@drip-apex/sdk 0.1.0 → 0.3.0

package/src/init-cart-attributes.test.ts

@@ -0,0 +1,2003 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  RECENT_MONDAY_NOON, documentListeners, windowListeners, appendedAntiFlickerStyle, configPayloadHash, flushDynamicImports, installCookieJar, installMutationObserverStub, makeClassList, makeStorage, readCookieValue, readDecodedDripContext, registerInitTestLifecycle, verifiedHandoverResponse,
+} from "./init-test-helpers";
+
+describe("init cart attributes", () => {
+  registerInitTestLifecycle();
+
+  it("announces when the signed attribution envelope becomes available", async () => {
+    const { __test, init } = await import("./index");
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_envelope",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_envelope", weight: 1, mutations: [] }],
+      }],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_123",
+    });
+    const input = __test!.buildActiveCartAttributeSyncInput(true);
+
+    input!.onAttributionEnvelope!("signed-envelope");
+
+    expect(document.dispatchEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ type: "apex:attribution-envelope" }),
+    );
+  });
+
+
+  it("stamps the first active assignment onto Shopify cart attributes", async () => {
+    (globalThis as any).window.Shopify = {};
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    const { init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_first",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_first", weight: 1, mutations: [] }],
+        },
+        {
+          id: "exp_second",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_second", weight: 1, mutations: [] }],
+        },
+      ],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_123",
+    });
+    await Promise.resolve();
+
+    const fetchMock = vi.mocked(globalThis.fetch);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fetchMock.mock.calls[0]?.[0]).toBe("/cart/update.js");
+    const body = JSON.parse(String(fetchMock.mock.calls[0]?.[1]?.body));
+    expect(body.attributes).toMatchObject({
+      apex_experiment_id: "exp_first",
+      apex_variation_id: "var_first",
+      apex_visitor_id: "visitor_123",
+    });
+    expect(body.attributes.apex_session_id).toEqual(expect.any(String));
+  });
+
+
+  it("does not write active assignments when an external integration owns cart attributes", async () => {
+    (globalThis as any).window.Shopify = {};
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    const { getCartAttributes, init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      cartAttributeScope: "all",
+      cartAttributeWrite: "external",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_external_cart",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_external_cart", weight: 1, mutations: [] }],
+      }],
+      hasConsent: true,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_external_cart",
+    });
+    await flushDynamicImports();
+
+    expect(vi.mocked(globalThis.fetch).mock.calls.some(([url]) => url === "/cart/update.js"))
+      .toBe(false);
+    expect(getCartAttributes()).toEqual(expect.arrayContaining([
+      { key: "apex_experiment_id", value: "exp_external_cart" },
+      { key: "apex_variation_id", value: "var_external_cart" },
+      { key: "apex_visitor_id", value: "visitor_external_cart" },
+      { key: "apex_assignment_authorization", value: "" },
+    ]));
+  });
+
+
+  it("returns only arm labels for an external all-scope declined visitor", async () => {
+    const { getCartAttributes, init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      cartAttributeScope: "all",
+      cartAttributeWrite: "external",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_external_all",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_external_all", weight: 1, mutations: [] }],
+      }],
+      hasConsent: false,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_external_all",
+    });
+
+    const attributes = getCartAttributes();
+    expect(attributes).toEqual([{
+      key: "apex_assignments",
+      value: JSON.stringify([{ e: "exp_external_all", v: "var_external_all", ep: 1 }]),
+    }]);
+    expect(attributes.map(({ key }) => key)).not.toEqual(expect.arrayContaining([
+      "apex_visitor_id",
+      "apex_session_id",
+      "apex_assignment_authorization",
+    ]));
+    expect(localStorage.getItem("drip_assignments_v1")).toBeNull();
+    expect(readCookieValue("drip_assignments_v1")).toBeNull();
+  });
+
+
+  it("keeps session-activated arm labels after SPA page deactivation and replaces a later epoch", async () => {
+    const triggeredExperiment = {
+      id: "exp_external_triggered",
+      status: "running" as const,
+      targeting: { url: [{ type: "simple" as const, pattern: "/products/*" }] },
+      trafficAllocation: 1,
+      assignmentEpoch: 1,
+      variations: [{ id: "var_external_triggered", weight: 1, mutations: [] }],
+    };
+    Object.assign((globalThis as any).location, {
+      href: "https://plain.test/products/example",
+      pathname: "/products/example",
+    });
+    const { getAssignments, getCartAttributes, init, reInit } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      cartAttributeScope: "all",
+      cartAttributeWrite: "external",
+      consentMode: { enabled: true },
+      experiments: [{
+        id: "exp_external_global",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_external_global", weight: 1, mutations: [] }],
+      }, triggeredExperiment],
+      hasConsent: false,
+      shopId: "shop_123",
+      spa: { routerMode: "history" },
+      trackingStart: "immediate",
+      userId: "visitor_external_session_ledger",
+    });
+
+    Object.assign((globalThis as any).location, {
+      href: "https://plain.test/cart",
+      pathname: "/cart",
+    });
+    (globalThis as any).history.pushState({}, "", "/cart");
+    expect(getAssignments().map(({ experimentId }) => experimentId)).toEqual([
+      "exp_external_global",
+    ]);
+    expect(JSON.parse(getCartAttributes()[0]!.value)).toEqual([
+      { e: "exp_external_global", v: "var_external_global", ep: 1 },
+      { e: "exp_external_triggered", v: "var_external_triggered", ep: 1 },
+    ]);
+
+    triggeredExperiment.assignmentEpoch = 2;
+    Object.assign((globalThis as any).location, {
+      href: "https://plain.test/products/again",
+      pathname: "/products/again",
+    });
+    reInit();
+    Object.assign((globalThis as any).location, {
+      href: "https://plain.test/cart",
+      pathname: "/cart",
+    });
+    reInit();
+    expect(JSON.parse(getCartAttributes()[0]!.value)).toEqual([
+      { e: "exp_external_global", v: "var_external_global", ep: 1 },
+      { e: "exp_external_triggered", v: "var_external_triggered", ep: 2 },
+    ]);
+  });
+
+
+  it("re-checks contamination for session-ledger cart assignments", async () => {
+    (globalThis as any).document.querySelectorAll = vi.fn(() => []);
+    const contaminatedExperiment = {
+      id: "exp_external_contaminated",
+      status: "running" as const,
+      targeting: { url: [{ type: "simple" as const, pattern: "/products/*" }] },
+      trafficAllocation: 1,
+      variations: [{
+        id: "var_external_contaminated",
+        weight: 1,
+        mutations: [] as Array<{ selector: string; action: "text"; text: string }>,
+      }],
+    };
+    Object.assign((globalThis as any).location, {
+      href: "https://plain.test/products/example",
+      pathname: "/products/example",
+    });
+    const { flush, getCartAttributes, init, reInit } = await import("./index");
+    init({
+      antiFlickerMode: "off",
+      cartAttributeScope: "all",
+      cartAttributeWrite: "external",
+      consentMode: { enabled: true },
+      experiments: [contaminatedExperiment],
+      hasConsent: false,
+      shopId: "shop_123",
+      spa: { activationMode: "manual" },
+      trackingStart: "immediate",
+      userId: "visitor_external_contaminated",
+    });
+    expect(getCartAttributes()).toHaveLength(1);
+
+    contaminatedExperiment.variations[0]!.mutations.push({
+      selector: "#missing",
+      action: "text",
+      text: "Missing",
+    });
+    reInit(true);
+    await flush();
+    expect(getCartAttributes()).toEqual([]);
+    // Eviction happens at contamination time, so a later re-init pruning the
+    // contamination marker cannot resurrect the entry fail-open.
