@drip-apex/sdk 0.1.0

package/src/shopify-cart.test.ts

@@ -0,0 +1,2823 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+function makeStorage(initial?: Record<string, string>) {
+  const map = new Map<string, string>(Object.entries(initial ?? {}));
+  return {
+    getItem: (key: string) => (map.has(key) ? map.get(key)! : null),
+    key: (index: number) => Array.from(map.keys())[index] ?? null,
+    removeItem: (key: string) => { map.delete(key); },
+    setItem: (key: string, value: string) => { map.set(key, value); },
+    get length() { return map.size; },
+  };
+}
+
+describe("syncShopifyCartAttributes", () => {
+  const originalWindow = (globalThis as any).window;
+  const originalSessionStorage = (globalThis as any).sessionStorage;
+  const originalFetch = globalThis.fetch;
+
+  beforeEach(() => {
+    vi.resetModules();
+    (globalThis as any).window = { Shopify: {} };
+    (globalThis as any).sessionStorage = makeStorage();
+    globalThis.fetch = vi.fn(async () => new Response("ok", { status: 200 })) as any;
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    (globalThis as any).window = originalWindow;
+    (globalThis as any).sessionStorage = originalSessionStorage;
+    globalThis.fetch = originalFetch;
+  });
+
+  it("posts all Apex assignments plus primary attribution keys to the Shopify cart", async () => {
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    syncShopifyCartAttributes({
+      assignments: [
+        { experimentId: "exp_123", variationId: "var_123", assignmentEpoch: 2 },
+        { experimentId: "exp_456", variationId: "var_456" },
+      ],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+    });
+    await Promise.resolve();
+
+    expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+    const [url, init] = vi.mocked(globalThis.fetch).mock.calls[0]!;
+    expect(url).toBe("/cart/update.js");
+    expect(init).toMatchObject({
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      keepalive: true,
+    });
+    expect(JSON.parse(String(init?.body))).toEqual({
+      attributes: {
+        apex_assignments: JSON.stringify([
+          { e: "exp_123", v: "var_123", ep: 2 },
+          { e: "exp_456", v: "var_456" },
+        ]),
+        apex_assignment_authorization: "",
+        apex_experiment_id: "exp_123",
+        apex_variation_id: "var_123",
+        apex_assignment_epoch: "2",
+        apex_visitor_id: "visitor_123",
+        apex_session_id: "session_123",
+      },
+    });
+    await vi.waitFor(() =>
+      expect(JSON.parse(String(sessionStorage.getItem("drip_cart_attr")))).toEqual({
+      assignments: [
+        ["exp_123", "var_123", 2],
+        ["exp_456", "var_456", null],
+      ],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      cartToken: null,
+      shippingAuthorizationRevision: null,
+      priceAuthorizationRevision: null,
+      }),
+    );
+  });
+
+  it("builds ordered Storefront API cart attribute entries with compact assignment keys", async () => {
+    const { buildCartAttributeEntries } = await import("./shopify-cart");
+
+    const entries = buildCartAttributeEntries({
+      assignments: [
+        { experimentId: "exp_123", variationId: "var_123", assignmentEpoch: 2 },
+        { experimentId: "exp_456", variationId: "var_456" },
+      ],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+    });
+
+    expect(entries.map((entry) => entry.key)).toEqual([
+      "apex_assignments",
+      "apex_assignment_authorization",
+      "apex_experiment_id",
+      "apex_variation_id",
+      "apex_assignment_epoch",
+      "apex_visitor_id",
+      "apex_session_id",
+    ]);
+    expect(JSON.parse(entries[0]!.value)).toEqual([
+      { e: "exp_123", v: "var_123", ep: 2 },
+      { e: "exp_456", v: "var_456" },
+    ]);
+    expect(Object.fromEntries(entries.map((entry) => [entry.key, entry.value]))).toEqual({
+      apex_assignments: JSON.stringify([
+        { e: "exp_123", v: "var_123", ep: 2 },
+        { e: "exp_456", v: "var_456" },
+      ]),
+      apex_assignment_authorization: "",
+      apex_experiment_id: "exp_123",
+      apex_variation_id: "var_123",
+      apex_assignment_epoch: "2",
+      apex_visitor_id: "visitor_123",
+      apex_session_id: "session_123",
+    });
+  });
+
+  it("keeps ordinary cart attribution best-effort when assignment proof is unavailable", async () => {
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(new Response("unavailable", { status: 503 }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 }))
+      .mockRejectedValueOnce(new Error("assign network unavailable"))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const input = {
+      assignments: [{ experimentId: "exp_123", variationId: "var_123" }],
+      visitorId: "visitor_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+    };
+
+    await expect(syncShopifyCartAttributes({
+      ...input,
+      sessionId: "session_1",
+    })).resolves.toEqual({ status: "sent" });
+    await expect(syncShopifyCartAttributes({
+      ...input,
+      sessionId: "session_2",
+    })).resolves.toEqual({ status: "sent" });
+
+    expect(vi.mocked(globalThis.fetch).mock.calls.map(([url]) => url)).toEqual([
+      "https://events.example.com/v1/assign",
+      "/cart/update.js",
+      "https://events.example.com/v1/assign",
+      "/cart/update.js",
+    ]);
+  });
+
+  it("requests a server authorization before writing checkout attributes", async () => {
+    globalThis.fetch = vi
+      .fn()
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify({
+            assignments: [{
+              experiment_id: "exp_123",
+              variation_id: "var_123",
+              assignment_epoch: 2,
+            }],
+            commerce_authorization: "signed-envelope",
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } },
+        ),
+      )
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    syncShopifyCartAttributes({
+      assignments: [
+        { experimentId: "exp_123", variationId: "var_123", assignmentEpoch: 2 },
+      ],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      url: "https://store.example.com/products/example",
+      environment: "staging",
+      shippingAuthorizationRevision: 7,
+      requiredAssignments: [
+        { experimentId: "exp_123", variationId: "var_123", assignmentEpoch: 2 },
+      ],
+      exclusionGroupSelections: [{
+        groupId: "group_123",
+        experimentId: "exp_123",
+        epoch: 4,
+      }],
+    });
+
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(2));
+    const [authorizationUrl, authorizationInit] = vi.mocked(globalThis.fetch).mock.calls[0]!;
+    expect(authorizationUrl).toBe("https://events.example.com/v1/assign");
+    expect(authorizationInit?.headers).toEqual({
+      "Content-Type": "application/json",
+      "X-Drip-Shop": "shop_123",
+      "X-Drip-Signature": "ingest-token",
+    });
+    expect(JSON.parse(String(authorizationInit?.body))).toEqual({
+      shop_id: "shop_123",
+      user_id: "visitor_123",
+      url: "https://store.example.com/products/example",
+      environment: "staging",
+      experiments: ["exp_123"],
+      exclusion_group_selections: [{
+        group_id: "group_123",
+        experiment_id: "exp_123",
+        epoch: 4,
+      }],
+    });
+    const cartBody = JSON.parse(
+      String(vi.mocked(globalThis.fetch).mock.calls[1]?.[1]?.body),
+    );
+    expect(cartBody.attributes.apex_assignment_authorization).toBe(
+      "signed-envelope",
+    );
+    await vi.waitFor(() =>
+      expect(JSON.parse(sessionStorage.getItem("drip_cart_attr")!)).toMatchObject({
+        shippingAuthorizationRevision: 7,
+      }),
+    );
+  });
+
+  it("clears stale shipping proof after a successful response reports no shipping assignment", async () => {
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({
+        assignments: [{
+          experiment_id: "exp_copy",
+          variation_id: "var_copy",
+          assignment_epoch: 4,
+        }],
+      }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [{
+        experimentId: "exp_copy",
+        variationId: "var_copy",
+        assignmentEpoch: 4,
+      }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      shippingAuthorizationRevision: 7,
+    })).resolves.toEqual({ status: "sent" });
+
+    expect(globalThis.fetch).toHaveBeenCalledTimes(2);
+    const cartUpdate = vi.mocked(globalThis.fetch).mock.calls[1];
+    expect(cartUpdate?.[0]).toBe("/cart/update.js");
+    expect(JSON.parse(String(cartUpdate?.[1]?.body)).attributes).toMatchObject({
+      apex_assignments: JSON.stringify([{ e: "exp_copy", v: "var_copy", ep: 4 }]),
+      apex_assignment_authorization: "",
+    });
+  });
+
+  it("does not clear stale shipping proof when the assign transport fails", async () => {
+    globalThis.fetch = vi.fn()
+      .mockRejectedValueOnce(new Error("assign network unavailable")) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [{
+        experimentId: "exp_copy",
+        variationId: "var_copy",
+        assignmentEpoch: 4,
+      }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      shippingAuthorizationRevision: 7,
+    })).resolves.toEqual({ status: "failed", reason: "authorization_failed" });
+
+    expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+    expect(sessionStorage.getItem("drip_cart_attr")).toBeNull();
+  });
+
+  it("preserves stale shipping proof when local assignments are empty and assign transport fails", async () => {
+    globalThis.fetch = vi.fn()
+      .mockRejectedValueOnce(new Error("assign network unavailable")) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      shippingAuthorizationRevision: 7,
+    })).resolves.toEqual({ status: "failed", reason: "authorization_failed" });
+
+    expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+    expect(vi.mocked(globalThis.fetch).mock.calls[0]?.[0]).toBe(
+      "https://events.example.com/v1/assign",
+    );
+    expect(vi.mocked(globalThis.fetch).mock.calls.some(([url]) =>
+      url === "/cart/update.js"
+    )).toBe(false);
+    expect(sessionStorage.getItem("drip_cart_attr")).toBeNull();
+  });
+
+  it("preserves stale shipping proof when the empty-local Worker response cannot be parsed", async () => {
+    globalThis.fetch = vi.fn().mockResolvedValueOnce(
+      new Response("not-json", {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      }),
+    ) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      shippingAuthorizationRevision: 7,
+    })).resolves.toEqual({ status: "failed", reason: "authorization_failed" });
+
+    expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+    expect(vi.mocked(globalThis.fetch).mock.calls.some(([url]) =>
+      url === "/cart/update.js"
+    )).toBe(false);
+    expect(sessionStorage.getItem("drip_cart_attr")).toBeNull();
+  });
+
+  it("clears stale shipping proof for empty local assignments only after an empty Worker response", async () => {
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({ assignments: [] }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      shippingAuthorizationRevision: 7,
+    })).resolves.toEqual({ status: "sent" });
+
+    expect(globalThis.fetch).toHaveBeenCalledTimes(2);
+    const assignBody = JSON.parse(
+      String(vi.mocked(globalThis.fetch).mock.calls[0]?.[1]?.body),
+    );
+    expect(assignBody.experiments).toEqual([]);
+    const cartUpdate = vi.mocked(globalThis.fetch).mock.calls[1];
+    expect(cartUpdate?.[0]).toBe("/cart/update.js");
+    expect(JSON.parse(String(cartUpdate?.[1]?.body)).attributes).toMatchObject({
+      apex_assignments: "[]",
+      apex_assignment_authorization: "",
+    });
+  });
+
+  it("clears stale offer proof for an offers-only shop after a cart-proven empty Worker response", async () => {
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({ assignments: [] }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-empty-offers?key=private-capability",
+      offersAuthorizationRevision: 4,
+    })).resolves.toEqual({ status: "sent" });
+
+    const cartUpdate = vi.mocked(globalThis.fetch).mock.calls[1];
+    expect(cartUpdate?.[0]).toBe("/cart/update.js");
+    expect(JSON.parse(String(cartUpdate?.[1]?.body)).attributes).toMatchObject({
+      apex_assignments: "[]",
+      apex_assignment_authorization: "",
+    });
+  });
+
+  it("preserves stale shipping proof when an empty-local Worker response still contains an assignment", async () => {
+    globalThis.fetch = vi.fn().mockResolvedValueOnce(Response.json({
+      assignments: [{
+        experiment_id: "exp_shipping",
+        variation_id: "var_shipping",
+        assignment_epoch: 5,
+      }],
+    })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      shippingAuthorizationRevision: 7,
+    })).resolves.toEqual({ status: "failed", reason: "authorization_failed" });
+
