Architecture
One NEAR account holds the app. Everything else is a service that reads it, writes to it or runs code for it. This page lists which is which, and what breaks when a service goes away.
- A browser asks a gateway over https: testnet.page, a Workers host or quay gateway.
- The gateway calls web4_get over RPC, by default FastNEAR's test.rpc.fastnear.com.
- The RPC node reads your NEAR account, where the contract holds releases, routes, data, members, receipts, the function registry and cron jobs.
- Large files come from FastFS by URL, and the release keeps their sha256.
- The wallet connector signs NEP-413 sign-in messages.
- The contract sends function requests to OutLayer and records the results.
What is on chain
The contract stores these, and any RPC node can read them without a Quay service. Large files are the exception. The release stores an https URL and a sha256, and anyone can check the hash.
The contract wasm is 295,899 bytes, which locks about 2.96 NEAR on each site account. Global contracts are not used, because a global deploy would burn 10 NEAR per 100 KB.
- Releases and the production pointerlive
- Docs, collections and their ruleslive on the Board
- Routes and templates, sealed in a releaselive on the Board
- Memberslive on the Board
- Products and receiptslive on the Board
- Function registry and function resultslive on the Board
- Cron jobs and the schedulelive on the Board, armed by hand
Trust table
Each row is something one operator runs, or that Quay cannot check for you. "Measured" means we saw it fail.
| Piece | What you depend on | How to replace it |
|---|---|---|
| testnet.page | One operator serves every web4 site. Measured: from about 18:12 UTC on Nov 10 it answered every account with HTTP 400 and a deprecated-RPC error, then came back. Its default RPC was the cause. | quay gateway on your machine, the single-file build on Node, Deno or Bun, or the Workers build. This site runs on the Workers build. |
| Workers mirror | The owner's Cloudflare account, running gateway/worker unchanged, one site per host. | Deploy the same worker to your own account with npx wrangler deploy. |
| OutLayer | One operator's TEE network. A run takes 5 to 17 seconds. Its governance keys are single keys, by its own NON_CUSTODIAL.md. Secrets are decrypted inside its enclave, so you trust that enclave and that operator. Guests are WASI wasm in Rust; there is no JavaScript runtime. | No drop-in replacement. Run the same logic on your own server with its own key, as quay relay serve does, or leave functions out. Without OutLayer, posts still land, previews stay empty and cron results stop. |
| FastNEAR | One operator for three things: the default RPC, test.rpc.fastnear.com; FastFS, test.fastfs.io, for large files and function wasm, which stores a file for gas only and served one about 5 minutes after upload; and FastData KV reads. If FastFS drops a file, the release still points at it, and the sha256 still says what it should be. | Pass --rpc. The gateway falls back to testnet-rpc.intea.rs and near-testnet.drpc.org. Store large files with Pinata or Filebase, or at any https URL. OutLayer fetches function wasm from any public https URL and checks its sha256. |
| NEARFS | One operator. Cut as a default. On Nov 10 testnet accepted fs_store uploads and never served them, for hours. The store is still in the CLI. | Use FastFS, Pinata or Filebase. |
| Pinata, Filebase | An API key you hold, and the service's own availability. Implemented, with unit tests. Never run against the live services. | Any IPFS pinning service. The gateway also reads ipfs:// through ipfs.io and dweb.link. |
| Relayer | Its own account and key; its balance is the spend limit. It can refuse requests and cannot move the site. The OutLayer host needs a payment key in the page, so anyone who reads the page can spend it. Scope it to the relay and keep it at a few cents. Calls took 5 to 20 seconds. | Run quay relay serve and fund it with quay relay create. |
| Wallet connector | @hot-labs/near-connect from esm.sh, and the wallets it lists. Sign-in is proven with the NEAR CLI connector only. | Pass your own connector, or sign with an explicit key in Node. |
| Cron | The contract itself, and OutLayer for each run. One arm lasts about 15 hours per 1 PGas with no jobs and about 6 with one hourly job, then a transaction must arm it again. No operator runs it, and nobody re-arms it for you. | Run quay cron arm on a timer you control. |
| RPC providers | A read that matters should not rely on one endpoint. | Any testnet RPC. rpc.testnet.near.org is deprecated and Quay drops it. |
| Your full-access key | It can replace the contract wasm, so a release is not owner-proof. Config changes need 1 yoctoNEAR, which a publish-only key cannot attach. | Keep it off CI. Use quay keys create --ci there. |
Versioned with a release, and not
A release seals files, routes and templates together, and quay rollback swaps all three.
Docs, collection rules, products, members, receipts, function code and secrets, relay settings and cron jobs are live state. A rollback does not touch them, and quay up says so before it runs.
Run it yourself
With your own RPC, quay gateway and, for the writes that need it, quay relay serve, nothing between you and the chain belongs to someone else. Functions and large files are the two layers that still lean on a third party today.
Everything here is testnet. Read Layers for what is deployed and what is pending.