourceRefs": [],
      "visibilityHandlerRef": null,
      "requiredCapabilities": [],
      "contextProjectionId": "admin.app.safe-installation.v1",
      "protocolVersion": "admin-extension-protocol.v1",
      "minHostVersion": "1.0.0",
      "localizedDisplayResource": "inventory.home",
      "budgets": { "startupMs": 500, "interactionMs": 2000, "maxInputBytes": 8192, "maxOutputBytes": 16384 }
    }]
  }
}

handlers/home.ts returns an adminComponentTree. It receives only the safe session projection and can propose only actions declared in the same reviewed manifest. For custom browser UI, use sandbox_iframe; never return executable code to the Admin page or use bundle_url, compiled_code, eval, or new Function.