+    expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+    expect(vi.mocked(globalThis.fetch).mock.calls.some(([url]) =>
+      url === "/cart/update.js"
+    )).toBe(false);
+  });
+
+  it("preserves stale shipping proof for empty local assignments when authorization credentials are missing", async () => {
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shippingAuthorizationRevision: 7,
+    })).resolves.toEqual({ status: "failed", reason: "authorization_failed" });
+
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+    expect(sessionStorage.getItem("drip_cart_attr")).toBeNull();
+  });
+
+  it("does not let a stale successful no-shipping response clear newer signed state", async () => {
+    let resolveOlderAuthorization!: (response: Response) => void;
+    let resolveNewerAuthorization!: (response: Response) => void;
+    globalThis.fetch = vi.fn((url) => {
+      if (url === "https://events.example.com/v1/assign") {
+        return new Promise<Response>((resolve) => {
+          if (!resolveOlderAuthorization) resolveOlderAuthorization = resolve;
+          else resolveNewerAuthorization = resolve;
+        });
+      }
+      return Promise.resolve(new Response("ok", { status: 200 }));
+    }) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    const older = syncShopifyCartAttributes({
+      assignments: [],
+      visitorId: "visitor_123",
+      sessionId: "session_older",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      shippingAuthorizationRevision: 7,
+    });
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(1));
+    const newer = syncShopifyCartAttributes({
+      assignments: [{
+        experimentId: "exp_shipping",
+        variationId: "var_shipping",
+        assignmentEpoch: 5,
+      }],
+      requiredAssignments: [{
+        experimentId: "exp_shipping",
+        variationId: "var_shipping",
+        assignmentEpoch: 5,
+      }],
+      visitorId: "visitor_123",
+      sessionId: "session_newer",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      shippingAuthorizationRevision: 7,
+    });
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(2));
+
+    resolveNewerAuthorization(Response.json({
+      assignments: [{
+        experiment_id: "exp_shipping",
+        variation_id: "var_shipping",
+        assignment_epoch: 5,
+      }],
+      commerce_authorization: "newer-proof",
+    }));
+    await expect(newer).resolves.toEqual({ status: "sent" });
+
+    resolveOlderAuthorization(Response.json({
+      assignments: [],
+    }));
+    await expect(older).resolves.toEqual({
+      status: "failed",
+      reason: "authorization_failed",
+    });
+
+    expect(globalThis.fetch).toHaveBeenCalledTimes(3);
+    const cartUpdates = vi.mocked(globalThis.fetch).mock.calls.filter(([url]) =>
+      url === "/cart/update.js"
+    );
+    expect(cartUpdates).toHaveLength(1);
+    expect(JSON.parse(String(cartUpdates[0]?.[1]?.body)).attributes)
+      .toMatchObject({ apex_assignment_authorization: "newer-proof" });
+  });
+
+  it.each([
+    ["missing", {}],
+    ["empty", { commerce_authorization: "" }],
+  ])("fails closed when a charge-affecting authorization token is %s", async (
+    _case,
+    authorizationPayload,
+  ) => {
+    const assignmentProof = {
+      assignments: [{
+        experiment_id: "exp_123",
+        variation_id: "var_123",
+        assignment_epoch: 2,
+      }],
+      ...authorizationPayload,
+    };
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json(assignmentProof))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 }))
+      .mockResolvedValueOnce(Response.json(assignmentProof))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const input = {
+      assignments: [
+        { experimentId: "exp_123", variationId: "var_123", assignmentEpoch: 2 },
+      ],
+      requiredAssignments: [
+        { experimentId: "exp_123", variationId: "var_123", assignmentEpoch: 2 },
+      ],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+    };
+
+    await expect(syncShopifyCartAttributes(input)).resolves.toEqual({
+      status: "failed",
+      reason: "authorization_failed",
+    });
+    expect(sessionStorage.getItem("drip_cart_attr")).toBeNull();
+
+    await expect(syncShopifyCartAttributes(input)).resolves.toEqual({
+      status: "failed",
+      reason: "authorization_failed",
+    });
+    expect(globalThis.fetch).toHaveBeenCalledTimes(4);
+    expect(sessionStorage.getItem("drip_cart_attr")).toBeNull();
+  });
+
+  it("rejects a shipping-only V2 envelope when a price assignment requires proof", async () => {
+    const shippingOnlyToken = JSON.stringify({
+      v: 2,
+      p: {
+        shipping: {
+          v: 1,
+          a: [{ e: "exp_shipping", v: "var_shipping", ep: 1 }],
+        },
+      },
+    });
+    const authorizationPayload = {
+      assignments: [{
+        experiment_id: "exp_price",
+        variation_id: "var_treatment",
+        assignment_epoch: 2,
+      }],
+      commerce_authorization: shippingOnlyToken,
+    };
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json(authorizationPayload))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 }))
+      .mockResolvedValueOnce(Response.json(authorizationPayload))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const input = {
+      assignments: [{
+        experimentId: "exp_price",
+        variationId: "var_treatment",
+        assignmentEpoch: 2,
+      }],
+      requiredAssignments: [{
+        experimentId: "exp_price",
+        variationId: "var_treatment",
+        assignmentEpoch: 2,
+      }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+    };
+
+    await expect(syncShopifyCartAttributes(input)).resolves.toEqual({
+      status: "failed",
+      reason: "authorization_failed",
+    });
+    expect(sessionStorage.getItem("drip_cart_attr")).toBeNull();
+    await expect(syncShopifyCartAttributes(input)).resolves.toEqual({
+      status: "failed",
+      reason: "authorization_failed",
+    });
+    expect(globalThis.fetch).toHaveBeenCalledTimes(2);
+    expect(vi.mocked(globalThis.fetch).mock.calls.some(([url]) =>
+      url === "/cart/update.js"
+    )).toBe(false);
+    expect(sessionStorage.getItem("drip_cart_attr")).toBeNull();
+  });
+
+  it("accepts a bare V1 price envelope covering the required assignment", async () => {
+    const token = JSON.stringify({
+      v: 1,
+      cartHash: "c".repeat(64),
+      a: [{ e: "exp_price", v: "var_treatment", ep: 2 }],
+    });
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({
+        assignments: [{
+          experiment_id: "exp_price",
+          variation_id: "var_treatment",
+          assignment_epoch: 2,
+        }],
+        commerce_authorization: token,
+      }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_price", variationId: "var_treatment", assignmentEpoch: 2 }],
+      requiredAssignments: [{ experimentId: "exp_price", variationId: "var_treatment", assignmentEpoch: 2 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+    })).resolves.toEqual({ status: "sent" });
+  });
+
+  it("accepts a V2 price plane covering the required assignment", async () => {
+    const token = JSON.stringify({
+      v: 2,
+      p: {
+        price: {
+          v: 1,
+          cartHash: "c".repeat(64),
+          a: [{ e: "exp_price", v: "var_treatment", ep: 2 }],
+        },
+      },
+    });
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({
+        assignments: [{
+          experiment_id: "exp_price",
+          variation_id: "var_treatment",
+          assignment_epoch: 2,
+        }],
+        commerce_authorization: token,
+      }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_price", variationId: "var_treatment", assignmentEpoch: 2 }],
+      requiredAssignments: [{ experimentId: "exp_price", variationId: "var_treatment", assignmentEpoch: 2 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+    })).resolves.toEqual({ status: "sent" });
+  });
+
+  it("lets a proven price plane proceed while a missing shipping plane fails closed", async () => {
+    const token = JSON.stringify({
+      v: 2,
+      p: {
+        price: {
+          v: 1,
+          cartHash: "c".repeat(64),
+          a: [{ e: "exp_price", v: "var_price", ep: 2 }],
+        },
+      },
+    });
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({
+        assignments: [
+          { experiment_id: "exp_price", variation_id: "var_price", assignment_epoch: 2 },
+          { experiment_id: "exp_shipping", variation_id: "var_shipping", assignment_epoch: 4 },
+        ],
+        commerce_authorization: token,
+      }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const authorizePriceDisplayAssignments = vi.fn();
+    const authorizeShippingDisplayAssignments = vi.fn();
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [
+        { experimentId: "exp_price", variationId: "var_price", assignmentEpoch: 2 },
+        { experimentId: "exp_shipping", variationId: "var_shipping", assignmentEpoch: 4 },
+      ],
+      requiredAssignments: [
+        { experimentId: "exp_price", variationId: "var_price", assignmentEpoch: 2 },
+        { experimentId: "exp_shipping", variationId: "var_shipping", assignmentEpoch: 4 },
+      ],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-token",
+      shippingAuthorizationRevision: 7,
+      shippingExperimentIds: ["exp_shipping"],
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+      authorizePriceDisplayAssignments,
+      authorizeShippingDisplayAssignments,
+    })).resolves.toEqual({ status: "sent" });
+
+    const cartBody = JSON.parse(String(vi.mocked(globalThis.fetch).mock.calls[1]?.[1]?.body));
+    expect(JSON.parse(cartBody.attributes.apex_assignments)).toEqual([
+      { e: "exp_price", v: "var_price", ep: 2 },
+    ]);
+    expect(cartBody.attributes.apex_assignment_authorization).toBe(token);
+    expect(authorizePriceDisplayAssignments).toHaveBeenCalledWith([
+      { experimentId: "exp_price", variationId: "var_price", assignmentEpoch: 2 },
+    ]);
+    expect(authorizeShippingDisplayAssignments).toHaveBeenCalledWith([]);
+  });
+
+  it("stamps a signed offers plane and fails closed when its proof is absent", async () => {
+    const signed = JSON.stringify({
+      v: 2,
+      p: { offers: { v: 1, a: [{ e: "exp_offer", v: "var_offer", ep: 3 }] } },
+    });
+    const assignment = { experimentId: "exp_offer", variationId: "var_offer", assignmentEpoch: 3 };
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({
+        assignments: [{ experiment_id: "exp_offer", variation_id: "var_offer", assignment_epoch: 3 }],
+        commerce_authorization: signed,
+      }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    await expect(syncShopifyCartAttributes({
+      assignments: [assignment],
+      requiredAssignments: [assignment],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-offers?key=private-capability",
+      offersAuthorizationRevision: 5,
+      offersExperimentIds: ["exp_offer"],
+    })).resolves.toEqual({ status: "sent" });
+    expect(JSON.parse(String(vi.mocked(globalThis.fetch).mock.calls[0]?.[1]?.body)))
+      .toMatchObject({ cart_token: "cart-offers?key=private-capability" });
+    const cartBody = JSON.parse(String(vi.mocked(globalThis.fetch).mock.calls[1]?.[1]?.body));
+    expect(cartBody.attributes.apex_assignment_authorization).toBe(signed);
+
+    vi.resetModules();
+    (globalThis as any).sessionStorage = makeStorage();
+    globalThis.fetch = vi.fn().mockResolvedValueOnce(Response.json({
+      assignments: [{ experiment_id: "exp_offer", variation_id: "var_offer", assignment_epoch: 3 }],
+      commerce_authorization: JSON.stringify({ v: 2, p: {} }),
+    })) as any;
+    const fresh = await import("./shopify-cart");
+    await expect(fresh.syncShopifyCartAttributes({
+      assignments: [assignment],
+      requiredAssignments: [assignment],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-offers?key=private-capability",
+      offersAuthorizationRevision: 5,
+      offersExperimentIds: ["exp_offer"],
+    })).resolves.toEqual({ status: "failed", reason: "authorization_failed" });
+    expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+  });
+
+  it("adopts the pinned offer arm when no local assignment exists (reused cart, new identity)", async () => {
+    const token = JSON.stringify({
+      v: 2,
+      p: { offers: { v: 1, a: [{ e: "exp_offer", v: "var_treatment", ep: 3 }] } },
+    });
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({
+        assignments: [{
+          experiment_id: "exp_offer",
+          variation_id: "var_treatment",
+          assignment_epoch: 3,
+        }],
+        commerce_authorization: token,
+      }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const adoptOffersAssignments = vi.fn(() => true);
+
+    // No local assignments at all — the stale-clear guard must NOT reject the
+    // nonempty pinned-arm response before adoption runs.