+    const { __test: internals } = await import("./index");
+    expect(internals!.attributionLedgerHas("exp_external_contaminated")).toBe(false);
+    Object.assign((globalThis as any).location, {
+      href: "https://plain.test/cart",
+      pathname: "/cart",
+    });
+    reInit();
+    expect(getCartAttributes()).toEqual([]);
+  });
+
+
+  it("does not wipe the session ledger on a guarded no-op init", async () => {
+    (globalThis as any).document.querySelectorAll = vi.fn(() => []);
+    const triggeredExperiment = {
+      id: "exp_guarded_noop",
+      status: "running" as const,
+      targeting: { url: [{ type: "simple" as const, pattern: "/products/*" }] },
+      trafficAllocation: 1,
+      variations: [{ id: "var_guarded_noop", weight: 1, mutations: [] }],
+    };
+    Object.assign((globalThis as any).location, {
+      href: "https://plain.test/products/example",
+      pathname: "/products/example",
+    });
+    const { getCartAttributes, init, reInit } = await import("./index");
+    const config = {
+      antiFlickerMode: "off" as const,
+      cartAttributeScope: "all" as const,
+      cartAttributeWrite: "external" as const,
+      consentMode: { enabled: true },
+      experiments: [triggeredExperiment],
+      hasConsent: false,
+      shopId: "shop_123",
+      spa: { activationMode: "manual" as const },
+      trackingStart: "immediate" as const,
+      userId: "visitor_guarded_noop",
+    };
+    init(config);
+    expect(getCartAttributes()).toHaveLength(1);
+
+    // A guarded init (edge mode) returns before committing a re-init and must
+    // not clear the session ledger.
+    init({ ...config, executionMode: "edge" as const });
+
+    Object.assign((globalThis as any).location, {
+      href: "https://plain.test/cart",
+      pathname: "/cart",
+    });
+    reInit();
+    const label = getCartAttributes();
+    expect(label).toHaveLength(1);
+    expect(label[0]!.value).toContain("exp_guarded_noop");
+  });
+
+
+  it("keeps the consented cart authorization builder isolated from session-ledger entries", async () => {
+    Object.assign((globalThis as any).location, {
+      href: "https://plain.test/products/example",
+      pathname: "/products/example",
+    });
+    const { __test, init, reInit } = await import("./index");
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true },
+      experiments: [{
+        id: "exp_consented_global",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_consented_global", weight: 1, mutations: [] }],
+      }, {
+        id: "exp_consented_triggered",
+        status: "running",
+        targeting: { url: [{ type: "simple", pattern: "/products/*" }] },
+        trafficAllocation: 1,
+        variations: [{ id: "var_consented_triggered", weight: 1, mutations: [] }],
+      }],
+      hasConsent: true,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_consented_session_ledger",
+    });
+    Object.assign((globalThis as any).location, {
+      href: "https://plain.test/cart",
+      pathname: "/cart",
+    });
+    reInit();
+
+    expect(__test!.buildActiveCartAttributeSyncInput(true)?.assignments).toEqual([
+      {
+        experimentId: "exp_consented_global",
+        variationId: "var_consented_global",
+        pageActive: true,
+        assignmentEpoch: 1,
+      },
+      {
+        experimentId: "exp_consented_triggered",
+        variationId: "var_consented_triggered",
+        pageActive: false,
+        assignmentEpoch: 1,
+      },
+    ]);
+  });
+
+
+  it("keeps the session label when a duplicate init no-ops", async () => {
+    Object.assign((globalThis as any).location, {
+      href: "https://plain.test/products/example",
+      pathname: "/products/example",
+    });
+    const { getCartAttributes, init, reInit } = await import("./index");
+    const baseConfig = {
+      antiFlickerMode: "off" as const,
+      cartAttributeScope: "all" as const,
+      cartAttributeWrite: "external" as const,
+      consentMode: { enabled: true },
+      hasConsent: false,
+      shopId: "shop_123",
+      trackingStart: "immediate" as const,
+      userId: "visitor_external_reinit",
+    };
+    init({ ...baseConfig, experiments: [{
+      id: "exp_external_reinit",
+      status: "running",
+      targeting: { url: [{ type: "simple", pattern: "/products/*" }] },
+      trafficAllocation: 1,
+      variations: [{ id: "var_external_reinit", weight: 1, mutations: [] }],
+    }] });
+    Object.assign((globalThis as any).location, {
+      href: "https://plain.test/cart",
+      pathname: "/cart",
+    });
+    reInit();
+    expect(getCartAttributes()).toHaveLength(1);
+
+    // A second init in the same JS context is a duplicate no-op (global boot
+    // flag) and must not wipe attribution the session already earned. A
+    // committed re-init only happens in a fresh context, where the ledger is
+    // a new empty Map by construction.
+    init({ ...baseConfig, experiments: [] });
+    expect(getCartAttributes()).toHaveLength(1);
+  });
+
+
+  it("clears stale Apex identity while merging external all-scope declined cart labels", async () => {
+    const { init, mergeCartAttributes } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      cartAttributeScope: "all",
+      cartAttributeWrite: "external",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_external_merge",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_external_merge", weight: 1, mutations: [] }],
+      }],
+      hasConsent: false,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_external_merge",
+    });
+
+    expect(mergeCartAttributes([
+      { key: "gift_message", value: "Happy birthday", __typename: "Attribute" },
+      { key: "apex_assignments", value: "prior assignments" },
+      { key: "apex_visitor_id", value: "visitor_prior" },
+      { key: "apex_session_id", value: "session_prior" },
+      { key: "apex_assignment_authorization", value: "authorization_prior" },
+      { key: "delivery_note", value: "Leave at door", extra: "drop me" },
+    ])).toEqual([
+      { key: "gift_message", value: "Happy birthday" },
+      { key: "delivery_note", value: "Leave at door" },
+      {
+        key: "apex_assignments",
+        value: JSON.stringify([{
+          e: "exp_external_merge",
+          v: "var_external_merge",
+          ep: 1,
+        }]),
+      },
+    ]);
+  });
+
+
+  it("selects external all-scope declined cart labels by allowlisted key", async () => {
+    vi.doMock("./shopify-cart", async () => {
+      const actual = await vi.importActual<typeof import("./shopify-cart")>("./shopify-cart");
+      return {
+        ...actual,
+        buildCartAttributeEntries: (...args: Parameters<typeof actual.buildCartAttributeEntries>) => (
+          actual.buildCartAttributeEntries(...args).reverse()
+        ),
+      };
+    });
+    const { getCartAttributes, init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      cartAttributeScope: "all",
+      cartAttributeWrite: "external",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_external_reordered",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_external_reordered", weight: 1, mutations: [] }],
+      }],
+      hasConsent: false,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_external_reordered",
+    });
+
+    const attributes = getCartAttributes();
+    expect(attributes).toHaveLength(1);
+    expect(attributes[0]).toEqual({
+      key: "apex_assignments",
+      value: JSON.stringify([{
+        e: "exp_external_reordered",
+        v: "var_external_reordered",
+        ep: 1,
+      }]),
+    });
+  });
+
+
+  it("returns no cart labels for a declined visitor with default scope", async () => {
+    const { getCartAttributes, init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_scope_default",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_scope_default", weight: 1, mutations: [] }],
+      }],
+      hasConsent: false,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_scope_default",
+    });
+
+    expect(getCartAttributes()).toEqual([]);
+  });
+
+
+  it("aborts an in-flight SDK cart write when config flips to external", async () => {
+    (globalThis as any).window.Shopify = {};
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    const experiment = {