+    await expect(syncShopifyCartAttributes({
+      assignments: [],
+      visitorId: "visitor_new",
+      sessionId: "session_new",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-offers?key=private-capability",
+      offersAuthorizationRevision: 5,
+      offersExperimentIds: ["exp_offer"],
+      adoptOffersAssignments,
+      canAdoptOffersAssignments: () => true,
+    })).resolves.toEqual({ status: "sent" });
+    expect(adoptOffersAssignments).toHaveBeenCalledWith([{
+      experimentId: "exp_offer",
+      variationId: "var_treatment",
+      assignmentEpoch: 3,
+    }]);
+  });
+
+  it("adopts the Worker's pinned offer arm before proof and cart attribution", async () => {
+    const token = JSON.stringify({
+      v: 2,
+      p: { offers: { v: 1, a: [{ e: "exp_offer", v: "var_treatment", ep: 3 }] } },
+    });
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({
+        assignments: [{
+          experiment_id: "exp_offer",
+          variation_id: "var_treatment",
+          assignment_epoch: 3,
+        }],
+        commerce_authorization: token,
+      })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    let cartWriteStarted = false;
+    let adoptedBeforeCartWrite: boolean | null = null;
+    const fetchMock = vi.mocked(globalThis.fetch);
+    fetchMock.mockImplementation(async (url) => {
+      if (String(url) === "/cart/update.js") cartWriteStarted = true;
+      return new Response("ok", { status: 200 });
+    });
+    const adoptOffersAssignments = vi.fn(() => {
+      adoptedBeforeCartWrite = !cartWriteStarted;
+      return true;
+    });
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_offer", variationId: "var_control", assignmentEpoch: 3 }],
+      requiredAssignments: [{ experimentId: "exp_offer", variationId: "var_control", assignmentEpoch: 3 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-offers?key=private-capability",
+      offersAuthorizationRevision: 5,
+      offersExperimentIds: ["exp_offer"],
+      adoptOffersAssignments,
+      canAdoptOffersAssignments: () => true,
+    })).resolves.toEqual({ status: "sent" });
+    expect(adoptOffersAssignments).toHaveBeenCalledWith([{
+      experimentId: "exp_offer",
+      variationId: "var_treatment",
+      assignmentEpoch: 3,
+    }]);
+    // Adoption applies only AFTER the stamped cart write went out.
+    expect(adoptedBeforeCartWrite).toBe(false);
+    const cartBody = JSON.parse(String(vi.mocked(globalThis.fetch).mock.calls[1]?.[1]?.body));
+    expect(JSON.parse(cartBody.attributes.apex_assignments)).toEqual([
+      { e: "exp_offer", v: "var_treatment", ep: 3 },
+    ]);
+  });
+
+  it("does not adopt the pinned offer arm when the cart write fails", async () => {
+    const token = JSON.stringify({
+      v: 2,
+      p: { offers: { v: 1, a: [{ e: "exp_offer", v: "var_treatment", ep: 3 }] } },
+    });
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({
+        assignments: [{
+          experiment_id: "exp_offer",
+          variation_id: "var_treatment",
+          assignment_epoch: 3,
+        }],
+        commerce_authorization: token,
+      }))
+      .mockResolvedValueOnce(new Response("no", { status: 500 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const adoptOffersAssignments = vi.fn(() => true);
+    const canAdoptOffersAssignments = vi.fn(() => true);
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_offer", variationId: "var_control", assignmentEpoch: 3 }],
+      requiredAssignments: [{ experimentId: "exp_offer", variationId: "var_control", assignmentEpoch: 3 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-offers?key=private-capability",
+      offersAuthorizationRevision: 5,
+      offersExperimentIds: ["exp_offer"],
+      adoptOffersAssignments,
+      canAdoptOffersAssignments,
+    })).resolves.toEqual({ status: "failed", reason: "cart_update_500" });
+    expect(canAdoptOffersAssignments).toHaveBeenCalled();
+    expect(adoptOffersAssignments).not.toHaveBeenCalled();
+  });
+
+  it("authorizes offer display exposure only after the stamped cart write", async () => {
+    const token = JSON.stringify({
+      v: 2,
+      p: { offers: { v: 1, a: [{ e: "exp_offer", v: "var_treatment", ep: 3 }] } },
+    });
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({
+        assignments: [{
+          experiment_id: "exp_offer",
+          variation_id: "var_treatment",
+          assignment_epoch: 3,
+        }],
+        commerce_authorization: token,
+      }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const authorizeOffersDisplayAssignments = vi.fn();
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_offer", variationId: "var_treatment", assignmentEpoch: 3 }],
+      requiredAssignments: [{ experimentId: "exp_offer", variationId: "var_treatment", assignmentEpoch: 3 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-offers?key=private-capability",
+      offersAuthorizationRevision: 5,
+      offersExperimentIds: ["exp_offer"],
+      authorizeOffersDisplayAssignments,
+    })).resolves.toEqual({ status: "sent" });
+    expect(authorizeOffersDisplayAssignments).toHaveBeenCalledWith([{
+      experimentId: "exp_offer",
+      variationId: "var_treatment",
+      assignmentEpoch: 3,
+    }]);
+  });
+
+  it("withholds offer display authorization when the cart write fails", async () => {
+    const token = JSON.stringify({
+      v: 2,
+      p: { offers: { v: 1, a: [{ e: "exp_offer", v: "var_treatment", ep: 3 }] } },
+    });
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({
+        assignments: [{
+          experiment_id: "exp_offer",
+          variation_id: "var_treatment",
+          assignment_epoch: 3,
+        }],
+        commerce_authorization: token,
+      }))
+      .mockResolvedValueOnce(new Response("no", { status: 500 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const authorizeOffersDisplayAssignments = vi.fn();
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_offer", variationId: "var_treatment", assignmentEpoch: 3 }],
+      requiredAssignments: [{ experimentId: "exp_offer", variationId: "var_treatment", assignmentEpoch: 3 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-offers?key=private-capability",
+      offersAuthorizationRevision: 5,
+      offersExperimentIds: ["exp_offer"],
+      authorizeOffersDisplayAssignments,
+    })).resolves.toEqual({ status: "failed", reason: "cart_update_500" });
+    expect(authorizeOffersDisplayAssignments).not.toHaveBeenCalled();
+  });
+
+  it("delivers the stamped cart snapshot to onCartSnapshot", async () => {
+    const cartBody = { items: [{ properties: { _apex_gwp: "exp_offer" } }] };
+    globalThis.fetch = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify(cartBody), { status: 200 }),
+    ) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const onCartSnapshot = vi.fn();
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_a", variationId: "var_a", assignmentEpoch: 1 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      onCartSnapshot,
+    })).resolves.toEqual({ status: "sent" });
+    await vi.waitFor(() => expect(onCartSnapshot).toHaveBeenCalledWith(cartBody));
+  });
+
+  it("fails the sync without stamping records when a pre-validated adoption cannot apply", async () => {
+    const token = JSON.stringify({
+      v: 2,
+      p: { offers: { v: 1, a: [{ e: "exp_offer", v: "var_treatment", ep: 3 }] } },
+    });
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({
+        assignments: [{
+          experiment_id: "exp_offer",
+          variation_id: "var_treatment",
+          assignment_epoch: 3,
+        }],
+        commerce_authorization: token,
+      }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_offer", variationId: "var_control", assignmentEpoch: 3 }],
+      requiredAssignments: [{ experimentId: "exp_offer", variationId: "var_control", assignmentEpoch: 3 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-offers?key=private-capability",
+      offersAuthorizationRevision: 5,
+      offersExperimentIds: ["exp_offer"],
+      adoptOffersAssignments: () => false,
+      canAdoptOffersAssignments: () => true,
+    })).resolves.toEqual({ status: "failed", reason: "offers_adoption_failed" });
+  });
+
+  it("requests configured offer experiments even without a local assignment", async () => {
+    globalThis.fetch = vi.fn().mockResolvedValueOnce(Response.json({
+      assignments: [],
+      commerce_authorization: JSON.stringify({ v: 2, p: { offers: { v: 1, a: [] } } }),
+    })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    await syncShopifyCartAttributes({
+      assignments: [],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-offers?key=private-capability",
+      offersAuthorizationRevision: 5,
+      offersExperimentIds: ["exp_offer"],
+      adoptOffersAssignments: () => true,
+    });
+
+    expect(JSON.parse(String(vi.mocked(globalThis.fetch).mock.calls[0]?.[1]?.body)))
+      .toMatchObject({ experiments: ["exp_offer"] });
+  });
+
+  it("fails offer authorization closed when the Worker's pinned arm is unparseable", async () => {
+    globalThis.fetch = vi.fn().mockResolvedValueOnce(Response.json({
+      assignments: [{
+        experiment_id: "exp_offer",
+        variation_id: "",
+        assignment_epoch: 3,
+      }],
+      commerce_authorization: JSON.stringify({ v: 2, p: { offers: { v: 1, a: [] } } }),
+    })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const adoptOffersAssignments = vi.fn(() => true);
+    await expect(syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_offer", variationId: "var_control", assignmentEpoch: 3 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-offers?key=private-capability",
+      offersAuthorizationRevision: 5,
+      offersExperimentIds: ["exp_offer"],
+      adoptOffersAssignments,
+    })).resolves.toEqual({ status: "failed", reason: "authorization_failed" });
+    expect(adoptOffersAssignments).not.toHaveBeenCalled();
+    expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+  });
+
+  it("keeps both commerce planes authorized when both signatures are present", async () => {
+    const token = JSON.stringify({
+      v: 2,
+      p: {
+        price: {
+          v: 1,
+          cartHash: "c".repeat(64),
+          a: [{ e: "exp_price", v: "var_price", ep: 2 }],
+        },
+        shipping: {
+          v: 1,
+          a: [{ e: "exp_shipping", v: "var_shipping", ep: 4 }],
+        },
+      },
+    });
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({
+        assignments: [
+          { experiment_id: "exp_price", variation_id: "var_price", assignment_epoch: 2 },
+          { experiment_id: "exp_shipping", variation_id: "var_shipping", assignment_epoch: 4 },
+        ],
+        commerce_authorization: token,
+      }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const authorizeShippingDisplayAssignments = vi.fn();
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [
+        { experimentId: "exp_price", variationId: "var_price", assignmentEpoch: 2 },
+        { experimentId: "exp_shipping", variationId: "var_shipping", assignmentEpoch: 4 },
+      ],
+      requiredAssignments: [
+        { experimentId: "exp_price", variationId: "var_price", assignmentEpoch: 2 },
+        { experimentId: "exp_shipping", variationId: "var_shipping", assignmentEpoch: 4 },
+      ],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-token",
+      shippingAuthorizationRevision: 7,
+      shippingExperimentIds: ["exp_shipping"],
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+      authorizeShippingDisplayAssignments,
+    })).resolves.toEqual({ status: "sent" });
+
+    const cartBody = JSON.parse(String(vi.mocked(globalThis.fetch).mock.calls[1]?.[1]?.body));
+    expect(JSON.parse(cartBody.attributes.apex_assignments)).toEqual([
+      { e: "exp_price", v: "var_price", ep: 2 },
+      { e: "exp_shipping", v: "var_shipping", ep: 4 },
+    ]);
+    expect(authorizeShippingDisplayAssignments).toHaveBeenCalledWith([
+      { experimentId: "exp_shipping", variationId: "var_shipping", assignmentEpoch: 4 },
+    ]);
+  });
+
+  it("adopts a pinned price assignment that differs from the local assignment", async () => {
+    const token = JSON.stringify({
+      v: 1,
+      cartHash: "c".repeat(64),
+      a: [{ e: "exp_price", v: "var_treatment", ep: 2 }],
+    });
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({
+        assignments: [{
+          experiment_id: "exp_price",
+          variation_id: "var_treatment",
+          assignment_epoch: 2,
+        }],
+        commerce_authorization: token,
+      }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const adoptPriceAssignments = vi.fn(() => true);
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_price", variationId: "var_control", assignmentEpoch: 2 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+      adoptPriceAssignments,
+    })).resolves.toEqual({ status: "sent" });
+    expect(adoptPriceAssignments).toHaveBeenCalledWith([{
+      experimentId: "exp_price",
+      variationId: "var_treatment",
+      assignmentEpoch: 2,
+    }]);
+    const cartUpdateBody = JSON.parse(
+      String(vi.mocked(globalThis.fetch).mock.calls[1]?.[1]?.body),
+    );
+    expect(JSON.parse(cartUpdateBody.attributes.apex_assignments)).toEqual([{
+      e: "exp_price",
+      v: "var_treatment",
+      ep: 2,
+    }]);
+    expect(sessionStorage.getItem("drip_cart_attr")).not.toBeNull();
+  });
+
+  it("adopts a signed null price pin and clears the local price claim", async () => {
+    const token = JSON.stringify({
+      v: 2,
+      p: {
+        price: {
+          v: 1,
+          r: 3,
+          c: "b".repeat(64),
+          x: "2026-07-20",
+          cartHash: "c".repeat(64),
+          a: [],
+          s: "d".repeat(64),
+        },
+      },
+    });
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({
+        assignments: [],
+        commerce_authorization: token,
+      }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const adoptPriceAssignments = vi.fn(() => true);
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_price", variationId: "var_treatment", assignmentEpoch: 2 }],
+      requiredAssignments: [{ experimentId: "exp_price", variationId: "var_treatment", assignmentEpoch: 2 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+      adoptPriceAssignments,
+    })).resolves.toEqual({ status: "sent" });
+
+    expect(adoptPriceAssignments).toHaveBeenCalledWith([]);
+    const cartUpdateBody = JSON.parse(
+      String(vi.mocked(globalThis.fetch).mock.calls[1]?.[1]?.body),
+    );
+    expect(cartUpdateBody.attributes).toMatchObject({
+      apex_assignments: "[]",
+      apex_assignment_authorization: token,
+      apex_experiment_id: "",
+      apex_variation_id: "",
+      apex_assignment_epoch: "",
+    });
+  });
+
+  it("adopts null pins only inside the V2 evaluated set and preserves browser-only assignments", async () => {
+    const browserOnlyAssignment = {
+      experimentId: "exp_browser_only",
+      variationId: "var_browser_treatment",
+      assignmentEpoch: 4,
+    };
+    const token = JSON.stringify({
+      v: 2,
+      e: ["exp_evaluated"],
+      p: {
+        price: {
+          v: 1,
+          r: 3,
+          c: "b".repeat(64),
+          x: "2026-07-20",
+          cartHash: "c".repeat(64),
+          a: [],
+          s: "d".repeat(64),
+        },
+      },
+    });
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({
+        assignments: [],
+        commerce_authorization: token,
+      }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const adoptPriceAssignments = vi.fn(() => true);
+    const authorizePriceDisplayAssignments = vi.fn();
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [
+        { experimentId: "exp_evaluated", variationId: "var_local", assignmentEpoch: 2 },
+        browserOnlyAssignment,
+      ],
+      requiredAssignments: [
+        { experimentId: "exp_evaluated", variationId: "var_local", assignmentEpoch: 2 },
+      ],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_evaluated", "exp_browser_only"],
+      adoptPriceAssignments,
+      authorizePriceDisplayAssignments,
+    })).resolves.toEqual({ status: "sent" });
+
+    expect(adoptPriceAssignments).toHaveBeenCalledWith([browserOnlyAssignment]);
+    expect(authorizePriceDisplayAssignments).toHaveBeenCalledWith([]);
+    const cartUpdateBody = JSON.parse(
+      String(vi.mocked(globalThis.fetch).mock.calls[1]?.[1]?.body),
+    );
+    expect(JSON.parse(cartUpdateBody.attributes.apex_assignments)).toEqual([{
+      e: "exp_browser_only",
+      v: "var_browser_treatment",
+      ep: 4,
+    }]);
+  });
+
+  it("treats every configured price experiment as evaluated when an older V2 envelope omits the set", async () => {
+    const token = JSON.stringify({
+      v: 2,
+      p: {
+        price: {
+          v: 1,
+          r: 3,
+          c: "b".repeat(64),
+          x: "2026-07-20",
+          cartHash: "c".repeat(64),
+          a: [],
+          s: "d".repeat(64),
+        },
+      },
+    });
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({
+        assignments: [],
+        commerce_authorization: token,
+      }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const adoptPriceAssignments = vi.fn(() => true);
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [
+        { experimentId: "exp_first", variationId: "var_first", assignmentEpoch: 2 },
+        { experimentId: "exp_second", variationId: "var_second", assignmentEpoch: 3 },
+      ],
+      visitorId: "visitor_compat",
+      sessionId: "session_compat",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_first", "exp_second"],
+      adoptPriceAssignments,
+    })).resolves.toEqual({ status: "sent" });
+
+    expect(adoptPriceAssignments).toHaveBeenCalledWith([]);
+    const cartUpdateBody = JSON.parse(
+      String(vi.mocked(globalThis.fetch).mock.calls[1]?.[1]?.body),
+    );
+    expect(cartUpdateBody.attributes.apex_assignments).toBe("[]");
+  });
+
+  it("does not let a stale pinned assignment replace the newer adopted runtime state", async () => {
+    let resolveOlderAuthorization!: (response: Response) => void;
+    let resolveNewerAuthorization!: (response: Response) => void;
+    const olderToken = JSON.stringify({
+      v: 1,
+      cartHash: "a".repeat(64),
+      a: [{ e: "exp_price", v: "var_older", ep: 2 }],
+    });
+    const newerToken = JSON.stringify({
+      v: 1,
+      cartHash: "b".repeat(64),
+      a: [{ e: "exp_price", v: "var_newer", ep: 2 }],
+    });
+    globalThis.fetch = vi.fn((url) => {
+      if (url === "https://events.example.com/v1/assign") {
+        return new Promise<Response>((resolve) => {
+          if (!resolveOlderAuthorization) resolveOlderAuthorization = resolve;
+          else resolveNewerAuthorization = resolve;
+        });
+      }
+      return Promise.resolve(new Response("ok", { status: 200 }));
+    }) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    let runtimeAssignments = [{
+      experimentId: "exp_price",
+      variationId: "var_control",
+      assignmentEpoch: 2,
+    }];
+    const adoptPriceAssignments = vi.fn((assignments: Array<{
+      experimentId: string;
+      variationId: string;
+      assignmentEpoch?: number;
+    }>) => {
+      runtimeAssignments = assignments;
+      return true;
+    });
+    const input = (sessionId: string) => ({
+      assignments: runtimeAssignments,
+      visitorId: "visitor_123",
+      sessionId,
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+      adoptPriceAssignments,
+    });
+
+    const older = syncShopifyCartAttributes(input("session_older"));
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(1));
+    const newer = syncShopifyCartAttributes(input("session_newer"));
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(2));
+
+    resolveNewerAuthorization(Response.json({
+      assignments: [{
+        experiment_id: "exp_price",
+        variation_id: "var_newer",
+        assignment_epoch: 2,
+      }],
+      commerce_authorization: newerToken,
+    }));
+    await expect(newer).resolves.toEqual({ status: "sent" });
+    expect(runtimeAssignments).toEqual([{
+      experimentId: "exp_price",
+      variationId: "var_newer",
+      assignmentEpoch: 2,
+    }]);
+
+    resolveOlderAuthorization(Response.json({
+      assignments: [{
+        experiment_id: "exp_price",
+        variation_id: "var_older",
+        assignment_epoch: 2,
+      }],
+      commerce_authorization: olderToken,
+    }));
+    await expect(older).resolves.toEqual({
+      status: "failed",
+      reason: "authorization_failed",
+    });
+    expect(adoptPriceAssignments).toHaveBeenCalledOnce();
+    expect(runtimeAssignments).toEqual([{
+      experimentId: "exp_price",
+      variationId: "var_newer",
+      assignmentEpoch: 2,
+    }]);
+    expect(globalThis.fetch).toHaveBeenCalledTimes(3);
+  });
+
+  it("does not let a stale null pin clear the newer adopted runtime state", async () => {
+    let resolveOlderAuthorization!: (response: Response) => void;
+    let resolveNewerAuthorization!: (response: Response) => void;
+    const nullPinToken = JSON.stringify({
+      v: 2,
+      p: {
+        price: {
+          v: 1,
+          r: 3,
+          c: "b".repeat(64),
+          x: "2026-07-20",
+          cartHash: "c".repeat(64),
+          a: [],
+          s: "d".repeat(64),
+        },
+      },
+    });
+    const newerToken = JSON.stringify({
+      v: 1,
+      cartHash: "e".repeat(64),
+      a: [{ e: "exp_price", v: "var_newer", ep: 2 }],
+    });
+    globalThis.fetch = vi.fn((url) => {
+      if (url === "https://events.example.com/v1/assign") {
+        return new Promise<Response>((resolve) => {
+          if (!resolveOlderAuthorization) resolveOlderAuthorization = resolve;
+          else resolveNewerAuthorization = resolve;
+        });
+      }
+      return Promise.resolve(new Response("ok", { status: 200 }));
+    }) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    let runtimeAssignments = [{
+      experimentId: "exp_price",
+      variationId: "var_control",
+      assignmentEpoch: 2,
+    }];
+    const adoptPriceAssignments = vi.fn((assignments: Array<{
+      experimentId: string;
+      variationId: string;
+      assignmentEpoch?: number;
+    }>) => {
+      runtimeAssignments = assignments;
+      return true;
+    });
+    const input = (sessionId: string) => ({
+      assignments: runtimeAssignments,
+      requiredAssignments: runtimeAssignments,
+      visitorId: "visitor_123",
+      sessionId,
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+      adoptPriceAssignments,
+    });
+
+    const older = syncShopifyCartAttributes(input("session_older"));
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(1));