+      id: "exp_external_flip",
+      status: "running" as const,
+      trafficAllocation: 1,
+      variations: [{ id: "var_external_flip", weight: 1, mutations: [] }],
+    };
+    localStorage.setItem("drip_cfg:shop_123:production", JSON.stringify({
+      fetchedAt: Date.now(),
+      hash: "cached-sdk-cart-write-owner",
+      experiments: [experiment],
+      runtime: { commerce: { cartAttributeWrite: "sdk" } },
+    }));
+    let cartWriteSignal: AbortSignal | undefined;
+    let resolveConfig!: (response: Response) => void;
+    globalThis.fetch = vi.fn((input: RequestInfo | URL, requestInit?: RequestInit) => {
+      if (String(input).includes("/config")) {
+        return new Promise<Response>((resolve) => { resolveConfig = resolve; });
+      }
+      if (input === "/cart/update.js") {
+        cartWriteSignal = requestInit?.signal ?? undefined;
+        return new Promise<Response>((_resolve, reject) => {
+          cartWriteSignal?.addEventListener("abort", () => {
+            reject(new DOMException("The operation was aborted.", "AbortError"));
+          }, { once: true });
+        });
+      }
+      return Promise.resolve(new Response("ok", { status: 202 }));
+    }) as any;
+    const { getDiagnostics, init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      lateConfigPolicy: "apply",
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_external_flip",
+    });
+    await vi.waitFor(() => expect(cartWriteSignal).toBeDefined());
+
+    resolveConfig(Response.json({
+      experiments: [experiment],
+      runtime: { commerce: { cartAttributeWrite: "external" } },
+    }));
+    await vi.waitFor(() => expect(getDiagnostics().configSource).toBe("network"));
+
+    expect(cartWriteSignal?.aborted).toBe(true);
+    expect(vi.mocked(globalThis.fetch).mock.calls.filter(
+      ([url]) => url === "/cart/update.js",
+    )).toHaveLength(1);
+  });
+
+
+  it("does not let a legacy cached runtime override a fresh external write owner", async () => {
+    (globalThis as any).window.Shopify = {};
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    localStorage.setItem("drip_cfg:shop_123:production", JSON.stringify({
+      fetchedAt: Date.now(),
+      hash: "legacy-cache-before-cart-write-owner",
+      experiments: [{
+        id: "exp_legacy_external",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_legacy_external", weight: 1, mutations: [] }],
+      }],
+      runtime: { antiFlicker: { mode: "off" } },
+    }));
+    globalThis.fetch = vi.fn((input: RequestInfo | URL) => {
+      if (String(input).includes("/config")) return new Promise<Response>(() => {});
+      return Promise.resolve(new Response("ok", { status: 202 }));
+    }) as any;
+    const { init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      cartAttributeWrite: "external",
+      endpoint: "https://events.test",
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_legacy_external",
+    });
+    await flushDynamicImports();
+
+    expect(vi.mocked(globalThis.fetch).mock.calls.some(
+      ([url]) => url === "/cart/update.js",
+    )).toBe(false);
+  });
+
+
+  it("clears prior signed Shopify treatment attributes for holdout when analytics is blocked", async () => {
+    (globalThis as any).window.Shopify = {};
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    const { getDiagnostics, init } = await import("./index");
+    const { isHoldoutVisitor } = await import("./hash");
+    const userId = Array.from({ length: 1000 }, (_, index) => `cart-holdout-${index}`).find((id) =>
+      isHoldoutVisitor({ holdout_v1_enabled: true, holdout_pct: 10 }, id),
+    );
+    expect(userId).toBeTruthy();
+
+    init({
+      antiFlickerMode: "off",
+      commerce: {
+        offers: {
+          authorization: {
+            checksum: "a".repeat(64),
+            experimentIds: ["exp_holdout_cart"],
+            revision: 7,
+            version: 1,
+          },
+          experiments: [],
+        },
+      },
+      consentMode: { enabled: true },
+      debug: { enabled: true, restrictMode: "always" },
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_holdout_cart",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_holdout_cart", weight: 1, mutations: [] }],
+        },
+      ],
+      holdout_v1_enabled: true,
+      holdout_pct: 10,
+      hasConsent: false,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: userId!,
+    });
+    await flushDynamicImports();
+
+    const fetchMock = vi.mocked(globalThis.fetch);
+    const cartUpdate = fetchMock.mock.calls.find(([url]) => url === "/cart/update.js");
+    expect(cartUpdate).toBeTruthy();
+    expect(getDiagnostics().trackingBlocked).toBe(true);
+    expect(getDiagnostics().analyticsStarted).toBe(false);
+    const body = JSON.parse(String(cartUpdate?.[1]?.body));
+    const priorSignedAttributes = {
+      apex_assignments: JSON.stringify([{ e: "exp_prior", v: "var_prior", ep: 5 }]),
+      apex_assignment_authorization: "signed-prior-treatment",
+      apex_experiment_id: "exp_prior",
+      apex_variation_id: "var_prior",
+      apex_assignment_epoch: "5",
+    };
+    expect({ ...priorSignedAttributes, ...body.attributes }).toEqual({
+      apex_assignments: "[]",
+      apex_assignment_authorization: "",
+      apex_experiment_id: "",
+      apex_variation_id: "",
+      apex_assignment_epoch: "",
+      apex_visitor_id: userId,
+      apex_session_id: expect.any(String),
+    });
+  });
+
+
+  it("keeps blocked active assignment cart sync analytics-gated", async () => {
+    (globalThis as any).window.Shopify = {};
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    const { init } = await import("./index");
+    const { isHoldoutVisitor } = await import("./hash");
+    const userId = Array.from({ length: 1000 }, (_, index) => `cart-blocked-active-${index}`)
+      .find((id) => !isHoldoutVisitor({ holdout_v1_enabled: true, holdout_pct: 10 }, id));
+    expect(userId).toBeTruthy();
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_blocked_active_cart",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_blocked_active_cart", weight: 1, mutations: [] }],
+        },
+      ],
+      hasConsent: false,
+      holdout_v1_enabled: true,
+      holdout_pct: 10,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: userId!,
+    });
+    await flushDynamicImports();
+
+    const fetchMock = vi.mocked(globalThis.fetch);
+    expect(fetchMock.mock.calls.some(([url]) => url === "/cart/update.js")).toBe(false);
+  });
+
+
+  it("mints arm labels only on the first product-page click when the served gate is true", async () => {
+    (globalThis as any).window.Shopify = {};
+    (globalThis as any).window.ShopifyAnalytics = {
+      meta: { page: { pageType: "collection" } },
+    };
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    const { init } = await import("./index");
+
+    init({
+      cartAttributeScope: "all",
+      antiFlickerMode: "off",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_sdk_cart_mint",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_sdk_cart_mint", weight: 1, mutations: [] }],
+      }],
+      hasConsent: false,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "ephemeral_visitor",
+    });
+
+    for (const handler of documentListeners.click ?? []) handler();
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+
+    (globalThis as any).window.ShopifyAnalytics.meta.page.pageType = "product";
+    for (const handler of documentListeners.click ?? []) handler();
+    await flushDynamicImports();
+
+    const fetchMock = vi.mocked(globalThis.fetch);
+    const cartCalls = fetchMock.mock.calls.filter(([url]) => url === "/cart/update.js");
+    expect(cartCalls).toHaveLength(1);
+    expect(JSON.parse(String(cartCalls[0]?.[1]?.body))).toEqual({
+      attributes: {
+        apex_assignments: JSON.stringify([{
+          e: "exp_sdk_cart_mint",
+          v: "var_sdk_cart_mint",
+          ep: 1,
+        }]),
+        apex_assignment_authorization: "",
+        apex_experiment_id: "",
+        apex_variation_id: "",
+        apex_assignment_epoch: "",
+        apex_visitor_id: "",
+        apex_session_id: "",
+      },
+    });
+    expect((globalThis as any).localStorage.length).toBe(0);
+    expect((globalThis as any).sessionStorage.length).toBe(0);