+    const newer = syncShopifyCartAttributes(input("session_newer"));
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(2));
+
+    resolveNewerAuthorization(Response.json({
+      assignments: [{
+        experiment_id: "exp_price",
+        variation_id: "var_newer",
+        assignment_epoch: 2,
+      }],
+      commerce_authorization: newerToken,
+    }));
+    await expect(newer).resolves.toEqual({ status: "sent" });
+
+    resolveOlderAuthorization(Response.json({
+      assignments: [],
+      commerce_authorization: nullPinToken,
+    }));
+    await expect(older).resolves.toEqual({
+      status: "failed",
+      reason: "authorization_failed",
+    });
+    expect(adoptPriceAssignments).toHaveBeenCalledOnce();
+    expect(runtimeAssignments).toEqual([{
+      experimentId: "exp_price",
+      variationId: "var_newer",
+      assignmentEpoch: 2,
+    }]);
+    expect(globalThis.fetch).toHaveBeenCalledTimes(3);
+  });
+
+  it("fails closed for an unsigned empty V2 price envelope", async () => {
+    const token = JSON.stringify({
+      v: 2,
+      p: {
+        price: {
+          v: 1,
+          r: 3,
+          c: "b".repeat(64),
+          x: "2026-07-20",
+          cartHash: "c".repeat(64),
+          a: [],
+        },
+      },
+    });
+    globalThis.fetch = vi.fn().mockResolvedValueOnce(Response.json({
+      assignments: [],
+      commerce_authorization: token,
+    })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const adoptPriceAssignments = vi.fn(() => true);
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_price", variationId: "var_treatment", assignmentEpoch: 2 }],
+      requiredAssignments: [{ experimentId: "exp_price", variationId: "var_treatment", assignmentEpoch: 2 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+      adoptPriceAssignments,
+    })).resolves.toEqual({ status: "failed", reason: "authorization_failed" });
+
+    expect(adoptPriceAssignments).not.toHaveBeenCalled();
+  });
+
+  it("fails closed when an omitted price assignment has no signed price plane", async () => {
+    globalThis.fetch = vi.fn().mockResolvedValueOnce(Response.json({
+      assignments: [],
+    })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const adoptPriceAssignments = vi.fn(() => true);
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_price", variationId: "var_treatment", assignmentEpoch: 2 }],
+      requiredAssignments: [{ experimentId: "exp_price", variationId: "var_treatment", assignmentEpoch: 2 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+      adoptPriceAssignments,
+    })).resolves.toEqual({ status: "failed", reason: "authorization_failed" });
+
+    expect(adoptPriceAssignments).not.toHaveBeenCalled();
+    const cartUpdate = vi.mocked(globalThis.fetch).mock.calls.find(([url]) =>
+      url === "/cart/update.js"
+    );
+    expect(cartUpdate).toBeUndefined();
+  });
+
+  it("fails closed when a pinned price variation cannot be adopted locally", async () => {
+    const token = JSON.stringify({
+      v: 1,
+      cartHash: "c".repeat(64),
+      a: [{ e: "exp_price", v: "var_unknown", ep: 2 }],
+    });
+    globalThis.fetch = vi.fn().mockResolvedValueOnce(Response.json({
+      assignments: [{
+        experiment_id: "exp_price",
+        variation_id: "var_unknown",
+        assignment_epoch: 2,
+      }],
+      commerce_authorization: token,
+    })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const adoptPriceAssignments = vi.fn(() => false);
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_price", variationId: "var_control", assignmentEpoch: 2 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+      adoptPriceAssignments,
+    })).resolves.toEqual({ status: "failed", reason: "authorization_failed" });
+    expect(adoptPriceAssignments).toHaveBeenCalledOnce();
+    const cartUpdate = vi.mocked(globalThis.fetch).mock.calls.find(([url]) =>
+      url === "/cart/update.js"
+    );
+    expect(cartUpdate).toBeUndefined();
+    expect(sessionStorage.getItem("drip_cart_attr")).toBeNull();
+  });
+
+  it("does not overwrite a signed price pin for an envelope-less 200", async () => {
+    globalThis.fetch = vi.fn().mockResolvedValueOnce(Response.json({
+      assignments: [{
+        experiment_id: "exp_price",
+        variation_id: "var_control",
+        assignment_epoch: 2,
+      }],
+    })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_price", variationId: "var_control", assignmentEpoch: 2 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+    })).resolves.toEqual({ status: "failed", reason: "authorization_failed" });
+    expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+    expect(vi.mocked(globalThis.fetch).mock.calls.some(([url]) =>
+      url === "/cart/update.js"
+    )).toBe(false);
+    expect(sessionStorage.getItem("drip_cart_attr")).toBeNull();
+  });
+
+  it("does not overwrite a signed price pin when authorization transport fails", async () => {
+    globalThis.fetch = vi.fn().mockRejectedValueOnce(
+      new Error("assign network unavailable"),
+    ) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_price", variationId: "var_treatment", assignmentEpoch: 2 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+    })).resolves.toEqual({ status: "failed", reason: "authorization_failed" });
+
+    expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+    expect(vi.mocked(globalThis.fetch).mock.calls.some(([url]) =>
+      url === "/cart/update.js"
+    )).toBe(false);
+  });
+
+  it("rejects a stale charge-affecting epoch before writing checkout attributes", async () => {
+    globalThis.fetch = vi.fn().mockResolvedValueOnce(
+      new Response(JSON.stringify({
+        assignments: [{
+          experiment_id: "exp_123",
+          variation_id: "var_123",
+          assignment_epoch: 3,
+        }],
+        commerce_authorization: "signed-envelope",
+      }), { status: 200, headers: { "Content-Type": "application/json" } }),
+    ) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    const result = await syncShopifyCartAttributes({
+      assignments: [
+        { experimentId: "exp_123", variationId: "var_123", assignmentEpoch: 2 },
+      ],
+      requiredAssignments: [
+        { experimentId: "exp_123", variationId: "var_123", assignmentEpoch: 2 },
+      ],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+    });
+
+    expect(result).toEqual({ status: "failed", reason: "authorization_failed" });
+    expect(globalThis.fetch).toHaveBeenCalledTimes(2);
+    const failedClosedBody = JSON.parse(
+      String(vi.mocked(globalThis.fetch).mock.calls[1]?.[1]?.body),
+    );
+    expect(failedClosedBody.attributes.apex_assignment_authorization).toBe("");
+    expect(sessionStorage.getItem("drip_cart_attr")).toBeNull();
+  });
+
+  it("revalidates a persisted charge-affecting stamp in each SDK process", async () => {
+    (globalThis as any).sessionStorage = makeStorage({
+      drip_cart_attr: JSON.stringify({
+        assignments: [["exp_123", "var_123", 2]],
+        requiredAssignments: [["exp_123", "var_123", 2]],
+        visitorId: "visitor_123",
+        sessionId: "session_123",
+        cartToken: null,
+        shippingAuthorizationRevision: null,
+        priceAuthorizationRevision: null,
+      }),
+    });
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(new Response(JSON.stringify({
+        assignments: [{
+          experiment_id: "exp_123",
+          variation_id: "var_123",
+          assignment_epoch: 2,
+        }],
+        commerce_authorization: "signed-envelope",
+      }), { status: 200, headers: { "Content-Type": "application/json" } }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    const result = await syncShopifyCartAttributes({
+      assignments: [
+        { experimentId: "exp_123", variationId: "var_123", assignmentEpoch: 2 },
+      ],
+      requiredAssignments: [
+        { experimentId: "exp_123", variationId: "var_123", assignmentEpoch: 2 },
+      ],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+    });
+
+    expect(result).toEqual({ status: "sent" });
+    expect(globalThis.fetch).toHaveBeenCalledTimes(2);
+  });
+
+  it("does not post outside Shopify storefronts", async () => {
+    (globalThis as any).window = {};
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_123", variationId: "var_123" }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+    });
+    await Promise.resolve();
+
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+  });
+
+  it("does not repeat a cart update already stamped this session", async () => {
+    (globalThis as any).sessionStorage = makeStorage({
+      drip_cart_attr: JSON.stringify({
+        assignments: [
+          ["exp_123", "var_123", null],
+          ["exp_456", "var_456", null],
+        ],
+        visitorId: "visitor_123",
+        sessionId: "session_123",
+        cartToken: null,
+        shippingAuthorizationRevision: null,
+        priceAuthorizationRevision: null,
+      }),
+    });
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    syncShopifyCartAttributes({
+      assignments: [
+        { experimentId: "exp_456", variationId: "var_456" },
+        { experimentId: "exp_123", variationId: "var_123" },
+      ],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+    });
+    await Promise.resolve();
+
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+  });
+
+  it("re-requests price authorization after an SPA route change but caches the same normalized route", async () => {
+    const token = JSON.stringify({
+      v: 1,
+      cartHash: "c".repeat(64),
+      a: [{ e: "exp_price", v: "var_treatment", ep: 2 }],
+    });
+    const authorizationResponse = () => Response.json({
+      assignments: [{
+        experiment_id: "exp_price",
+        variation_id: "var_treatment",
+        assignment_epoch: 2,
+      }],
+      commerce_authorization: token,
+    });
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(authorizationResponse())
+      .mockResolvedValueOnce(new Response("ok", { status: 200 }))
+      .mockResolvedValueOnce(authorizationResponse())
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const input = {
+      assignments: [{
+        experimentId: "exp_price",
+        variationId: "var_treatment",
+        assignmentEpoch: 2,
+      }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+    };
+
+    await expect(syncShopifyCartAttributes({
+      ...input,
+      url: " HTTPS://STORE.EXAMPLE.COM:443/products/first ",
+    })).resolves.toEqual({ status: "sent" });
+    await expect(syncShopifyCartAttributes({
+      ...input,
+      url: "https://store.example.com/products/first",
+    })).resolves.toEqual({ status: "sent", reason: "already_stamped" });
+    expect(globalThis.fetch).toHaveBeenCalledTimes(2);
+
+    await expect(syncShopifyCartAttributes({
+      ...input,
+      url: "https://store.example.com/products/second",
+    })).resolves.toEqual({ status: "sent" });
+    expect(globalThis.fetch).toHaveBeenCalledTimes(4);
+    const authorizationBodies = [0, 2].map((index) =>
+      JSON.parse(String(vi.mocked(globalThis.fetch).mock.calls[index]?.[1]?.body))
+    );
+    expect(authorizationBodies.map((body) => body.url)).toEqual([
+      " HTTPS://STORE.EXAMPLE.COM:443/products/first ",
+      "https://store.example.com/products/second",
+    ]);
+    expect(JSON.parse(sessionStorage.getItem("drip_cart_attr") ?? "{}").url)
+      .toBe("https://store.example.com/products/second");
+  });
+
+  it("force re-stamps an assignment after the cart itself changes", async () => {
+    (globalThis as any).sessionStorage = makeStorage({
+      drip_cart_attr: JSON.stringify({
+        assignments: [["exp_123", "var_123", null]],
+        visitorId: "visitor_123",
+        sessionId: "session_123",
+        cartToken: null,
+        shippingAuthorizationRevision: null,
+        priceAuthorizationRevision: null,
+      }),
+    });
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    const result = await syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_123", variationId: "var_123" }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+    }, { force: true });
+
+    expect(result).toEqual({ status: "sent" });
+    expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+  });
+
+  it("invalidates an in-flight token-null sync before a forced replacement-cart resync", async () => {
+    let resolveCartA!: (response: Response) => void;
+    let cartReads = 0;
+    let authorizationRequests = 0;
+    const assignment = {
+      experimentId: "exp_price",
+      variationId: "var_treatment",
+      assignmentEpoch: 2,
+    };
+    const priceEnvelope = (cartHash: string) => JSON.stringify({
+      v: 1,
+      cartHash,
+      a: [{ e: assignment.experimentId, v: assignment.variationId, ep: assignment.assignmentEpoch }],
+    });
+    globalThis.fetch = vi.fn((url) => {
+      if (url === "/cart.js") {
+        cartReads += 1;
+        if (cartReads === 1) {
+          return new Promise<Response>((resolve) => {
+            resolveCartA = resolve;
+          });
+        }
+        return Promise.resolve(Response.json({ token: "cart-b?key=b" }));
+      }
+      if (url === "https://events.example.com/v1/assign") {
+        authorizationRequests += 1;
+        return Promise.resolve(Response.json({
+          assignments: [{
+            experiment_id: assignment.experimentId,
+            variation_id: assignment.variationId,
+            assignment_epoch: assignment.assignmentEpoch,
+          }],
+          commerce_authorization: priceEnvelope(
+            (authorizationRequests === 1 ? "a" : "b").repeat(64),
+          ),
+        }));
+      }
+      return Promise.resolve(new Response("ok", { status: 200 }));
+    }) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const input = {
+      assignments: [assignment],
+      requiredAssignments: [assignment],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: [assignment.experimentId],
+    };
+
+    const cartA = syncShopifyCartAttributes(input);
+    await vi.waitFor(() => expect(cartReads).toBe(1));
+    const cartB = syncShopifyCartAttributes(input, { force: true });
+    expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+
+    resolveCartA(Response.json({ token: "cart-a?key=a" }));
+    await expect(cartA).resolves.toEqual({
+      status: "failed",
+      reason: "authorization_failed",
+    });
+    await expect(cartB).resolves.toEqual({ status: "sent" });
+
+    const calls = vi.mocked(globalThis.fetch).mock.calls;
+    const authorizationCartTokens = calls
+      .filter(([url]) => url === "https://events.example.com/v1/assign")
+      .map(([, init]) => JSON.parse(String(init?.body)).cart_token);
+    expect(authorizationCartTokens).toEqual(["cart-a?key=a", "cart-b?key=b"]);
+    const cartUpdates = calls.filter(([url]) => url === "/cart/update.js");
+    expect(cartUpdates).toHaveLength(1);
+    expect(JSON.parse(String(cartUpdates[0]?.[1]?.body)).attributes)
+      .toMatchObject({ apex_assignment_authorization: priceEnvelope("b".repeat(64)) });
+  });
+
+  it("leaves a replacement cart unstamped when its forced resync fails", async () => {
+    let resolveCartA!: (response: Response) => void;
+    let cartReads = 0;
+    let authorizationRequests = 0;
+    const assignment = {
+      experimentId: "exp_price",
+      variationId: "var_treatment",
+      assignmentEpoch: 2,
+    };
+    const cartAEnvelope = JSON.stringify({
+      v: 1,
+      cartHash: "a".repeat(64),
+      a: [{ e: assignment.experimentId, v: assignment.variationId, ep: assignment.assignmentEpoch }],
+    });
+    globalThis.fetch = vi.fn((url) => {
+      if (url === "/cart.js") {
+        cartReads += 1;
+        if (cartReads === 1) {
+          return new Promise<Response>((resolve) => {
+            resolveCartA = resolve;
+          });
+        }
+        return Promise.resolve(Response.json({ token: "cart-b?key=b" }));
+      }
+      if (url === "https://events.example.com/v1/assign") {
+        authorizationRequests += 1;
+        if (authorizationRequests === 2) {
+          return Promise.resolve(new Response("unavailable", { status: 503 }));
+        }
+        return Promise.resolve(Response.json({
+          assignments: [{
+            experiment_id: assignment.experimentId,
+            variation_id: assignment.variationId,
+            assignment_epoch: assignment.assignmentEpoch,
+          }],
+          commerce_authorization: cartAEnvelope,
+        }));
+      }
+      return Promise.resolve(new Response("ok", { status: 200 }));
+    }) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const input = {
+      assignments: [assignment],
+      requiredAssignments: [assignment],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: [assignment.experimentId],
+    };
+
+    const cartA = syncShopifyCartAttributes(input);
+    await vi.waitFor(() => expect(cartReads).toBe(1));
+    const cartB = syncShopifyCartAttributes(input, { force: true });
+
+    resolveCartA(Response.json({ token: "cart-a?key=a" }));
+    await expect(cartA).resolves.toEqual({
+      status: "failed",
+      reason: "authorization_failed",
+    });
+    await expect(cartB).resolves.toEqual({
+      status: "failed",
+      reason: "authorization_failed",
+    });
+
+    expect(vi.mocked(globalThis.fetch).mock.calls
+      .filter(([url]) => url === "/cart/update.js")).toHaveLength(0);
+    expect(sessionStorage.getItem("drip_cart_attr")).toBeNull();
+  });
+
+  it("keeps non-forced token-null overlaps coalesced", async () => {
+    let resolveCart!: (response: Response) => void;
+    const assignment = {
+      experimentId: "exp_price",
+      variationId: "var_treatment",
+      assignmentEpoch: 2,
+    };
+    const envelope = JSON.stringify({
+      v: 1,
+      cartHash: "c".repeat(64),
+      a: [{ e: assignment.experimentId, v: assignment.variationId, ep: assignment.assignmentEpoch }],
+    });
+    globalThis.fetch = vi.fn()
+      .mockImplementationOnce(() => new Promise<Response>((resolve) => {
+        resolveCart = resolve;
+      }))
+      .mockResolvedValueOnce(Response.json({
+        assignments: [{
+          experiment_id: assignment.experimentId,
+          variation_id: assignment.variationId,
+          assignment_epoch: assignment.assignmentEpoch,
+        }],
+        commerce_authorization: envelope,
+      }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const input = {
+      assignments: [assignment],
+      requiredAssignments: [assignment],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: [assignment.experimentId],
+    };
+
+    const first = syncShopifyCartAttributes(input);
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(1));
+    const overlap = syncShopifyCartAttributes(input);
+    expect(overlap).toBe(first);
+    expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+
+    resolveCart(Response.json({ token: "cart-c?key=c" }));
+    await expect(overlap).resolves.toEqual({ status: "sent" });
+    expect(globalThis.fetch).toHaveBeenCalledTimes(3);
+    expect(vi.mocked(globalThis.fetch).mock.calls
+      .filter(([url]) => url === "/cart/update.js")).toHaveLength(1);
+  });
+
+  it("retries a failed cart update and stamps only after a successful response", async () => {
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(new Response("failed", { status: 500 }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const input = {
+      assignments: [{ experimentId: "exp_123", variationId: "var_123" }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+    };
+
+    syncShopifyCartAttributes(input);
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(1));
+    expect(sessionStorage.getItem("drip_cart_attr")).toBeNull();
+    await Promise.resolve();
+    await Promise.resolve();
+    await Promise.resolve();
+
+    syncShopifyCartAttributes(input);
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(2));
+    await vi.waitFor(() => expect(sessionStorage.getItem("drip_cart_attr")).not.toBeNull());
+  });
+
+  it("updates cart identity when assignments stay the same", async () => {
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const assignments = [{ experimentId: "exp_123", variationId: "var_123" }];
+
+    syncShopifyCartAttributes({ assignments, visitorId: "visitor_old", sessionId: "session_1" });
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(1));
+    syncShopifyCartAttributes({ assignments, visitorId: "visitor_new", sessionId: "session_2" });
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(2));
+
+    const secondBody = JSON.parse(String(vi.mocked(globalThis.fetch).mock.calls[1]?.[1]?.body));
+    expect(secondBody.attributes).toMatchObject({
+      apex_visitor_id: "visitor_new",
+      apex_session_id: "session_2",
+    });
+  });
+
+  it("does not let an older overlapping sync overwrite the newest stamp", async () => {
+    let resolveFirst!: (response: Response) => void;
+    let resolveSecond!: (response: Response) => void;
+    globalThis.fetch = vi.fn()
+      .mockImplementationOnce(() => new Promise<Response>((resolve) => {
+        resolveFirst = resolve;
+      }))
+      .mockImplementationOnce(() => new Promise<Response>((resolve) => {
+        resolveSecond = resolve;
+      })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const firstInput = {
+      assignments: [{ experimentId: "exp_old", variationId: "var_old" }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+    };
+    const secondInput = {
+      assignments: [{ experimentId: "exp_new", variationId: "var_new" }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+    };
+
+    const first = syncShopifyCartAttributes(firstInput);
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(1));
+    const second = syncShopifyCartAttributes(secondInput);
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(2));
+
+    resolveSecond(new Response("ok", { status: 200 }));
+    await expect(second).resolves.toEqual({ status: "sent" });
+    const newestStamp = sessionStorage.getItem("drip_cart_attr");
+    expect(newestStamp).toContain("exp_new");
+
+    resolveFirst(new Response("ok", { status: 200 }));
+    await expect(first).resolves.toEqual({ status: "sent" });
+    expect(sessionStorage.getItem("drip_cart_attr")).toBe(newestStamp);
+
+    vi.mocked(globalThis.fetch).mockClear();
+    await expect(syncShopifyCartAttributes(secondInput)).resolves.toEqual({
+      status: "sent",
+      reason: "already_stamped",
+    });
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+  });
+
+  it("does not let stale authorization mutate the Shopify cart", async () => {
+    let resolveOlderAuthorization!: (response: Response) => void;
+    let resolveNewerAuthorization!: (response: Response) => void;
+    globalThis.fetch = vi.fn((url) => {