+  });
+
+
+  it("uses the normal active cart sync when consent is already granted", async () => {
+    (globalThis as any).window.Shopify = {};
+    (globalThis as any).window.ShopifyAnalytics = {
+      meta: { page: { pageType: "product" } },
+    };
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    const { init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      cartAttributeScope: "all",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_granted_cart",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_granted_cart", weight: 1, mutations: [] }],
+      }],
+      hasConsent: true,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_granted_cart",
+    });
+    await flushDynamicImports();
+
+    for (const handler of documentListeners.click ?? []) handler();
+    await flushDynamicImports();
+
+    const cartCalls = vi.mocked(globalThis.fetch).mock.calls
+      .filter(([url]) => url === "/cart/update.js");
+    expect(cartCalls).toHaveLength(1);
+    expect(JSON.parse(String(cartCalls[0]?.[1]?.body)).attributes).toMatchObject({
+      apex_visitor_id: "visitor_granted_cart",
+      apex_session_id: expect.any(String),
+    });
+  });
+
+
+  it("does not mint cart labels when Do Not Track blocks tracking", async () => {
+    Object.defineProperty(globalThis, "navigator", {
+      configurable: true,
+      value: { userAgent: "Mozilla/5.0", doNotTrack: "1" },
+    });
+    (globalThis as any).window.Shopify = {};
+    (globalThis as any).window.ShopifyAnalytics = {
+      meta: { page: { pageType: "product" } },
+    };
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    const { init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      cartAttributeScope: "all",
+      consentMode: { enabled: true },
+      dataProtection: { respectDoNotTrack: true, storageMode: "localStorage" },
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_dnt_cart",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_dnt_cart", weight: 1, mutations: [] }],
+      }],
+      hasConsent: false,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_dnt_cart",
+    });
+
+    for (const handler of documentListeners.click ?? []) handler();
+    await flushDynamicImports();
+
+    expect(vi.mocked(globalThis.fetch).mock.calls.some(([url]) => url === "/cart/update.js"))
+      .toBe(false);
+    expect(documentListeners.click ?? []).toHaveLength(0);
+  });
+
+
+  it("does not mint consent-pending cart attributes when an external integration owns writes", async () => {
+    (globalThis as any).window.Shopify = {};
+    (globalThis as any).window.ShopifyAnalytics = {
+      meta: { page: { pageType: "product" } },
+    };
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    const { init } = await import("./index");
+
+    init({
+      cartAttributeScope: "all",
+      antiFlickerMode: "off",
+      cartAttributeWrite: "external",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_external_mint",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_external_mint", weight: 1, mutations: [] }],
+      }],
+      hasConsent: false,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "ephemeral_external_mint",
+    });
+
+    for (const handler of documentListeners.click ?? []) handler();
+    await flushDynamicImports();
+
+    expect(vi.mocked(globalThis.fetch).mock.calls.some(([url]) => url === "/cart/update.js"))
+      .toBe(false);
+    expect(documentListeners.click ?? []).toHaveLength(0);
+  });
+
+
+  it("keeps the consent-pending mint default-off when the served gate is absent", async () => {
+    (globalThis as any).window.Shopify = {};
+    (globalThis as any).window.ShopifyAnalytics = {
+      meta: { page: { pageType: "product" } },
+    };
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    const { init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_gate_off",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_gate_off", weight: 1, mutations: [] }],
+      }],
+      hasConsent: false,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "ephemeral_visitor",
+    });
+
+    for (const handler of documentListeners.click ?? []) handler();
+    await flushDynamicImports();
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+  });
+
+
+  it("writes the full consented stamp after an in-flight minimal stamp", async () => {
+    (globalThis as any).window.Shopify = {};
+    (globalThis as any).window.ShopifyAnalytics = {
+      meta: { page: { pageType: "product" } },
+    };
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    let finishMinimal!: (response: Response) => void;
+    globalThis.fetch = vi.fn((url: RequestInfo | URL) => {
+      const cartCallCount = vi.mocked(globalThis.fetch).mock.calls
+        .filter(([calledUrl]) => calledUrl === "/cart/update.js").length;
+      if (url === "/cart/update.js" && cartCallCount === 1) {
+        return new Promise<Response>((resolve) => { finishMinimal = resolve; });
+      }
+      return Promise.resolve(new Response("{}", { status: 200 }));
+    }) as any;
+    const { init, setConsent } = await import("./index");
+
+    init({
+      cartAttributeScope: "all",
+      antiFlickerMode: "off",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_transition",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_transition", weight: 1, mutations: [] }],
+      }],
+      hasConsent: false,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_transition",
+    });
+    for (const handler of documentListeners.click ?? []) handler();
+    await Promise.resolve();
+    setConsent(true);
+
+    expect(vi.mocked(globalThis.fetch).mock.calls.filter(([url]) => url === "/cart/update.js"))
+      .toHaveLength(1);
+    finishMinimal(new Response("{}", { status: 200 }));
+    await flushDynamicImports();
+
+    const cartCalls = vi.mocked(globalThis.fetch).mock.calls
+      .filter(([url]) => url === "/cart/update.js");
+    expect(cartCalls).toHaveLength(2);
+    const minimal = JSON.parse(String(cartCalls[0]?.[1]?.body)).attributes;
+    const consented = JSON.parse(String(cartCalls[1]?.[1]?.body)).attributes;
+    expect(minimal).toMatchObject({
+      apex_assignment_authorization: "",
+      apex_experiment_id: "",
+      apex_variation_id: "",
+      apex_assignment_epoch: "",
+      apex_visitor_id: "",
+      apex_session_id: "",
+    });
+    expect(JSON.parse(consented.apex_assignments)).toEqual([
+      { e: "exp_transition", v: "var_transition", ep: 1 },
+    ]);
+    expect(consented).toMatchObject({
+      apex_visitor_id: "visitor_transition",
+      apex_session_id: expect.any(String),
+    });
+  });
+
+
+  it("finishes an in-flight consent-pending stamp before a consented re-init stamp", async () => {
+    (globalThis as any).window.Shopify = {};
+    (globalThis as any).window.ShopifyAnalytics = {
+      meta: { page: { pageType: "product" } },
+    };
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    (globalThis as any).document.removeEventListener = vi.fn(
+      (type: string, handler: () => void) => {
+        documentListeners[type] = (documentListeners[type] ?? [])
+          .filter((candidate) => candidate !== handler);
+      },
+    );
+    let finishConfig!: (response: Response) => void;
+    let finishSdkCartMint!: () => void;
+    let cartAttributes: Record<string, string> = {};
+    const cachedExperiment = {
+      id: "exp_cached_sdk_cart_mint",
+      status: "running" as const,
+      trafficAllocation: 1,
+      variations: [{ id: "var_cached_sdk_cart_mint", weight: 1, mutations: [] }],
+    };
+    const networkExperiment = {
+      id: "exp_network_consented",
+      status: "running" as const,
+      trafficAllocation: 1,
+      variations: [{ id: "var_network_consented", weight: 1, mutations: [] }],
+    };
+    const runtime = {
+      commerce: { cartAttributeScope: "all" },
+      antiFlicker: { mode: "off" },
+      consentMode: { enabled: true },
+    };
+    const { __test, init, setConsent } = await import("./index");
+    (globalThis as any).localStorage.setItem(
+      __test!.getConfigCacheKey("shop_123"),
+      JSON.stringify({
+        experiments: [cachedExperiment],
+        fetchedAt: Date.now(),
+        hash: "force-network-refresh",
+        runtime,
+      }),
+    );
+    globalThis.fetch = vi.fn((url: RequestInfo | URL, request?: RequestInit) => {