+      if (url === "https://events.example.com/v1/assign") {
+        return new Promise<Response>((resolve) => {
+          if (!resolveOlderAuthorization) resolveOlderAuthorization = resolve;
+          else resolveNewerAuthorization = resolve;
+        });
+      }
+      return Promise.resolve(new Response("ok", { status: 200 }));
+    }) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const input = (
+      experimentId: string,
+      variationId: string,
+      assignmentEpoch: number,
+    ) => ({
+      assignments: [{ experimentId, variationId, assignmentEpoch }],
+      requiredAssignments: [{ experimentId, variationId, assignmentEpoch }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+    });
+
+    const older = syncShopifyCartAttributes(input("exp_old", "var_old", 1));
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(1));
+    const newer = syncShopifyCartAttributes(input("exp_new", "var_new", 2));
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(2));
+
+    resolveNewerAuthorization(new Response(JSON.stringify({
+      assignments: [{
+        experiment_id: "exp_new",
+        variation_id: "var_new",
+        assignment_epoch: 2,
+      }],
+      commerce_authorization: "newer-proof",
+    }), { status: 200, headers: { "Content-Type": "application/json" } }));
+    await expect(newer).resolves.toEqual({ status: "sent" });
+    expect(globalThis.fetch).toHaveBeenCalledTimes(3);
+
+    resolveOlderAuthorization(new Response(JSON.stringify({
+      assignments: [{
+        experiment_id: "exp_old",
+        variation_id: "var_old",
+        assignment_epoch: 1,
+      }],
+      commerce_authorization: "older-proof",
+    }), { status: 200, headers: { "Content-Type": "application/json" } }));
+    await expect(older).resolves.toEqual({
+      status: "failed",
+      reason: "authorization_failed",
+    });
+    expect(globalThis.fetch).toHaveBeenCalledTimes(3);
+
+    const cartUpdate = vi.mocked(globalThis.fetch).mock.calls[2];
+    expect(cartUpdate?.[0]).toBe("/cart/update.js");
+    expect(JSON.parse(String(cartUpdate?.[1]?.body)).attributes).toMatchObject({
+      apex_experiment_id: "exp_new",
+      apex_variation_id: "var_new",
+      apex_assignment_epoch: "2",
+      apex_assignment_authorization: "newer-proof",
+    });
+  });
+
+  it("lets price-plane teardown invalidate an in-flight cart authorization before it writes", async () => {
+    let resolveAuthorization!: (response: Response) => void;
+    globalThis.fetch = vi.fn((url) => {
+      if (url === "/cart.js") {
+        return Promise.resolve(Response.json({ token: "cart-runtime?key=runtime-secret" }));
+      }
+      if (url === "https://events.example.com/v1/assign") {
+        return new Promise<Response>((resolve) => { resolveAuthorization = resolve; });
+      }
+      return Promise.resolve(new Response("ok", { status: 200 }));
+    }) as any;
+    const {
+      invalidateShopifyCartAttributeSync,
+      syncShopifyCartAttributes,
+    } = await import("./shopify-cart");
+    const sync = syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_price", variationId: "treatment", assignmentEpoch: 1 }],
+      requiredAssignments: [{ experimentId: "exp_price", variationId: "treatment", assignmentEpoch: 1 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      priceAuthorizationRevision: 1,
+      priceExperimentIds: ["exp_price"],
+    });
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(2));
+
+    invalidateShopifyCartAttributeSync();
+    resolveAuthorization(Response.json({
+      assignments: [{
+        experiment_id: "exp_price",
+        variation_id: "treatment",
+        assignment_epoch: 1,
+      }],
+      commerce_authorization: "stale-proof",
+    }));
+
+    await expect(sync).resolves.toEqual({
+      status: "failed",
+      reason: "authorization_failed",
+    });
+    expect(globalThis.fetch).toHaveBeenCalledTimes(2);
+    expect(sessionStorage.getItem("drip_cart_attr")).toBeNull();
+  });
+
+  it("does not overwrite a newer stamp when its sync is already complete", async () => {
+    const newestStamp = JSON.stringify({
+      assignments: [["exp_new", "var_new", null]],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      cartToken: null,
+      shippingAuthorizationRevision: null,
+      priceAuthorizationRevision: null,
+    });
+    (globalThis as any).sessionStorage = makeStorage({
+      drip_cart_attr: newestStamp,
+    });
+    let resolveOlder!: (response: Response) => void;
+    globalThis.fetch = vi.fn(() => new Promise<Response>((resolve) => {
+      resolveOlder = resolve;
+    })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    const older = syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_old", variationId: "var_old" }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+    });
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(1));
+    await expect(syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_new", variationId: "var_new" }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+    })).resolves.toEqual({ status: "sent", reason: "already_stamped" });
+
+    resolveOlder(new Response("ok", { status: 200 }));
+    await expect(older).resolves.toEqual({ status: "sent" });
+    expect(sessionStorage.getItem("drip_cart_attr")).toBe(newestStamp);
+  });
+
+  it("retains the locale cart key in the price proof request", async () => {
+    (globalThis as any).window = {
+      location: { origin: "https://store.example.com" },
+      Shopify: { routes: { root: "/fr/" } },
+    };
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({ token: "cart-native?key=native-secret" }))
+      .mockResolvedValueOnce(Response.json({
+        assignments: [{
+          experiment_id: "exp_123",
+          variation_id: "var_123",
+          assignment_epoch: 2,
+        }],
+        commerce_authorization: "signed-envelope",
+      }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_123", variationId: "var_123", assignmentEpoch: 2 }],
+      requiredAssignments: [{ experimentId: "exp_123", variationId: "var_123", assignmentEpoch: 2 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      priceAuthorizationRevision: 3,
+    })).resolves.toEqual({ status: "sent" });
+
+    expect(vi.mocked(globalThis.fetch).mock.calls[0]?.[0]).toBe("/fr/cart.js");
+    expect(JSON.parse(String(vi.mocked(globalThis.fetch).mock.calls[1]?.[1]?.body)))
+      .toMatchObject({ cart_token: "cart-native?key=native-secret" });
+    expect(JSON.parse(String(vi.mocked(globalThis.fetch).mock.calls[2]?.[1]?.body)).attributes)
+      .toMatchObject({ apex_assignment_authorization: "signed-envelope" });
+  });
+
+  it("returns complete signed attributes for a headless cart", async () => {
+    globalThis.fetch = vi.fn().mockResolvedValueOnce(Response.json({
+      commerce_authorization: "signed-envelope",
+    })) as any;
+    const { buildSignedCartAttributeEntries } = await import("./shopify-cart");
+    const entries = await buildSignedCartAttributeEntries({
+      assignments: [{ experimentId: "exp_123", variationId: "var_123", assignmentEpoch: 2 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "gid://shopify/Cart/headless?key=headless-secret",
+      priceAuthorizationRevision: 3,
+    });
+    expect(Object.fromEntries(entries.map((entry) => [entry.key, entry.value])))
+      .toMatchObject({ apex_assignment_authorization: "signed-envelope" });
+    expect(JSON.parse(String(vi.mocked(globalThis.fetch).mock.calls[0]?.[1]?.body)))
+      .toMatchObject({ cart_token: "gid://shopify/Cart/headless?key=headless-secret" });
+  });
+
+  it("authorizes headless price display when signed attributes are returned", async () => {
+    const token = JSON.stringify({
+      v: 1,
+      cartHash: "c".repeat(64),
+      a: [{ e: "exp_price", v: "var_treatment", ep: 2 }],
+    });
+    globalThis.fetch = vi.fn().mockResolvedValueOnce(Response.json({
+      assignments: [{
+        experiment_id: "exp_price",
+        variation_id: "var_treatment",
+        assignment_epoch: 2,
+      }],
+      commerce_authorization: token,
+    })) as any;
+    const { buildSignedCartAttributeEntries } = await import("./shopify-cart");
+    const authorizePriceDisplayAssignments = vi.fn();
+
+    const entries = await buildSignedCartAttributeEntries({
+      assignments: [{
+        experimentId: "exp_price",
+        variationId: "var_treatment",
+        assignmentEpoch: 2,
+      }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "gid://shopify/Cart/headless?key=headless-secret",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+      authorizePriceDisplayAssignments,
+    });
+
+    expect(entries).not.toEqual([]);
+    expect(authorizePriceDisplayAssignments).toHaveBeenCalledOnce();
+    expect(authorizePriceDisplayAssignments).toHaveBeenCalledWith([{
+      experimentId: "exp_price",
+      variationId: "var_treatment",
+      assignmentEpoch: 2,
+    }]);
+  });
+
+  it("lets only the latest overlapping headless call adopt a resurrected price pin", async () => {
+    const token = JSON.stringify({
+      v: 1,
+      cartHash: "c".repeat(64),
+      a: [{ e: "exp_price", v: "var_treatment", ep: 2 }],
+    });
+    let resolveOlder!: (response: Response) => void;
+    let resolveNewer!: (response: Response) => void;
+    globalThis.fetch = vi.fn()
+      .mockImplementationOnce(() => new Promise<Response>((resolve) => { resolveOlder = resolve; }))
+      .mockImplementationOnce(() => new Promise<Response>((resolve) => { resolveNewer = resolve; })) as any;
+    const { buildSignedCartAttributeEntries } = await import("./shopify-cart");
+    const adoptOlder = vi.fn(() => true);
+    const adoptNewer = vi.fn(() => true);
+    const input = {
+      assignments: [],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+    };
+
+    const older = buildSignedCartAttributeEntries({
+      ...input,
+      cartToken: "gid://shopify/Cart/older?key=older-secret",
+      adoptPriceAssignments: adoptOlder,
+    });
+    const newer = buildSignedCartAttributeEntries({
+      ...input,
+      cartToken: "gid://shopify/Cart/newer?key=newer-secret",
+      adoptPriceAssignments: adoptNewer,
+    });
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(2));
+
+    resolveNewer(Response.json({
+      assignments: [{
+        experiment_id: "exp_price",
+        variation_id: "var_treatment",
+        assignment_epoch: 2,
+        commerce_price_only: true,
+      }],
+      commerce_authorization: token,
+    }));
+    await expect(newer).resolves.not.toEqual([]);
+    expect(adoptNewer).toHaveBeenCalledWith([{
+      experimentId: "exp_price",
+      variationId: "var_treatment",
+      assignmentEpoch: 2,
+      commercePriceOnly: true,
+    }]);
+
+    resolveOlder(Response.json({
+      assignments: [{
+        experiment_id: "exp_price",
+        variation_id: "var_treatment",
+        assignment_epoch: 2,
+        commerce_price_only: true,
+      }],
+      commerce_authorization: token,
+    }));
+    await expect(older).resolves.toEqual([]);
+    expect(adoptOlder).not.toHaveBeenCalled();
+  });
+
+  it("returns no stale headless attributes when an older cart response matches local state", async () => {
+    const olderToken = JSON.stringify({
+      v: 1,
+      cartHash: "a".repeat(64),
+      a: [{ e: "exp_price", v: "var_treatment", ep: 2 }],
+    });
+    const newerToken = JSON.stringify({
+      v: 1,
+      cartHash: "b".repeat(64),
+      a: [{ e: "exp_price", v: "var_treatment", ep: 2 }],
+    });
+    let resolveOlder!: (response: Response) => void;
+    let resolveNewer!: (response: Response) => void;
+    globalThis.fetch = vi.fn()
+      .mockImplementationOnce(() => new Promise<Response>((resolve) => { resolveOlder = resolve; }))
+      .mockImplementationOnce(() => new Promise<Response>((resolve) => { resolveNewer = resolve; })) as any;
+    const {
+      buildCartAttributeEntries,
+      buildSignedCartAttributeEntries,
+    } = await import("./shopify-cart");
+    const writeAttributes = vi.fn();
+    const input = {
+      assignments: [{ experimentId: "exp_price", variationId: "var_treatment", assignmentEpoch: 2 }],
+      requiredAssignments: [{ experimentId: "exp_price", variationId: "var_treatment", assignmentEpoch: 2 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+    };
+    const consume = async (entriesPromise: ReturnType<typeof buildSignedCartAttributeEntries>) => {
+      const entries = await entriesPromise;
+      if (entries.length > 0) writeAttributes(entries);
+      return entries;
+    };
+
+    const older = consume(buildSignedCartAttributeEntries({
+      ...input,
+      cartToken: "gid://shopify/Cart/older?key=older-secret",
+    }));
+    const newer = consume(buildSignedCartAttributeEntries({
+      ...input,
+      cartToken: "gid://shopify/Cart/newer?key=newer-secret",
+    }));
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(2));
+
+    resolveNewer(Response.json({
+      assignments: [{
+        experiment_id: "exp_price",
+        variation_id: "var_treatment",
+        assignment_epoch: 2,
+      }],
+      commerce_authorization: newerToken,
+    }));
+    await expect(newer).resolves.toEqual(buildCartAttributeEntries(input, newerToken));
+    expect(writeAttributes).toHaveBeenCalledOnce();
+
+    resolveOlder(Response.json({
+      assignments: [{
+        experiment_id: "exp_price",
+        variation_id: "var_treatment",
+        assignment_epoch: 2,
+      }],
+      commerce_authorization: olderToken,
+    }));
+    await expect(older).resolves.toEqual([]);
+    expect(writeAttributes).toHaveBeenCalledOnce();
+  });
+
+  it("returns no stale headless attributes when overlapping carts both receive signed-empty proof", async () => {
+    const signedEmptyToken = (cartHash: string, signature: string) => JSON.stringify({
+      v: 2,
+      p: {
+        price: {
+          v: 1,
+          r: 3,
+          c: "b".repeat(64),
+          x: "2026-07-20",
+          cartHash,
+          a: [],
+          s: signature,
+        },
+      },
+    });
+    const olderToken = signedEmptyToken("a".repeat(64), "c".repeat(64));
+    const newerToken = signedEmptyToken("d".repeat(64), "e".repeat(64));
+    let resolveOlder!: (response: Response) => void;
+    let resolveNewer!: (response: Response) => void;
+    globalThis.fetch = vi.fn()
+      .mockImplementationOnce(() => new Promise<Response>((resolve) => { resolveOlder = resolve; }))
+      .mockImplementationOnce(() => new Promise<Response>((resolve) => { resolveNewer = resolve; })) as any;
+    const {
+      buildCartAttributeEntries,
+      buildSignedCartAttributeEntries,
+    } = await import("./shopify-cart");
+    const writeAttributes = vi.fn();
+    const input = {
+      assignments: [],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+    };
+    const consume = async (entriesPromise: ReturnType<typeof buildSignedCartAttributeEntries>) => {
+      const entries = await entriesPromise;
+      if (entries.length > 0) writeAttributes(entries);
+      return entries;
+    };
+
+    const older = consume(buildSignedCartAttributeEntries({
+      ...input,
+      cartToken: "gid://shopify/Cart/older?key=older-secret",
+    }));
+    const newer = consume(buildSignedCartAttributeEntries({
+      ...input,
+      cartToken: "gid://shopify/Cart/newer?key=newer-secret",
+    }));
+    await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledTimes(2));
+
+    resolveNewer(Response.json({ assignments: [], commerce_authorization: newerToken }));
+    await expect(newer).resolves.toEqual(buildCartAttributeEntries(input, newerToken));
+    expect(writeAttributes).toHaveBeenCalledOnce();
+
+    resolveOlder(Response.json({ assignments: [], commerce_authorization: olderToken }));
+    await expect(older).resolves.toEqual([]);
+    expect(writeAttributes).toHaveBeenCalledOnce();
+  });
+
+  it("fails closed with no signed attributes for a headless cart when authorization fails", async () => {
+    globalThis.fetch = vi.fn().mockResolvedValueOnce(
+      new Response("unavailable", { status: 503 }),
+    ) as any;
+    const { buildSignedCartAttributeEntries } = await import("./shopify-cart");
+
+    await expect(buildSignedCartAttributeEntries({
+      assignments: [{ experimentId: "exp_123", variationId: "var_123", assignmentEpoch: 2 }],
+      requiredAssignments: [
+        { experimentId: "exp_123", variationId: "var_123", assignmentEpoch: 2 },
+      ],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "gid://shopify/Cart/headless?key=headless-secret",
+      priceAuthorizationRevision: 3,
+    })).resolves.toEqual([]);
+  });
+
+  it("preserves signed attribute clearing entries when assignments are empty", async () => {
+    const { buildSignedCartAttributeEntries } = await import("./shopify-cart");
+
+    const entries = await buildSignedCartAttributeEntries({
+      assignments: [],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      priceAuthorizationRevision: 3,
+    });
+
+    expect(Object.fromEntries(entries.map((entry) => [entry.key, entry.value]))).toEqual({
+      apex_assignments: "[]",
+      apex_assignment_authorization: "",
+      apex_experiment_id: "",
+      apex_variation_id: "",
+      apex_assignment_epoch: "",
+      apex_visitor_id: "visitor_123",
+      apex_session_id: "session_123",
+    });
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+  });
+
+  it("resurrects a pinned price assignment when the local assignment set is empty", async () => {
+    const token = JSON.stringify({
+      v: 1,
+      cartHash: "c".repeat(64),
+      a: [{ e: "exp_price", v: "var_treatment", ep: 2 }],
+    });
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({
+        assignments: [{
+          experiment_id: "exp_price",
+          variation_id: "var_treatment",
+          assignment_epoch: 2,
+        }],
+        commerce_authorization: token,
+      }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+    const adoptPriceAssignments = vi.fn(() => true);
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "cart-token",
+      priceAuthorizationRevision: 3,
+      priceExperimentIds: ["exp_price"],
+      adoptPriceAssignments,
+    })).resolves.toEqual({ status: "sent" });
+
+    const assignRequest = vi.mocked(globalThis.fetch).mock.calls[0];
+    expect(assignRequest?.[0]).toBe("https://events.example.com/v1/assign");
+    expect(JSON.parse(String(assignRequest?.[1]?.body)).experiments).toEqual(["exp_price"]);
+    expect(adoptPriceAssignments).toHaveBeenCalledWith([{
+      experimentId: "exp_price",
+      variationId: "var_treatment",
+      assignmentEpoch: 2,
+    }]);
+    const cartUpdateBody = JSON.parse(
+      String(vi.mocked(globalThis.fetch).mock.calls[1]?.[1]?.body),
+    );
+    expect(JSON.parse(cartUpdateBody.attributes.apex_assignments)).toEqual([{
+      e: "exp_price",
+      v: "var_treatment",
+      ep: 2,
+    }]);
+    expect(cartUpdateBody.attributes.apex_assignment_authorization).toBe(token);
+  });
+
+  it("keeps unsigned cart attribute entries for non-commerce headless input", async () => {
+    const { buildSignedCartAttributeEntries } = await import("./shopify-cart");
+
+    const entries = await buildSignedCartAttributeEntries({
+      assignments: [{ experimentId: "exp_123", variationId: "var_123" }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+    });
+
+    expect(Object.fromEntries(entries.map((entry) => [entry.key, entry.value])))
+      .toMatchObject({
+        apex_assignments: JSON.stringify([{ e: "exp_123", v: "var_123" }]),
+        apex_assignment_authorization: "",
+        apex_experiment_id: "exp_123",
+        apex_variation_id: "var_123",
+      });
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+  });
+
+  it("round-trips a headless GID proof to the Worker while comparing the bare cart token", async () => {
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce(Response.json({
+        assignments: [{
+          experiment_id: "exp_123",
+          variation_id: "var_123",
+          assignment_epoch: 2,
+        }],
+        commerce_authorization: "signed-envelope",
+      }))
+      .mockResolvedValueOnce(new Response("ok", { status: 200 })) as any;
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [{ experimentId: "exp_123", variationId: "var_123", assignmentEpoch: 2 }],
+      requiredAssignments: [{ experimentId: "exp_123", variationId: "var_123", assignmentEpoch: 2 }],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      shopId: "shop_123",
+      endpoint: "https://events.example.com/events",
+      ingestSignature: "ingest-token",
+      cartToken: "  gid://shopify/Cart/headless?key=headless-secret  ",
+      priceAuthorizationRevision: 3,
+    })).resolves.toEqual({ status: "sent" });
+
+    const proofBody = JSON.parse(String(vi.mocked(globalThis.fetch).mock.calls[0]?.[1]?.body));
+    expect(proofBody.cart_token).toBe("gid://shopify/Cart/headless?key=headless-secret");
+    const cartUpdateBody = JSON.parse(
+      String(vi.mocked(globalThis.fetch).mock.calls[1]?.[1]?.body),
+    );
+    expect(cartUpdateBody.attributes.apex_assignment_authorization).toBe("signed-envelope");
+    const persistedSignature = String(sessionStorage.getItem("drip_cart_attr"));
+    expect(JSON.parse(persistedSignature).cartToken).toBe("headless");
+    expect(persistedSignature).not.toContain("headless-secret");
+  });
+
+  it("does not post without assignments", async () => {
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    syncShopifyCartAttributes({
+      assignments: [],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+    });
+    await Promise.resolve();
+
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+  });
+
+  it("clears the commerce authorization locally when assignments are empty under a revision", async () => {
+    const { syncShopifyCartAttributes } = await import("./shopify-cart");
+
+    await expect(syncShopifyCartAttributes({
+      assignments: [],
+      visitorId: "visitor_123",
+      sessionId: "session_123",
+      priceAuthorizationRevision: 3,
+    })).resolves.toEqual({ status: "sent" });
+
+    expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+    const [url, init] = vi.mocked(globalThis.fetch).mock.calls[0]!;
+    expect(url).toBe("/cart/update.js");
+    expect(JSON.parse(String(init?.body))).toEqual({
+      attributes: {
+        apex_assignments: "[]",
+        apex_assignment_authorization: "",
+        apex_experiment_id: "",
+        apex_variation_id: "",
+        apex_assignment_epoch: "",
+        apex_visitor_id: "visitor_123",
+        apex_session_id: "session_123",
+      },
+    });
+    expect(vi.mocked(globalThis.fetch).mock.calls.some(([requestUrl]) =>
+      String(requestUrl).includes("/v1/assign")
+    )).toBe(false);
+  });
+});