+      if (String(url).includes("/config?")) {
+        return new Promise<Response>((resolve) => { finishConfig = resolve; });
+      }
+      if (url === "/cart/update.js") {
+        const nextAttributes = JSON.parse(String(request?.body)).attributes as Record<string, string>;
+        const cartCallCount = vi.mocked(globalThis.fetch).mock.calls
+          .filter(([calledUrl]) => calledUrl === "/cart/update.js").length;
+        if (cartCallCount === 1) {
+          return new Promise<Response>((resolve) => {
+            finishSdkCartMint = () => {
+              cartAttributes = { ...cartAttributes, ...nextAttributes };
+              resolve(new Response("{}", { status: 200 }));
+            };
+          });
+        }
+        cartAttributes = { ...cartAttributes, ...nextAttributes };
+        return Promise.resolve(new Response("{}", { status: 200 }));
+      }
+      return Promise.resolve(new Response("{}", { status: 202 }));
+    }) as any;
+
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_reinit_ordering",
+    });
+    await vi.waitFor(() => expect(documentListeners.click).toHaveLength(1));
+    for (const handler of documentListeners.click ?? []) handler();
+    await vi.waitFor(() => {
+      expect(vi.mocked(globalThis.fetch).mock.calls.filter(([url]) => url === "/cart/update.js"))
+        .toHaveLength(1);
+    });
+
+    expect(vi.mocked(globalThis.fetch).mock.calls.filter(([url]) => url === "/cart/update.js"))
+      .toHaveLength(1);
+    finishConfig(new Response(JSON.stringify({
+      experiments: [networkExperiment],
+      runtime,
+    }), { status: 200 }));
+    await flushDynamicImports();
+    setConsent(true);
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(vi.mocked(globalThis.fetch).mock.calls.filter(([url]) => url === "/cart/update.js"))
+      .toHaveLength(1);
+    finishSdkCartMint();
+    await flushDynamicImports();
+
+    expect(vi.mocked(globalThis.fetch).mock.calls.filter(([url]) => url === "/cart/update.js"))
+      .toHaveLength(2);
+    expect(JSON.parse(cartAttributes.apex_assignments)).toEqual([{
+      e: "exp_network_consented",
+      v: "var_network_consented",
+      ep: 1,
+    }]);
+    expect(cartAttributes).toMatchObject({
+      apex_visitor_id: "visitor_reinit_ordering",
+      apex_session_id: expect.any(String),
+    });
+  });
+
+
+  it("writes the full consented stamp after the consent-pending mint rejects", async () => {
+    (globalThis as any).window.Shopify = {};
+    (globalThis as any).window.ShopifyAnalytics = {
+      meta: { page: { pageType: "product" } },
+    };
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    const shopifyCart = await import("./shopify-cart");
+    const syncShopifyCartAttributes = vi.spyOn(shopifyCart, "syncShopifyCartAttributes");
+    syncShopifyCartAttributes.mockRejectedValueOnce(new Error("mint rejected"));
+    const { init, setConsent } = await import("./index");
+
+    init({
+      cartAttributeScope: "all",
+      antiFlickerMode: "off",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_rejected_transition",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_rejected_transition", weight: 1, mutations: [] }],
+      }],
+      hasConsent: false,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_rejected_transition",
+    });
+    for (const handler of documentListeners.click ?? []) handler();
+    setConsent(true);
+    await flushDynamicImports();
+
+    const consentedCalls = syncShopifyCartAttributes.mock.calls.slice(1)
+      .filter(([input]) => input.visitorId === "visitor_rejected_transition");
+    expect(consentedCalls.length).toBeGreaterThanOrEqual(1);
+    expect(consentedCalls[0]?.[0]).toMatchObject({
+      assignments: [{
+        experimentId: "exp_rejected_transition",
+        variationId: "var_rejected_transition",
+        assignmentEpoch: 1,
+      }],
+      visitorId: "visitor_rejected_transition",
+    });
+    const cartCalls = vi.mocked(globalThis.fetch).mock.calls
+      .filter(([url]) => url === "/cart/update.js");
+    expect(cartCalls).toHaveLength(1);
+    expect(JSON.parse(String(cartCalls[0]?.[1]?.body)).attributes).toMatchObject({
+      apex_visitor_id: "visitor_rejected_transition",
+      apex_session_id: expect.any(String),
+    });
+  });
+
+
+  it("keeps one consent-pending product-click handler across two inits", async () => {
+    (globalThis as any).window.Shopify = {};
+    (globalThis as any).window.ShopifyAnalytics = {
+      meta: { page: { pageType: "product" } },
+    };
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    (globalThis as any).document.removeEventListener = vi.fn(
+      (type: string, handler: () => void) => {
+        documentListeners[type] = (documentListeners[type] ?? [])
+          .filter((candidate) => candidate !== handler);
+      },
+    );
+    const experiment = {
+      id: "exp_reinit_sdk_cart_mint",
+      status: "running" as const,
+      trafficAllocation: 1,
+      variations: [{ id: "var_reinit_sdk_cart_mint", weight: 1, mutations: [] }],
+    };
+    const runtime = {
+      commerce: { cartAttributeScope: "all" },
+      antiFlicker: { mode: "off" },
+      consentMode: { enabled: true },
+    };
+    const { __test, init } = await import("./index");
+    (globalThis as any).localStorage.setItem(
+      __test!.getConfigCacheKey("shop_123"),
+      JSON.stringify({
+        experiments: [experiment],
+        fetchedAt: Date.now(),
+        hash: "force-network-refresh",
+        runtime,
+      }),
+    );
+    globalThis.fetch = vi.fn(async (url: RequestInfo | URL) => {
+      if (String(url).includes("/config?")) {
+        return new Response(JSON.stringify({ experiments: [experiment], runtime }), {
+          status: 200,
+        });
+      }
+      return new Response("{}", { status: 200 });
+    }) as any;
+
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_reinit_sdk_cart_mint",
+    });
+    await flushDynamicImports();
+
+    expect(documentListeners.click).toHaveLength(1);
+    for (const handler of documentListeners.click ?? []) handler();
+    await flushDynamicImports();
+    expect(vi.mocked(globalThis.fetch).mock.calls.filter(([url]) => url === "/cart/update.js"))
+      .toHaveLength(1);
+  });
+
+
+  it("does not build or write consent-pending cart attributes without assignments", async () => {
+    (globalThis as any).window.Shopify = {};
+    (globalThis as any).window.ShopifyAnalytics = {
+      meta: { page: { pageType: "product" } },
+    };
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    const { getCartAttributes, init } = await import("./index");
+
+    init({
+      cartAttributeScope: "all",
+      antiFlickerMode: "off",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [],
+      hasConsent: false,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_without_assignment",
+    });
+    for (const handler of documentListeners.click ?? []) handler();
+    await flushDynamicImports();
+
+    expect(getCartAttributes()).toEqual([]);
+    expect(vi.mocked(globalThis.fetch).mock.calls.some(([url]) => url === "/cart/update.js"))
+      .toBe(false);
+  });
+
+
+  it("installs the consent-pending mint trigger when a manual callback activates later", async () => {
+    (globalThis as any).window.Shopify = {};
+    (globalThis as any).window.ShopifyAnalytics = {
+      meta: { page: { pageType: "product" } },
+    };
+    (globalThis as any).window.location = (globalThis as any).location;
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    const { getAssignments, init } = await import("./index");
+
+    init({
+      cartAttributeScope: "all",
+      antiFlickerMode: "off",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_late_sdk_cart_mint",
+        status: "running",
+        targeting: {
+          pageRules: [{
+            id: "page_late_sdk_cart_mint",
+            includeRules: [{ type: "simple", pattern: "/", include: true }],
+            trigger: {
+              mode: "manual-callback",
+              apiName: "late_sdk_cart_mint",
+              signal: "page.trigger.late_sdk_cart_mint",
+              triggerJs: "window.__activateLateSdkCartMint = activate;",
+            },
+          }],
+        },
+        trafficAllocation: 1,
+        variations: [{ id: "var_late_sdk_cart_mint", weight: 1, mutations: [] }],
+      }],
+      hasConsent: false,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_late_sdk_cart_mint",
+    });
+
+    expect(getAssignments()).toHaveLength(0);
+    (globalThis as any).window.__activateLateSdkCartMint();
+    expect(getAssignments()).toEqual([
+      expect.objectContaining({
+        experimentId: "exp_late_sdk_cart_mint",
+        variationId: "var_late_sdk_cart_mint",
+      }),
+    ]);
+    for (const handler of documentListeners.click ?? []) handler();
+    await flushDynamicImports();
+
+    const cartCall = vi.mocked(globalThis.fetch).mock.calls.find(
+      ([url]) => url === "/cart/update.js",
+    );
+    expect(cartCall).toBeDefined();
+    expect(JSON.parse(String(cartCall?.[1]?.body)).attributes.apex_assignments).toBe(
+      JSON.stringify([{ e: "exp_late_sdk_cart_mint", v: "var_late_sdk_cart_mint", ep: 1 }]),
+    );
+  });
+
+
+  it("writes only visitor identity for an active holdout-program visitor with zero assignments", async () => {
+    (globalThis as any).window.Shopify = {};
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    const { getCartAttributes, init, mergeCartAttributes } = await import("./index");
+    const { isHoldoutVisitor } = await import("./hash");
+    const userId = Array.from({ length: 1000 }, (_, index) => `cart-zero-active-${index}`)
+      .find((id) => !isHoldoutVisitor({ holdout_v1_enabled: true, holdout_pct: 10 }, id));
+    expect(userId).toBeTruthy();
+
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_zero_active_cart",
+          status: "running",
+          trafficAllocation: 0,
+          variations: [{ id: "var_zero_active_cart", weight: 1, mutations: [] }],
+        },
+      ],
+      holdout_v1_enabled: true,
+      holdout_pct: 10,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: userId!,
+    });
+    await flushDynamicImports();
+
+    const fetchMock = vi.mocked(globalThis.fetch);
+    const cartUpdate = fetchMock.mock.calls.find(([url]) => url === "/cart/update.js");
+    expect(cartUpdate).toBeTruthy();
+    const body = JSON.parse(String(cartUpdate?.[1]?.body));
+    expect(body.attributes).toEqual({ apex_visitor_id: userId });
+    expect(getCartAttributes()).toEqual([{ key: "apex_visitor_id", value: userId }]);
+    expect(mergeCartAttributes([
+      { key: "gift_message", value: "Happy birthday", __typename: "Attribute" },
+      { key: "apex_assignments", value: "preserved assignments", __typename: "Attribute" },
+      { key: "apex_variation_id", value: "preserved variation" },
+      { key: "apex_visitor_id", value: "visitor_stale", __typename: "Attribute" },
+    ])).toEqual([
+      { key: "gift_message", value: "Happy birthday" },
+      { key: "apex_assignments", value: "preserved assignments" },
+      { key: "apex_variation_id", value: "preserved variation" },
+      { key: "apex_visitor_id", value: userId },
+    ]);
+  });
+
+
+  it("keeps the ordinary Shopify assignment stamp for an active holdout-program visitor", async () => {
+    (globalThis as any).window.Shopify = {};
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    const { init } = await import("./index");
+    const { isHoldoutVisitor } = await import("./hash");
+    const userId = Array.from({ length: 1000 }, (_, index) => `cart-active-${index}`).find((id) =>
+      !isHoldoutVisitor({ holdout_v1_enabled: true, holdout_pct: 10 }, id),
+    );
+    expect(userId).toBeTruthy();
+
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_active_cart",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_active_cart", weight: 1, mutations: [] }],
+        },
+      ],
+      holdout_v1_enabled: true,
+      holdout_pct: 10,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: userId!,
+    });
+    await flushDynamicImports();
+
+    const fetchMock = vi.mocked(globalThis.fetch);
+    const cartUpdate = fetchMock.mock.calls.find(([url]) => url === "/cart/update.js");
+    expect(cartUpdate).toBeTruthy();
+    const body = JSON.parse(String(cartUpdate?.[1]?.body));
+    expect(body.attributes).toEqual({
+      apex_assignments: JSON.stringify([{ e: "exp_active_cart", v: "var_active_cart", ep: 1 }]),
+      apex_assignment_authorization: "",
+      apex_experiment_id: "exp_active_cart",
+      apex_variation_id: "var_active_cart",
+      apex_assignment_epoch: "1",
+      apex_visitor_id: userId,
+      apex_session_id: expect.any(String),
+    });
+  });
+
+
+  it("exposes ordered cart attributes for headless Storefront API carts", async () => {
+    const { getCartAttributes, init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_headless_first",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_headless_first", weight: 1, mutations: [] }],
+        },
+        {
+          id: "exp_headless_second",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_headless_second", weight: 1, mutations: [] }],
+        },
+      ],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_123",
+    });
+
+    const entries = getCartAttributes();
+    expect(entries.map((entry) => entry.key)).toEqual([
+      "apex_assignments",
+      "apex_assignment_authorization",
+      "apex_experiment_id",
+      "apex_variation_id",
+      "apex_assignment_epoch",
+      "apex_visitor_id",
+      "apex_session_id",
+    ]);
+    expect(JSON.parse(entries[0]!.value)).toEqual([
+      { e: "exp_headless_first", v: "var_headless_first", ep: 1 },
+      { e: "exp_headless_second", v: "var_headless_second", ep: 1 },
+    ]);
+    expect(entries).toEqual(expect.arrayContaining([
+      { key: "apex_experiment_id", value: "exp_headless_first" },
+      { key: "apex_variation_id", value: "var_headless_first" },
+      { key: "apex_visitor_id", value: "visitor_123" },
+      { key: "apex_session_id", value: expect.any(String) },
+    ]));
+    expect((globalThis as any).drip.getCartAttributes()).toEqual(entries);
+    expect((globalThis as any).Apex.getCartAttributes()).toEqual(entries);
+  });
+
+
+  it("exposes non-empty cart attributes as composite-key metafields through module and browser APIs", async () => {
+    const {
+      getCartAttributes,
+      getCartMetafields,
+      getCartMetafieldStaleKeys,
+      init,
+    } = await import("./index");
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_headless_metafields",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_headless_metafields", weight: 1, mutations: [] }],
+      }],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_123",
+    });
+
+    const metafields = getCartMetafields({ namespace: "merchant_bi" });
+    expect((globalThis as any).drip.getCartMetafields({ namespace: "merchant_bi" }))
+      .toEqual(metafields);
+    expect((globalThis as any).Apex.getCartMetafields({ namespace: "merchant_bi" }))
+      .toEqual(metafields);
+    const staleKeys = getCartMetafieldStaleKeys({ namespace: "merchant_bi" });
+    expect((globalThis as any).drip.getCartMetafieldStaleKeys({ namespace: "merchant_bi" }))
+      .toEqual(staleKeys);
+    expect((globalThis as any).Apex.getCartMetafieldStaleKeys({ namespace: "merchant_bi" }))
+      .toEqual(staleKeys);
+    expect(staleKeys).toEqual([
+      "merchant_bi.apex_assignment_authorization",
+    ]);
+    expect(metafields.map(({ key, value }) => ({
+      key: key.replace(/^merchant_bi\./, ""),
+      value,
+    }))).toEqual(getCartAttributes().filter(({ value }) => value !== ""));
+    expect(metafields.every((entry) => entry.key.startsWith("merchant_bi."))).toBe(true);
+    expect(metafields.every((entry) => !("namespace" in entry))).toBe(true);
+  });
+
+
+  it("falls back to the apex namespace when the requested namespace is invalid", async () => {
+    const { getCartMetafields, init } = await import("./index");
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_headless_metafields",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_headless_metafields", weight: 1, mutations: [] }],
+      }],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_123",
+    });
+
+    for (const namespace of ["a", "merchant.bi", "merchant bi", "x".repeat(256)]) {
+      expect(getCartMetafields({ namespace }).every(
+        ({ key }) => key.startsWith("apex."),
+      )).toBe(true);
+    }
+  });
+
+
+  it("keeps cart metafields empty when initialized without an active assignment", async () => {
+    const { getCartMetafields, getCartMetafieldStaleKeys, init } = await import("./index");
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      experiments: [],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_123",
+    });
+
+    expect(getCartMetafields()).toEqual([]);
+    expect(getCartMetafields()).toEqual([]);
+    expect(getCartMetafieldStaleKeys()).toEqual([
+      "apex.apex_assignments",
+      "apex.apex_assignment_authorization",
+      "apex.apex_experiment_id",
+      "apex.apex_variation_id",
+      "apex.apex_assignment_epoch",
+      "apex.apex_visitor_id",
+      "apex.apex_session_id",
+    ]);
+  });
+
+
+  it("returns stable empty cart metafields when uninitialized or consent-blocked", async () => {
+    const { getCartMetafields, init } = await import("./index");
+    expect(getCartMetafields()).toEqual([]);
+    expect(getCartMetafields()).toEqual([]);
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [],
+      hasConsent: false,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_123",
+    });
+    expect(getCartMetafields()).toEqual([]);
+    expect((globalThis as any).drip.getCartMetafields()).toEqual([]);
+  });
+
+
+  it("preserves and normalizes existing cart attributes when tracking consent blocks a fresh stamp", async () => {
+    const { getCartAttributes, init, mergeCartAttributes } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_consent_blocked_cart",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_consent_blocked_cart", weight: 1, mutations: [] }],
+        },
+      ],
+      hasConsent: false,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_123",
+    });
+
+    expect(getCartAttributes()).toEqual([]);
+    expect((globalThis as any).drip.getCartAttributes()).toEqual([]);
+    expect(mergeCartAttributes([
+      { key: "gift_message", value: "Happy birthday", __typename: "Attribute" },
+      { key: "apex_assignments", value: "prior assignments", __typename: "Attribute" },
+      { key: "apex_visitor_id", value: "visitor_prior", extra: "drop me" },
+      { key: "missing_value" },
+      { key: "numeric_value", value: 42 },
+      { key: 42, value: "numeric key" },
+      null,
+    ])).toEqual([
+      { key: "gift_message", value: "Happy birthday" },
+      { key: "apex_assignments", value: "prior assignments" },
+      { key: "apex_visitor_id", value: "visitor_prior" },
+    ]);
+  });
+
+
+  it("merges fresh Apex attribution without replacing foreign cart attributes", async () => {
+    const { getCartAttributes, init, mergeCartAttributes } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_headless_merge",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_headless_merge", weight: 1, mutations: [] }],
+        },
+      ],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_fresh",
+    });
+
+    const existing = [
+      { key: "gift_message", value: "Happy birthday", __typename: "Attribute" },
+      { key: "apex_visitor_id", value: "visitor_stale", __typename: "Attribute" },
+      { key: "delivery_note", value: "Leave at door", extra: "drop me" },
+      { key: "apex_assignments", value: "stale" },
+      { key: "missing_value" },
+      { key: "numeric_value", value: 42 },
+      { key: 42, value: "numeric key" },
+      null,
+    ];
+    const fresh = getCartAttributes();
+    const merged = mergeCartAttributes(existing);
+
+    expect(merged).not.toBe(existing);
+    expect(existing).toHaveLength(8);
+    expect(merged).toEqual([
+      { key: "gift_message", value: "Happy birthday" },
+      { key: "delivery_note", value: "Leave at door" },
+      ...fresh,
+    ]);
+    for (const entry of fresh) {
+      expect(merged.filter(({ key }) => key === entry.key)).toEqual([entry]);
+    }
+    expect((globalThis as any).drip.mergeCartAttributes(existing)).toEqual(merged);
+    expect((globalThis as any).Apex.mergeCartAttributes(existing)).toEqual(merged);
+  });
+
+
+  it("replaces a headless minimal stamp with one consented assignment stamp", async () => {
+    const { getCartAttributes, init, mergeCartAttributes, setConsent } = await import("./index");
+
+    init({
+      cartAttributeScope: "all",
+      antiFlickerMode: "off",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_headless_transition",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_headless_transition", weight: 1, mutations: [] }],
+      }],
+      hasConsent: false,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_headless_transition",
+    });
+    const minimal = getCartAttributes();
+    expect(minimal).toHaveLength(7);
+
+    setConsent(true);
+    const merged = mergeCartAttributes([
+      { key: "delivery_note", value: "Leave at door" },
+      ...minimal,
+    ]);
+
+    expect(merged.filter(({ key }) => key === "apex_assignments")).toHaveLength(1);
+    expect(merged).toEqual([
+      { key: "delivery_note", value: "Leave at door" },
+      ...getCartAttributes(),
+    ]);
+    expect(merged).toContainEqual({
+      key: "apex_visitor_id",
+      value: "visitor_headless_transition",
+    });
+  });
+
+
+  it("safely treats non-arrays as empty and drops malformed entries", async () => {
+    const { getCartAttributes, mergeCartAttributes } = await import("./index");
+    const fresh = getCartAttributes();
+
+    expect(mergeCartAttributes(null)).toEqual(fresh);
+    expect(mergeCartAttributes(undefined)).toEqual(fresh);
+    expect(mergeCartAttributes("garbage")).toEqual(fresh);
+    expect(mergeCartAttributes([
+      null,
+      {},
+      { key: 42, value: "bad" },
+      { key: "missing" },
+      { key: "bad", value: 42 },
+    ])).toEqual(fresh);
+  });
+
+
+  it("returns no cart attributes without active assignments", async () => {
+    const { getCartAttributes, init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      experiments: [],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_123",
+    });
+
+    expect(getCartAttributes()).toEqual([]);
+  });
+
+
+  it("defers Shopify assignment sync until a held SPA route recheck completes", async () => {
+    const shopifyPublish = vi.fn();
+    (globalThis as any).window.Shopify = { analytics: { publish: shopifyPublish } };
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    const { getAssignments, hold, init, release } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_spa_initial_sync",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_spa_initial_sync", weight: 1, mutations: [] }],
+        },
+        {
+          id: "exp_spa_held_sync",
+          status: "running",
+          targeting: { url: [{ type: "simple", pattern: "/next" }] },
+          trafficAllocation: 1,
+          variations: [{ id: "var_spa_held_sync", weight: 1, mutations: [] }],
+        },
+      ],
+      shopId: "shop_123",
+      spa: { hydrationTimeoutMs: 3_000, routerMode: "history" },
+      trackingStart: "immediate",
+    });
+
+    expect(getAssignments().some((assignment) => assignment.experimentId === "exp_spa_held_sync")).toBe(false);
+    shopifyPublish.mockClear();
+    hold();
+    (globalThis as any).location.href = "https://plain.test/middle";
+    (globalThis as any).location.pathname = "/middle";
+    (globalThis as any).history.pushState({}, "", "/middle");
+    (globalThis as any).location.href = "https://plain.test/next";
+    (globalThis as any).location.pathname = "/next";
+    (globalThis as any).history.pushState({}, "", "/next");
+
+    expect(shopifyPublish).not.toHaveBeenCalled();
+    expect(getAssignments().some((assignment) => assignment.experimentId === "exp_spa_held_sync")).toBe(false);
+
+    release();
+    await vi.advanceTimersByTimeAsync(0);
+
+    expect(getAssignments()).toEqual(expect.arrayContaining([
+      expect.objectContaining({ experimentId: "exp_spa_held_sync", variationId: "var_spa_held_sync" }),
+    ]));
+    expect(shopifyPublish).toHaveBeenCalledWith(
+      "drip_assignment_sync",
+      expect.objectContaining({
+        assignments: expect.arrayContaining([
+          expect.objectContaining({ experimentId: "exp_spa_held_sync", variationId: "var_spa_held_sync" }),
+        ]),
+      }),
+    );
+  });
+
+
+  it("defers initial Shopify assignment sync until hydration applies the treatment", async () => {
+    const shopifyPublish = vi.fn();
+    const title = { textContent: "Original" };
+    installMutationObserverStub();
+    (globalThis as any).document.querySelectorAll = vi.fn((selector: string) => (
+      selector === "#product-title" ? [title] : []
+    ));
+    (globalThis as any).window.Shopify = { analytics: { publish: shopifyPublish } };
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    const { hydrated, init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_hydration_shopify_sync",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{
+          id: "var_hydration_shopify_sync",
+          weight: 1,
+          mutations: [{ selector: "#product-title", action: "text", text: "Treatment" }],
+        }],
+      }],
+      shopId: "shop_123",
+      spa: { applyTiming: "after_hydration", hydrationTimeoutMs: 3_000 },
+      trackingStart: "immediate",
+    });
+
+    expect(title.textContent).toBe("Original");
+    expect(shopifyPublish).not.toHaveBeenCalledWith("drip_assignment_sync", expect.any(Object));
+
+    hydrated();
+    await vi.advanceTimersByTimeAsync(0);
+
+    expect(title.textContent).toBe("Treatment");
+    expect(shopifyPublish).toHaveBeenCalledWith(
+      "drip_assignment_sync",
+      expect.objectContaining({
+        assignments: [expect.objectContaining({
+          experimentId: "exp_hydration_shopify_sync",
+          variationId: "var_hydration_shopify_sync",
+        })],
+      }),
+    );
+  });
+
+
+  it("writes the server-readable drip_ctx cookie after experiment exposure", async () => {
+    const cookieWrites = installCookieJar();
+    (globalThis as any).sessionStorage.setItem("drip_sid", "session_ctx");
+    const { init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_ctx_a",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_ctx_a", weight: 1, mutations: [] }],
+        },
+        {
+          id: "exp_ctx_b",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_ctx_b", weight: 1, mutations: [] }],
+        },
+      ],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_ctx",
+    });
+
+    const raw = readCookieValue("drip_ctx");
+    expect(raw).toBeTruthy();
+    expect(raw!.length).toBeLessThanOrEqual(1024);
+    const contextWrite = cookieWrites.find((write) => write.startsWith("drip_ctx="));
+    expect(contextWrite).toContain("Path=/");
+    expect(contextWrite).toContain("SameSite=Lax");
+    expect(contextWrite).toContain("Max-Age=2592000");
+    expect(contextWrite).not.toContain("Secure");
+    expect(readDecodedDripContext()).toBe(
+      "1|visitor_ctx|session_ctx|exp_ctx_a:var_ctx_a,exp_ctx_b:var_ctx_b",
+    );
+  });
+
+
+  it("writes drip_ctx during init before idle analytics starts", async () => {
+    installCookieJar();
+    (globalThis as any).sessionStorage.setItem("drip_sid", "session_ctx");
+    const { init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      experiments: [],
+      shopId: "shop_123",
+      trackingStart: "idle",
+      userId: "visitor_ctx",
+    });
+
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+    expect(readDecodedDripContext()).toBe("1|visitor_ctx|session_ctx|");
+  });
+
+
+  it("caps drip_ctx at 1024 encoded bytes with the most recent deduped exposures", async () => {
+    installCookieJar();
+    const now = Date.now();
+    (globalThis as any).sessionStorage.setItem("drip_sid", "session_ctx");
+    (globalThis as any).localStorage.setItem(
+      "drip_exposures",
+      JSON.stringify([
+        { e: "exp_dup", v: "var_old", t: now - 20_000 },
+        ...Array.from({ length: 12 }, (_, index) => ({
+          e: `exp_${index}`,
+          v: `var_${index}_${"x".repeat(130)}`,
+          t: now - (12 - index) * 1000,
+        })),
+        { e: "exp_dup", v: "var_new", t: now + 1000 },
+      ]),
+    );
+    const { init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      experiments: [],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_ctx",
+    });
+
+    const raw = readCookieValue("drip_ctx");
+    expect(raw).toBeTruthy();
+    expect(raw!.length).toBeLessThanOrEqual(1024);
+    const exposurePairs = readDecodedDripContext()?.split("|")[3]?.split(",").filter(Boolean) ?? [];
+    expect(exposurePairs.length).toBeLessThanOrEqual(10);
+    expect(exposurePairs).toContain("exp_dup:var_new");
+    expect(exposurePairs).not.toContain("exp_dup:var_old");
+    expect(exposurePairs.some((pair) => pair.startsWith("exp_0:"))).toBe(false);
+    expect(exposurePairs.some((pair) => pair.startsWith("exp_1:"))).toBe(false);
+  });
+
+
+  it("marks Shopify assignment sync payloads as QA traffic in QA mode", async () => {
+    (globalThis as any).location.search = "?drip_qa=1&drip_qa_session=qa_shopify_sync";
+    const shopifyPublish = vi.fn();
+    (globalThis as any).window.Shopify = { analytics: { publish: shopifyPublish } };
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+
+    const { getDiagnostics, init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_qa_shopify",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_qa_shopify", weight: 1, mutations: [] }],
+        },
+      ],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    expect(shopifyPublish).toHaveBeenCalledWith(
+      "drip_assignment_sync",
+      expect.objectContaining({
+        qaMode: true,
+        qaSessionId: "qa_shopify_sync",
+      }),
+    );
+    expect(getDiagnostics().spa.lastShopifyAssignmentSync).toMatchObject({
+      status: "sent",
+      assignmentCount: 1,
+    });
+  });
+
+
+  it("republishes the assignment bridge when the Shopify cart token becomes known", async () => {
+    const shopifyPublish = vi.fn();
+    (globalThis as any).window.Shopify = { analytics: { publish: shopifyPublish } };
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    globalThis.fetch = vi.fn(async (input: RequestInfo | URL) => {
+      if (input === "/cart/update.js") {
+        return new Response(JSON.stringify({ token: "cart-token?key=private" }), {
+          status: 200,
+        });
+      }
+      return new Response("{}", { status: 202 });
+    }) as any;
+
+    const { init } = await import("./index");
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_cart_token_bridge",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_cart_token_bridge", weight: 1, mutations: [] }],
+      }],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_cart_token_bridge",
+    });
+
+    await vi.waitFor(() => {
+      expect(shopifyPublish).toHaveBeenCalledWith(
+        "drip_assignment_sync",
+        expect.objectContaining({ cartToken: "cart-token" }),
+      );
+    });
+    const payloads = shopifyPublish.mock.calls
+      .filter(([name]) => name === "drip_assignment_sync")
+      .map(([, payload]) => payload as Record<string, unknown>);
+    expect(payloads.some((payload) => !Object.hasOwn(payload, "cartToken"))).toBe(true);
+    expect(payloads.at(-1)).toMatchObject({ cartToken: "cart-token" });
+  });
+
+
+  it.each([
+    [true, true, "holdout"],
+    [true, false, "active"],
+    [false, false, undefined],
+  ] as const)("publishes the two-sided Shopify cohort when enabled=%s holdout=%s", async (enabled, shouldHoldout, expectedCohort) => {
+    const shopifyPublish = vi.fn();
+    (globalThis as any).window.Shopify = { analytics: { publish: shopifyPublish } };
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+
+    const { init } = await import("./index");
+    const { isHoldoutVisitor } = await import("./hash");
+    const userId = Array.from({ length: 1000 }, (_, index) => `cohort-${index}`).find((id) =>
+      isHoldoutVisitor({ holdout_v1_enabled: true, holdout_pct: 10 }, id) === shouldHoldout,
+    );
+    expect(userId).toBeTruthy();
+
+    init({
+      antiFlickerMode: "off",
+      endpoint: "https://events.test",
+      experiments: [],
+      holdout_config_updated_at: "2026-07-27T08:30:00.000Z",
+      holdout_v1_enabled: enabled,
+      holdout_pct: 10,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: userId!,
+    });
+
+    expect(shopifyPublish).toHaveBeenCalledWith(
+      "drip_assignment_sync",
+      expect.objectContaining({
+        cohort: expectedCohort,
+        holdoutConfigEpoch: Date.parse("2026-07-27T08:30:00.000Z"),
+      }),
+    );
+  });
+});